detection engineering
82 posts
Git never deleted your secrets.
How ZCode's AI indexer uploads your entire git history, including deleted secrets, to the cloud, and why DLP and EDR never catch the egress.
The attacker skips your login and steals the cookie
Passkeys defeat credential phishing but not session hijacking. How token replay, passkey enrollment, and weak recovery bypass phishing-resistant MFA.
Keepalive packets bypass Android lockdown
Android NAT-T keepalive offload egresses UDP/4500 below the VPN lockdown firewall, leaking the device's real IP outside the tunnel. Mechanism and detection.
The session that never expired
How attackers held a year-long live feed inside an ID verification vendor via exposed credentials and session persistence, and why telemetry missed it.
MFA protects the login, not the session.
Fastpotify mints unbound session cookies that survive MFA. Stolen via AiTM or infostealer, they replay as full sessions. The telemetry that catches it.
One grep, full repo access
A security camera shipped a full-scope GitHub PAT in its login page bundle. The credential exposure, supply-chain exploit path, GitHub audit-log telemetry, and why rotation - not removal - is the only fix.
Your image parser is a remote kill switch
Codex Micro's unvalidated image upload endpoint decodes attacker-controlled rasters in-band with a check-then-act race, enabling CWE-400/CWE-770 resource exhaustion.
Count Binface breaks your correlation rule
Count Binface names a detection-pipeline attack: targeted noise injection exploits data-aggregation bias to bury true positives and poison UEBA baselines.
tanh now fingerprints your OS
Chromium 148 dispatches Math.tanh to the platform libm, leaking OS identity through last-bit IEEE 754 divergence. A silent, unpatchable fingerprinting signal.
The flat line is the exploit
A flat SOC dashboard can be defense evasion, not a quiet network. How APTs shape telemetry to land in a pipeline's discard paths, and why the graph is the IOC.
XBOW topped HackerOne in 2025 and fixed nothing
Vulnerability research rewards finding, not fixing. Exploitation tracks disclosure, not the flaw. Why attackers react to reported CVEs, and where telemetry goes blind.
The copy runs past the allocation, again
Recurring dystopian tech vulnerabilities persist because defenders patch the CVE instance and never hunt the underlying mechanism. The inaction is the vuln.