Weekly detection rule digest covers 73 rule changes across 9 repos, with new Sigma coverage for ADCS CVE-2026-54121 (Certighost), AI agent threat rules, and email evasion detections topping the list. - SigmaHQ shipped 8 new rules for Certighost (CVE-2026-54121): watch Event ID 4886 for 'cdc' or 'rmd' attributes, certsrv.exe making outbound SMB/LDAP connections, and machine accounts matching 'GHOST*$'. Auxiliary rules cover DC machine account TGT/TGS requests (Event IDs 4768/4769) from non-DC source IPs. DCSync detection (Event ID 4662) now includes the DS-Replication-Synchronize GUID and drops the AccessMask requirement. - Splunk added consent.exe child process monitoring (linked to CVE-2024-30051 UAC bypass), PowerShell IEX over DNS TXT queries (Event ID 4104), and sniffing tool execution (Wireshark, tshark, tcpdump). Event ID 5145 Admin share rules tightened with explicit AccessMask bitwise checks (0x2, 0x4) and expanded to .cpl and .sys file extensions. - Sublime Security added 15 email rules: CSS clip-path and zero-value calc() hidden text, zero-width Unicode obfuscation, IP URL octal/decimal integer parsing, and infrastructure flags for SmartApe (AS56694) and Aeza Group LLC bulletproof hosts. SaaS abuse rules cover Evernote, Wufoo, and Cognito Forms. - Fibratus added a rule correlating SMB file creation (srv2.sys/srvnet.sys under PID 4) with subsequent DLL loads by rundll32.exe, regsvr32.exe, or lsass.exe, a direct SMB-to-DLL lateral movement detection. #DFIR_Radar
Post summary
The text reports a set of updated detection rules, including new Sigma routines for Certighost (CVE-2026-54121), but it does not provide any PoC, exploit code, patch details, or evidence of active exploitation.