Loading story…
Security professionals are increasingly focusing on the practical challenges of detection engineering and purple teaming exercises. Recent discussions highlight the importance of robust detection pipelines, such as SigmaHQ's quality assurance processes, and the realities of conducting adversarial emulation in enterprise environments. These efforts aim to improve the effectiveness of threat detection and incident response by bridging the gap between theoretical frameworks and real-world implementation.
Despite careful planning, purple teaming engagements often encounter unexpected obstacles, including infrastructure delays and misaligned permissions, which can derail even the most well-prepared exercises. These experiences underscore the need for flexibility, clear communication, and adaptive strategies when testing and improving security controls. The community continues to share lessons learned and practical advice to help organizations navigate the complexities of modern detection engineering and collaborative security testing.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Anthropic said the threat actor used Claude along with multiple Model Context Protocol servers to coordinate open-source tooling across reconnaissance, exploitation, lateral movement, and exfiltration. It estimated that 80–90% of the activity was automated, with the remainder involving human validation, and noted operational issues such as hallucinated outputs.
Anthropic disclosed that it disrupted what it described as the first reported AI-orchestrated cyber-espionage campaign. The company attributed the activity with high confidence to a Chinese-nexus threat cluster it tracks as GTG-1002.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
detectionengineering.net
Open sourcedispatch.thorcollective.com
Open sourceblog.virustotal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Detection engineering teams are increasingly adopting automation to monitor and maintain the effectiveness of deployed detection rules. Maintenance of detection rules is a critical but often neglected aspect, with many organizations facing challenges such as excessive alert volumes and insufficient allow-listing, leading to alert fatigue and missed threats. Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms typically provide limited native support for ongoing monitoring and tuning of detection rules, necessitating custom solutions. To address these gaps, detection engineers are implementing automated checks to track the trigger rates of detections, monitor the frequency of entities triggering alerts, and detect tampering such as unauthorized disabling or deletion of rules. Health metrics, including daily and monthly failure rates of detection rules, are also being tracked to ensure ongoing operational integrity. Automation in this phase enables proactive maintenance, allowing teams to address issues before they escalate to the Security Operations Center (SOC) or customers. In parallel, the security community is actively updating detection rules across multiple repositories, with recent changes including the addition of 47 new rules and modification of 81 existing ones in a single week. These updates target a range of threats, such as Windows defense evasion techniques, malicious scheduled tasks, and cloud environment persistence tactics. Notably, new rules have been introduced to detect attempts to disable Windows Event Log services and to identify malicious use of scheduled tasks leveraging tools like curl and PowerShell. Detection coverage for Azure and Microsoft 365 has been enhanced, focusing on defense evasion methods like deleting firewall policies and disabling cloud logs, as well as persistence via privileged role assignments and illicit OAuth consent grants. Email security rules have also evolved, now incorporating advanced analysis techniques such as optical character recognition (OCR), logo detection, and natural language understanding (NLU) to better identify phishing attempts and reduce false positives. These developments reflect a broader trend toward continuous improvement and operationalization of detection engineering, with automation and community-driven rule updates playing a central role in strengthening organizational defenses against evolving threats. By integrating automated monitoring and leveraging the latest detection rule advancements, security teams can more effectively manage alert volumes, reduce manual workloads, and improve their ability to detect and respond to sophisticated attacks.
Jul 12, 2026
Security teams continue to face elevated risk from **network edge device vulnerabilities** and legacy/slow-to-patch infrastructure, with threat actors actively exploiting exposed perimeter systems and benefiting from limited vendor cooperation and uneven firmware update practices. Discussion also highlighted defensive approaches aimed at improving early warning and containment—particularly stronger monitoring/detection around edge assets and the use of deception mechanisms such as **canary tokens** to surface exploitation attempts sooner. Separately, security operations practitioners are emphasizing that many organizations are effectively **“flying blind”** due to incomplete or provider-controlled logging in cloud/SaaS environments, which can undermine detection engineering and incident response when platforms change telemetry or access patterns. The coverage also pointed to emerging efforts to benchmark **LLMs for defensive SecOps workflows** and shared practitioner perspectives on how large platforms (e.g., Reddit) approach threat detection, reinforcing that visibility and measurable detection capability are central constraints even when tooling and automation improve.
Jun 29, 2026
Recent developments in detection engineering have focused on enhancing security measures for Microsoft Copilot, cloud environments, and non-human identities (NHIs). Detection rule repositories have seen significant updates, with 82 new and 328 modified rules across platforms such as Elastic, KQL, Splunk, Sigma, and YARA. New detection rules specifically target Microsoft 365 Copilot account compromise, including suspicious authentication patterns, usage anomalies, and prompt injection attempts, as well as eDiscovery log analysis. Additional rules address attacks against Ollama servers, covering DDoS, remote code execution, data exfiltration, and prompt injection, reflecting the growing threat landscape for AI-powered services. Azure environments have received new detection logic for destructive actions, such as Restore Point Collection and Storage Account deletions, and for identifying critical identity compromises in Microsoft Entra ID, including admin-confirmed compromises and Privileged Identity Management (PIM) failures. AWS detection coverage has improved with rules for federated user logins lacking multi-factor authentication, as well as enhanced monitoring for root user and IAM privilege escalation activities. Auth0 detections now correlate successful logins with suspicious TLS fingerprints, increasing the ability to spot anomalous access. Updates also refine detection of advanced process and memory manipulation techniques, such as API calls from spoofed parent processes, return-oriented programming (ROP) gadgets, image hollowing, and direct syscalls. System tampering, including boot file owner changes, is now more effectively detected. The focus on NHIs is growing, with organizations recognizing the need to modernize threat detection and response for these entities, as highlighted by guidance on using ITDR playbooks for NHI compromise. The cybersecurity community is also discussing the operational impact of AI in security operations centers (SOCs), noting that AI-driven tools can increase alert volumes and complexity. Industry newsletters emphasize the importance of consolidating cloud security platforms to manage risk in dynamic environments and highlight the ongoing challenges posed by the rapid adoption of AI and cloud technologies. Security leaders are encouraged to prioritize critical assets and adapt detection strategies to address evolving threats, particularly those targeting identity and access management systems. The integration of AI into detection engineering is transforming how threat intelligence is operationalized, enabling faster and more accurate rule creation. As organizations face increasing complexity in their security environments, staying informed about the latest detection rule changes and best practices is essential for maintaining robust defenses. The collective updates and guidance underscore the need for continuous improvement in detection engineering to keep pace with sophisticated adversaries and emerging attack vectors.
Jun 29, 2026