detection engineering
79 posts
Not a pricing problem
Why security automation like Splunk SOAR and ML triage costs more than the engineer it replaced: systems execute on referenced trust, not verification.
Vectra lifted bearer tokens off Teams disk
Why Microsoft Teams session tokens leak between workspace and consumer accounts, how bearer-token replay bypasses MFA, and what fires - and doesn't - in telemetry.
dd writes raw sectors below the filesystem
Why the Unix dd command is a real security primitive: raw block writes below the filesystem, wiper TTPs, exfiltration, and the telemetry gap defenders miss.
htop is a reconnaissance surface
How htop and top expose Linux resource contention - OOM-killer steering, D-state telemetry gaps, niced miners, and PID exhaustion mapped to MITRE T1562 and T1499.
Alibaba bans Claude Code across its engineering org
Alibaba's reported ban on Claude Code is a trust decision, not a CVE. Why an agentic coding tool's sanctioned egress is also its exfiltration path.
Locale decides the payload
The en-GB locale isn't a vulnerability - it's a selector. How attackers use Accept-Language and OS locale checks to filter delivery and gate detonation.
Spain rips Palantir out of its data pipelines
Spain's Palantir blacklist is a supply chain concentration risk - a privileged vendor data plane mapped to MITRE T1199, and why customer telemetry stays blind.
Log4Shell executed exactly as written
Log4Shell, xz-utils, and Spring4Shell weren't isolated bugs. They were composition failures in systems too deep for anyone to fully read. The disease is complexity.
Read the mark hidden in your bot's requests
Steganographic request marking as a targeted reconnaissance primitive: how invisible-Unicode carriers survive into logs and why SIEM normalization goes blind.
Schrems II broke US data transfers, July 2020
Schrems II (CJEU C-311/18) makes US-hosted EDR telemetry on EU endpoints a restricted transfer. Why data residency now degrades detection fidelity.
#gerpar trended this week; PartitionAlloc already answers it
A. Shah (REDLINE) tests the trending #gerpar Chromium heap-overflow claim against PartitionAlloc, CFI, the V8 sandbox, and renderer isolation.
Mythos AI cleared for distribution, no validation report
REDLINE breaks down the security risk in releasing Mythos AI to trusted US organizations: not the model, the missing adversarial validation and zero prompt-level telemetry.