SI – Page 2 – Trackr.Live

§ Category

EDR-Freeze Puts Your Sensor in a Coma With a Signed Windows Dumper. The Detection Is a Gap in Your Own Telemetry

EDR-Freeze abuses WerFaultSecure.exe — a Microsoft-signed WinTCB/PPL crash dumper — to suspend Defender and third-party EDR for as long as the operator holds it, with no kernel driver and almost no forensic residue. Here is what the detection actually looks like in Sysmon, why the filename-based Sigma rule everyone shipped first is a canary rather than a control, and which process-access relationship the real rule matches.

ClickFix Delivery Is an On-Demand API Now, and It Guts Every Content-Based Detection You Have

A researcher pulled roughly 3,000 live ClickFix payloads and found the delivery running like a metered API — request 100, get 100 different builds. That breaks detection built on the pasted command, the encoded blob, or a string IOC. Here’s the content-blind detection that survives, and why the registry rule was never the durable part.

Artificial Intelligence

Invisible Unicode Tags Smuggle Instructions Past Your LLM Filter. The Detection Is a Byte Pattern on the Raw Stream

A block of Unicode characters that renders as nothing can carry a full paragraph of instructions into your LLM, and your content filter can miss it because it inspects a sanitized or transformed representation while the model receives the original code points. Here is where the detection actually has to live, and what you spend the first week of tuning on.

Cyber Tools

GRIDTIDE’s C2 Is a Google Sheet You Don’t Own. Your Workspace Audit Log Is Blind to It

UNC2814’s GRIDTIDE backdoor runs command-and-control through an attacker-controlled Google Sheet — reached via the attacker’s own service account and Cloud project, not the victim’s Workspace tenant — so the victim’s Workspace audit logs never see it. The detection has to come from egress and the host, and the real fix is default-deny outbound from your server tiers.

Static Tundra Pulls Your Startup-Config Over Smart Install. The Switch That Leaks It Breaks Its Own Audit Trail

FSB Center 16’s Static Tundra crew is still working a 2018 Cisco Smart Install bug to steal startup-configs from end-of-life gear, then modifying TACACS+ so the box stops narrating the theft. The detection has to live off the device.

Cyber Tools

Your Edge Router Is Someone Else’s Exit Node. UAT-7810 Conscripts It With an n-Day, and the IOCs Have a 31-Day Shelf Life

A China-nexus actor is compromising unpatched Ruckus edge gear (and, via associated infrastructure, ASUS AiCloud) to build relay meshes for other APTs — and the published network IOCs can rot in as little as a month. The durable defense is edge-device hygiene and relay-behavior detection over blocklists.

A Systemd Generator Executes Before Your Logging Is Up. Catch the Write, Not the Run

System-level systemd generators run as root at the earliest moment of boot, before auditd, before the EDR agent, before your normal journald/syslog/audit telemetry is reliably up. You will never see the execution. Here is how to build the detection that actually works — file writes and baseline reconciliation — and what breaks it the first week.

CVE-2026-3055 Bleeds Session Tokens Your NetScaler Barely Logs. The Detection Lives Off the Box

The NetScaler memory-overread class has a third sequel. CVE-2026-3055 leaks session tokens through an endpoint the appliance barely logs — so its own logs won’t prove you’re clean, and the detection has to move upstream to the response size and downstream to the reused token, while patching does nothing to the sessions already bled.

Artificial Intelligence

Agent Memory Poisoning Survives the Session. The Detection Lives in the Write Path Nobody Logs

Single-turn prompt injection usually dies when the context window clears. Memory poisoning persists, fires weeks later, and hides in a memory-write event your platform was never built to emit as security telemetry. Here is what to instrument, what to detect, and what the first round of tuning gets wrong.

AppDomainManager Hijacking Hides in a Signed Binary. The Tell Is One Line of XML That Kills ETW

AppDomainManager hijacking loads attacker code into a Microsoft-signed .NET process before the app runs — and the same config file that does it can switch off the ETW telemetry your EDR depends on. The cleanest detection isn’t the dropped DLL. It’s the XML.