🧰 Wiz Defend

The items that name it 9

• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeup2026-10-25It is written here as Wiz Defend: detection rules "New Workflow Completed And Deleted In Short Time Span", "Workflow Pushed With Secret Dump" and "Commit Created With Known Malicious Commit Message".
• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
  writeup2026-10-20It is written here as Wiz Defend: raises Wiz Threats on initial logins from Google Workspace logs and on described activity from GCP audit logs.
• Supply Chain Zero Days: Closing the Gap Between Publication and Detection
  article2026-10-19It is written here as Wiz Defend: detection and response product with auto-updated detection rules for malicious packages and configurable runtime detection and response policies.
• Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
  writeup2026-10-19It is written here as Wiz Defend: real-time ingestion of version control, cloud and identity provider logs, built-in threat detection rules, and context-aware grouping that correlates detections into one story.
• Building an AI Detection Engine That Understands Agent Intent
  article2026-09-17

  product offering private preview access to Bedrock invocation logs and AI agent security detection

• Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329
  advisory2026-09-10

  Provides agentless scanning of Artifactory logs for Wiz customers.

• How to Spot and Stop Rogue Device Joins
  writeup2026-08-18

  Provides real-time alerts and detection rules for identity attacks in Entra ID, including device-code phishing and suspicious device registrations

• How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
  writeup2026-08-13

  Includes Threat Detection Rules (TDRs) that detect suspicious and malicious activity across GitHub environments, including techniques from this campaign

• Securing Jenkins: Top Attack Flows & Misconfigurations | Wiz Blog
  article2026-05-06

  Monitors Jenkins workloads and associated service accounts for suspicious and malicious activity