2 new validated Sigma rules this week — Generic CSV, Apache HTTP Server error log.
Every rule is proven to fire on a real malicious log sample and stay silent on the benign one before it ships.
https://logtriage.app/rules/
#Sigma #DetectionEngineering #blueteam
Every rule is proven to fire on a real malicious log sample and stay silent on the benign one before it ships.
https://logtriage.app/rules/
#Sigma #DetectionEngineering #blueteam
Validated Sigma detection rules · LogTriage
Free Sigma rules, each tested against a malicious and a benign sample log.
logtriage.app
November 9, 2026 at 6:28 AM
2 new validated Sigma rules this week — Generic CSV, Apache HTTP Server error log.
Every rule is proven to fire on a real malicious log sample and stay silent on the benign one before it ships.
https://logtriage.app/rules/
#Sigma #DetectionEngineering #blueteam
Every rule is proven to fire on a real malicious log sample and stay silent on the benign one before it ships.
https://logtriage.app/rules/
#Sigma #DetectionEngineering #blueteam
@elastic.co
Microsoft's WESP framework moves EDR out of the Windows kernel via wesp.sys, but preview binaries show user-mode clients cannot block process creation yet.
-
IOCs: (None identified)
-
#DetectionEngineering #EDREvasion #ThreatIntel #VulnerabilityResearch
Microsoft's WESP framework moves EDR out of the Windows kernel via wesp.sys, but preview binaries show user-mode clients cannot block process creation yet.
-
IOCs: (None identified)
-
#DetectionEngineering #EDREvasion #ThreatIntel #VulnerabilityResearch
Link
www.elastic.co
November 4, 2026 at 8:05 PM
@elastic.co
Microsoft's WESP framework moves EDR out of the Windows kernel via wesp.sys, but preview binaries show user-mode clients cannot block process creation yet.
-
IOCs: (None identified)
-
#DetectionEngineering #EDREvasion #ThreatIntel #VulnerabilityResearch
Microsoft's WESP framework moves EDR out of the Windows kernel via wesp.sys, but preview binaries show user-mode clients cannot block process creation yet.
-
IOCs: (None identified)
-
#DetectionEngineering #EDREvasion #ThreatIntel #VulnerabilityResearch
Elastic Defend blocked bof-ldr.exe.
JellyBee implant returned service data through a PIC module
Windows 11 25H2 + Elastic Defend.
67-second lab demo.
🎥 Full video (3:47):
www.youtube.com/watch?v=-5n3...
#JellyBee #RedTeam #DetectionEngineering
JellyBee implant returned service data through a PIC module
Windows 11 25H2 + Elastic Defend.
67-second lab demo.
🎥 Full video (3:47):
www.youtube.com/watch?v=-5n3...
#JellyBee #RedTeam #DetectionEngineering
November 3, 2026 at 5:06 PM
Elastic Defend blocked bof-ldr.exe.
JellyBee implant returned service data through a PIC module
Windows 11 25H2 + Elastic Defend.
67-second lab demo.
🎥 Full video (3:47):
www.youtube.com/watch?v=-5n3...
#JellyBee #RedTeam #DetectionEngineering
JellyBee implant returned service data through a PIC module
Windows 11 25H2 + Elastic Defend.
67-second lab demo.
🎥 Full video (3:47):
www.youtube.com/watch?v=-5n3...
#JellyBee #RedTeam #DetectionEngineering
A stolen developer token to full cloud admin in roughly three hours. A new detection rule in government: weeks, through a change board. That gap is the finding in Anthropic's threat report for security teams, not the Russia headline. #AISecurity #DetectionEngineering #InfoSec
Three hours from a stolen token to full admin. Weeks to deploy a detection rule.
Attackers now rebuild malware as fast as it is detected. In government a new detection rule still takes weeks to go live.
adriansaxton.com
November 5, 2026 at 8:43 AM
A stolen developer token to full cloud admin in roughly three hours. A new detection rule in government: weeks, through a change board. That gap is the finding in Anthropic's threat report for security teams, not the Russia headline. #AISecurity #DetectionEngineering #InfoSec
AI agents pillage 2,250 cloud tenants in hours, memory flaws breach firewalls, and SD-WAN bleeds keys.
inferlume.com/reports/nigh...
#ThreatIntelligence #CloudSecurity #AgenticAI #DetectionEngineering #CyberSecurity
inferlume.com/reports/nigh...
#ThreatIntelligence #CloudSecurity #AgenticAI #DetectionEngineering #CyberSecurity
AI Agents Pillage Clouds, Firewalls Yield Root, and SD-WAN Bleeds Keys — Nightwatch \| Inferlume
Autonomous agents pillaged clouds, memory flaws collapsed runtimes, and hot wallets emptied at machine speed. - Presented by Inferlume's weekly cyber threat intelligence roundup covering the top attac...
inferlume.com
November 1, 2026 at 2:32 PM
AI agents pillage 2,250 cloud tenants in hours, memory flaws breach firewalls, and SD-WAN bleeds keys.
inferlume.com/reports/nigh...
#ThreatIntelligence #CloudSecurity #AgenticAI #DetectionEngineering #CyberSecurity
inferlume.com/reports/nigh...
#ThreatIntelligence #CloudSecurity #AgenticAI #DetectionEngineering #CyberSecurity
Pillola di detection #2 - WordPress staging path. Regola Sigma (webserver generica) per richieste a .php sotto /wp-content/upgrade/, il path dell'attacco race condition al core (fix 7.1.4). Da testare nel proprio ambiente. #blueteam #detectionengineering
November 2, 2026 at 10:13 AM
Pillola di detection #2 - WordPress staging path. Regola Sigma (webserver generica) per richieste a .php sotto /wp-content/upgrade/, il path dell'attacco race condition al core (fix 7.1.4). Da testare nel proprio ambiente. #blueteam #detectionengineering
If you are looking for detection rules for recent vulnerabilities, you can use rulezet
https://rulezet.org/vulnerability/CVE-2026-109618
It's pretty nifty.
#rulezet #opensource #opendata #cybersecurity #detectionengineering
https://rulezet.org/vulnerability/CVE-2026-109618
It's pretty nifty.
#rulezet #opensource #opendata #cybersecurity #detectionengineering
CVE-2026-109618 — CVE response kit — Rulezet
rulezet.org
October 24, 2026 at 10:38 PM
If you are looking for detection rules for recent vulnerabilities, you can use rulezet
https://rulezet.org/vulnerability/CVE-2026-109618
It's pretty nifty.
#rulezet #opensource #opendata #cybersecurity #detectionengineering
https://rulezet.org/vulnerability/CVE-2026-109618
It's pretty nifty.
#rulezet #opensource #opendata #cybersecurity #detectionengineering
Security isn't about your next move. It's about theirs.
Good detection starts with understanding how attackers might target the systems you already have.
DinaBridge helps build visibility and detection around real threats.
#Security #DetectionEngineering
Good detection starts with understanding how attackers might target the systems you already have.
DinaBridge helps build visibility and detection around real threats.
#Security #DetectionEngineering
October 24, 2026 at 5:01 PM
Security isn't about your next move. It's about theirs.
Good detection starts with understanding how attackers might target the systems you already have.
DinaBridge helps build visibility and detection around real threats.
#Security #DetectionEngineering
Good detection starts with understanding how attackers might target the systems you already have.
DinaBridge helps build visibility and detection around real threats.
#Security #DetectionEngineering
More detection rules don't always mean better security. Too many noisy alerts can make real threats easier to miss.
DinaBridge helps teams tune detection rules to catch the signals that matter.
#CyberSecurity #DetectionEngineering #SIEM
DinaBridge helps teams tune detection rules to catch the signals that matter.
#CyberSecurity #DetectionEngineering #SIEM
October 22, 2026 at 5:01 PM
More detection rules don't always mean better security. Too many noisy alerts can make real threats easier to miss.
DinaBridge helps teams tune detection rules to catch the signals that matter.
#CyberSecurity #DetectionEngineering #SIEM
DinaBridge helps teams tune detection rules to catch the signals that matter.
#CyberSecurity #DetectionEngineering #SIEM
Every Entra break-glass sign-in deserves investigation.
Success or failure
Monitor by user object ID, not just UPN
Track authentication methods, CA results and administrative changes
An emergency account should never generate unexplained routine activity.
#DetectionEngineering
Success or failure
Monitor by user object ID, not just UPN
Track authentication methods, CA results and administrative changes
An emergency account should never generate unexplained routine activity.
#DetectionEngineering
October 21, 2026 at 12:39 PM
Every Entra break-glass sign-in deserves investigation.
Success or failure
Monitor by user object ID, not just UPN
Track authentication methods, CA results and administrative changes
An emergency account should never generate unexplained routine activity.
#DetectionEngineering
Success or failure
Monitor by user object ID, not just UPN
Track authentication methods, CA results and administrative changes
An emergency account should never generate unexplained routine activity.
#DetectionEngineering
Plex2Shell unauthenticated RCE drops miners as SafePay breaches 600+ organizations and wipes backups. Access our complete forensic analysis, IOCs, and Sigma detection rules.
inferlume.com/reports/dail...
#ThreatIntelligence #Ransomware #CyberSecurity #IncidentResponse #DetectionEngineering
inferlume.com/reports/dail...
#ThreatIntelligence #Ransomware #CyberSecurity #IncidentResponse #DetectionEngineering
Plex2Shell Exploits and SafePay Ransomware Spur Immediate Enterprise Defense Protocols - Inferlume
{{rh9e7yNRO}}
inferlume.com
October 21, 2026 at 1:20 PM
Plex2Shell unauthenticated RCE drops miners as SafePay breaches 600+ organizations and wipes backups. Access our complete forensic analysis, IOCs, and Sigma detection rules.
inferlume.com/reports/dail...
#ThreatIntelligence #Ransomware #CyberSecurity #IncidentResponse #DetectionEngineering
inferlume.com/reports/dail...
#ThreatIntelligence #Ransomware #CyberSecurity #IncidentResponse #DetectionEngineering
Threat intelligence cuts false positives, speeds indicator lookups, and keeps detection rules relevant. #ThreatIntelligence #SOC #CyberSecurity #IOCs #DetectionEngineering thedailytechfeed.com/3-game-chang...
October 20, 2026 at 4:54 PM
Threat intelligence cuts false positives, speeds indicator lookups, and keeps detection rules relevant. #ThreatIntelligence #SOC #CyberSecurity #IOCs #DetectionEngineering thedailytechfeed.com/3-game-chang...
In Anthropic's threat report, Midnight Blizzard kept each targeting choice with a human and left recon, exploitation and evasion to models. In government a new detection rule goes through a change board, on platforms that could take it in minutes. #AISecurity #DetectionEngineering
Three hours from a stolen token to full admin. Weeks to deploy a detection rule.
Attackers now rebuild malware as fast as it is detected. In government a new detection rule still takes weeks to go live.
adriansaxton.com
October 15, 2026 at 4:28 PM
In Anthropic's threat report, Midnight Blizzard kept each targeting choice with a human and left recon, exploitation and evasion to models. In government a new detection rule goes through a change board, on platforms that could take it in minutes. #AISecurity #DetectionEngineering
Sigma-Hunter is a new domain-specific LLM for generating Sigma detection rules, fine-tuned from Mistral 7B and Phi-4 with LoRA on a curated dataset of 3,635 open-source Sigma rules. It aims to fix the invalid…
#opensource #ai #cybersecurity #detectionengineering
https://arxiv.org/abs/2610.09007
#opensource #ai #cybersecurity #detectionengineering
https://arxiv.org/abs/2610.09007
October 8, 2026 at 6:01 AM
Sigma-Hunter is a new domain-specific LLM for generating Sigma detection rules, fine-tuned from Mistral 7B and Phi-4 with LoRA on a curated dataset of 3,635 open-source Sigma rules. It aims to fix the invalid…
#opensource #ai #cybersecurity #detectionengineering
https://arxiv.org/abs/2610.09007
#opensource #ai #cybersecurity #detectionengineering
https://arxiv.org/abs/2610.09007
SOC & MSSP leaders must move beyond logs to intelligence-led threat monitoring, not just detection engineering. #ThreatIntelligence #SOC #MSSP #DetectionEngineering #Cybersecurity thedailytechfeed.com/how-soc-mssp...
October 6, 2026 at 4:11 PM
SOC & MSSP leaders must move beyond logs to intelligence-led threat monitoring, not just detection engineering. #ThreatIntelligence #SOC #MSSP #DetectionEngineering #Cybersecurity thedailytechfeed.com/how-soc-mssp...
"Ask the User to Approve" Is Not a Security Control www.darinor.com/blog/human-i... #AgenticAI #AgentArchitecture #HumanINTHELOOP #DetectionEngineering
"Ask the User to Approve" Is Not a Security Control
Approval prompts get clicked through by the tenth repetition. Treat human review as a scarce resource and spend it where the blast radius is — everywhere else, enforce in code.
www.darinor.com
October 3, 2026 at 6:28 PM
"Ask the User to Approve" Is Not a Security Control www.darinor.com/blog/human-i... #AgenticAI #AgentArchitecture #HumanINTHELOOP #DetectionEngineering
How to Build an Agent Audit Trail Before You Need It www.darinor.com/blog/how-to-... #AgenticAI #IncidentResponse #DetectionEngineering #AgentArchitecture
How to Build an Agent Audit Trail Before You Need It
The provider's copy expires on their clock. Build the trail you own — context snapshots, provenance, a config hash, into storage the agent can't rewrite.
www.darinor.com
September 26, 2026 at 5:42 AM
How to Build an Agent Audit Trail Before You Need It www.darinor.com/blog/how-to-... #AgenticAI #IncidentResponse #DetectionEngineering #AgentArchitecture
Microsoft mailed 974 patches. Cisco mailed root. AI coding assistant mailed a worm. This NightWatch report is the map of KEV clocks, stolen trust, & leak sites: inferlume.com/reports/nigh...
#CyberSecurity #ThreatIntelligence #Infosec #CISO #VulnerabilityManagement #DetectionEngineering #SOC
#CyberSecurity #ThreatIntelligence #Infosec #CISO #VulnerabilityManagement #DetectionEngineering #SOC
When Mail Gateways And Identity Brokers Failed Open — Nightwatch \| Inferlume
Supply chains, AI agents, and Microsofts patch record all broke in the same week - Presented by Inferlume's weekly cyber threat intelligence roundup covering the top attack vectors, threat actors, and...
inferlume.com
September 20, 2026 at 2:53 PM
Microsoft mailed 974 patches. Cisco mailed root. AI coding assistant mailed a worm. This NightWatch report is the map of KEV clocks, stolen trust, & leak sites: inferlume.com/reports/nigh...
#CyberSecurity #ThreatIntelligence #Infosec #CISO #VulnerabilityManagement #DetectionEngineering #SOC
#CyberSecurity #ThreatIntelligence #Infosec #CISO #VulnerabilityManagement #DetectionEngineering #SOC
CVE-2026-76460 gives strangers root. Federal clock emds 2026-09-19. Settra, Pixel & two Windows zero days arrived in the same 24 hours.
Full Inferlume Report: inferlume.com/reports/dail...
#CyberThreatIntelligence #CiscoISE #CISAKEV #Ransomware #DetectionEngineering #SOC #VulnerabilityManagement
Full Inferlume Report: inferlume.com/reports/dail...
#CyberThreatIntelligence #CiscoISE #CISAKEV #Ransomware #DetectionEngineering #SOC #VulnerabilityManagement
The Box That Admits Devices Now Hands Out Root - Inferlume
{{rh9e7yNRO}}
inferlume.com
September 18, 2026 at 2:27 PM
CVE-2026-76460 gives strangers root. Federal clock emds 2026-09-19. Settra, Pixel & two Windows zero days arrived in the same 24 hours.
Full Inferlume Report: inferlume.com/reports/dail...
#CyberThreatIntelligence #CiscoISE #CISAKEV #Ransomware #DetectionEngineering #SOC #VulnerabilityManagement
Full Inferlume Report: inferlume.com/reports/dail...
#CyberThreatIntelligence #CiscoISE #CISAKEV #Ransomware #DetectionEngineering #SOC #VulnerabilityManagement
From Splunk to Sigma 🔍
I rebuilt a suspicious PowerShell detection as a Sigma rule, then converted it back to SPL and tested it with existing telemetry + Atomic Red Team.
medium.com/@citadelcybe...
#Cybersecurity #DetectionEngineering #Homelab
I rebuilt a suspicious PowerShell detection as a Sigma rule, then converted it back to SPL and tested it with existing telemetry + Atomic Red Team.
medium.com/@citadelcybe...
#Cybersecurity #DetectionEngineering #Homelab
From Splunk to Sigma: Building and Validating Vendor-Neutral Detection Logic
A detection-engineering exercise using Sigma, Splunk, Windows telemetry, and Atomic Red Team to validate vendor-neutral detection logic.
medium.com
September 16, 2026 at 7:40 AM
From Splunk to Sigma 🔍
I rebuilt a suspicious PowerShell detection as a Sigma rule, then converted it back to SPL and tested it with existing telemetry + Atomic Red Team.
medium.com/@citadelcybe...
#Cybersecurity #DetectionEngineering #Homelab
I rebuilt a suspicious PowerShell detection as a Sigma rule, then converted it back to SPL and tested it with existing telemetry + Atomic Red Team.
medium.com/@citadelcybe...
#Cybersecurity #DetectionEngineering #Homelab
📢 Elastic publie un framework de détection des élévations de privilèges Linux couvrant 13 CVE 2026
📅 Source et contexte : Publié le 11 septembre 2026 par Ruben Groenewoud sur Elastic Security Labs, cet article s'inscrit…
🟢 vérification factuelle haute
#DetectionEngineering #LinuxLPE #Cyberveille
📅 Source et contexte : Publié le 11 septembre 2026 par Ruben Groenewoud sur Elastic Security Labs, cet article s'inscrit…
🟢 vérification factuelle haute
#DetectionEngineering #LinuxLPE #Cyberveille
Elastic publie un framework de détection des élévations de privilèges Linux couvrant 13 CVE 2026
📅 Source et contexte : Publié le 11 septembre 2026 par Ruben Groenewoud sur Elastic Security Labs, cet article s'inscrit dans la série « Linux Detection Engineering » et présente un framework de détection des élévations de privilèges locales (LPE) sous Linux, validé contre des preuves de concept (PoC) publiques.
cyberveille.ch
September 14, 2026 at 4:30 PM
📢 Elastic publie un framework de détection des élévations de privilèges Linux couvrant 13 CVE 2026
📅 Source et contexte : Publié le 11 septembre 2026 par Ruben Groenewoud sur Elastic Security Labs, cet article s'inscrit…
🟢 vérification factuelle haute
#DetectionEngineering #LinuxLPE #Cyberveille
📅 Source et contexte : Publié le 11 septembre 2026 par Ruben Groenewoud sur Elastic Security Labs, cet article s'inscrit…
🟢 vérification factuelle haute
#DetectionEngineering #LinuxLPE #Cyberveille
Firewall managers handing out root, 122500 routers open, Magento dropping Rust, Claude rebuilding malware. KEV clocks hit 12 Sep and 13 Sep.
Full Inferlume Report: inferlume.com/reports/dail...
#ThreatIntel #CyberSecurity #CISA #SOC #IncidentResponse #DetectionEngineering #Cisco #Ransomware
Full Inferlume Report: inferlume.com/reports/dail...
#ThreatIntel #CyberSecurity #CISA #SOC #IncidentResponse #DetectionEngineering #Cisco #Ransomware
Your Firewall Manager Just Became a Qilin Beachhead - Inferlume
{{rh9e7yNRO}}
inferlume.com
September 11, 2026 at 4:52 PM
Firewall managers handing out root, 122500 routers open, Magento dropping Rust, Claude rebuilding malware. KEV clocks hit 12 Sep and 13 Sep.
Full Inferlume Report: inferlume.com/reports/dail...
#ThreatIntel #CyberSecurity #CISA #SOC #IncidentResponse #DetectionEngineering #Cisco #Ransomware
Full Inferlume Report: inferlume.com/reports/dail...
#ThreatIntel #CyberSecurity #CISA #SOC #IncidentResponse #DetectionEngineering #Cisco #Ransomware
Root on the firewall brain, 153M licenses on Nexus, & agents stealing creds in six hours. Patch by 12 Sep. Hunt license.tmp first.
Read full Inferlume report here: inferlume.com/reports/dail...
#CTI #ThreatIntel #Cisco #CISA #InfoSec #VulnerabilityManagement #DetectionEngineering #IncidentResponse
Read full Inferlume report here: inferlume.com/reports/dail...
#CTI #ThreatIntel #Cisco #CISA #InfoSec #VulnerabilityManagement #DetectionEngineering #IncidentResponse
They Turned Your Firewall Manager Into the Breach Path - Inferlume
{{rh9e7yNRO}}
inferlume.com
September 10, 2026 at 4:19 PM
Root on the firewall brain, 153M licenses on Nexus, & agents stealing creds in six hours. Patch by 12 Sep. Hunt license.tmp first.
Read full Inferlume report here: inferlume.com/reports/dail...
#CTI #ThreatIntel #Cisco #CISA #InfoSec #VulnerabilityManagement #DetectionEngineering #IncidentResponse
Read full Inferlume report here: inferlume.com/reports/dail...
#CTI #ThreatIntel #Cisco #CISA #InfoSec #VulnerabilityManagement #DetectionEngineering #IncidentResponse
974 Microsoft fixes, 2 live SYSTEM elevators, a CVSS 10.0 MSP console on a 11 Sep clock, 6 hour agentic theft, & named distillation of frontier models.
Full Inferlume report: inferlume.com/reports/dail....
#ThreatIntelligence #PatchTuesday #ThreatIntel #InfoSec #DetectionEngineering #AISecurity
Full Inferlume report: inferlume.com/reports/dail....
#ThreatIntelligence #PatchTuesday #ThreatIntel #InfoSec #DetectionEngineering #AISecurity
AI Agents Empty Cloud Vaults During Record Patch Tuesday - Inferlume
{{rh9e7yNRO}}
inferlume.com
September 9, 2026 at 3:43 PM
974 Microsoft fixes, 2 live SYSTEM elevators, a CVSS 10.0 MSP console on a 11 Sep clock, 6 hour agentic theft, & named distillation of frontier models.
Full Inferlume report: inferlume.com/reports/dail....
#ThreatIntelligence #PatchTuesday #ThreatIntel #InfoSec #DetectionEngineering #AISecurity
Full Inferlume report: inferlume.com/reports/dail....
#ThreatIntelligence #PatchTuesday #ThreatIntel #InfoSec #DetectionEngineering #AISecurity