North Korean IT workers don’t breach you — they get hired. The device fingerprint everyone reaches for is spoofable and behind home NAT. The detection that survives contact with production lives in your identity provider’s sign-in logs.
The 2026 TanStack compromise (CVE-2026-45321) turned a bundle-size workflow into an npm publishing channel by poisoning a repo-scoped cache. The cache write left almost no runtime telemetry, which makes this a config audit before it’s ever a detection.
Microsoft’s three-phase RC4 disablement for Kerberos closes a real attack surface and quietly breaks the most common Kerberoasting detection rule in the process. The signal you keyed on is about to disappear, and the attack isn’t going with it.
An unauthenticated file-write in Splunk Enterprise’s bundled Postgres sidecar chains to code execution as the splunk service account — the same account that owns your _audit and _internal indexes. The detection problem is mostly a log-forwarding hygiene problem you either solved last year or didn’t.
Conditional Access Token Protection is the control everyone cites as the answer to adversary-in-the-middle phishing. It binds the PRT for native apps on Windows and skips browsers entirely — which is exactly where the stolen cookie lands. Detection, not the control, is still your line.
Attackers don’t need a vulnerable driver to blind an EDR — they need the agent’s own installer and a window. The durable detection isn’t the kill command, it’s the silence that follows. Here is what that detection looks like the first time you deploy it, and why it floods the SOC before it works.
RunMRU is the tidiest endpoint signal for ClickFix, which is exactly why it’s the first thing attackers stopped touching. A look at what the registry detection catches, why it’s already half-blind, and the process-ancestry signal that actually survives.
Most prompt injection is semantic and resists signature detection. Invisible Unicode tag smuggling is the exception: it leaves a deterministic byte range you can match at the gateway. Here’s the detection, the tuning, and why most teams instrument the wrong path.
SRG moved its extortion infrastructure onto DNS fast flux. Building the detection is easy; the hard part is that a naive low-TTL-plus-many-IPs rule lights up every CDN in your environment before it ever surfaces the botnet.
China-nexus operational relay box networks rotate their egress IPs monthly and pick exit nodes inside the victim’s own region. Blocklists and impossible-travel rules don’t fire. Here’s where the detection actually lives, and what the first round of tuning has to fix.
