tag: Detection-Evasion · 4 items
- Engineer — Learn: A useful framing of why session-theft, malicious extensions, and in-browser manipulation leave no classic EDR artifacts — informs decisions about adding browser isolation or enterprise browser controls to the defense stack, but no immediate patch or config action required.
- SOC/IR — Plan: The coverage gaps described (no process creation, no file writes for browser-based session theft) are worth addressing this quarter by evaluating browser telemetry sources — proxy logs, enterprise browser audit events, or identity provider anomaly detection — to compensate for what EDR won’t surface.
- Leader — Skip
- Engineer — Learn: Technique analysis of a crafted phishing URL designed to fool automated security controls; no patch or configuration change required, but useful context for tuning email gateway URL inspection policies.
- SOC/IR — Plan: SANS ISC breaks down specific URL obfuscation methods used to evade scanners — review the full diary to extract patterns and consider adding corresponding URL-decoding or pattern-matching rules to your email security or SIEM pipeline.
- Leader — Skip
- Engineer — Learn: Research reveals that graph-based NIDS benchmarks are largely artifacts of preprocessing and windowing choices, not detector quality — relevant if evaluating or procuring NIDS solutions, but no running system to change today.
- SOC/IR — Learn: The finding that two crafted edges achieve full evasion against multiple detector-dataset pairs is a meaningful signal about coverage gaps in graph-based NIDS; useful context when assessing your network detection stack’s real-world reliability, though no detection tuning is actionable from this paper alone.
- Leader — Skip
- Engineer — Learn: If your org uses Claude-generated content at scale, be aware that claimed watermark-stripping tools exist but are unverifiable; worth monitoring as Anthropic’s detection capability matures before building content-provenance workflows around it.
- SOC/IR — Skip
- Leader — Learn: Watermarking as an AI governance control is less reliable than advertised at this stage; factor into any AI content policy or vendor assurance claims about detectability of LLM-generated output.