8 posts
The encryptor is the terminal event, not the attack. Detection didn't vanish when breakout hit 29 minutes. It relocated to the pre-encryption phases.
Lateral movement moved to the cloud control plane. Each hop is individually authorized, so single-event rules miss the chain.
LOTL didn't add binaries. It commoditized chaining and moved to where EDR can't run. Stop detecting the binary. Detect the chain.
Prompt injection is OWASP's #1 LLM risk and you can't filter it out. Stop detecting the prompt. Detect the lethal trifecta closing in one session.
XZ, tj-actions, Shai-Hulud, Codecov all owned the build, not the code. Scanning is blind to a poisoned build in flight. Detect the runner instead.
Cloud hands every workload a privileged identity by default. Unlike other machine identities it's bound to one host. Use from elsewhere is theft.
OAuth abuse bypasses MFA by attacking authorization, not authentication. Most SOCs don't collect consent-grant telemetry. Here's what to detect.
Most teams 'do DaC' by putting Sigma in a repo. That's the easy 20%. The capability that scales is a tested lifecycle, not a toolchain.