Behavioral LOLBins detection engine with sequential correlation, PE masquerading checks, and Sysmon integration
I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback.Problem it tries to solve Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context.What the tool doesCollects process telemetry (prefers Sysmon Event ID 1, falls back to psutil)Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.)Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades)Binary masquerading detection via PE OriginalFileNamePPID spoofing anomaly checksCommand-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing)False-positive suppression + de-duplicationTimeline reconstruction (±5–10 min window) + process lineageLocal web dashboard for triageAutomated Markdown incident reports + webhook support (Slack/Discord/SIEM)Architecture highlightsModular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcherRules can be written in YAML (declarative) or pure PythonBuilt-in threat emulation test harness (11 scenarios currently)Current limitationspsutil mode has polling latency (can miss very short-lived processes)Still user-mode only (no kernel/ETW consumer yet)Needs more real-world tuning of suppression rulesGitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-SystemWould love feedback on:Rule coverage / false positive rates you’ve seen with similar approachesMissing high-value sequential chainsWhether the dashboard and timeline reconstruction are useful in practiceAny other LOLBins or techniques I should prioritizeHappy to answer technical questions or discuss design decisions.
Submitted November 9, 2026 at 03:38PM by nimesh404
via reddit https://ift.tt/P5C1HUo
I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback.Problem it tries to solve Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context.What the tool doesCollects process telemetry (prefers Sysmon Event ID 1, falls back to psutil)Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.)Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades)Binary masquerading detection via PE OriginalFileNamePPID spoofing anomaly checksCommand-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing)False-positive suppression + de-duplicationTimeline reconstruction (±5–10 min window) + process lineageLocal web dashboard for triageAutomated Markdown incident reports + webhook support (Slack/Discord/SIEM)Architecture highlightsModular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcherRules can be written in YAML (declarative) or pure PythonBuilt-in threat emulation test harness (11 scenarios currently)Current limitationspsutil mode has polling latency (can miss very short-lived processes)Still user-mode only (no kernel/ETW consumer yet)Needs more real-world tuning of suppression rulesGitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-SystemWould love feedback on:Rule coverage / false positive rates you’ve seen with similar approachesMissing high-value sequential chainsWhether the dashboard and timeline reconstruction are useful in practiceAny other LOLBins or techniques I should prioritizeHappy to answer technical questions or discuss design decisions.
Submitted November 9, 2026 at 03:38PM by nimesh404
via reddit https://ift.tt/P5C1HUo
GitHub
GitHub - nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System
Contribute to nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System development by creating an account on GitHub.
Certificate authority list: every CA's incident record since 2017
https://ift.tt/03q859W
Submitted November 9, 2026 at 07:54PM by certkit
via reddit https://ift.tt/AK2enzW
https://ift.tt/03q859W
Submitted November 9, 2026 at 07:54PM by certkit
via reddit https://ift.tt/AK2enzW
CertKit SSL Certificate Management
Certificate authority list: every CA's incident record since 2017
Certificate authorities in Mozilla's CA program and their incident records since 2017: severity, certificates affected, size, and who found each one.
Lessons from 126 AWS Breach Investigations with Claude Code, Codex and Cursor
https://ift.tt/6zm3GRB
Submitted November 9, 2026 at 09:25PM by elitistAlmond
via reddit https://ift.tt/aEhBveC
https://ift.tt/6zm3GRB
Submitted November 9, 2026 at 09:25PM by elitistAlmond
via reddit https://ift.tt/aEhBveC
CloudAgent
CloudAgent: Lessons from 126 AWS Breach Investigations with Claude Code, Codex and Cursor
126 investigations across seven breached AWS environments: what Claude Code, Codex and Cursor found, missed and inferred, and how an incident-response runbook changed their work.
IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF
https://ift.tt/6ZXmuDf
Submitted November 9, 2026 at 11:11PM by PlasmaJam
via reddit https://ift.tt/GeYh1vp
https://ift.tt/6ZXmuDf
Submitted November 9, 2026 at 11:11PM by PlasmaJam
via reddit https://ift.tt/GeYh1vp
www.sh.consulting
Dangling DNS in 43 State & Local Gov Domains | SH Consulting
We scanned 25,964 US government domains: 43 have SPF, MX, NS or DMARC records that trust expired or typo domains. One typo authorizes 32,066 IPs.
N-able N-central Critical Vulnerabilities: What We Know So Far
https://ift.tt/W2yqCZX
Submitted November 9, 2026 at 11:24PM by ethicalhack3r
via reddit https://ift.tt/AwpJrmM
https://ift.tt/W2yqCZX
Submitted November 9, 2026 at 11:24PM by ethicalhack3r
via reddit https://ift.tt/AwpJrmM
Previdian
N-able N-central Critical Vulnerabilities: What We Know So Far
N-able has taken its hosted N-central classic environments offline following the public disclosure of critical vulnerabilities in N-central.
The company is also advising customers running on-premises N-central servers to take them offline until further notice…
The company is also advising customers running on-premises N-central servers to take them offline until further notice…
Electron, we have a problem
https://ift.tt/SFhNjbw
Submitted November 10, 2026 at 05:08PM by pascalschaerli
via reddit https://ift.tt/41aXndL
https://ift.tt/SFhNjbw
Submitted November 10, 2026 at 05:08PM by pascalschaerli
via reddit https://ift.tt/41aXndL
Pascal Schärli
Electron, we have a problem
Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your network install malware on your machine.
Kubernetes Non-Core Security Audit
https://ift.tt/ZtmUseH
Submitted November 10, 2026 at 08:57PM by smaury
via reddit https://ift.tt/FYSBACn
https://ift.tt/ZtmUseH
Submitted November 10, 2026 at 08:57PM by smaury
via reddit https://ift.tt/FYSBACn
Shielder
Shielder - Kubernetes Non-Core Security Audit
Security audit of projects in the Kubernetes non-core ecosystem. Sponsored by the CNCF (Cloud Native Computing Foundation), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.
Cracking Server 2022 NTLMv1-SSP Hashes with Rainbow Tables
https://ift.tt/3wrES59
Submitted November 11, 2026 at 01:23AM by elohhs
via reddit https://ift.tt/onlU6ys
https://ift.tt/3wrES59
Submitted November 11, 2026 at 01:23AM by elohhs
via reddit https://ift.tt/onlU6ys
hun.io
Cracking downgraded NTLMv1 SSP hashes with rainbow tables
It works with Windows Server 2022!
Supabase Security findings why RLS is only 25% of the issues
https://ift.tt/0o5GDyw
Submitted November 11, 2026 at 03:51AM by 1thirteenthirtyseven
via reddit https://ift.tt/LOFwxdK
https://ift.tt/0o5GDyw
Submitted November 11, 2026 at 03:51AM by 1thirteenthirtyseven
via reddit https://ift.tt/LOFwxdK
Oneleet
Supabase Security: Why RLS Is Only 25% of the Problem | Oneleet
Our research breakdown of the Supabase vulnerabilities we found across nearly 200 companies and how our ASM scanner detects them.
2.4% of AFRINIC’s IPv4 addresses answer from outside Africa, and about 81% of those sit in one company’s four blocks
https://ift.tt/eixYIcH
Submitted November 11, 2026 at 07:42PM by seremot
via reddit https://ift.tt/G7BwZx6
https://ift.tt/eixYIcH
Submitted November 11, 2026 at 07:42PM by seremot
via reddit https://ift.tt/G7BwZx6
ipinfo.io
One Company Accounts for 80% of AFRINIC's IP Addresses Being Used Outside Africa | IPinfo.io
IPinfo's WHEREIS research reveals where IP addresses are used outside their registered regions and why measurement-based geolocation matters.
ScriptBlock Smuggling - AMSI Evasion
https://ift.tt/8MZew4l
Submitted November 11, 2026 at 08:03PM by netbiosX
via reddit https://ift.tt/yaTojFP
https://ift.tt/8MZew4l
Submitted November 11, 2026 at 08:03PM by netbiosX
via reddit https://ift.tt/yaTojFP
Purple Team
ScriptBlock Smuggling
ScriptBlock Smuggling is a PowerShell evasion technique that creates a mismatch between the script text presented to security controls and the instructions actually executed. A threat actor can man…
Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits
https://ift.tt/BAdZTUa
Submitted November 11, 2026 at 08:25PM by Much-Television-9449
via reddit https://ift.tt/5uPO3lQ
https://ift.tt/BAdZTUa
Submitted November 11, 2026 at 08:25PM by Much-Television-9449
via reddit https://ift.tt/5uPO3lQ
KYLES INVESTIGATION
Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits - Nationwide Private Investigator…
By Mark Kyle November 11, 2026 Security firm Cynet has reported attempts to run PowerShell reverse shells on Qlik Sense servers at several European organizations. The attempts were blocked, but the attacker’s infrastructure contained tooling for other enterprise…
Hide and Stream: Ambient Aircraft-DopplerGeolocation of Live Audio, and a Defense
https://ift.tt/8CEH0Ly
Submitted November 11, 2026 at 08:45PM by lymn
via reddit https://ift.tt/Cevt145
https://ift.tt/8CEH0Ly
Submitted November 11, 2026 at 08:45PM by lymn
via reddit https://ift.tt/Cevt145
History of Password Cracking
https://ift.tt/DzZMsc9
Submitted November 12, 2026 at 06:32AM by netmux
via reddit https://ift.tt/ji4hSQU
https://ift.tt/DzZMsc9
Submitted November 12, 2026 at 06:32AM by netmux
via reddit https://ift.tt/ji4hSQU
Netmux
History of Password Cracking — netmux
How we defended against an AI-driven ARTEX attack
https://ift.tt/DrQM5yW
Submitted November 12, 2026 at 07:06PM by Far_Ice2481
via reddit https://ift.tt/8Fyzpag
https://ift.tt/DrQM5yW
Submitted November 12, 2026 at 07:06PM by Far_Ice2481
via reddit https://ift.tt/8Fyzpag
Eye Research
Machine speed: how we defended against an AI-driven attack
Inside an incident response against an AI-driven attack: how fast the attacker's agents adapted, and how we used AI agents of our own to fight back.
Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt
https://ift.tt/BjOto7S
Submitted November 12, 2026 at 07:48PM by ultrastrik3
via reddit https://ift.tt/Bzora4l
https://ift.tt/BjOto7S
Submitted November 12, 2026 at 07:48PM by ultrastrik3
via reddit https://ift.tt/Bzora4l
UltraStrike Cybersecurity
Claude Code VSCode Plugin: Workspace Escape Via Misleading Permission Prompt
Imagine an AI coding tool asks you for permission to access a file. You look at the approval prompt and notice the file path appears to land in the current workspace. You shrug, wondering why the agent asked for access to the current workspace, and you click…
prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)
https://ift.tt/12F5m7T
Submitted November 12, 2026 at 09:51PM by wtfse
via reddit https://ift.tt/0GOk2sF
https://ift.tt/12F5m7T
Submitted November 12, 2026 at 09:51PM by wtfse
via reddit https://ift.tt/0GOk2sF
Mehmet Ince @mdisec - Vulnerability Researcher | Building security products | Security Advisor | Amateur Muay Thai fighter
Part 3/6 | How I Ended Up Turning a 22-Year-Old PostgreSQL Type-Confusion Primitive into RCE (CVE-2026-6460) - Mehmet Ince @mdisec…
If you had told me in April 2026 one question “Mehmet, can we use managed PostgreSQL for this project?” would send me into the deepest rabbit hole of my life, I would have laughed. Months later, I finally found the bottom of that rabbit hole. It was a 22…
NvRoot (CVE-2026-47591) where in neocloud multi-tenant GPU environments, rent = root. Essentially it's a dirty page cache LPE using GPUs as catalyzer
https://ift.tt/47NybkL
Submitted November 12, 2026 at 10:39PM by ChrisAtStealthium
via reddit https://ift.tt/mSNny19
https://ift.tt/47NybkL
Submitted November 12, 2026 at 10:39PM by ChrisAtStealthium
via reddit https://ift.tt/mSNny19
Stealthium
From Rent to Root: Introducing NvRoot
NvRoot (CVE-2026-47591) is an NVIDIA driver local privilege escalation vulnerability found by the Stealthium team. We built a working exploit to demonstrate the bug and confirm root, and reported it to NVIDIA. We also built detection for the bug’s exploitation…
JSON Schema References Considered Harmful
https://ift.tt/ysMKJEr
Submitted November 13, 2026 at 04:05AM by allacebeats
via reddit https://ift.tt/WuZphGM
https://ift.tt/ysMKJEr
Submitted November 13, 2026 at 04:05AM by allacebeats
via reddit https://ift.tt/WuZphGM
Svix Blog
JSON Schema References Considered Harmful
Walking through a security issue caused by a surprising behavior in JSON Schema validation
OWASP Top 10 Neocloud and AI Data Center Security Risks project released
https://ift.tt/s8HtBZ5
Submitted November 13, 2026 at 04:28AM by Pale_Fly_2673
via reddit https://ift.tt/FNeuDdQ
https://ift.tt/s8HtBZ5
Submitted November 13, 2026 at 04:28AM by Pale_Fly_2673
via reddit https://ift.tt/FNeuDdQ
OWASP Foundation
OWASP Top 10 Neocloud & AI Data Center Security Risks: Securing the Layer AI Runs On | OWASP Foundation
A new OWASP Incubator Project gives neocloud providers, neocloud users, and AI data center operators a shared framework for understanding and addressing AI infrastructure security risks.
Massive ‘wfx-loot’ Campaign Probes Over 60,000 GitHub Repositories to Steal CI and Cloud Secrets
https://ift.tt/mGu9QWt
Submitted November 13, 2026 at 06:42AM by Much-Television-9449
via reddit https://ift.tt/hB54tfo
https://ift.tt/mGu9QWt
Submitted November 13, 2026 at 06:42AM by Much-Television-9449
via reddit https://ift.tt/hB54tfo
KYLES INVESTIGATION
Massive ‘wfx-loot’ Campaign Probes Over 60,000 GitHub Repositories to Steal CI and Cloud Secrets - Nationwide Private Investigator…
November 12, 2026 – An automated supply chain attack is sweeping through GitHub, using thousands of hijacked developer accounts to plant secret-stealing code in build pipelines. Security firms including Aikido Security, StepSecurity and SafeDep say the attacker…