Hardening on CuraSec

Windows Named Pipe Abuse: Access Control Hardening Guidance

Sun, 23 Aug 2026 11:32:55 +0000

Engineer — Learn: Good conceptual reminder that named-pipe ACLs are an exploitable surface in Windows services, but no CVE, no KEV, and no exploitation signal means no immediate patching or configuration change is required — file this as design guidance for future Windows service work.
SOC/IR — Learn: Named-pipe abuse for lateral movement and C2 tunneling is already a documented ATT&CK technique (T1559.001); this article adds no new IOCs, campaigns, or detection angles beyond what existing Sigma rules and EDR behavioral detections already cover.
Leader — Skip

Fri, 24 Jul 2026 12:43:46 +0000

Engineer — Learn: A reference collection for Windows Server defensive hardening; worth bookmarking if you need structured guidance on configuration baselines, but no immediate action required.
SOC/IR — Skip
Leader — Skip

Thu, 16 Jul 2026 12:18:39 +0000

Engineer — Plan: Mandiant assessments routinely find unauthenticated Cloud Run/Functions exposed to the internet; audit your serverless inventory for missing auth controls and apply the hardening patterns (least-privilege service accounts, input validation, network egress restrictions) this quarter. No active exploitation signals elevate this to Act.
SOC/IR — Learn: The LFI/RFI and command-injection paths described could inform detection logic for serverless workloads, but there are no IOCs, no named campaign, and no novel TTPs here — no immediate hunt or rule-writing required.
Leader — Skip