Loading story…
Recent updates in detection engineering include the addition and refinement of detection rules across multiple platforms and repositories. Notable changes involve new Sigma rules targeting the 'EDR-Freeze' technique, which exploits debugging libraries to suspend security processes, as well as expanded detection for server-side application exploits and malicious named pipe activity. These updates aim to improve coverage for threats such as LSASS credential dumping, suspicious child processes in Node.js and Java environments, and Linux-based threats, enhancing overall threat detection capabilities.
In parallel, there is an ongoing discussion within the detection engineering community about the design and effectiveness of atomic detection rules. Atomic detection rules are foundational elements in threat detection, focusing on identifying discrete, observable attacker behaviors. The field emphasizes balancing detection efficacy, minimizing false positives and negatives, and understanding the context in which rules operate. This conceptual framework guides the continuous improvement of detection strategies and the development of new rules to address evolving attacker techniques.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
On 2025-12-15, Detection Engineering published an article arguing that narrowly scoped atomic detection rules are easy to deploy but brittle, noisy, and easy for attackers to evade. The piece recommends more context-rich, behavior-based detections and frames the tradeoff using the Pyramid of Pain and operational-cost examples.
Numerous existing rules were modified to improve operational use, including Linux auditd schema fixes, new investigation guides, cloud detection refinements for AWS, GitHub, and Entra ID, and migrations from EQL to ESQL. The changes were aimed at better scalability and lower alert noise.
During the Dec. 8-15 period, new and improved email detections were introduced for phishing activity including Impact Solutions PhaaS, Adobe Sign impersonation, and callback phishing using Microsoft Teams invites. These updates expanded coverage of social-engineering and service-abuse techniques.
Multiple repositories added Linux-focused YARA and behavioral detections, including rules for ELF malware families such as ZinFoq, Kaiji variants, CowTunnel, and PeerBlight. Behavioral rules were also tuned to reduce false positives in containerized and development environments.
Repositories added or expanded detections for suspicious child processes spawned by Node.js, React, and Next.js servers on Windows and Linux. They also added a Java template-injection pattern that looks for XSL/XSLT file creation followed by shell execution.
In the same update period, new Sysmon-based rules were introduced to identify suspicious named pipe activity associated with persistence and lateral movement. These additions expanded behavioral coverage for common post-compromise tradecraft.
During the Dec. 8-15, 2025 update window, repositories added Sigma detections for the "EDR-Freeze" technique abusing dbgcore.dll and dbghelp.dll to suspend security processes. Related detection logic was also added for LSASS credential-dumping behaviors.
Between 2025-12-08 and 2025-12-15, a weekly review of 11 monitored GitHub repositories recorded 31 new detection rules and 77 updated rules. The changes spanned Sigma, Sysmon, YARA, email security, cloud, and Linux-focused detections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Detection engineering communities have released a series of updates and insights aimed at improving threat detection capabilities across multiple platforms. Notable highlights include the integration of chaos engineering principles into incident response playbooks, the use of AI to generate and translate detection rules, and the expansion of community-driven detection content for PowerShell execution, lateral movement, and service installations. These efforts are designed to help security teams stay ahead of evolving attacker techniques and streamline the process of operationalizing threat intelligence. In parallel, major detection rule repositories such as Sigma, Splunk, and YARA have seen significant activity, with dozens of new and updated rules targeting recent exploits and vulnerabilities. Key updates include new Sigma rules for Commvault RCE and GoAnywhere MFT attacks, Splunk content for Oracle E-Business Suite exploitation, and YARA rules for WSUS RCE and WinRAR path traversal. Cloud detection coverage has also been enhanced, with new rules for AWS and Azure environments, and credential dumping detections have been refined to monitor additional processes and command-line flags. These developments collectively strengthen the detection engineering landscape and provide security teams with actionable tools to address current threats.
Jun 29, 2026
Detection engineering teams are increasingly adopting automation to monitor and maintain the effectiveness of deployed detection rules. Maintenance of detection rules is a critical but often neglected aspect, with many organizations facing challenges such as excessive alert volumes and insufficient allow-listing, leading to alert fatigue and missed threats. Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms typically provide limited native support for ongoing monitoring and tuning of detection rules, necessitating custom solutions. To address these gaps, detection engineers are implementing automated checks to track the trigger rates of detections, monitor the frequency of entities triggering alerts, and detect tampering such as unauthorized disabling or deletion of rules. Health metrics, including daily and monthly failure rates of detection rules, are also being tracked to ensure ongoing operational integrity. Automation in this phase enables proactive maintenance, allowing teams to address issues before they escalate to the Security Operations Center (SOC) or customers. In parallel, the security community is actively updating detection rules across multiple repositories, with recent changes including the addition of 47 new rules and modification of 81 existing ones in a single week. These updates target a range of threats, such as Windows defense evasion techniques, malicious scheduled tasks, and cloud environment persistence tactics. Notably, new rules have been introduced to detect attempts to disable Windows Event Log services and to identify malicious use of scheduled tasks leveraging tools like curl and PowerShell. Detection coverage for Azure and Microsoft 365 has been enhanced, focusing on defense evasion methods like deleting firewall policies and disabling cloud logs, as well as persistence via privileged role assignments and illicit OAuth consent grants. Email security rules have also evolved, now incorporating advanced analysis techniques such as optical character recognition (OCR), logo detection, and natural language understanding (NLU) to better identify phishing attempts and reduce false positives. These developments reflect a broader trend toward continuous improvement and operationalization of detection engineering, with automation and community-driven rule updates playing a central role in strengthening organizational defenses against evolving threats. By integrating automated monitoring and leveraging the latest detection rule advancements, security teams can more effectively manage alert volumes, reduce manual workloads, and improve their ability to detect and respond to sophisticated attacks.
Jul 12, 2026
A roundup of recent developments in information security and detection engineering highlights both evolving cyber threats and the community's response through updated detection rules. Notable news includes AI-powered cyber attacks targeting Russian arms firms, concerns over open-source software supply chain risks raised by U.S. Senate leadership, and the increasing use of automated data analysis in government enforcement. These stories underscore the growing sophistication of threat actors and the need for vigilance in both public and private sector cybersecurity. In parallel, detection engineering teams released 19 new and 87 updated rules across major platforms such as Sigma, Splunk, YARA, KQL, Elastic, and Sublime Security. Key improvements include expanded phishing detections for services like Monday.com and SendGrid, enhanced rules for defense evasion using Windows processes, and refined cloud threat detection for AWS and Azure environments. These updates aim to improve threat coverage and operational efficiency in response to the latest attack techniques and adversary behaviors.
Jun 29, 2026