Topic
Searching existing systems, appliances and logs for evidence of intrusion that automated alerting did not catch.
Tanium relaunched Tanium Security Operations around Endpoint Drift, a detector that ranks endpoints acting out of character against their own learned baseline. The bet is that AI-assisted intruders will log in with stolen credentials and run IT's own admin tools, which a list of known-bad files will not catch.
Reality
Tanium shipped detection, response and hunting tools on its Atlas agent platform that query endpoints live, instead of SIEM logs it says can be hours old. Teams rolling them out have to decide which actions, such as quarantining a host, an agent may take without a person signing off.
Reality
Japan's government will build and test methods to find attackers already inside power and telecom networks, with costs in fiscal 2027 budget requests. For operators, the job extends past answering alerts to searching for intruders who never set one off.
Reality
Automated exploit attempts hit MediaWiki's External Data extension within a day of the 25 September disclosure of CVE-2026-100382, a CVSS 10.0 flaw. Upgrading to 3.7 closes the entry point but leaves behind any PHP shell an attacker already wrote to disk.
Reality
Cisco Talos found a 16.4MB Go implant that asks DeepSeek, Qwen, Mistral and Gemini what to do next and acts on the winning vote, treating the providers themselves as its C2 infrastructure. Talos has no confirmation it was ever deployed.
Perspective Coverage
7 publishersReality
Microsoft Defender Experts tied 30+ domains to a macOS stealer by matching execution, staging and upload behaviour. The count is incidental; the method is the part worth copying.
Perspective Coverage
3 publishersReality
Half of respondents to the SANS 2026 Threat Hunting Survey named data quality or quantity as their top hunting barrier. The most cited gaps are cloud and identity logs, the telemetry needed to catch intruders who use administrators' own tools.
Reality
SANS's 2026 hunting survey found 72.7% of hunters who caught nation-state actors saw them living off the land, against 63.4% for ransomware crews. Hunters rank data quality as their top barrier, so detecting misused admin tools starts with the telemetry those hunts depend on.
Reality
Cisco Talos says its CLOSEDQUORUM sample asks four language models for executable decisions, tallies the votes and acts on the winner. An entire phase of the attack runs while the operator is offline.
Reality
Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.
Reality
CVE-2026-76461 was in use before Monday's advisory and Cisco says multiple customers were likely compromised first, so a gateway patched this week still needs a hunt against indicators that root access can erase.
Reality