DFIR Radar (@DFIR_Radar) on X

What it is

A weekly digest from the @DFIR_Radar account on X, automated by @FS_Alhumaid, dated by the post as covering 23 new and 19 updated detection rules across 6 monitored GitHub repositories. The post names the repositories and the data sources each rule reads, which the catalog summary leaves out.

What to do

Azure and MCP (benscha/KQLAdvancedHunting). The Key Vault rules read the CloudKeyVaultEvents data plane logs. They flag high-volume secret retrieval within 10-minute windows, access from IPs not seen in the past 14 days, and unusual User-Agent plus IP pairs. A separate rule looks for local Azure credential theft in process telemetry: references to azurermcontext.json and msal_token_cache alongside Copy-Item, Robocopy or 7z. Two MCP rules match MCP client User-Agent strings and alert on bulk operations above a threshold, one in Azure DevOps audit logs (ADOAuditLogs) and one in Sentinel UEBA (BehaviorAnalytics). The post does not give the threshold values.

AI agents. Agent-Threat-Rule/agent-threat-rules tightened regexes on tool-argument conditions covering path traversal, shell chaining, SQL injection, sensitive file access and environment extraction. The post says this cut false positives on a benign corpus from 12.8% to 1.06%. Cisco AI Defense analytics now flag prompt injection bursts and PII/PCI leakage in allowed prompts and responses.

AWS CloudTrail. New analytics cover three cases: assume-role escalation through external trust with wildcard entities, repeated EC2 Instance Connect SendSSHPublicKey calls (lateral movement), and EC2 userData modification on stopped instances (persistence).

Sigma (SigmaHQ/sigma). New rules detect registry writes to the AuthorizedApplications key and DoNotAllowExceptions set to 0 under FirewallPolicy. Another flags reg.exe changes that disable Task Manager, Command Prompt and registry editing tools. The ETW evasion rules now match decimal 17 as well as hex 0x11 during Set-EtwTraceProvider execution. They cover both PowerShell script block logs and process command lines, and bind to wevtutil.exe, logman.exe and PowerShell. The post calls the decimal-versus-hex gap a real blind spot, so rules that match only 0x11 may miss it.

Drivers. magicsword-io/LOLDrivers refreshed MD5, SHA1, SHA256 and IMPHASH values in two driver-load monitoring rules for BYOVD.

Email (sublime-security/sublime-rules). One new rule inspects inbound URLs for Microsoft OAuth parameters (offline_access, ctx, sessionId) to catch illicit consent grants on self-service hosting platforms. Another targets fake IRS W-9 lures: PDFs produced by the MuhammaraJS or Hummus-Recipe libraries with OCR-detected IRS references. Brand impersonation rules for FedEx, Evite, MyChart and Google Workspace got updated NLU entity checks, null-safe DMARC parsing and wider regexes. A renamed-binary rule compares ProcessVersionInfoOriginalFileName with signature data for Python, command interpreters and LOLBAS utilities.

The post's own priority order: deploy the Key Vault and MCP User-Agent KQL rules if you run Azure, and pull the updated Sigma ETW rules into your pipeline.

Caveats

The post is an automated summary and contains no rule bodies, queries, file paths or links to individual rules. An engineer has to find them in the named repositories. The 12.8% to 1.06% false-positive figure is reported without a description of the corpus. The post gives no thresholds for the MCP bulk-operation rules.