33 results for “Sigma”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types33 Repos14 Write-ups10 Articles3 Advisories2 Papers2 Other1 Threads1

“Sigma”

arxiv.orgpaper🧠 AI

Intervention-Certified Amplification: A Validity Gate for $σ$-Weighted Post-Training

Intervention-Certified Amplification (ICA) is a validity gate for sigma-weighted hybrid SFT/RL post-training. The paper shows that DIAA, a per-sample sigma-weighted hybrid, emits unexecuted tool-integrated reasoning on 29% of MATH-500 prompts (three times vanilla GRPO) even with Python fences removed from its anchor. ICA gates sigma with paired-rollout evidence, cutting TIR to 13.8% (frozen) and 11.2% (online) and raising accuracy from 47.5% to 48.7% and 49.3%. It transfers to GSM8K.

GRPOPython

DIAAIntervention-Certified AmplificationMATH-500+2

training, research· Added 27 Oct 2026, published 24 Oct 2026

cisa.govadvisory🛡️ Security

CISA: Critical Vulnerabilities in PHP Require Immediate Patching

CISA alert on CVE-2026-109618 and CVE-2026-109619 ("php2shell"), unauthenticated remote code execution flaws affecting PHP installations serving web requests, including mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updated 23 October 2026 with a Sigma rule, partner advisories (NSA, NCSC-UK, ASD ACSC, NCSC-NL, NCSC-NZ, Cyber Centre) and guidance to inventory PHP, patch internet-facing systems first, and watch for PHP workers spawning shells. No in-the-wild exploitation had been observed.

PHPApachePHP-FPM+3

CVE-2026-109618CVE-2026-109619PHP2Shell+2

AppSec, Blue Team & Detection· Added 24 Oct 2026

github.comrepo🛡️ Security

ikow/php2shell-poc

php2shell-poc is a proof-of-concept and detection toolkit for CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities tied to session.upload_progress handling and a Zend engine out-of-memory bailout path affecting PHP 5.4.0 through 8.5.11. The repository includes three working exploit chains, a Docker-based lab (PHP-FPM, nginx, Apache mod_php) for reproduction, and pre-built Suricata, Sigma, ModSecurity, and Lua detection rules. The author recommends disabling session.upload_progress as an interim mitigation, noting the underlying memory corruption requires a full PHP patch to fix.

PHPWordPressDocker+3

CVE-2026-109618CVE-2026-109619GHSA-w8hw-w9fx-j79w+3

AppSec, Offensive Security, Blue Team & Detection· Added 23 Oct 2026, published 21 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Rounded Gaussians are Discrete Gaussians

Rounded Gaussians are Discrete Gaussians is an IACR ePrint paper (2026/2583) by Corentin Jeudy. It shows that setting the rounded Gaussian parameter to sigma = s - 1/(24s) gives a distribution within Rényi divergence 1 + O(1/s^8) of a discrete Gaussian of parameter s. Lattice schemes can then use the simple, constant-time-friendly, low-memory rounded sampler while analyzing security against an ideal discrete Gaussian.

Rényi divergenceCorentin JeudyHülsing, Lange and Smeets

other· Added 24 Oct 2026, published 21 Oct 2026

github.comrepo🛡️ Security

Show HN: VoidAccess – open-source dark web OSINT, from query to a graph

VoidAccess is a self-hosted, MIT-licensed dark web OSINT platform that runs a 13-step pipeline from a research query to a relationship graph. It collects from Tor indexes, paste sites, code forges, security feeds and .onion seeds, applies content-safety filters, and exports STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV and JSON. It runs as a CLI with SQLite or as a Docker Compose stack with PostgreSQL, FastAPI and Next.js.

TorPythonDocker+3

LockBitSTIX 2.1MISP+6

OSINT, Threat Intel· Added 21 Oct 2026, published 20 Oct 2026

x.comthread🛡️ Security

DFIR Radar (@DFIR_Radar) on X

DFIR_Radar weekly detection engineering digest covering 23 new and 19 updated rules across 6 GitHub repositories. It lists KQL rules for Azure Key Vault secret retrieval, MCP client User-Agent bulk operations and local Azure token theft, AWS CloudTrail analytics, Sigma rules for firewall and ETW tampering (decimal 17 vs hex 0x11), updated LOLDrivers hashes, and Sublime email rules for OAuth consent phishing and fake IRS W-9 PDFs.

KQLSigmaMicrosoft Sentinel+3

BYOVDCisco AI Defensebenscha/KQLAdvancedHunting+7

Blue Team & Detection, Cloud & Infra, AI Security· Added 20 Oct 2026, published 19 Oct 2026

latent.spacearticle🛡️ Security

Crossing the Threshold: How OpenAI and Anthropic Approach Autonomy and Safety in Financial Agents

Recap of AI Engineer New York talks on balancing agent autonomy and safety in financial services. Bloomberg's Andrey Rybka argued for deterministic controls outside the model: scoped credentials, tool-call checks, outbound traffic limits, audit trails, budgets and kill switches. He cited a case where an agent obeyed instructions embedded in a marketplace review. Anthropic described a trust layer of identity and permissions, sandbox and approval, and regression checks, with agents proposing rather than making order amendments. Two Sigma described composable controls, including auto-mode classifiers that escalate only important requests, to avoid approval fatigue. OpenAI framed human-in-the-loop as a product design choice.

ChatGPTClaude

prompt injectionTwo SigmaBloomberg+1

AI Security· Published and added 14 Oct 2026

latent.spacearticle🧠 AI

Crossing the Threshold: How OpenAI and Anthropic Approach Autonomy and Safety in Financial Agents

Latent Space recap of AI Engineer New York keynotes on balancing agent autonomy with safety in finance. OpenAI's Joseph Kim frames human-in-the-loop as a product design decision and predicts agents doing investment idea generation and trading by 2027. Two Sigma's John Feminella describes composable controls such as auto-mode classifiers to avoid approval fatigue. Anthropic's Keon Shahab lays out a trust layer: identity and permissions, sandboxed approval, and regression checks, with agents proposing actions rather than executing them. Bloomberg's Andrey Rybka argues for deterministic controls outside the model: scoped credentials, tool-call checks, audit logs, budgets and kill switches.

ChatGPTClaude

OpenAIAnthropicTwo Sigma+10

agents, ai-policy· Published and added 14 Oct 2026

huntress.comwriteup🛡️ Security

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Huntress documents active exploitation of two AhsayCBS (Ahsay Cloud Backup Server) vulnerabilities being chained together: CVE-2026-105133, an authentication bypass in checkSysPwd, and CVE-2026-105134, an unauthenticated RCE in the Replication Receiver's UpdateReceivers.do endpoint that grants SYSTEM. Attackers use the chain to drop JSP webshells, then deploy a renamed XMRig cryptominer (masquerading as msedge.exe via a modified NSSM binary), a Task-Manager-aware anti-detection PowerShell script, and the vulnerable WinRing0x64.sys kernel driver for hardware-level miner access. Huntress provides IOCs, mitigation guidance (restrict management interface, re-image if compromised) and four Sigma rules targeting each stage of the intrusion chain.

AhsayCBSXMRigSigma+3

CVE-2026-105133CVE-2026-105134WinRing0x64.sys+2

Threat Intel, Blue Team & Detection, AppSec· Added 9 Oct 2026, published 8 Oct 2026

github.comrepo🛡️ Security

Sigma r2026-07-01 — 20 new detection rules

GitHub release notes for Sigma r2026-07-01, the open-source detection-rule repository, adding 20 new rules (e.g. LSASS crash via Netlogon buffer overflow CVE-2026-41089, TanStack supply-chain attack indicators for Windows/Linux, RedTail cryptominer user-agent detection, AF_ALG kernel crypto API exploit indicator) and updating/fixing dozens of existing rules for ARM64 binary variants, file-sharing domain IOCs, and WMI-based reconnaissance/persistence detection. It's a routine but substantive update to a widely-used blue-team detection content pack.

SigmaWMISysmon+3

CVE-2026-41089RedTail

Blue Team & Detection, Supply Chain· Added 3 Oct 2026

github.comrepo🛡️ Security

jiwoochris/artex-global

ARTEX global edition is an English-default fork of the Chinese open-source ARTEX (AGPL-3.0), an autonomous penetration-testing system in which planner and worker LLM agents run real tools and record results in an asset graph and an exploration graph on PostgreSQL. It also ships a defense guide, Sigma and Suricata rules, an ATT&CK Navigator layer, MISP indicators and a host triage script for spotting ARTEX-driven attacks.

ARTEXGoNext.js+3

KISAPIPCAct on Promotion of Information and Communications Network Utilization and Information Protection+2

AI Security, Offensive Security, Blue Team & Detection· Added 31 Oct 2026, published 3 Oct 2026

github.comrepo🛡️ Security

CAIRN — Cisco Talos AI-Malware-Hunting Toolkit

CAIRN is a Cisco Talos research toolkit that identifies and attributes AI-integrated malware purely from VirusTotal metadata — no binary downloads or detonation — by running a tiered YARA ontology (T1/T2/T3) over composed scan text (AV strings, PE resources, Sigma/sandbox behavioral data, embedded URLs) and layering on sentence-transformer embeddings with HDBSCAN clustering for semantic family attribution. It has produced confirmed family reports for AI-malware such as PROMPTLOCK, LAMEHUG, PROMPTSTEAL, QUIETVAULT, CLOSEDQUORUM, and FRUITSHELL, each cross-verified by hands-on Talos reverse engineering before publication.

VirusTotalYARASQLite+2

PROMPTLOCKHONESTCUEPROMPTFLUX+7

AI Security, Threat Intel, Malware & RE· Added 30 Sep 2026

cisa.govadvisory🛡️ Security

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

CISA alert amplifying Citrix's disclosure of ten NetScaler ADC and Gateway vulnerabilities (CVE-2026-88771 to CVE-2026-88779 and CVE-2026-107406). CVE-2026-88771 and CVE-2026-88772 are critical zero-days enabling independent remote code execution and are exploited globally; CVE-2026-88779 is a SAML SP/IdP denial-of-service that can force a reboot to trigger code injected via CVE-2026-88771. It advises checking for compromise before patching, preserving forensic evidence, forwarding logs to a SIEM, restoring a pre-compromise backup and rotating all secrets, and links a CISA SIGMA detection rule.

Citrix NetScalerSIEMSigma

CVE-2026-88771CVE-2026-88772CVE-2026-88773+9

Threat Intel, Blue Team & Detection· Added 28 Sep 2026

github.comrepo🛡️ Security

Adversarial-Detection-Engineering/adeskills

adeskills is a working knowledge base for "Adversarial Detection Engineering" (ADE), a taxonomy of four categories and 16 subcategories of detection-logic bugs (e.g. Reformatting in Actions, Omit Alternatives, Context Development, Logic Manipulation) that explain why a SIEM/EDR/XDR rule fails to catch what it intends to. It ships 38 worked technique files with vulnerable/hardened rule examples and detection-layer guidance, a cross-platform bug-pattern catalog, a pre-engagement scoping checklist, and a Redamon-packaged skill (ade_scoper), all grounded in analysis of real public rulesets from Sigma, Elastic Security, and Microsoft Sentinel. It's explicitly scoped for defensive detection engineering and purple-team rule hardening, with several files documenting real vendor-rule weaknesses.

SigmaMicrosoft SentinelElastic Security+3

Nikolas BielskiDaniel Koifman

Blue Team & Detection· Added 2 Oct 2026, published 27 Sep 2026

github.comrepo🛡️ Security

Agent Threat Rules (ATR) — open detection-rule standard for AI agent threats

Agent Threat Rules (ATR) is an open, versioned YAML rule format (ATR-YYYY-NNNNN scheme) for detecting AI-agent runtime threats — prompt injection, tool-poisoning, malicious SKILL.md content, and MCP exchange abuse — evaluated by a reference TypeScript engine (with a Python wrapper) shipped as an npm/pip package, CLI, GitHub Action, and Docker scanner with SARIF output. The project positions itself as "Sigma for agent threats," maps rules to OWASP Agentic/LLM Top 10, MITRE ATLAS, and NIST AI RMF, and publishes an extensive (and unusually self-critical) benchmark suite against corpora like garak, PromptBench, and PromptInject, including documented harness bugs and withdrawn recall figures.

Model Context ProtocolnpmTypeScript+3

CVE-2026-26030CVE-2026-25592OWASP Top 10 for Agentic Applications+2

AI Security· Added 26 Sep 2026

agentthreatrule.orgother🛡️ Security

Agent Threat Rules (ATR) — Sigma/YARA-style open detection format for AI agent threats

Agent Threat Rules (ATR) is an open, versioned YAML rule format for detecting AI-agent security threats — prompt injection, tool poisoning, credential exfiltration, unauthenticated agent execution — positioned as "what Sigma is to SIEM and YARA is to malware." Rules carry permanent ATR-YYYY-NNNNN IDs, declare detection conditions against fields like LLM I/O, tool-call args, or SKILL.md content, and map back to OWASP Agentic/LLM Top 10, MITRE ATLAS, SAFE-MCP, and NIST AI RMF; a reference TypeScript engine and Python wrapper ship MIT-licensed. Governance is transitioning from a single BDFL maintainer to a Technical Steering Committee, and the spec is notably transparent about its own limits, withdrawing previously published per-lane false-positive figures after discovering a tainted benign corpus.

SigmaYARAMITRE ATLAS+3

OWASP Top 10 for LLM ApplicationsOWASP Top 10 for Agentic ApplicationsNIST AI RMF+2

AI Security, Blue Team & Detection· Added 26 Sep 2026

huntress.comwriteup🛡️ Security

OAuth Token Theft Through Microsoft's Front Door | Huntress

Huntress researcher Andrew Schwartz demonstrates a novel OAuth token-theft technique: a sideloaded AppX package registered via Add-AppxPackage -Register (requiring only Developer Mode, no admin beyond that toggle) can set ContentUriRules WindowsRuntimeAccess="all" so attacker-controlled JavaScript rendered inside the Microsoft-signed WWAHost.exe process gets full WinRT access, including the legacy WebAuthenticationBroker OAuth API. Using Microsoft Office's own client ID and the oob redirect URI, the attacker triggers a genuine login.microsoftonline.com/MFA dialog with no browser chrome, captures the auth code, and exchanges it for an access token plus a long-lived refresh token carrying the full Office delegated Graph scope set (mail, files, Teams, directory, AuditLog.Create) — validated end-to-end against a live Entra ID tenant with MFA and default Conditional Access. The post frames it as a class of vulnerable signed AppX host binaries sharing the same WinRT activation layer, and provides a Sigma rule keyed on the MSAppHost/3.0 EdgeHTML user agent reaching non-Microsoft destinations, plus Sysmon/Event ID and GPO-based mitigations (restricting Developer Mode, Conditional Access, shorter refresh-token lifetimes, CAE).

WindowsOAuthMicrosoft Entra ID+4

WWAHost.exeWebAuthenticationBrokeraskWAM+8

Identity & Access, Offensive Security, Blue Team & Detection· Published and added 23 Sep 2026

huntress.comwriteup🛡️ Security

DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer

Huntress details a 2026 DarkMe RAT campaign that ditches the zero-days (CVE-2023-38831, CVE-2024-21412) previously used by the Water Hydra/EvilNum-linked group in favor of a plain phishing email delivering a disguised .pif file. The writeup reverse-engineers the full chain — msiexec pulling a wrapped MSI, a WSF stager, three obfuscated VB6 loader DLLs (Coconout.dll, Use.dll, Finalized.dll), a novel 329-app "inverted sandbox" gate, process hollowing into a signed clspack.exe, and Locked:// protocol-handler persistence — and corrects prior public reporting by showing the payload's "single-byte XOR" is actually a broken RC4 implementation. It closes with fresh C2 infrastructure (thatawful[.]boutique, port 7712), OSINT on delivery domains (including a related ClickFix/Efimer campaign), and concrete Sigma-style hunting rules and remediation steps.

WindowsHuntressVirusTotal+4

CVE-2023-38831CVE-2024-21412DarkMe+9

Malware & RE, Threat Intel, Blue Team & Detection· Added 23 Sep 2026, published 22 Sep 2026

github.comrepo🛡️ Security

ThreatIntel-Aggregator

ThreatIntel-Aggregator is a self-hosted FastAPI/Next.js platform that polls 60+ tiered security RSS feeds (CISA, Talos, Unit42, etc.), runs AI triage to score severity and tag MITRE ATT&CK TTPs, extracts IOCs/CVEs, and correlates findings against a RunZero asset inventory to surface org-level exposure. Its Detections module goes further: it catalogs AI-generated or locally-imported detection rules (KQL/Sigma/YARA/Suricata/SPL), statically validates them, runs AI-driven MITRE alignment checks against technique coverage, tracks detection "rot," and can sync Hunts/Analytics Rules to a live Microsoft Sentinel workspace. It's designed to run standalone with zero cloud dependency or fully integrated with Azure/Entra/Sentinel, with all storage in Postgres and auth via Entra SSO or a local API key.

Microsoft SentinelMITRE ATT&CKKQL+3

CISA KEV

Threat Intel, Blue Team & Detection· Added 22 Sep 2026, published 17 Sep 2026

github.comrepo🛡️ Security

DeathShotXD/0xCr0ssCrush

Research project on two signed vulnerable Windows drivers, DCRCVDrv.sys (MOCOMSYS) and Alinubx.sys (CnCrypt), abused by the Cruciferra MaaS loader to kill AV/EDR processes. It documents their devices, IOCTLs (0x2205C0, 0x222024) and the termination chain (ObOpenObjectByPointer -> ZwTerminateProcess), and gives annotated disassembly, hash-level sample provenance and blocklist-status snapshots. It includes a Rust lab harness with hash validation and dry-run, plus Sigma, YARA and telemetry guidance. Findings carry evidence labels, and the test matrix is limited to Windows 11 24H2 with HVCI disabled.

WindowsRustSigma+2

BYOVDCruciferraDCRCVDrv.sys+7

Malware & RE, Blue Team & Detection, Offensive Security· Added 11 Oct 2026, published 14 Sep 2026

github.comrepo🛡️ Security

SiberKapan

SiberKapan is a Turkey-focused, community-driven open-source threat intelligence platform that aggregates data from FortiGate webhooks, an 11-service honeypot (HoneypotKapan), nginx/Fail2ban log watchers, and external feeds, publishing it as STIX 2.1/TAXII 2.1, a MISP default feed, Sigma/Suricata/Wazuh exports, and REST blocklists. It also runs a real-time phishing/domain-squatting detector via Certificate Transparency log monitoring with fuzzy typosquat and Punycode/IDN decoding, and safely fingerprints SSH-honeypot malware downloads with SSRF-protected, never-executed hashing enriched via MalwareBazaar. The write-up details concrete anti-abuse safeguards: time-based IP score decay, CDN/cloud-proxy allowlisting, UDP-spoofing exclusion, RFC1918 rejection, and manual review gating for weak phishing signals.

MISPFortiGateSuricata+3

CISA KEVAbuseIPDBMalwareBazaar+1

Threat Intel, Blue Team & Detection· Published and added 8 Aug 2026

huntress.comwriteup🛡️ Security

It’s Not Safe To Pay SafePa

Huntress details two firsthand incident-response engagements against SafePay, a closed (non-RaaS) double-extortion ransomware group active since late 2024 that has claimed 270+ victims in 2025. The writeup covers the intrusion chains (RDP access, Defender disabling via LOLBins, ShareFinder.ps1 share discovery, WinRAR/FileZilla staging and exfiltration, regsvr32-loaded locker.dll encryption), reverse-engineers the ransomware binary showing heavy code overlap with leaked LockBit Black source (including a Cyrillic-language kill switch, XOR string obfuscation, token impersonation via DuplicateToken/ZwSetThreadInformation, and custom anti-analysis thread creation), and provides Sigma detection rules for Defender-tampering-via-GUI and the CMSTPLUA/ICMLuaUtil COM UAC bypass technique.

PowerShellRDPWinRAR+3

SafePayLockBit BlackINC ransomware+3

Threat Intel, Malware & RE, Blue Team & Detection· Added 3 Sep 2026, published 17 Jul 2026

github.comrepo🛡️ Security

awesome-ai-security-tools

An extensive, actively updated awesome-list aggregating public-source, research, and commercial tools for AI security and AI-assisted cybersecurity. It spans LLM-driven finding triage (nuclei-autotriage, SigmaOptimizer), securing AI coding agents and MCP/skill ecosystems (agent-audit, SkillSpector, Ramparts, ToolHive, Pipelock), AI/ML supply-chain and model-artifact scanning (modelscan, Fickling, GuardDog, Adversarial Robustness Toolbox), and autonomous pentest/exploit agents (PentestGPT, PentAGI, Strix, CAI). Each entry includes stars, license notes, and cross-references, making it a practical index for the fast-moving 2026 agentic-AI-security tooling landscape.

Model Context ProtocolClaude CodeOpenClaw+2

MITRE ATT&CKMITRE ATLASNIST AI RMF+2

AI Security, Supply Chain, Offensive Security· Published and added 11 Jul 2026

github.comrepo🛡️ Security

XORCISM-AI/XORCISM

XORCISM is a self-hosted, open-source enterprise risk/exposure management platform (Node.js/TypeScript over SQLite/PostgreSQL/MySQL) that unifies asset inventory, vulnerability management, threat intel (STIX/TAXII), GRC (ISO 27001, NIST CSF/800-53, EBIOS Risk Manager, NIS2, DORA), incident management, and offensive/defensive testing into one continuously recomputed per-asset and enterprise risk score. It chains recon/exploitation tool connectors (nmap, nuclei, Metasploit, sqlmap) into attack-path/choke-point graphs weighted by fusion exploitability (EPSS+CVSS+KEV+public exploits), validates detection coverage via a purple-team loop against 3,750+ Sigma rules and MITRE ATT&CK/D3FEND, and quantifies ransomware impact in dollar terms via a FAIR-style model — with local-only Ollama AI assistants for triage, hunting, and reporting.

Node.jsTypeScriptSQLite+3

APT29SecureCodersRustinel

GRC, Offensive Security, Blue Team & Detection· Published and added 1 Jul 2026

github.comrepo🛡️ Security

mukul975/Anthropic-Cybersecurity-Skills

A community-maintained GitHub repo providing 818 structured, YAML-frontmatter skill files (e.g. Volatility3 memory forensics, Kerberoasting hunting, cloud breach scoping) that AI coding agents like Claude Code, GitHub Copilot, or Cursor can load to follow senior-analyst-level security workflows. Each skill is mapped against MITRE ATT&CK v19.1, MITRE ATLAS, MITRE D3FEND, NIST CSF 2.0, NIST AI RMF, and the newly released MITRE Fight Fraud Framework (F3), and follows the agentskills.io progressive-disclosure standard for token-efficient agent discovery. Covers offensive (red-team C2, phishing simulation, exploitation), defensive (DFIR, threat hunting, Sigma detections), cloud, and AI-security domains.

MITRE ATT&CKMITRE ATLASNIST CSF+3

NIST AI RMFMITRE D3FENDMITRE Fight Fraud Framework+2

Blue Team & Detection, Offensive Security, AI Security· Published and added 26 May 2026

github.comrepo🛡️ Security

0xMohammedHassan/morphkatz

MorphKatz is a static C++20 Windows x64 tool that rewrites PE binaries and raw shellcode into semantically identical but byte-different variants using a Zydis-powered CFG-aware disassembler/encoder, YAML rewrite rules, and EFLAGS liveness tracking. It targets two audiences: detection engineers who can measure what percentage of their YARA/Defender/Elastic/Sigma rules survive N polymorphic variants (--variants, --target, --bisect against a live Defender via MpCmdRun), and authorized red-teamers who need reproducible, seed-based, rule-cited evasion runs with JSON/HTML diff reports for engagement deliverables. It explicitly excludes ML-behavioral evasion and live pop-malware obfuscation, restricting mutations to author-audited, semantically-proven equivalence rules.

WindowsYARASigma+3

HackTool:Win32/AmDisable!MTB

Blue Team & Detection, Offensive Security, Malware & RE· Published and added 7 May 2026

huntress.comwriteup🛡️ Security

Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)

Huntress details active exploitation of SolarWinds Web Help Desk deserialization vulnerabilities (CVE-2025-26399, plus CVE-2025-40551 which is in CISA KEV, and CVE-2025-40536) across three customer intrusions, tracing an attack chain from wrapper.exe/java.exe spawning silent MSI installs of Zoho Assist, through Velociraptor abused as a C2 framework, a Cloudflare Workers/mooo.com HTTP-406-triggered C2 failover mechanism, Get-ComputerInfo exfiltration to an attacker-run Elastic Cloud instance, Windows Defender/Firewall disabling via registry edits, and QEMU-based SSH backdoor persistence via a "TPMProfiler" scheduled task. It provides mitigation guidance (patch to WHD 2026.1, remove admin interface from the internet, reset credentials) and links to Sigma detection rules.

SolarWinds Web Help DeskVelociraptorCloudflare Workers+3

CVE-2025-26399CVE-2025-40551CVE-2025-40536+4

Threat Intel, Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 8 Feb 2026

huntress.comwriteup🛡️ Security

The (!FALSE) Pattern | Huntress

Part four of Huntress's LDAP/AD detection series shows that querying a non-existent LDAP attribute with negation (e.g., SOAPHound's hardcoded (!soaphound=*) filter) gets optimized by Active Directory's LDAP engine into (! (FALSE)) before it is written to Event ID 1644, erasing the tool's signature from logs. The author verifies this is universal AD behavior (not SOAPHound-specific), correlates it with SOAPHound's SDFlags:0x7 server control and its ADWS/port-9389 localhost proxying behavior, and publishes two Sigma rules combining the (! (FALSE)) pattern, attribute lists, and SDFlags for high-fidelity detection.

Active DirectoryLDAPSOAPHound+3

FalconForceEvent 1644SDFlags+2

Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 29 Jan 2026

huntress.comarticle🛡️ Security

SDFlags | Huntress

Part three of Huntress's LDAP/Active Directory detection series explains the SDFlags LDAP control (bitmask values 0x1/0x2/0x4/0x8 for Owner/Group/DACL/SACL) that SharpHound must use when querying the nTSecurityDescriptor attribute to avoid failing silently due to SACL read permissions. The author shows via lab testing and Event ID 1644 log analysis that legitimate admin tools almost never use SDFlags, while SharpHound consistently sets SDFlags=0x4 for general object enumeration and 0x5 (Owner+DACL) for group and certificate template enumeration, making the combination of mass enumeration + nTSecurityDescriptor + SDFlags a high-fidelity signal for BloodHound-style attack-path discovery. It concludes with a Sigma detection rule (ECS field names) targeting SDFlags=0x5 group enumeration and references SharpHoundCommon's LdapConnectionPool.cs source code confirming the behavior.

Active DirectoryLDAPBloodHound+3

Event 1644SDFlagsNasreddine Bencherchali

Blue Team & Detection· Added 3 Sep 2026, published 15 Jan 2026

huntress.comwriteup🛡️ Security

ESXi Exploitation in the Wild

Huntress details a December 2025 intrusion where a threat actor, after gaining initial access via a compromised SonicWall VPN and Domain Admin credentials, deployed a full ESXi VM-escape toolkit against a domain controller's ESXi host. The toolkit — orchestrator "MAESTRO" (exploit.exe), kernel driver "MyDriver.sys" loaded via KDU (BYOVD), and VSOCK-based backdoor "VSOCKpuppet" — chains CVE-2025-22226 (HGFS out-of-bounds read info leak), CVE-2025-22224 (VMCI TOCTOU out-of-bounds write, VMX code execution) and CVE-2025-22225 (arbitrary write sandbox escape) to defeat ASLR and pivot from a guest VM to full hypervisor compromise, supporting 155 ESXi builds (5.1–8.0). Simplified-Chinese PDB paths dated over a year before VMware's public disclosure point to a well-resourced developer, likely Chinese-speaking, possibly building this as a sellable zero-day toolkit; Huntress provides YARA/Sigma detections and hardening recommendations.

VMware ESXiSonicWallImpacket+6

CVE-2025-22224CVE-2025-22225CVE-2025-22226+4

Malware & RE, Threat Intel, Cloud & Infra· Added 3 Sep 2026, published 7 Jan 2026

huntress.comwriteup🛡️ Security

The LDAP Whitespace Problem | Huntress

Part two of a Huntress detection-engineering series showing that Windows Event 1644 logs LDAP filters from Active Directory's LDAP Service Layer with inconsistent, undocumented whitespace around bitwise operators, causing naive Sigma rules for Impacket tools like findDelegation.py to fire only ~30% of the time. The author walks through iterating from exact-string matches to whitespace-tolerant, case-insensitive regex (e.g. `.*userAccountControl\s*&\s*524288.*`), a pre-filter-then-regex pattern for SIEM performance, and a final production Sigma rule combining userAccountControl bitwise checks, requested-attribute lists, and source-IP filtering to reliably catch RBCD/delegation abuse.

ImpacketActive DirectoryLDAP+2

Event 1644findDelegation.py

Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 30 Dec 2025

huntress.comwriteup🛡️ Security

The OID Problem: Writing LDAP Detections That Actually Work

A Huntress detection engineer explains why naive LDAP Sigma rules for Impacket recon tools (GetADUsers.py, GetADComputers.py, GetNPUsers.py, GetUserSPNs.py, findDelegation.py, secretsdump.py) never fire: Active Directory silently transforms LDAP extended-matching-rule OIDs like 1.2.840.113556.1.4.803 into bitwise operators (&) before writing them to Event ID 1644, so rules searching for the OID string in logs get zero hits. The post walks through a source-code-to-telemetry methodology (analyze Impacket source, run tools in a lab, inspect Event 1644/Event 30, then write and validate Sigma rules) and ships working detection logic for each tool, plus notes on correlating server-side Event 1644 with client-side Event 30 (wldap32.dll tools only) for attribution.

ImpacketActive DirectorySigma+3

Event 1644Event 301.2.840.113556.1.4.803+2

Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 16 Dec 2025

0xv1n.github.iowriteup🛡️ Security

PrivEsc: Abusing the Service Control Manager for Stealthy & Persistent LPE

Walkthrough of a Windows privilege escalation and persistence technique credited to Grzegorz Tworek: from a compromised admin account, running `sc.exe sdset scmanager D:(A;;KA;;;WD)` grants the Everyone group full control over the Service Control Manager, letting any non-privileged user create a SYSTEM-context service (e.g. one that adds their account to local Administrators) that persists across reboots even if admin rights or the service are later removed. The post breaks down the SDDL security-descriptor syntax used in the command and provides a Sigma rule to detect the sdset DACL modification via process-creation logs.

WindowsSigmaPowerShell

Grzegorz Tworek

Offensive Security, Blue Team & Detection· Added 3 Sep 2026, published 27 Feb 2023