Attributed metadata history
Up to 100 retained publisher events per page for b1d05a90d437c66a387fa0d033be75dd8e11205c0eb5411205e757b730b92533. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
available
Fingerprint: 46a79d93330609014f09d35b0d753a3dee278bd71aaea4321313d2ee9c64a43c
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
🚀 Key Highlights 🏴 Linux Dirty Frag Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) 🏴 Added a new detection for the Dirty Frag Linux kernel privilege escalation vulnerabilities, identifying the exploit's characteristic high-frequency splice() syscall activity followed by execution of a setuid binary within the same audit session. This analytic provides early visibility into attempts to corrupt the kernel page cache and escalate privileges to root through abuse of the IPsec ESP or RxRPC subsystems. 👻 Phantom Stealer 👻 Expanded detection coverage for this Windows information stealer that targets browser credentials, FTP/SSH clients, cryptocurrency wallets, and other sensitive application data. This release adds a new detection for unauthorized access to WinSCP security configuration folders while tagging and enhancing existing analytics covering browser credential theft, PowerShell abuse, process injection, persistence, suspicious browser behavior, and data exfiltration, improving visibility into credential harvesting and post-compromise activity commonly associated with modern infostealers. ⏫ Sysmon Event ID 8 Detection Improvements ⏫ Refined detection
Fingerprint: d32a73100972bd28d1ba65d0998fbea49578246e9f53969f3b793fbd4326241c