Tech – Trackr.Live

§ Tag

Screening Serpens Loads a .NET AppDomainManager Before Its RAT Runs, and Your Sysmon ImageLoad Rule Can Miss the Managed Assembly

Iran-nexus Screening Serpens paired AppDomainManager hijacking with DLL sideloading across its 2026 campaigns. A managed loader assembly runs before the host binary’s normal entry point and isn’t reliably represented in Sysmon ImageLoad telemetry, so the detection has to move to file-create events and .config content.

A Fork PR Poisoned the pnpm Cache Your Release Workflow Trusted, and GitHub’s Audit Log Never Logged the Write

The TanStack compromise published 84 poisoned npm versions across 42 packages by writing a cache entry into the default-branch scope from an untrusted fork PR. GitHub has since made that write path read-only for low-trust triggers — but cache creation still never touches the audit log, so post-hoc detection has to live on the runner and in cache-inventory differencing instead.

Cyber Tools

EDR-Freeze Puts Your Sensor in a Coma With a Signed Windows Dumper. The Detection Is a Gap in Your Own Telemetry

EDR-Freeze abuses WerFaultSecure.exe — a Microsoft-signed WinTCB/PPL crash dumper — to suspend Defender and third-party EDR for as long as the operator holds it, with no kernel driver and almost no forensic residue. Here is what the detection actually looks like in Sysmon, why the filename-based Sigma rule everyone shipped first is a canary rather than a control, and which process-access relationship the real rule matches.

A Systemd Generator Executes Before Your Logging Is Up. Catch the Write, Not the Run

System-level systemd generators run as root at the earliest moment of boot, before auditd, before the EDR agent, before your normal journald/syslog/audit telemetry is reliably up. You will never see the execution. Here is how to build the detection that actually works — file writes and baseline reconciliation — and what breaks it the first week.

AppDomainManager Hijacking Hides in a Signed Binary. The Tell Is One Line of XML That Kills ETW

AppDomainManager hijacking loads attacker code into a Microsoft-signed .NET process before the app runs — and the same config file that does it can switch off the ETW telemetry your EDR depends on. The cleanest detection isn’t the dropped DLL. It’s the XML.

ORB Networks Put the Exit Node in Your Metro Area. Your Geofence Was Never Going to Catch It

China-nexus operational relay box networks rotate their egress IPs monthly and pick exit nodes inside the victim’s own region. Blocklists and impossible-travel rules don’t fire. Here’s where the detection actually lives, and what the first round of tuning has to fix.

Artificial Intelligence

Ollama’s GGUF Quantizer Bleeds Heap, and the Exfil Rides Its Own Push API

An out-of-bounds read in Ollama’s model quantization path leaks process heap, and the data leaves through Ollama’s own /api/push. The detection problem isn’t the read, it’s that the box almost certainly isn’t logging anything.

ESXi Forensics and the RAMdisk Logging Gap Nobody Configured Around

On ESXi the logs that explain how an intruder got root are written to a ramdisk that a reboot erases. Here is where the evidence actually lives, what to detect before it’s gone, and how it maps to the audit-storage controls the architecture violates by default.

Kerberoasting detection in 2026: the 4769 signals that hold up, AES downgrade tells, and clearing service-account account noin week one

Encryption-type detancy deton Kerberos TGS requests still catches lazy roasting, but as RC4 gets disabled the durable signal moves to behavior. What to grep for, why the AES downgrade tell degrades, and how to kill service-account false positives before they bury the SOC.

When netstat Lies: Detecting eBPF Magic-Packet Backdoors on Linux

A clean netstat is not proof of safety: eBPF backdoors like LinkPro keep an internal listener, rewrite ports through XDP/TC, and can make bpftool lie about themselves. The durable signal is the bpf() syscall at load time, and on Cilium-heavy fleets, telling real loaders from noise is most of the work.