RMF – Trackr.Live

§ Tag

The BadSuccessor Patch Killed the One-Sided Link. Mutual Pairing Still Leaks the Target’s Kerberos Keys

Microsoft’s August 2025 fix for BadSuccessor (CVE-2025-53779) works — but an attacker who controls a dMSA and can write a target’s migration-link attributes can forge the mutual pairing the KDC now demands and pull that account’s Kerberos key material out of the dMSA key package. The detection has to move from watching one attribute to watching the pairing on the target object.

A Systemd Generator Executes Before Your Logging Is Up. Catch the Write, Not the Run

System-level systemd generators run as root at the earliest moment of boot, before auditd, before the EDR agent, before your normal journald/syslog/audit telemetry is reliably up. You will never see the execution. Here is how to build the detection that actually works — file writes and baseline reconciliation — and what breaks it the first week.

The DPRK Worker’s KVM Is Plugged Into Your Laptop, Not the Internet. Hunt the Sign-In Log Instead

North Korean IT workers don’t breach you — they get hired. The device fingerprint everyone reaches for is spoofable and behind home NAT. The detection that survives contact with production lives in your identity provider’s sign-in logs.

Cyber Tools

RC4 Is About to Go Extinct in Kerberos. So Is Your Kerberoasting Detection

Microsoft’s three-phase RC4 disablement for Kerberos closes a real attack surface and quietly breaks the most common Kerberoasting detection rule in the process. The signal you keyed on is about to disappear, and the attack isn’t going with it.

Service Principal Credential Adds Are the Entra Persistence Move Conditional Access Won’t See

An attacker with app-management rights doesn’t need another password. They add their own secret to a trusted service principal and authenticate as the app, outside MFA and outside Conditional Access. Here is what the audit event looks like, what the first round of tuning has to fix, and where the cleanest preventive control hides behind a SKU you probably didn’t buy.

Cyber Tools

ORB Networks and the Slow Death of the IP Blocklist

Nation-state operators now rent disposable relay meshes that cycle IPs faster than your threat feed updates. Indicator-based blocking was already brittle; against ORB networks it’s mostly theater. Here’s what actually moves the needle.

Image-Mode RHEL Breaks Your File Integrity Baseline, and Nobody Told the SOC

Bootc and rpm-ostree turn the root filesystem read-only and push state into a handful of writable paths. That quietly invalidates half your host integrity detections. Here is the new shape of the problem and what to instrument before the first ATO review notices.

CVE-2026-41089: A Pre-Auth Netlogon RCE Lands on Your Domain Controllers

A CVSS 9.8 stack-based buffer overflow in Windows Netlogon gives an unauthenticated attacker code execution on a domain controller. Microsoft called exploitation ‘less likely.’ Belgium’s CCB says it’s happening now.

Microsoft’s passwordless-by-default shift: what Entra admins and home users need to know

System-preferred authentication is moving to the first factor, the password prompt is about to vanish for passkey holders, and break-glass accounts are not exempt from mandatory MFA. Here’s what that actually changes for Entra defenders and home users.

Token theft DFIR in Entra ID after the device-bound credential rollout

Token Protection and DBSC closed some doors in 2026 but left the SOC with a messier detection surface than the vendor decks suggest. Here is what the incident actually looks like in the SIEM, where the first round of tuning has to land, and what most teams get wrong on revocation.