Tech – Trackr.Live

§ Tag

EDR-Freeze Puts Your Sensor in a Coma With a Signed Windows Dumper. The Detection Is a Gap in Your Own Telemetry

EDR-Freeze abuses WerFaultSecure.exe — a Microsoft-signed WinTCB/PPL crash dumper — to suspend Defender and third-party EDR for as long as the operator holds it, with no kernel driver and almost no forensic residue. Here is what the detection actually looks like in Sysmon, why the filename-based Sigma rule everyone shipped first is a canary rather than a control, and which process-access relationship the real rule matches.

A Systemd Generator Executes Before Your Logging Is Up. Catch the Write, Not the Run

System-level systemd generators run as root at the earliest moment of boot, before auditd, before the EDR agent, before your normal journald/syslog/audit telemetry is reliably up. You will never see the execution. Here is how to build the detection that actually works — file writes and baseline reconciliation — and what breaks it the first week.

AppDomainManager Hijacking Hides in a Signed Binary. The Tell Is One Line of XML That Kills ETW

AppDomainManager hijacking loads attacker code into a Microsoft-signed .NET process before the app runs — and the same config file that does it can switch off the ETW telemetry your EDR depends on. The cleanest detection isn’t the dropped DLL. It’s the XML.

ORB Networks Put the Exit Node in Your Metro Area. Your Geofence Was Never Going to Catch It

China-nexus operational relay box networks rotate their egress IPs monthly and pick exit nodes inside the victim’s own region. Blocklists and impossible-travel rules don’t fire. Here’s where the detection actually lives, and what the first round of tuning has to fix.

Artificial Intelligence

Ollama’s GGUF Quantizer Bleeds Heap, and the Exfil Rides Its Own Push API

An out-of-bounds read in Ollama’s model quantization path leaks process heap, and the data leaves through Ollama’s own /api/push. The detection problem isn’t the read, it’s that the box almost certainly isn’t logging anything.

ESXi Forensics and the RAMdisk Logging Gap Nobody Configured Around

On ESXi the logs that explain how an intruder got root are written to a ramdisk that a reboot erases. Here is where the evidence actually lives, what to detect before it’s gone, and how it maps to the audit-storage controls the architecture violates by default.

Kerberoasting detection in 2026: the 4769 signals that hold up, AES downgrade tells, and clearing service-account account noin week one

Encryption-type detancy deton Kerberos TGS requests still catches lazy roasting, but as RC4 gets disabled the durable signal moves to behavior. What to grep for, why the AES downgrade tell degrades, and how to kill service-account false positives before they bury the SOC.

When netstat Lies: Detecting eBPF Magic-Packet Backdoors on Linux

A clean netstat is not proof of safety: eBPF backdoors like LinkPro keep an internal listener, rewrite ports through XDP/TC, and can make bpftool lie about themselves. The durable signal is the bpf() syscall at load time, and on Cilium-heavy fleets, telling real loaders from noise is most of the work.

Artificial Intelligence

Two Ways to Go Vertical: Stanford’s Monolithic 3D Chip and Huawei’s LogicFolding

Stanford fabricated and measured a memory-on-logic 3D chip in a US foundry; Huawei announced a logic-folding design method and a new scaling law with no independent audit yet. Same wall, opposite evidence bars.

Drift detection on image-mode RHEL: what bootc actually changes for defenders

Image-mode RHEL moves the host into an ostree-backed, container-built world. The threat model shifts up the stack, and most detection content built for traditional EL hosts quietly stops working.