Engineering Corner

September 2026 - Published Detection Rules

• Linux

  • Attempt to Clear Kernel Ring Buffer

  • Potential Disabling of SELinux

  • Direct Modification or Overwrite of Sensitive Authentication Files

  • Linux Process Hooking via GDB

  • Authentication Bypass via User Environment Variable

  • Setcap setuid/setgid Capability Set

• Windows

  • NTDS.dit Backup via NTDSUtil (IFM)

  • Potential Active Directory Replication Account Backdoor

  • Windows - Enable RDP via Registry Modification

• Cisco Duo Security

  • DUO - Low Trust Authentication Assessment

  • DUO - Successful User Bypass Following Novel Access IP Assessment

  • DUO - New MFA User or Device Self-Enrollment Activity

• Microsoft Entra

  • Entra ID Domain Federation Configuration Change

  • Entra ID High Risk Sign-in

  • Entra ID Kali365 Default User-Agent Detected

• FortiGate Firewall

  • FortiGate Suspicious External CAPWAP Access

  • FortiGate Overly Permissive Firewall Policy Created