detection engineering
82 posts
Sanctioned keylogger, unlocked back end
Meta's exposed employee keystroke telemetry is not an AI story. It is a third-party data-handling failure: T1056.001 collection, an unauthenticated store, T1530 read.
There is no free()
Claude Code's extended thinking is not a use-after-free. The real exposure is indirect prompt injection into a tool-holding agent - OWASP LLM01, ATLAS T0051.
A model brute-forced Linear A
A Linear A decipherment claim exposes the lesson defenders miss: complexity is not security, and scaled pattern recognition defeats obscurity.
Google IPv6 crossed 50%, your IPv4 controls didn't follow
Google's IPv6 traffic crossed 50 percent. IPv4-era controls don't see IPv6 - the kernel, NDP, scanning, and telemetry reality for defenders.
Google killed io_uring fleet-wide in 2023
io_uring runs file and network operations off the syscall path, blinding seccomp, auditd, and EDR, while epoll stays observable to defenders.
Social engineering is a misconfiguration
Human error in identity workflows is a misconfiguration, not incompetence - how Scattered Spider, 0ktapus and MFA fatigue exploit the validation gap.
A SQLite underflow, and the flood behind it
AI isn't replacing defenders - it's multiplying vulnerability volume, hallucinated dependencies, and synthetic findings. The skill that survives is validation at machine rate.
AMD's Memory Encryption Blind Spot
AMD re-enables TSME on Ryzen 9000 in July. What it stops, what it never touches, and the physical-attack telemetry gap defenders miss.
MITRE already filed your detection bypass as AML.T0015
ML malware detection is a deterministic classifier with a mappable decision boundary. Attackers exploit its learned bias. That demands more engineering.
DeepSeek dodged the Entity List, not your pipeline
US regulators listed 100+ firms but held off on DeepSeek. The real exposure: third-party AI weights and inference as a trusted security supply chain.
ScStoragePathFromUrl overflows the stack on PROPFIND
CVE-2017-7269 turns an unpatched IIS 6.0 WebDAV server into pre-auth RCE. The exploit primitive, the telemetry blind spot, and the residual exposure.
GrapheneOS Android 17 degrades every exploit primitive
GrapheneOS's Android 17 port: how sync MTE, hardened_malloc, and a hardened kernel degrade mobile exploit chains-and why failed attempts are the loudest telemetry.