https://df00tech.com/detections/blog Detection engineering insights, MITRE ATT&CK guides, and KQL/SPL threat hunting tutorials for SOC analysts and security teams. en-us Thu, 23 Jul 2026 09:39:57 GMT https://df00tech.com/detections/blog/cve-2026-50522 https://df00tech.com/detections/blog/cve-2026-50522 Thu, 23 Jul 2026 09:39:57 GMT CVE-2026-50522 is a CISA KEV-listed deserialization flaw (CWE-502) in Microsoft SharePoint enabling RCE via crafted serialized payloads, actively exploited in the wild. Our detection spans Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel Microsoft CVE-2026-50522 https://df00tech.com/detections/blog/cve-2026-16232 https://df00tech.com/detections/blog/cve-2026-16232 Thu, 23 Jul 2026 09:39:53 GMT CVE-2026-16232 is a KEV-listed authentication bypass in Check Point SmartConsole (CWE-287) that lets attackers access management sessions without valid credentials. We cover detection across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel Check Point CVE-2026-16232 https://df00tech.com/detections/blog/cve-2026-54052 https://df00tech.com/detections/blog/cve-2026-54052 Thu, 23 Jul 2026 09:39:50 GMT CVE-2026-54052 is a critical (CVSS 9.9) authorization bypass in n8n-mcp <= 2.56.0 that lets attackers read other tenants' workflow backups, potentially exposing embedded credentials and secrets. A public PoC exists and no patch is currently available. vuln-intel npm CVE-2026-54052 https://df00tech.com/detections/blog/cve-2026-0770 https://df00tech.com/detections/blog/cve-2026-0770 Wed, 22 Jul 2026 09:54:33 GMT CVE-2026-0770 is a KEV-listed, actively exploited flaw in Langflow that lets attackers trigger execution of untrusted components. Our detection catches it via anomalous outbound connections, child process spawns, and untrusted calls to flow-execution endpoints. vuln-intel Langflow CVE-2026-0770 https://df00tech.com/detections/blog/cve-2021-27137 https://df00tech.com/detections/blog/cve-2021-27137 Wed, 22 Jul 2026 09:54:31 GMT CVE-2021-27137 is a KEV-listed stack-based buffer overflow in DD-WRT's web management interface enabling RCE or DoS. Our detection covers abnormal HTTP requests, httpd crashes, and post-exploitation IoT segment activity across seven SIEM platforms. vuln-intel DD-WRT CVE-2021-27137 https://df00tech.com/detections/blog/cve-2026-60137 https://df00tech.com/detections/blog/cve-2026-60137 Wed, 22 Jul 2026 09:54:30 GMT CVE-2026-60137 is a CISA KEV-listed SQL injection vulnerability in WordPress Core, actively exploited in the wild against wp-admin, wp-json, and xmlrpc.php. WordPress 7.0.2 patches the flaw; our detection ships across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel WordPress CVE-2026-60137 https://df00tech.com/detections/blog/cve-2026-50566 https://df00tech.com/detections/blog/cve-2026-50566 Tue, 21 Jul 2026 10:25:19 GMT A critical (CVSS 9.9) flaw in Fission <= 1.23.0 lets attackers with Environment/Function access bypass SecurityContext hardening and deploy privileged pods, risking node or cluster compromise. PoC is public. vuln-intel go CVE-2026-50566 https://df00tech.com/detections/blog/cve-2026-44935-3 https://df00tech.com/detections/blog/cve-2026-44935-3 Tue, 21 Jul 2026 10:25:15 GMT CVE-2026-44935 (CVSS 9.9) lets low-privileged users in Rancher Fleet exfiltrate Secrets/ConfigMaps from arbitrary namespaces via unvalidated Helm valuesFrom references. A public PoC exists; see our KQL, SPL, and other SIEM detections for exploitation attempts. vuln-intel go CVE-2026-44935 https://df00tech.com/detections/blog/cve-2026-52831 https://df00tech.com/detections/blog/cve-2026-52831 Tue, 21 Jul 2026 10:25:10 GMT CVE-2026-52831 is a critical (CVSS 10.0) command injection flaw in Nuclio's cron trigger handling that allows unauthenticated RCE via unsanitized event headers/body. A public PoC exists; our detection covers seven SIEMs, watching for shell metacharacter injection and anomalous CronJob-spawned proces vuln-intel go CVE-2026-52831 https://df00tech.com/detections/blog/cve-2026-48939 https://df00tech.com/detections/blog/cve-2026-48939 Mon, 20 Jul 2026 10:02:05 GMT CVE-2026-48939 is a KEV-listed unrestricted file upload flaw in Joomla's iCagenda component enabling web shell uploads and RCE; our detection covers the exploitation pattern across KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel iCagenda CVE-2026-48939 https://df00tech.com/detections/blog/detecting-web-shells-t1505-003-kql-spl-iis-apache-tomcat https://df00tech.com/detections/blog/detecting-web-shells-t1505-003-kql-spl-iis-apache-tomcat Mon, 20 Jul 2026 09:04:28 GMT Web shells give attackers persistent, hands-on-keyboard access to compromised web servers. Learn to detect T1505.003 with practical KQL and SPL queries covering process lineage, webroot file writes, and IIS access-log anomalies. Detection Engineering https://df00tech.com/detections/blog/cve-2026-50564 https://df00tech.com/detections/blog/cve-2026-50564 Sat, 18 Jul 2026 09:49:00 GMT CVE-2026-50564 (CVSS 9.9) lets Fission Environment CRD authors inject privileged, host-namespace PodSpec fields into builder/executor pods, enabling node compromise in multi-tenant clusters. A public PoC exists; df00tech ships detection across KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and Cr vuln-intel go CVE-2026-50564 https://df00tech.com/detections/blog/cve-2026-50551 https://df00tech.com/detections/blog/cve-2026-50551 Sat, 18 Jul 2026 09:48:56 GMT CVE-2026-50551 is a critical (CVSS 9.9) stored XSS-to-RCE chain in SiYuan's kernel via unsanitized attribute view asset cells, with a public PoC available. Our detection covers the injection, API abuse, and post-exploitation stages across seven SIEM platforms. vuln-intel go CVE-2026-50551 https://df00tech.com/detections/blog/cve-2026-25089 https://df00tech.com/detections/blog/cve-2026-25089 Sat, 18 Jul 2026 09:48:55 GMT CVE-2026-25089 is a KEV-listed OS command injection flaw in Fortinet FortiSandbox enabling arbitrary command execution. We cover detection across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel Fortinet CVE-2026-25089 https://df00tech.com/detections/blog/cve-2026-39808 https://df00tech.com/detections/blog/cve-2026-39808 Fri, 17 Jul 2026 10:17:34 GMT CVE-2026-39808 is a KEV-listed OS command injection flaw in Fortinet FortiSandbox's management interface. Our detection catches it via anomalous process execution and shell-metacharacter requests across KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel Fortinet CVE-2026-39808 https://df00tech.com/detections/blog/cve-2026-58644 https://df00tech.com/detections/blog/cve-2026-58644 Fri, 17 Jul 2026 10:17:33 GMT CVE-2026-58644 is a KEV-listed deserialization flaw in Microsoft SharePoint enabling remote code execution. Our detections cover post-exploitation indicators like w3wp.exe anomalies, webshell drops, and LSASS access across seven SIEM platforms. vuln-intel Microsoft CVE-2026-58644 https://df00tech.com/detections/blog/cve-2026-45262 https://df00tech.com/detections/blog/cve-2026-45262 Fri, 17 Jul 2026 10:17:31 GMT CVE-2026-45262 is a critical (CVSS 9.9) authenticated SQL injection in FacturaScripts's REST API filter parameter, with public PoC code and potential for SSRF-driven database host compromise. We ship detection coverage across seven major SIEM platforms. vuln-intel composer CVE-2026-45262 https://df00tech.com/detections/blog/cve-2026-56291 https://df00tech.com/detections/blog/cve-2026-56291 Thu, 16 Jul 2026 23:17:00 GMT CVE-2026-56291 is a KEV-listed unrestricted file upload flaw in Balbooa Forms for Joomla, letting attackers upload web shells for RCE. Our detection ships across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel Balbooa CVE-2026-56291 https://df00tech.com/detections/blog/cve-2023-4346 https://df00tech.com/detections/blog/cve-2023-4346 Thu, 16 Jul 2026 23:16:59 GMT CVE-2023-4346, a CISA KEV-listed flaw in KNX's connection authorization lockout, lets attackers brute-force building automation access keys. Our KQL, SPL, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike detections flag the repeated failed auth attempts that reveal it. vuln-intel KNX Association CVE-2023-4346 https://df00tech.com/detections/blog/cve-2026-15409 https://df00tech.com/detections/blog/cve-2026-15409 Thu, 16 Jul 2026 23:16:58 GMT CVE-2026-15409 is a KEV-listed SSRF flaw in SonicWall SMA1000 appliances letting attackers pivot into internal networks and cloud metadata. Our detection catches it via SIEM correlation of anomalous outbound requests across seven platforms. vuln-intel SonicWall CVE-2026-15409 https://df00tech.com/detections/blog/cve-2026-46817 https://df00tech.com/detections/blog/cve-2026-46817 Thu, 16 Jul 2026 23:15:10 GMT CVE-2026-46817, a CISA KEV-listed privilege escalation flaw in Oracle E-Business Suite, enables authentication bypass and escalation to APPS/SYSADMIN roles. df00tech ships detections across Sentinel, Splunk, Elastic, QRadar, Sumo Logic, Chronicle, and CrowdStrike. vuln-intel Oracle CVE-2026-46817 https://df00tech.com/detections/blog/cve-2026-56155 https://df00tech.com/detections/blog/cve-2026-56155 Thu, 16 Jul 2026 23:15:07 GMT CVE-2026-56155 is a KEV-listed access control flaw in Microsoft AD FS that lets limited-privilege actors obtain unauthorized federated access. Our detection tracks anomalous token issuance, claims rule changes, and AD FS admin activity across seven SIEM platforms. vuln-intel Microsoft CVE-2026-56155 https://df00tech.com/detections/blog/cve-2026-56164 https://df00tech.com/detections/blog/cve-2026-56164 Thu, 16 Jul 2026 23:15:01 GMT CVE-2026-56164 is a KEV-listed unauthenticated access flaw in Microsoft SharePoint Server enabling RCE and webshell deployment; our detection covers anonymous endpoint access, anomalous IIS child processes, and webshell drops across seven SIEM platforms. vuln-intel Microsoft CVE-2026-56164 https://df00tech.com/detections/blog/detecting-byovd-vulnerable-driver-abuse-t1068-kql-spl https://df00tech.com/detections/blog/detecting-byovd-vulnerable-driver-abuse-t1068-kql-spl Thu, 16 Jul 2026 23:04:44 GMT Bring Your Own Vulnerable Driver (BYOVD) attacks let adversaries kill EDR from kernel space before your detections ever fire. This guide gives SOC analysts concrete KQL and SPL queries to catch driver loads, service creation, and kernel tampering mapped to MITRE ATT&CK T1068. Detection Engineering MITRE ATT&CK KQL SPL Threat Hunting https://df00tech.com/detections/blog/detecting-kerberos-attacks-kerberoasting-as-rep-roasting-kql-spl-t1558 https://df00tech.com/detections/blog/detecting-kerberos-attacks-kerberoasting-as-rep-roasting-kql-spl-t1558 Mon, 08 Jun 2026 12:00:00 GMT Production KQL (Microsoft Sentinel) and SPL (Splunk) detections for MITRE ATT&CK T1558 — Kerberoasting, AS-REP Roasting, Golden and Silver Tickets — with Event 4769/4768 logic and tuning guidance for SOC teams. T1558 Kerberoasting AS-REP Roasting Golden Ticket KQL SPL Microsoft Sentinel Splunk MITRE ATT&CK Active Directory Threat Hunting https://df00tech.com/detections/blog/detecting-rmm-tool-abuse-remote-access-software-t1219-kql-spl https://df00tech.com/detections/blog/detecting-rmm-tool-abuse-remote-access-software-t1219-kql-spl Mon, 01 Jun 2026 12:00:00 GMT How threat actors weaponize legitimate remote access software like AnyDesk, ScreenConnect, and Atera — and the production KQL and SPL detection rules SOC teams need to catch T1219 abuse before ransomware lands. T1219 RMM remote access software AnyDesk ScreenConnect KQL SPL Microsoft Sentinel Splunk MITRE ATT&CK Threat Hunting Scattered Spider https://df00tech.com/detections/blog/detecting-process-injection-t1055-kql-spl-guide https://df00tech.com/detections/blog/detecting-process-injection-t1055-kql-spl-guide Mon, 18 May 2026 12:00:00 GMT Production KQL and SPL detection rules for MITRE ATT&CK T1055 process injection — DLL injection, process hollowing, thread hijacking, PE injection, and Early Bird APC — with tuning guidance for SOC teams. T1055 process injection KQL SPL Microsoft Sentinel Splunk MITRE ATT&CK Threat Hunting https://df00tech.com/detections/blog/cisa-kev-detection-rules-kql-spl-critical-cves https://df00tech.com/detections/blog/cisa-kev-detection-rules-kql-spl-critical-cves Mon, 11 May 2026 12:00:00 GMT Production-grade KQL and SPL detection queries for five critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog. Map KEV to MITRE ATT&CK, prioritise alerts, and close the gap between patch lag and detection coverage. CISA KEV CVE detection KQL SPL vulnerability management threat intelligence https://df00tech.com/detections/blog/edr-tamper-detection-kql-spl-t1562-001 https://df00tech.com/detections/blog/edr-tamper-detection-kql-spl-t1562-001 Mon, 04 May 2026 12:00:00 GMT Every ransomware deployment starts with killing the AV. KQL queries for Microsoft Sentinel and SPL for Splunk to catch Defender disablement, service stops, taskkill abuse, and unauthorized exclusion additions before encryption begins. T1562.001 EDR tampering defense evasion KQL SPL Microsoft Sentinel Windows Defender MITRE ATT&CK ransomware detection https://df00tech.com/detections/blog/detecting-living-off-the-land-lolbin-attacks-kql-spl https://df00tech.com/detections/blog/detecting-living-off-the-land-lolbin-attacks-kql-spl Mon, 27 Apr 2026 12:00:00 GMT Real KQL and SPL detection rules for catching LOLBin abuse — mshta, regsvr32, rundll32, WMI, and BITS Jobs — using MITRE ATT&CK T1218, T1047, and T1197 mapped queries from the df00tech library. KQL SPL Microsoft Sentinel Splunk LOLBins MITRE ATT&CK Threat Hunting defense evasion Detection Engineering https://df00tech.com/detections/blog/building-first-soc-detection-library-mitre-attack https://df00tech.com/detections/blog/building-first-soc-detection-library-mitre-attack Thu, 16 Apr 2026 12:00:00 GMT A practical guide to building your first SOC detection library: required logs, MITRE ATT&CK prioritisation, starter KQL and SPL queries, and a development loop that works. SOC detection library MITRE ATT&CK Detection Engineering KQL SPL https://df00tech.com/detections/blog/command-and-control-detection-beaconing-dns-tunneling-c2 https://df00tech.com/detections/blog/command-and-control-detection-beaconing-dns-tunneling-c2 Thu, 16 Apr 2026 12:00:00 GMT A practical C2 detection rule guide for SOCs: beaconing analysis, DNS tunneling, Cobalt Strike, Sliver, and protocol tunneling with KQL and SPL queries. C2 beaconing DNS tunneling Cobalt Strike T1071 T1572 KQL SPL https://df00tech.com/detections/blog/credential-dumping-detection-mimikatz-lsass-sam-t1003 https://df00tech.com/detections/blog/credential-dumping-detection-mimikatz-lsass-sam-t1003 Thu, 16 Apr 2026 12:00:00 GMT Credential dumping detection for T1003.001 LSASS, SAM, and NTDS extraction. KQL and SPL queries to catch Mimikatz, ProcDump, comsvcs.dll, and DCSync in your environment. credential dumping T1003 Mimikatz LSASS KQL SPL Detection Engineering https://df00tech.com/detections/blog/detecting-lateral-movement-microsoft-sentinel-kql-t1021 https://df00tech.com/detections/blog/detecting-lateral-movement-microsoft-sentinel-kql-t1021 Thu, 16 Apr 2026 12:00:00 GMT Production-tested lateral movement detection KQL queries for Microsoft Sentinel and Defender for Endpoint covering T1021 — RDP, SMB admin shares, and WinRM. KQL lateral movement T1021 Microsoft Sentinel Defender for Endpoint Detection Engineering https://df00tech.com/detections/blog/phishing-detection-microsoft-defender-sentinel-t1566 https://df00tech.com/detections/blog/phishing-detection-microsoft-defender-sentinel-t1566 Thu, 16 Apr 2026 12:00:00 GMT A practical phishing detection rule guide for T1566 covering spearphishing attachments, links, and service-based phishing with KQL queries for Microsoft Defender and Sentinel. phishing T1566 spearphishing Microsoft Defender for Office 365 Sentinel KQL https://df00tech.com/detections/blog/powershell-detection-rule-t1059-001-complete-guide https://df00tech.com/detections/blog/powershell-detection-rule-t1059-001-complete-guide Thu, 16 Apr 2026 12:00:00 GMT Build a PowerShell detection rule for T1059.001 with production KQL for Microsoft Sentinel and SPL for Splunk. Covers encoded commands, AMSI bypass, and tuning. PowerShell T1059.001 KQL SPL Microsoft Sentinel Splunk Detection Engineering https://df00tech.com/detections/blog/ransomware-detection-ttps-kql-queries-2026 https://df00tech.com/detections/blog/ransomware-detection-ttps-kql-queries-2026 Thu, 16 Apr 2026 12:00:00 GMT A ransomware detection rule playbook for 2026: TTPs, KQL queries, and LockBit, BlackCat, Akira tells — catch mass file encryption and shadow copy deletion pre-detonation. ransomware LockBit BlackCat T1486 T1490 T1562.001 KQL SPL https://df00tech.com/detections/blog/scheduled-task-persistence-detection-kql-spl-t1053-005 https://df00tech.com/detections/blog/scheduled-task-persistence-detection-kql-spl-t1053-005 Thu, 16 Apr 2026 12:00:00 GMT Scheduled task detection for T1053.005 with production KQL and SPL queries for Microsoft Sentinel and Splunk — covering schtasks.exe, at.exe, cron, 4698/4700/4702 events, and hidden task persistence. scheduled tasks T1053.005 persistence KQL SPL Detection Engineering https://df00tech.com/detections/blog/splunk-spl-vs-microsoft-kql-detection-rule-syntax-comparison https://df00tech.com/detections/blog/splunk-spl-vs-microsoft-kql-detection-rule-syntax-comparison Thu, 16 Apr 2026 12:00:00 GMT SPL vs KQL for detection engineering — side-by-side Splunk and Microsoft Sentinel syntax with real queries for PowerShell, LSASS, and scheduled task detections. SPL KQL Splunk Microsoft Sentinel Detection Engineering comparison https://df00tech.com/detections/blog/top-20-mitre-attack-techniques-soc-analysts-detect https://df00tech.com/detections/blog/top-20-mitre-attack-techniques-soc-analysts-detect Thu, 16 Apr 2026 12:00:00 GMT The most important MITRE ATT&CK techniques every SOC analyst must detect, prioritized by real-world frequency with KQL detection coverage for each. MITRE ATT&CK SOC Detection Engineering prioritization top techniques https://df00tech.com/detections/blog/mitre-attack-detection-coverage-704-kql-spl-queries https://df00tech.com/detections/blog/mitre-attack-detection-coverage-704-kql-spl-queries Wed, 08 Apr 2026 12:00:00 GMT df00tech provides 704 production-ready KQL and SPL detection rules mapped to the MITRE ATT&CK framework. Learn how comprehensive detection coverage protects your environment. MITRE ATT&CK detection rules KQL SPL Detection Engineering https://df00tech.com/detections/blog/building-detection-engineering-program-mitre-attack https://df00tech.com/detections/blog/building-detection-engineering-program-mitre-attack Mon, 06 Apr 2026 12:00:00 GMT A practical guide for SOC teams on using the MITRE ATT&CK framework to identify detection gaps, prioritise rule development, and measure coverage improvements over time. Detection Engineering MITRE ATT&CK SOC security operations threat detection https://df00tech.com/detections/blog/kql-threat-hunting-queries-microsoft-sentinel https://df00tech.com/detections/blog/kql-threat-hunting-queries-microsoft-sentinel Sat, 04 Apr 2026 12:00:00 GMT Hands-on KQL threat hunting queries for Microsoft Sentinel, covering credential dumping, UAC bypass, log tampering, ingress tool transfer, and password spraying detection. KQL Microsoft Sentinel Threat Hunting Defender for Endpoint Detection Engineering