// Detection Intel Archive

The August 2026 Shai-Hulud npm worm wave adds a novel persistence vector — committing auto-executing .vscode/tasks.json and .claude/settings.json files into repositories. Sigma and KQL to catch it.

Researchers Ezra Woods and Mike Manrod documented 'EDR-on-EDR violence' — attackers with local admin abusing free EDR trials (demonstrated with Cisco Secure Endpoint) to disable CrowdStrike Falcon and Elastic Defend without generating a single alert. Here's how to detect the installation, the tamper attempt, and the resulting telemetry gap.

Trend Micro disclosed 14 trojanized npm packages masquerading as calendar and streak-tracking utilities that silently deploy RedC2 4.0, a cross-platform implant with an LLM-backed command layer. Here's how the import-time execution chain works and the Sigma and KQL logic to catch it.

Adversaries with sufficient cloud IAM permissions routinely disable CloudTrail, delete Azure diagnostic settings, or tamper with GCP audit sinks before running the rest of their playbook. This hunt covers detection logic across AWS, Azure, and GCP for T1562.008.

Zscaler ThreatLabz's C2Looper backdoor evolved from plaintext HTTP C2 to routing every command, task, and result through GitHub repositories. This guide covers detection logic for the API-polling behaviour that gives away the technique despite the trusted domain.

MacSync is a macOS-targeted infostealer and RAT spreading through ClickFix lures fronted by 250+ browser-fingerprinting domains. This guide covers the Terminal-execution and LaunchAgent-persistence detection surface, with Sigma rules for the EndpointSecurity/osquery log source and KQL for Defender for Endpoint macOS telemetry.

State-sponsored APT groups including IRGC-linked APT42 continue to weaponise LNK files masquerading as PDF documents to deliver modular surveillance frameworks targeting high-value professionals. This playbook provides Sigma rules and KQL queries covering LNK execution, enumeration, browser credential harvesting, Outlook .ost collection, and screenshot capture.

Mshta.exe is a Windows-native binary that executes HTA (HTML Application) files and is frequently abused by threat actors to run malicious scripts while bypassing application whitelisting. This guide covers the detection opportunities, Sigma rules, and KQL queries for identifying MSHTA abuse in enterprise environments.

Gunra ransomware actors exploit CVE-2024-5559 and CVE-2025-24472 in internet-facing VPN devices before executing a Conti-derived kill chain. This guide provides Sigma rules and Microsoft Sentinel KQL queries covering initial access detection, LSASS credential dumping, lateral movement, and pre-encryption staging.

CVE-2026-72898 is a CVSS 10 unauthenticated SQL injection in Metabase's password reset endpoint, actively exploited as a zero-day. This guide provides detection logic for exploitation attempts, post-compromise admin activity, and downstream credential abuse — covering Sigma rules, KQL queries, and log source guidance for SOC teams.

APT actors are actively exploiting CVE-2026-59310, a CVSS 9.8 directory-traversal flaw in VMware vCenter's Syslog service, to achieve unauthenticated RCE and deploy reverse_ssh persistence via malicious cron jobs. This guide covers the detection logic, Sigma rules, and KQL queries for identifying exploitation activity, cron persistence, and outbound SSH tunnelling from compromised vCenter appliances.

Lazarus Group's FudModule rootkit uses kernel-level handle table manipulation to blind EDR tools after exploiting the CVE-2026-68820 AFD.sys privilege escalation. This guide covers behavioural detection logic, Sigma rules, and KQL queries targeting the FudModule attack chain before your security stack goes dark.

As AI assistants enter XDR platforms, SIEM copilots, and alert summarisers, adversaries are embedding adversarial prompts directly in log events — log fields that the analyst never sees but the model acts on. Here's how to detect it.

NTFS Alternate Data Streams allow adversaries to hide malicious payloads, scripts, and persistence artefacts inside the metadata forks of legitimate files, making them invisible to standard directory listings. This guide covers detection logic with Sigma rules and KQL for hunting ADS abuse across endpoints.

The DeepSeek-powered autonomous agent campaign exploiting CVE-2026-9198 adds AI workflow platforms to the list of targets SOC teams must monitor. This guide covers detection opportunities across initial exploitation, post-exploitation behaviour, and the pivot to n8n — with deployable Sigma rules and KQL queries.

Adversary-in-the-middle phishing kits (Evilginx, Tycoon 2FA, Modlishka) bypass MFA by harvesting session tokens rather than passwords. This detection guide covers the Entra ID log signatures and KQL queries that identify token theft activity across sign-in and audit telemetry.

Microsoft disclosed on 31 July 2026 that Midnight Blizzard cluster Storm-2945 is compromising hotel and conference Wi-Fi captive portals to deliver CornFlake (a Go-based RAT) and ChocoShell (an in-memory PowerShell infostealer) against corporate travellers. This playbook covers detection across Windows event logs, Entra ID, and SIEM telemetry with Sigma rules and KQL.

COM object hijacking is one of the quieter persistence techniques in the Windows ecosystem — no new services, no scheduled tasks, just a registry entry that redirects legitimate application DLL loads. This guide covers detection with Sigma rules and KQL, including HKCU hijack paths, TypeLib abuse, and DLL load anomalies.

Silver Ticket attacks let attackers forge Kerberos service tickets using a compromised service account hash — without touching the domain controller. That makes them hard to detect with standard event logging. This guide covers the detection opportunities that do exist, with deployable Sigma rules and KQL.

Threat actors increasingly exfiltrate data through legitimate cloud storage APIs, blending with normal SaaS traffic. This guide covers detection opportunities across Microsoft 365, Google Drive, and Box using Microsoft Sentinel KQL, Sigma rules, and UEBA correlation.

Threat actors exploiting CVE-2026-18577 in N-able N-central gain administrative access to every managed endpoint, deploy persistent Cloudflare tunnels via a rogue Cloudflared service, and drop a masquerading svchost.exe in user Documents folders. This guide covers detection logic, Sigma rules, and KQL queries for each stage.

Golden SAML attacks forge SAML assertions using a stolen ADFS token signing certificate, granting persistent, MFA-bypassing access to any service provider federated with the compromised identity provider — including Microsoft 365, AWS, and Azure. This guide covers the attack chain, detection opportunities in ADFS event logs, and deployable Sigma and KQL rules.

Qilin affiliates are exploiting CVE-2026-0257, an authentication bypass in Palo Alto GlobalProtect that lets unauthenticated attackers establish valid VPN sessions. This guide covers the attack chain, detection logic, and Sigma and KQL rules for catching initial access and the rapid post-exploitation sequence that follows.

Threat actors including the TELESHIM campaign and multiple commodity RAT families abuse the Telegram Bot API for command and control, blending malicious traffic with legitimate messaging. This guide covers detection logic for Sigma, KQL, and Splunk SPL across network, endpoint, and proxy telemetry.

Threat actors targeting enterprise help desks via phone-based social engineering are bypassing MFA and resetting credentials without malware. This guide covers detection in directory, telephony, and ticketing logs with Sigma and KQL.

PoisonX is a kernel-mode EDR killer that shipped with a valid Microsoft signature. It wasn't on the LOLDrivers blocklist because it wasn't a repurposed vulnerable driver -- it was purpose-built and certified. Detection must shift to behaviour. This guide covers Sigma rules and KQL for catching malicious kernel driver loading before your EDR goes dark.

SectopRAT and a growing list of RATs use Ethereum smart contracts for command-and-control, making traditional domain-blocking ineffective. This guide covers detection logic, Sigma rules, and KQL queries for hunting blockchain C2 in enterprise telemetry.

Named pipes are a core IPC mechanism on Windows — and a favoured channel for post-exploitation frameworks including Cobalt Strike, Havoc, and Brute Ratel. This guide covers Sysmon pipe events, known offensive pipe names, Sigma detection rules, and KQL queries for Sentinel and Defender XDR.

LAUNDRY BEAR's Zimbra zero-click email collection campaign exploits CVE-2025-66376 to harvest 90 days of email without victim interaction. This guide covers the detection logic, Sigma rules, and KQL queries defenders need to identify exploitation and post-compromise collection activity.

DNS-over-HTTPS tunnels adversary C2 traffic through encrypted HTTPS to a resolving endpoint, bypassing traditional DNS monitoring. This guide covers detection approaches when the DNS layer itself is obscured, with Sigma rules and KQL.

The AsyncAPI and Miasma supply chain attacks introduced a class of threat that strikes before your application code runs: malicious postinstall hooks and import-time execution in npm packages. Here's the detection logic to catch these attacks at the registry import stage before they establish persistent access.

Trend Micro's analysis of threat actor bandcampro revealed a new C2 pattern: PowerShell agents polling an in-memory HTTP server every 5 seconds, entirely architected by jailbroken Gemini CLI. Here's the detection logic — Sigma rules and KQL — for this emerging category of AI-generated C2 infrastructure.

Cross-tenant synchronization is a legitimate Entra ID feature for multi-tenant enterprises — and an underappreciated attack surface. This guide covers how attackers configure cross-tenant sync to maintain persistent access across Azure tenants, with Sigma rules and KQL for detecting configuration changes and anomalous sync-created accounts.

CISA Advisory AA26-194A details FSB Center 16 using default SNMP community strings and Cisco Smart Install to steal router configurations from critical infrastructure. Here's the detection logic — Sigma rules and KQL queries — to identify this collection technique before exfiltration completes.

Okta is a target in almost every major identity-based breach campaign. This playbook covers the log sources, event types, Sigma rules, and hunting queries defenders need to detect credential abuse, session hijacking, and administrative backdoor creation in Okta environments.

Password spraying is one of the most consistent initial access techniques in enterprise breaches: a single password tested against hundreds of accounts avoids lockout policies while maximising the chance of a hit. This guide covers the telemetry, Sigma rules, and KQL queries defenders need to detect spray campaigns against Active Directory and Entra ID.

AI-assisted attackers can operate multiple IAM credential sets in parallel at a speed no human can match. This guide covers the CloudTrail anomalies that betray this behaviour, with Sigma rules and KQL queries for Sentinel and Splunk.

Kerberos delegation is one of the most exploited privilege escalation paths in Active Directory environments. This guide covers how attackers abuse unconstrained, constrained, and resource-based constrained delegation to escalate to domain admin, and provides Sigma rules and KQL queries to detect each variant.

GhostLock is a 15-year-old Linux kernel use-after-free with a public, 97%-reliable exploit granting root and container escape. This guide covers the detection surface — auditd events, process integrity signals, and post-exploitation indicators — with Sigma rules and KQL for Defender for Endpoint and Sentinel.

DCSync abuses legitimate Active Directory replication protocols to extract credential hashes from a domain controller without running code on the DC itself. This guide covers how the attack works, what it looks like in logs, and Sigma and KQL detection rules to catch it.

Process injection is the backbone of modern malware evasion — shellcode injected into svchost.exe, code running from NTDLL, and Cobalt Strike sleeping in a hollowed process. This guide covers the host-based artifacts, Sigma rules, and KQL queries for detecting T1055 sub-techniques across Windows environments.

Attackers routinely disable or bypass AMSI and PowerShell Script Block Logging before executing malicious payloads. This guide covers the most common bypass techniques, their detection signatures, and Sigma and KQL rules to catch evasion attempts in Windows environments.

Access token manipulation (T1134) lets attackers run processes as SYSTEM, other users, or privileged service accounts without knowing passwords. This guide covers the key sub-techniques, detection telemetry, and production-ready Sigma and KQL rules for catching token theft and impersonation.

Interlock ransomware uses ClickFix social engineering to deliver initial access, then moves through credential theft, lateral movement, and data exfiltration before deploying its encryptor. This playbook covers the full kill chain with Sigma rules and KQL queries at each stage.

CVE-2026-33825 'BlueHammer' is a Microsoft Defender race condition that grants SYSTEM from an unprivileged user. CISA confirmed it is now actively exploited in ransomware pre-deployment. This guide covers detection logic, Sigma rules, and KQL for Sentinel and Defender XDR.

Remote Desktop Protocol is one of the most-abused lateral movement vectors in enterprise networks. This guide covers RDP-based lateral movement mechanics, the event telemetry defenders need, and practical Sigma and KQL detection rules for hunting RDP pivots.

Ransomware groups targeting VMware ESXi directly bypass endpoint agents and encrypt all hosted VMs simultaneously. This guide covers the attack chain used by REDBIKE (Akira) and AGENDA (Qilin), ESXi-specific detection opportunities in syslog and vCenter logs, and Sigma rules for identifying hypervisor-level ransomware staging.

Qilin has become the most active ransomware group of mid-2026, claiming 500+ victims using a layered evasion stack: WSL-based Linux execution to bypass EDR hooks, BYOVD driver abuse to disable defences, and Chrome credential harvesting via PowerShell GPO. This guide covers detection logic for all three techniques.

Following Anthropic's disclosure of the first AI-orchestrated espionage campaign, this playbook covers how to hunt for evidence of AI coding agent abuse in enterprise environments — covering API telemetry, network patterns, and endpoint behavioural indicators.

North Korean threat actors are routing C2 traffic through GitHub repositories and pCloud to evade enterprise proxy controls. Here's how to build detection logic that catches this living-off-the-cloud technique before exfiltration begins.

Threat actors increasingly use SOCKS5 proxy tunnels over HTTP/HTTPS to blend C2 traffic with legitimate web traffic and bypass perimeter controls. This guide covers detection logic for Chisel and Ligolo-NG, the two most observed tunneling tools, with Sigma rules and KQL queries for each technique.

When attackers exploit vulnerabilities in RMM server software rather than deploying unauthorised RMM clients, the detection problem changes completely. This guide covers how to detect the attack chain from CVE-2026-48558-style RMM server compromise through TaskWeaver stager delivery to Djinn Stealer credential theft — with Sigma rules and KQL queries for each stage.

ClickFix instructs victims to paste attacker-controlled commands from their clipboard into Run or PowerShell, bypassing endpoint controls and security awareness training. This guide covers the execution artifacts, Sigma rules, and KQL queries for detecting ClickFix campaigns across initial access and execution phases.

Attackers are abusing Cloudflare Tunnel (cloudflared) to route command-and-control traffic through legitimate Cloudflare infrastructure, bypassing egress controls and reputation-based firewalls. This guide covers detection logic for endpoint, network, and SIEM layers.

Brute Ratel C4 (BRC4) is a commercial adversarial simulation framework adopted by APT29, ALPHV affiliates, and other threat actors specifically for its EDR evasion capabilities. This guide covers the Badger implant's named pipe patterns, syscall evasion, network beaconing, and Sigma rules and KQL for detection.

Havoc is an open-source C2 framework increasingly adopted by ransomware affiliates and nation-state actors. This detection guide covers the Demon agent's named pipe patterns, HTTPS beaconing signatures, process injection behaviour, and Sigma rules plus KQL for Microsoft Sentinel.

Adversaries abuse SSH's built-in tunneling capabilities to create covert channels through firewall controls. This guide covers detection of local, remote, and dynamic port forwarding using Sigma rules, Linux auditd, and network telemetry.

Threat actors increasingly deploy legitimate remote management tools as backdoors to bypass EDR detection. This guide covers Sigma rules and KQL queries for detecting unauthorised ScreenConnect, AnyDesk, and TeamViewer deployments — covering installation indicators, unusual parent processes, suspicious network destinations, and post-compromise activity patterns.

Process injection is the most common technique for executing malicious code within the address space of a legitimate process. This guide covers detection logic for CreateRemoteThread, VirtualAllocEx, QueueUserAPC, reflective DLL injection, and shellcode injection, with Sigma rules and KQL for each.

Attackers routinely weaponize SQL Server's xp_cmdshell stored procedure, linked server pivots, and SQL Agent jobs for lateral movement and persistence. This guide provides Sigma rules and KQL queries to detect all three abuse paths.

DragonForce's Backdoor.Turn routes command-and-control through legitimate Microsoft Teams TURN relay infrastructure using QUIC over UDP 443, defeating network monitoring tools that can't distinguish malicious traffic from Teams collaboration. Here's where the detection opportunities actually are, with deployable Sigma rules and KQL.

SocGholish — also known as FakeUpdates — is one of the most prevalent initial access frameworks in enterprise intrusions, delivering Cobalt Strike, RansomHub, and other payloads via fake software update prompts on compromised legitimate websites. This guide covers detection at the browser, endpoint, proxy, and network layers with Sigma rules and KQL.

MFA fatigue attacks flood victims with authentication push notifications until they approve one by mistake or exhaustion. This guide covers the attack mechanics, Sigma rules for Entra ID and Okta, and KQL queries to surface anomalous MFA behaviour in your environment.

Webshells are the most common persistence mechanism following successful server exploitation. This guide covers detection across multiple surfaces: file creation events, process ancestry anomalies, IIS/Apache log analysis, and memory-resident shellcode patterns — with Sigma rules and KQL for each.

Cobalt Strike remains the most widely observed adversary simulation framework in real-world intrusions. This guide covers the principal detection opportunities: default and custom malleable C2 network signatures, named pipe artifacts, process injection indicators, and memory-resident beacon detection, with Sigma rules and KQL for each.

DLL side-loading and hijacking are among the most abused techniques for persistence, privilege escalation, and defence evasion. This guide covers the difference between the two variants, how attackers use them, and the detection logic to catch both.

BloodHound's graph-based AD attack path analysis is a staple of red teams and real attackers alike. This guide covers Sigma rules and KQL queries to detect SharpHound collection, LDAP enumeration bursts, and trust discovery activity across Windows and Entra ID.

Primary Refresh Tokens are the skeleton key to Microsoft Entra ID. This guide covers how PRT theft works, the known attack tools, KQL detections in Microsoft Sentinel and Defender XDR, and what to look for in sign-in logs when MFA has been bypassed.

Pass-the-Hash and Pass-the-Ticket are foundational lateral movement techniques used by nearly every ransomware affiliate and APT group operating in Windows environments. This guide covers how both attacks work, the telemetry sources that catch them, and production-ready Sigma and KQL detection rules.

Distributed COM (DCOM) is a legitimate Windows remoting protocol increasingly abused for lateral movement by APT groups and ransomware operators. This guide covers DCOM execution mechanics, detection telemetry, and Sigma/KQL rules for hunting DCOM-based pivots.

Windows Remote Management is a legitimate administrative protocol increasingly abused for lateral movement by ransomware affiliates and APT groups. This guide covers the key detection opportunities: event log telemetry, network signatures, and Sigma rules for SIEM and EDR platforms.

Modern ransomware groups exfiltrate data before encrypting — using tools like rclone, MEGAsync, and WinSCP to stage and send stolen files. This detection guide covers behavioural Sigma rules, KQL queries, and hunting strategies to catch exfiltration in progress.

Shadow credentials attacks abuse the msDS-KeyCredentialLink Active Directory attribute to add attacker-controlled certificates to a user or computer object, enabling persistent authentication without touching the password. Here's how to detect and hunt them.

Sliver is an open-source C2 framework written in Go, increasingly adopted by ransomware affiliates and APT groups. This detection guide covers named pipe signatures, HTTPS/DNS beacon detection, and memory-side indicators with Sigma rules and KQL.

HTML smuggling (T1027.006) assembles malicious payloads in the browser using JavaScript or HTML5 attributes, bypassing network-layer inspection. Recent campaigns by Gamaredon, Lazarus Group, and commodity phishing kits use XHTML and Blob URL delivery to drop archives or executables without triggering gateway controls. Here's the detection logic.

Windows Data Protection API (DPAPI) is used by browsers, credential managers, and enterprise apps to encrypt stored secrets. Attackers use SharpDPAPI, Mimikatz, and DonPAPI to harvest those secrets without LSASS interaction — bypassing many EDR configurations focused on process injection. This guide covers DPAPI attack paths, the event artefacts they leave behind, and Sigma/KQL detections to surface them.

Adversary-in-the-Middle phishing proxies like Evilginx2 and Modlishka bypass MFA by relaying credentials and capturing session cookies in real time. This guide covers the attack mechanics, Entra ID sign-in log indicators, and Sigma/KQL detections for impossible travel, new device token replay, and suspicious authentication patterns.

Detection guidance for CVE-2026-41089, the pre-authentication Netlogon stack buffer overflow actively exploited against domain controllers. Covers network-layer Suricata rules, Windows event log indicators, and a full Sigma detection for anomalous NRPC traffic and post-exploitation behaviour.

A detection engineering guide to hunting Windows Scheduled Task abuse (T1053.005) with Sigma rules, KQL queries, and event log forensics — covering attacker creation patterns, LOLBin chaining, and persistence mechanisms.

Nation-state actors including APT28, APT29, and Harvester now route C2 traffic through Microsoft Graph API and Outlook — blending malicious activity with legitimate cloud traffic. This guide covers KQL detection rules for Microsoft Sentinel, Sigma rules for endpoint telemetry, and behavioural indicators to hunt for living-off-trusted-services C2.

DCSync abuses Active Directory's legitimate replication mechanism to extract password hashes without touching LSASS. This guide covers the technique, detection logic, and Sigma/KQL rules to catch it in your environment.

Active Directory Certificate Services misconfigurations (ESC1–ESC8) are among the most reliable privilege escalation paths in enterprise environments. This guide covers detection with Windows Event IDs, Sigma rules, and KQL hunting queries.

Adversary-in-the-Middle phishing using reverse proxy kits captures valid post-MFA session tokens — bypassing MFA entirely without breaking it. This guide covers the attack mechanics, Sigma detection rules, and KQL hunting queries for session token replay activity.

OAuth device code flow phishing lets attackers harvest valid MFA-bypassed tokens with no malicious link required. This guide covers the attack mechanics, Sigma rules, KQL queries, and hunting strategies for SOC teams.

NTLM coercion techniques like PetitPotam and DFSCoerce are a reliable Active Directory attack path -- forcing machine accounts to authenticate and then relaying those credentials to take over domain infrastructure. Here's how to detect them.

Detection guidance and Sigma rules for identifying GitHub Actions OIDC token extraction, cache poisoning via pull_request_target, and post-compromise cloud credential use -- the attack chain behind the Mini Shai-Hulud campaign.

WMI event subscriptions are one of the most overlooked persistence mechanisms in Windows environments. This guide covers the three-component model, how attackers abuse it, and the Sysmon and PowerShell detection logic to catch it.

A detection engineer's guide to hunting BITS job misuse (T1197) with Sigma rules, KQL queries, and endpoint telemetry -- covering persistence, download cradles, and C2 staging.

AppDomain Hijacking (T1574.014) abuses the .NET CLR's config-file loading behaviour to execute arbitrary code within trusted processes. This guide covers the mechanics, detection artifacts, and Sigma rules -- recently weaponised by Iranian APT Nimbus Manticore.

Bring Your Own Vulnerable Driver (BYOVD) attacks let ransomware affiliates kill EDR at kernel level. This guide covers detection logic, Sigma rules, and KQL queries to catch BYOVD before your defences are silenced.

Kerberoasting and AS-REP Roasting remain the most reliable paths to privileged AD credentials. This guide covers detection logic with Sigma rules, KQL queries, and hunting approaches for both techniques across Windows Security Event logs.

PowerShell remains one of the most abused tools in the attacker's arsenal. This guide covers the full detection stack -- script block logging, module logging, transcription, AMSI, and Sigma rules for hunting obfuscated and encoded commands.

A threat hunt playbook for detecting LOLBin abuse -- adversaries using native Windows binaries to execute payloads, download files, and evade detection. Covers certutil, mshta, regsvr32, and wscript with Sigma rules and hunting queries.

A hands-on review of Velociraptor for endpoint threat hunting. Covers VQL query language basics, artifact collection, live response, and building custom hunt artifacts for large environments.

A deep dive into C2 beaconing detection using statistical analysis of connection timing and DNS query patterns. Learn how to identify beacon sleep intervals, jitter patterns, and DNS exfiltration using log-based analytics.

Learn to write detection rules in Sigma -- the vendor-neutral rule format for SIEM detections. Covers logsource types, condition syntax, field mappings, and how to test and tune rules before deploying.

A structured threat hunt playbook for identifying lateral movement activity using SMB-based tooling. Covers PsExec, Impacket, WMI execution, and the network and host artifacts each leaves behind.

A practical detection guide for identifying Mimikatz, procdump, and other tools targeting LSASS memory. Covers Sysmon events, Windows Security logs, and Sigma rules you can deploy today.