Loading story…
A detection blind spot in Microsoft Defender XDR and related Sentinel hunting logic can cause external command-and-control traffic to be missed when queries filter DeviceNetworkEvents on RemoteIPType == "Public". During a purple-team exercise, an expected alert failed to fire because some outbound connections to external IPv4 destinations were recorded instead as FourToSixMapping, a label used for IPv4-mapped IPv6 addresses such as ::ffff:8.8.8.8. The behavior is consistent with IPv6 addressing rules and can appear when Windows applications use dual-stack sockets.
The issue also affects KQL detections that rely on ipv4_is_private(RemoteIP), because the function can return null for FourToSixMapping values and exclude malicious external traffic from results. Researchers advised defenders to review Microsoft Defender XDR DeviceNetworkEvents queries and normalize mapped addresses by removing the ::ffff: prefix before applying private-versus-public IP logic, reducing false negatives in network hunting and alerting.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The analysis further found that KQL's ipv4_is_private() returns null for FourToSixMapping values such as ::ffff:8.8.8.8, creating an additional blind spot in Defender XDR and Sentinel queries. The recommended mitigation was to normalize RemoteIP values by stripping the ::ffff: prefix before applying private/public IP logic.
During a purple team exercise, an expected alert for covert external command-and-control traffic failed to trigger because Microsoft Defender XDR logged some external IPv4 destinations as RemoteIPType "FourToSixMapping" instead of "Public". This revealed that hunting and detection queries filtering only on RemoteIPType == "Public" could miss external connections.
RFC 4291 documented the IPv6 addressing architecture, including IPv4-mapped IPv6 addresses of the form ::ffff:w.x.y.z that underpin the FourToSixMapping behavior discussed later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcemalware.news
Open sourcedetect.fyi
Open sourcelearn.microsoft.com
Open sourcerfc-editor.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s fix for the Windows Defender zero-day **RoguePlanet** (`CVE-2026-50656`) is facing new scrutiny after researcher **Chaotic Eclipse** alleged that changes in `mpengine.dll` introduced fresh problems in the Microsoft Malware Protection Engine. The original flaw was described as a race-condition privilege-escalation bug that could yield a **SYSTEM** shell and had public proof-of-concept code, adding to mounting pressure on defenders as Microsoft disclosed more than 200 CVEs in a single month across Windows, Office, SharePoint Server, Visual Studio, and .NET. According to the researcher, the patched engine may expose an eight-byte information disclosure and a more practical denial-of-service condition that can fill local storage by abusing oversized `Zone.Identifier` alternate data streams during Defender scanning over SMB. In the reported scenario, **MsMpEng.exe** continues caching content from a controlled SMB server while a later read request is stalled, eventually exhausting disk space; the behavior was reportedly reproduced on **Windows 11 25H2** and **Windows Server 2025**. Microsoft previously addressed RoguePlanet in engine version `1.1.26060.3008`, but had not publicly confirmed the alleged post-patch issues at the time of reporting.
Jul 10, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026
Microsoft disclosed that **Microsoft Defender XDR** automatically disrupted a ransomware intrusion at QNET by isolating an endpoint **128 seconds** after the first detection, containing the incident to a single device. According to the incident summary, the attack began when a user opened a malicious file that launched `mshta.exe`, which then reached out to attacker-controlled infrastructure to retrieve a second-stage payload; Defender also observed signs consistent with persistence preparation through **RunMRU** registry activity. Microsoft said its automatic attack disruption capability correlated multiple high-confidence alerts and triggered the **IsolateDevice** response playbook without SOC intervention, severing command-and-control communications before the attackers could establish persistence, move laterally, or pull down additional payloads. The case was presented as an example of Defender XDR's automated attack disruption workflow, which is designed to autonomously contain active attacks by taking response actions such as device isolation once sufficient confidence thresholds are met.
Aug 5, 2026