The Cyber Toolchain — issue 070, September 10, 2026

Adds the docker-socket-breakout escape that opens an interactive host-root shell when a Docker-compatible socket is accessible, an escape technique for when the node's root filesystem is mounted into the container, an escape exploiting a writeable /proc/sys/kernel/core_pattern, and an escape usable when CAP_PTRACECAP_PTRACEA Linux capability that grants a process permission to use the ptrace syscall to inspect and control other processes, letting cyber tools perform debugging, memory inspection, or injection without running as full root. is available and the pod has hostPIDhostPIDA Kubernetes pod setting that lets containers in the pod share the host node's process ID namespace, giving them visibility into — and potential control over — all processes running on the node. set to true (amd64 only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ A new scanner detects which of these four conditions are present in a pod and alerts accordingly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

New POST /api/v2/agents/{id}/tasks/chdir endpoint and TASK_CHDIR (opcode 44) persistently change an agent's working directory across checkins, supported on PowerShell, Python, and IronPython agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

New BOF modules for in-memory evasion: wdtoggle patches WDigest/Credential Guard in LSASS to re-enable plaintext credential caching, etw_patching patches or reverts EtwEventWrite in ntdll to degrade ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. logging, static_syscalls_dump dumps a target process's memory via static syscall numbers bypassing ntdll hooks, static_syscalls_inject injects shellcode into a remote process via static syscalls, static_syscalls_apc_spawn spawns a temporary process and injects shellcode via APC queue using static syscalls, and syscalls_shellcode_injection injects shellcode into a remote process via direct syscalls.

New BOF modules for AD recon and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access.: nonpaged_ldapsearch runs synchronous non-paged LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. queries against a domain controller when paged queries are throttled, ldapsearch runs LDAP/LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. queries with configurable scope, reconad performs ADSI-based AD reconnaissance, domaininfo reports AD domain membership and Azure AD join status, addmachineaccount adds machine accounts for lateral movement, lapsdump dumps LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. passwords (ms-Mcs-AdmPwd) from AD via LDAP, and netuserenum enumerates local or domain user accounts via NetUserEnum with a configurable filter.

New BOF modules for host and process introspection: psx lists processes annotated with detected security products, psm returns detailed single-process info by PID (loaded modules, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions), psk enumerates loaded kernel modules/drivers annotated with security-product driver detection, psw enumerates window titles across running processes, psc lists processes with active TCP connections and RDP session details, findmodule and findLoadedModule find processes with a given DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. loaded, findprochandle finds processes holding a handle to a named object, notepad enumerates open Notepad/Notepad++ windows and extracts displayed file path or in-memory text, winver retrieves Windows version, build number and patch revision, reg_query performs in-agent registry queries (key enumeration, value lookup, recursive traversal) locally or remotely, and smbinfo retrieves SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. server info via NetServerGetInfo.

Password hashing switched from bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. to PBKDF2-HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. (600K iterations); existing bcrypt hashes are incompatible, requiring password resets or database recreation, and non-default bcrypt users must be manually reset via PUT /api/v2/users/{id}/password. Staging key normalization replaced MD5 with SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., requiring agents staged under the old algorithm to be re-staged. CSPRNG generation replaced Python's random with secrets on the server and random.SystemRandom() on the agent across listeners, stagers, agents, and utilities, requiring all deployed agents to be re-staged.

New BOF modules: netuse_add, netuse_list, and netuse_delete map, enumerate, and disconnect mapped network drives; nslookup performs DNS lookups via the Windows DNS client API with optional custom server and record type; vssenum enumerates Volume Shadow Copies exposed on a host's SMB share (useful for locating offline SAM/SYSTEM/NTDS hives); and startwebclient starts the WebClient service via ETW trigger registration.

New InjectSelf option (default true) on inject_amsi_bypass and inject_etw_bypass modules; set to false to target a remote PID instead of injecting into the agent's own process.

New BOF modules query and enumerate Windows services via the Service Control Manager: sc_enum bulk-enumerates all services on a local or remote host (config, query, failure, and trigger data), sc_qc queries a service's configuration (binary path, start type, account, dependencies), sc_qdescription queries a service's description, sc_qfailure queries a service's failure actions (restart, run command, reboot), and sc_qtriggerinfo queries the trigger events that start or stop a service.

Chat messages are now persisted to a new chat_messages table (Alembic migration 0003); the chat/history endpoint returns the most recent 20 messages, a new AFTER_CHAT_MESSAGE_HOOK core hook fires with (db, message: ChatMessage) after a message is persisted, and a downloadable report=chat export (also included in report=all) produces chatlog.csv.

New starkiller.directory config option serves an already-built Starkiller instance instead of cloning it from GitHub at startup, enabling air-gapped and distro-packaged installs.

starkiller:
  directory: /opt/starkiller/dist

The listener parser now supports the Cobalt Strike http-config block in malleable HTTP profiles, wiring trust_x_forwarded_for (default false) and block_useragents (fnmatch globs).

New MergeReferences option in the C# module YAML schema enables ILRepack dependency merging via the Empire Compiler's --merge-references flag.

AES-256-GCM is now used server- and agent-side: an AES256GCM AEAD class in encryption.py on the server, agent/stagers/common/aesgcm.py for Python/IronPython stagers, and a .NET 4.x AesGcmHelper for PowerShell stagers.

New krb_session_key credential type stores Rubeus session keys as <keytype>:<base64key>, captured automatically from both dump and asktgt/asktgs command output.

New situational_awareness/host/inveigh credential parser ingests NetNTLMv1/v2 hashes from task output, tagging machine accounts as inveigh machine_account.

New situational-awareness modules powershell/situational_awareness/host/processes, .../ipconfig, .../route, .../dir_list, and python/situational_awareness/host/processes emit JSON output for server-side filtering.

Agent file uploads are now split into 512KB chunks drip-fed across checkins, removing the previous 1MB upload limit, with backward-compatible protocol detection for agents on older versions.

New SafeChecksPS and SafeChecksPython bypass YAMLs consolidate common bypass snippets, opted into via a stager's Bypasses parameter.

New per-option format_string override and {{ VALUE_ARRAY }} template token render PowerShell [Array] parameters as double-quoted, comma-joined elements.

Adds a remote MCP server at https://zeropath.com/mcp — point Claude, Cursor, Codex, or any Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. client at it, authenticate via browser, and work with findings with no install and no API key required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Connections are read-only until changes are approved, and administrators can revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

On repository objects, lastScanError is replaced by lastScanFailure; any API client or integration reading lastScanError will receive no value and must be updated to read lastScanFailure.

Connecting an integration now requires the Create Integrations or Create Installations permission; adding a repository by URL requires Create Repositories — existing automations without these grants will be refused.

Adds Ticket creation as a per-repository permission for Jira and Linear, required for organizations using access control; creating Jira and Linear tickets is now a per-repository permission that must be explicitly granted or ticket creation will be refused.

Adds the require_secret_scanning_alert_resolution rule type (with a secret_types parameter) to the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and the REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION rule type to the GraphQL API, plus a Require secret scanning alerts are resolved ruleset rule under Repository > Rulesets in repository, organization, and enterprise settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The rule blocks PR merges until all introduced secret alerts are cleared, and the secret_types parameter can extend blocking to custom or generic patterns beyond default provider patterns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Admins can centrally block, require human approval for, or auto-allow shell commands, file reads and edits, and network domains for GitHub Copilot agent operations, enforced across the GitHub Copilot app, GitHub Copilot CLI, and Visual Studio Code Agent Host sessions. Policies support per-team scoping, and managed restrictions override and cannot be weakened by user settings, workspace settings, auto-approval rules, or previously saved approvals.

Adds native Linux ARM64 support for the CodeQL CLI and bundle via the linux-arm64 per-platform release assets. The generic multi-platform codeql.zip distribution will be removed in a future release — users must switch to the per-platform .zip for their platform — and the CLI now emits a warning when run from an all-platforms distribution, which can be suppressed by setting CODEQL_ALLOW_ALL_PLATFORMS_DIST=true.

Adds the rust/command-line-injection query to detect uncontrolled command lines in Rust code, and adds PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare as SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. sinks for cpp/sql-injection and related C/C++ queries.

Adds taint tracking support for OData action parameter binding in C#, improving detection for vulnerabilities involving ODataActionParameters and entities tracked by Delta.

Introduces CI_TRACEPARENT and CI_TRACESTATE predefined CI/CD variables bringing W3C Trace Context into jobs for cross-pipeline and distributed-system trace correlation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ curl -X POST https://otel-collector.example.com/v1/traces \
  -H "traceparent: $CI_TRACEPARENT" \
  -H "tracestate: $CI_TRACESTATE" \
  -d '{"job": "'$CI_JOB_ID'"}'

Introduces the INFISICAL_RUN_MODES environment variable to control which operational modes the Infisical server runs in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a triage AI agent and a deep analysis AI agent that run over every public GitHub and Docker Hub incident, returning a company-related verdict (Related, Uncertain, or Unrelated) and an agent-computed risk score.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ A new Analysis tab in the incident investigation details view shows the triage reasoning, deep-analysis findings, and the timeline of both agent passes. Three pre-configured saved views group incidents into company-related, unclear if company-related, and not company-related queues. Agents Analysis is enabled by default for new Public Secrets Monitoring workspaces, with gradual rollout to existing workspaces; customers can request early access through their Customer Success Manager.

⤢ ⤢ ⤢

Bounds the -od/-audit-log response snapshot and response header size to cap on-disk and in-memory growth during large fuzzing runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds the Claude Connect integration in the Salt Data Source Hub, which authenticates to Anthropic's Compliance API using a read:compliance_activities-scoped Compliance Access Key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It polls the Compliance API Activity Feed at https://api.anthropic.com/v1/compliance/activities to continuously inventory organization-managed MCP servers, surfacing each server's name, identity, status (active vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ removed), and lifecycle timestamps into the Salt Agentic inventory, where discovered servers are labeled with source Claude Connect and show first- and last-seen times.

$ curl -s "https://api.anthropic.com/v1/compliance/activities?limit=1" \
  -H "x-api-key: <your-compliance-access-key>"

Adds a combined SMS and MMS Messages artifact that merges both transports into one table sorted by date, adding a Message Type column (SMS or MMS) and a Source Table column naming the originating table (sms, spam_sms, or pdu).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a new MMS Attachments artifact reporting every part row joined to its message, including unreferenced files under app_parts and parts, with stored content type, sniffed type, size, and a status column.

Adds MMKV decryption support via a vendored mmkv_parser, correct varint header handling, and a new MMKV - Recovered Records artifact.

Adds Android system artifacts covering Android users, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. authorizations, and telecom phone accounts; install sessions, per-user package state, and per-app SSAID artifacts; Android dropbox, tombstone, and ANR crash record artifacts; and App Ops artifacts covering recent accesses, standby buckets, and permission modes, plus permission subsystem access.abx parsing.

Adds 70+ new app parsers spanning secure messaging (WeChat, Element X, Silent Phone, Tutanota, Dust), password/security managers (Bitwarden, KeePassDX, Aegis, Magisk), productivity/note apps (Joplin, Tasks.org, Orgzly Revived, ColorNote), media/streaming (NewPipe, AntennaPod, Snapseed, Musicolet, InShot, VivaVideo), navigation/fitness (Organic Maps, OsmAnd, OpenTracks, Trail Sense, Sleep as Android), and others including GETTR, Xiaohongshu, Houseparty, CCleaner, Aurora Store, Breezy Weather, RedReader, Aves Gallery, Solid Explorer, HERE WeGo, Moovit, QR and Barcode Scanner, MX Player, Nova Launcher, Flipboard, Easy Voice Recorder, and CamScanner.

Adds fastly-object-storage-source-url request header support on PutObject and UploadPart S3 API calls, letting Fastly pull object data directly from a source URL server-side instead of requiring the client to upload a payload (sent with Content-Length: 0).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Partial range transfers are supported via a standard Range header (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ bytes=0-41943039) on UploadPart for multipart uploads from a byte-range, and pre-signed URLs can be passed in the header to migrate private assets without exposing long-term credentials.

$ curl -X PUT 'https://<bucket>.storage.fastly.com/<destination-key>' \
  -H 'Content-Length: 0' \
  -H 'fastly-object-storage-source-url: https://<source-bucket>.s3.amazonaws.com/<source-key>' \
  -H 'Authorization: AWS4-HMAC-SHA256 ...'

$ curl -X PUT 'https://<bucket>.storage.fastly.com/<destination-key>?partNumber=1&uploadId=<upload-id>' \
  -H 'Content-Length: 0' \
  -H 'fastly-object-storage-source-url: https://<source-bucket>.s3.amazonaws.com/<source-key>' \
  -H 'Range: bytes=0-41943039' \
  -H 'Authorization: AWS4-HMAC-SHA256 ...'

Adds Terraform resources for core service building blocks: domain, backend, ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. and ACL entries, config store and items, secret store, dictionary items, cache settings, response object, request setting, custom dashboard, syslog logging, and DNS zone.

Adds a fastly_tsig_key resource and fastly_tsig_keys data source for managing TSIG keys, a new resource for managing Fastly object storage access keys, and support for Cloudfiles logging via logging_cloudfiles.

Adds log.level and log.format tuning for Logstash via SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. configuration, and supports tuning multiple Logstash pipelines in SOC ES.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Go 1.27 support across the go, go-fips, and go-openssl-fips container images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The go-openssl-fips image now selects its FIPS-validated cryptographic module at deployment rather than at build time, letting a single artifact run with either the OpenSSL FIPS provider or the Go Cryptographic Module without recompilation.

Integrates Chainguard Libraries with JFrog Catalog so joint customers can pull Chainguard-built packages through JFrog Artifact Repository without build errors, and enables JFrog Zero-Touch Remediation with patched Chainguard packages. Java support is live now; JavaScript and Python support are planned by end of September 2026.

Adds 39 new container images including 10 FIPS variants of kubeflow-pipelines-* components, plus dbmate, hadolint, jruby, kserve-huggingfaceserver, gubernator, fortiotel, packer, security-profiles-operator, aws-lambda-dotnet, opentelemetry-go-instrumentation, presidio-anonymizer, redpanda-console-fips, and others.

Plerion now scans inside Google Cloud workloads — Compute Engine instances, managed instance groups, and custom images, as well as Cloud Run services and Cloud Functions (1st and 2nd gen) — for vulnerabilities, software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOM), and secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ All scans run inside a dedicated scanning project within the customer's own organization to keep data in-boundary, and GCP authentication is keyless via workload identityworkload identityAn identity assigned to software, such as a service or container, rather than a person. It lets the workload authenticate and receive permissions without sharing a user's credentials. federation (WIFWIFWorkload Identity Federation is a Google Cloud mechanism that lets external workloads authenticate to Google APIs using short-lived tokens from a trusted identity provider, eliminating the need to manage long-lived service account keys.).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Iru Vulnerability Management now covers Windows devices alongside existing Mac coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It inventories all installed Windows applications, maps them against the National Vulnerability Database (NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization.), and ranks findings by severity with an active-exploitation flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Each CVE is tracked through statuses — active, remediated, or risk-accepted — with device-level counts for fleet-wide visibility. Administrators can set severity-based remediation controls per CVE tier via Enforce immediately, Enforce on a timeframe, or No action under Vulnerability Management > Enforcement Controls, and patching is non-disruptive: silent installs when possible, with a user-facing countdown to save work if an app is open at the enforcement deadline.

Elastic Defend now records a process event whenever a process calls memfd_create on Linux (requires kernel 5.10.16+ for eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based event sourcing), starting in Elastic Security 9.4.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The event captures the syscall arguments via new fields process.Ext.memfd.name, process.Ext.memfd.flags, flag_cloexec, flag_allow_seal, flag_hugetlb, flag_noexec_seal, and flag_exec, enabling hunting for fileless ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. execution chains such as download → memfd_create → exec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

⤢ ⤢ ⤢

$ event.category: process AND process.Ext.memfd.name: * AND NOT process.Ext.memfd.flag_noexec_seal: true

Elastic Defend 9.5.0 adds dll.Ext.defense_evasions: "DLL Hijack: Masquerading" to DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. load events, enriching them when a loaded DLL is not Microsoft-signed and its name matches a cached inventory of Windows and system-library DLLs. This collapses detection logic that previously required ~88 lines covering ~2,600 named libraries, 10 excluded Windows system paths, signature checks, and a drop-to-load time window into a single field match.

⤢ ⤢ ⤢ ⤢

$ dll.Ext.defense_evasions: "DLL Hijack: Masquerading"

Elastic released FENIX (Fileless Execution for NIX), an open-source lab framework at github.com/elastic/FENIX with a fenix run <technique> CLI for reproducing and testing memfd-based fileless execution patterns against Elastic Defend telemetry.

⤢

$ git clone https://github.com/elastic/FENIX.git && cd FENIX
make all
python3 -m venv .venv && source .venv/bin/activate
pip install -e .
export FENIX_BIN_DIR=$PWD/bin
fenix run memfd_create

Introduces a shared UrlEgressValidator that enforces a common outbound URL policy, validating schemes and resolved addresses and blocking loopback, link-local, and private destinations across all remote-resource retrieval paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Extends CurlClient with host pinning, controlled and validated redirects, response size limits, and TLS peer verification enabled by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Batches sightings retrieval inside MispAttribute::fetchAttributes() instead of querying per attribute, reducing a 5,000-attribute case from 8.1 seconds / 10,661 queries to 0.149 seconds / 6 queries — more than a 50x improvement.

Expands Overmind event quick-action cards with merge attributes, enrich event, contact reporter, delegate publishing, execute ad-hoc workflows, and recorrelate events operations; adds warning-list filtering in correlation graphs, Galaxy support inside Tag Collections, and the first version of the MISP Tutorial; adds card views for additional indexes, server-specific card views, and multiple cards per row; and adds responsive correlation graph timelines with correlated events collapsed by default.

⤢

Launches Digital Risk Protection, a unified workspace covering five external threat surfaces: Malicious Site Monitoring, Impersonation Monitoring, Code Repository Monitoring, Dark Web Brand Monitoring, and Identity Exposure Monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Includes configurable risk thresholds per use case so teams control which detections escalate to Alerts without losing underlying detection coverage, and one-click takedown coordination available across all five use cases from day one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

⤢ ⤢ ⤢

Flags newly registered lookalike domains and phishing infrastructure within hours of registration, using logo detection and image OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. to catch impersonation beyond keyword matching.

An AI Triage Agent for Malicious Site Monitoring and Dark Web Brand Monitoring automatically evaluates high-interest detections and delivers an explicit verdict with reasoning, surfacing only critical, high-priority Alerts.

Surfaces compromised employee credentials from active infostealer logs within hours of exfiltration, with VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. monitoring available for executive accounts.

The sigma operator automatically matches conformant OCSF events without any configuration, covering SigmaHQSigmaHQAn open community repository on GitHub that maintains the Sigma generic signature format and its growing library of detection rules, giving cyber tools a vendor-neutral rule set they can convert to any SIEM query language. logsources including all Sysmon-backed Windows categories, Linux/macOS process creation, Windows Security/System/PowerShell/Defender channels, Okta, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Azure activity logs, AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., GCP Cloud Audit Logs, and Zeek DNS/HTTP/SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments.; use mapping="direct" to opt out.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It works by rewriting rule predicates to OCSF field paths (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Image → process.path, ParentImage → process.parent_process.path, CurrentDirectory → process.working_directory) guided by the rule's logsource, so stock SigmaHQ rules match normalized telemetry without per-rule field mapping. The new microsoft::windows::ocsf::normalize pipeline operator normalizes both Sysmon event 1 and Windows Security event 4688 to OCSF Process Activity events, letting a single Sigma rule fire across both producers.

$ from_file "windows-events.xml" { read_delimited "</Event>\n", include_separator = true }
microsoft::windows::ocsf::normalize
sigma path = "sigma/rules/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml"

$ demo::windows "xml", speed = 10.0
microsoft::windows::ocsf::normalize raw
sigma path = "sigma/rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml"

from_azure_blob_storage and to_azure_blob_storage gain an azure_auth record with a web_identity field enabling Entra workload identity federation per-operator, so a single node can authenticate to multiple tenants; web_identity accepts token_endpoint, token_file, or inline token. The token_endpoint.query_params record lets OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. audience parameters be passed as structured key-value pairs (percent-encoded automatically) instead of concatenated onto the URL, accepting both string and secret values. Note: azure_auth cannot be combined with account_key.

$ from_azure_blob_storage "abfss://logs@customer1.dfs.core.windows.net/**.json.gz"
  azure_auth = {
    tenant_id: secret("customer1-entra-tenant")
    client_id: secret("customer1-entra-client")
    web_identity: {
      token_endpoint: {
        url: env("ACTIONS_ID_TOKEN_REQUEST_URL")
        query_params: { "audience": "api://AzureADTokenExchange" }
        headers: { "Authorization": "Bearer " + env("ACTIONS_ID_TOKEN_REQUEST_TOKEN") }
        path: ".value"
      }
    }
  }
{ read_json }

The Explorer now loads stored schemas on demand: clicking Load schemas in Stored data retrieves schema names and event counts without loading all schemas upfront, and expanding a schema loads field definitions for all schemas once, caching them until Refresh is clicked. A Retry option appears when schema loading fails, schema search now matches schema names only (not field contents), and the Explorer opens the Results tab by default instead of the stored-data view.

The from_clickhouse operator now pushes where, select, and head into the SQL query sent to ClickHouse (as WHERE, column selection, and LIMIT), so ClickHouse reads and transfers only what the pipeline needs.