Control – Page 4 – Trackr.Live

§ Tag

Scratch on a Ramdisk: The ESXi Default That Decides Your Timeline

On an ESXi host without persistent scratch, /var/run/log lives on an in-memory ramdisk and evaporates at the next boot. Ransomware crews get the same effect for free — they power off, kill, or reboot the workloads before encrypting — which means your entire forensic timeline had to be forwarded off-box before the incident or it never existed at all.

Entra Logs a Federated Credential Add as Update Application

Most SOCs detect service principal persistence by watching for “Add service principal credentials.” Federated identity credentials reach the same persistence with a different audit operation, on a different object, sometimes in a log source you never ingested.

ESC16 Strips the SID Extension Strong Mapping Depends On

Microsoft’s strong certificate mapping enforcement finally landed, and where it’s genuinely in force it does close the naive implicit-mapping hole that made ADCS escalation trivial — a certificate with only a weak name is denied. ESC16 strips the CA-issued SID so the mapping decision falls to whatever’s left: on a compatibility-mode DC that’s weak SAN mapping, and even on a fully-enforced DC it’s an attacker-supplied SID-in-SAN URI the KDC treats as strong. The audit events you’d hunt it with are off by default.

Artificial Intelligence

mem_source: The Provenance Tag That Makes Memory Writes Detectable

Single-turn prompt injection usually dies when the context window clears. Memory poisoning persists, fires weeks later, and hides in a memory-write event your platform was never built to emit as security telemetry. Here is what to instrument, what to detect, and what the first round of tuning gets wrong.

A .NET App Config Can Disable the Runtime’s ETW Provider

AppDomainManager hijacking loads attacker code into a Microsoft-signed .NET process before the app runs — and the same config file that does it can switch off the ETW telemetry your EDR depends on. The cleanest detection isn’t the dropped DLL. It’s the XML.

Shared Egress: Three Unrelated Employees on One Residential IP

North Korean IT workers don’t breach you — they get hired. The device fingerprint everyone reaches for is spoofable and behind home NAT. The detection that survives contact with production lives in your identity provider’s sign-in logs.

Cyber Tools

GitHub Actions Cache Is Repository-Scoped With a Branch-Derived Read Hierarchy

The 2026 TanStack compromise (CVE-2026-45321) turned a bundle-size workflow into an npm publishing channel by poisoning a repo-scoped cache. The cache write left almost no runtime telemetry, which makes this a config audit before it’s ever a detection.

Cyber Tools

Decoy SPNs: The One Kerberoasting Detection RC4 Disablement Improves

Microsoft’s three-phase RC4 disablement for Kerberos closes a real attack surface and quietly breaks the most common Kerberoasting detection rule in the process. The signal you keyed on is about to disappear, and the attack isn’t going with it.

CVE-2026-20253 Runs as the splunk User — and That’s the Index You’d Hunt It In

An unauthenticated file-write in Splunk Enterprise’s bundled Postgres sidecar chains to code execution as the splunk service account — the same account that owns your _audit and _internal indexes. The detection problem is mostly a log-forwarding hygiene problem you either solved last year or didn’t.

Token Protection Binds the PRT, Not the Browser Session AiTM Actually Steals

Conditional Access Token Protection is the control everyone cites as the answer to adversary-in-the-middle phishing. It binds the PRT for native apps on Windows and skips browsers entirely — which is exactly where the stolen cookie lands. Detection, not the control, is still your line.