Detection Engineering Brief - Saturday, August 1, 2026

Detection Engineering Summary

This brief produced 3 detection candidates.

0 production candidates, 3 hunting-only, 0 require environment mapping, and 0 rejected.

3 detections include KQL. 3 include ATT&CK mappings. 3 include triage guidance.

Search metadata extracted for this run includes: CVE-2026-66066, T1190, Ruby on Rails, Active Storage, libvips, Xcode, macOS, XCSSET, T1059, T1071, T1547, T1021.

No explicit IOCs were preserved for this run.

Deployment blockers or scheduling gates were identified for: CVE-2026-66066 Rails Active Storage Sensitive File Read via libvips Process; CVE-2026-66066 Rails libvips Spawning Unexpected Child Processes or Outbound Connections Post Image Upload; XCSSET Malware Infection of Xcode Projects via Non-Xcode Process File Writes.

Detection candidates were derived from recent cybersecurity reporting, operational threat research, RSS intelligence feeds, and related detection engineering sources.

Detection 1: CVE-2026-66066 Rails Active Storage Sensitive File Read via libvips Process

Detection Opportunity

Unauthenticated attacker reads sensitive files accessible to the Rails application process by exploiting CVE-2026-66066 in Active Storage image processing with libvips.

Intelligence Context

• Rapid7: KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails — https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails
  • Context: CVE-2026-66066 allows an unauthenticated attacker to read files accessible to the Rails application process by submitting malicious image uploads processed by libvips via Active Storage. Rapid7 reported arbitrary file read as confirmed and RCE as possible.

Search Metadata

• CVEs: CVE-2026-66066
• Threat actors: Not specified
• ATT&CK tags: T1190, T1059, T1071
• Products: Ruby on Rails, Active Storage, libvips
• Platforms: Not specified
• Malware: Not specified
• Tools: Not specified
• Search tags: CVE-2026-66066, T1190, Ruby on Rails, Active Storage, libvips, T1059, T1071

Relevant IOCs

No explicit IOCs were preserved for this detection.

Metadata

• Readiness: hunting-only
• Platform: Defender XDR
• Analytic type: hunting
• Severity recommendation: high
• MITRE ATT&CK: Initial Access: T1190 Exploit Public-Facing Application (high); Execution: T1059 Command and Scripting Interpreter (medium); Command and Control: T1071 Application Layer Protocol (low)

Deployment Gates

• Do not schedule yet; validate as an analyst-led hunt first.

Required telemetry:

• DeviceFileEvents, DeviceNetworkEvents

KQL

let sensitivePathPatterns = dynamic(["/etc/passwd", "/etc/shadow", "/proc/self", "secrets.yml", "credentials.yml", "master.key", ".env", "database.yml"]);
let railsProcesses = dynamic(["ruby", "puma", "unicorn", "rails", "vips", "libvips"]);
let lookback = 1h;
let fileReads =
    DeviceFileEvents
    | where Timestamp > ago(lookback)
    | where ActionType in ("FileRead", "FileAccessed")
    | where InitiatingProcessName has_any (railsProcesses)
    | where FolderPath has_any (sensitivePathPatterns) or FileName has_any (sensitivePathPatterns)
    | project
        DeviceName,
        FileReadTime = Timestamp,
        InitiatingProcessName,
        InitiatingProcessId,
        FolderPath,
        FileName,
        ActionType;
let inboundWeb =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessName has_any (railsProcesses)
    | where ActionType in ("ConnectionSuccess", "InboundConnectionAccepted")
        or RemotePort in (80, 443, 3000, 8080)
    | project
        DeviceName,
        NetworkTime = Timestamp,
        InitiatingProcessName,
        InitiatingProcessId,
        RemoteIP,
        RemotePort;
fileReads
| join kind=inner inboundWeb on DeviceName, InitiatingProcessId
| where NetworkTime < FileReadTime
| where FileReadTime between (NetworkTime .. (NetworkTime + 5m))
| project
    DeviceName,
    NetworkTime,
    FileReadTime,
    InitiatingProcessName,
    InitiatingProcessId,
    FolderPath,
    FileName,
    ActionType,
    RemoteIP,
    RemotePort
| sort by FileReadTime desc

False Positives / Tuning / Risks / Caveats

Expected false positives:

• Ruby or Puma processes reading /etc/passwd during NSS lookups for user resolution at startup.
• Configuration management agents (Chef, Puppet, Ansible) running as ruby that legitimately read secrets.yml or database.yml during deployment.
• Monitoring tools that inspect /proc/self for process introspection.

Tuning notes:

• After baselining, add legitimate process names that read sensitive paths during normal operation to an exclusion dynamic list.
• Expand sensitivePathPatterns to include application-specific secret paths such as config/master.key absolute paths relevant to the deployment.
• If RemotePort-based inbound detection produces noise from health checks, restrict to ActionType == ‘InboundConnectionAccepted’ only.

Risks / caveats:

• FileRead and FileAccessed ActionType values in DeviceFileEvents on Linux require MDE advanced audit configuration; these action types may not appear without explicit auditd or fanotify coverage enabled.
• RemoteUrl is not a standard field in DeviceNetworkEvents; the correct field is RemoteIP for IP addresses and RemoteUrl is only populated for HTTP-layer events. Using RemoteUrl as an IP label would produce empty results.
• The 5-minute correlation window between inbound connection and file read may need adjustment based on observed Rails request processing latency in the target environment.
• Joining on InitiatingProcessId assumes the same process handles both the network connection and the file read; in multi-threaded Puma workers the PID may differ from the thread handling the upload.

Triage Runbook

First 15 minutes:

• Confirm the host runs Ruby on Rails/Active Storage with libvips and identify whether the alert aligns with a recent image upload request.
• Check whether the file read targeted sensitive paths such as /etc/passwd, /etc/shadow, secrets.yml, master.key, .env, or database.yml and whether the read occurred shortly after an inbound web connection.
• Review the initiating process and parent process chain to verify the read came from the Rails worker or libvips path rather than a deployment, backup, or monitoring job.
• Look for any immediate follow-on activity from the same host or process such as unexpected child processes, outbound connections, or additional sensitive file access.

Evidence to collect:

• DeviceFileEvents for the file read details, including FolderPath, FileName, ActionType, InitiatingProcessName, and InitiatingProcessId.
• DeviceNetworkEvents around the same time to confirm the inbound connection, source IP, RemotePort, and whether the network event preceded the file read.
• Process context for the Rails worker or libvips process, including command line, parent process, and any child processes spawned near the alert time.
• Application and web server logs for the upload request, request path, authenticated user if any, and the uploaded file name or content type.

Pivot points:

• DeviceFileEvents filtered to the same DeviceName and InitiatingProcessId for additional sensitive file reads.
• DeviceNetworkEvents for the same DeviceName to identify repeated inbound requests, source IPs, and timing relative to the file read.
• DeviceProcessEvents for the same host to check for shell, scripting, curl, wget, or other suspicious child processes.
• Web application and reverse proxy logs to correlate the upload request with the alert timestamp.

Benign explanations:

• Ruby or Puma may read /etc/passwd during startup or user resolution, especially on Linux systems with NSS lookups.
• Configuration management or deployment automation running as ruby may legitimately read secrets.yml or database.yml during application rollout.
• Monitoring or health-check tooling may inspect process or filesystem state and create file access telemetry that resembles exploitation.

Escalation criteria:

• Escalate immediately if the read targeted secrets, credential files, or /etc/shadow, or if the same host shows shell spawning or outbound connections after the upload.
• Escalate if the source IP is external, the request was unauthenticated, or the upload path is not expected in normal application use.
• Escalate if multiple sensitive files were accessed in a short window or if the same process repeats the behavior across several requests.
• Escalate if application logs show a suspicious image upload, malformed file, or errors consistent with parser abuse.

Containment actions:

• If exploitation is plausible, temporarily disable or restrict the affected upload endpoint or image-processing workflow until the host is reviewed.
• Isolate the application host if there is evidence of credential access, post-exploitation activity, or repeated suspicious reads from the same process.
• Rotate any secrets that may have been exposed if the alert involved application keys, environment files, or database credentials.
• Preserve volatile evidence before remediation, including process state, logs, and the suspicious uploaded file if available.

Closure criteria:

• The file read is confirmed to be a known benign startup or deployment access pattern and no other suspicious activity is present.
• Application and network logs show the event was tied to a legitimate upload or internal maintenance action, not an external exploit attempt.
• No additional sensitive file access, child process creation, or outbound connections are observed from the same host or process.
• The environment owner confirms the process and file path are expected and the behavior matches established baseline activity.

Detection 2: CVE-2026-66066 Rails libvips Spawning Unexpected Child Processes or Outbound Connections Post Image Upload

Detection Opportunity

Malicious image uploads to a Rails Active Storage endpoint trigger libvips processing that spawns unexpected child processes or initiates outbound network connections, indicating possible remote code execution via CVE-2026-66066.

Intelligence Context

• Rapid7: KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails — https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails
  • Context: Rapid7 assessed that malicious image uploads processed by libvips through Active Storage could enable RCE. Post-exploitation indicators would include libvips or the Rails worker spawning shell processes or making unexpected outbound connections after an upload request.

Search Metadata

• CVEs: CVE-2026-66066
• Threat actors: Not specified
• ATT&CK tags: T1190, T1059, T1071
• Products: Ruby on Rails, Active Storage, libvips
• Platforms: Not specified
• Malware: Not specified
• Tools: Not specified
• Search tags: CVE-2026-66066, T1190, Ruby on Rails, Active Storage, libvips, T1059, T1071

Relevant IOCs

No explicit IOCs were preserved for this detection.

Metadata

• Readiness: hunting-only
• Platform: Defender XDR
• Analytic type: hunting
• Severity recommendation: high
• MITRE ATT&CK: Initial Access: T1190 Exploit Public-Facing Application (high); Execution: T1059 Command and Scripting Interpreter (medium); Command and Control: T1071 Application Layer Protocol (low)

Deployment Gates

• Do not schedule yet; validate as an analyst-led hunt first.

Required telemetry:

• DeviceProcessEvents, DeviceNetworkEvents

KQL

let railsProcesses = dynamic(["ruby", "puma", "unicorn", "rails", "vips", "libvips"]);
let suspiciousChildren = dynamic(["sh", "bash", "zsh", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "nmap", "id", "whoami"]);
let lookback = 1h;
let rceSpawn =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessName has_any (railsProcesses)
    | where FileName has_any (suspiciousChildren)
    | project
        DeviceName,
        SpawnTime = Timestamp,
        InitiatingProcessName,
        InitiatingProcessId,
        ChildProcess = FileName,
        ProcessCommandLine;
let egressAfterSpawn =
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessName has_any (railsProcesses)
    | where ActionType == "ConnectionSuccess"
    | where RemoteIP !in ("127.0.0.1", "::1")
    | where isnotempty(RemoteIP)
    | project
        DeviceName,
        EgressTime = Timestamp,
        EgressProcessName = InitiatingProcessName,
        EgressProcessId = InitiatingProcessId,
        RemoteIP,
        RemotePort;
rceSpawn
| join kind=leftouter (
    egressAfterSpawn
) on DeviceName
| where isnull(EgressTime) or (EgressTime >= SpawnTime and EgressTime <= SpawnTime + 10m)
| summarize
    SpawnTime = any(SpawnTime),
    InitiatingProcessName = any(InitiatingProcessName),
    InitiatingProcessId = any(InitiatingProcessId),
    ProcessCommandLine = any(ProcessCommandLine),
    EgressTime = any(EgressTime),
    RemoteIP = any(RemoteIP),
    RemotePort = any(RemotePort)
    by DeviceName, ChildProcess
| sort by SpawnTime desc

False Positives / Tuning / Risks / Caveats

Expected false positives:

• Rails applications that shell out to system utilities (ImageMagick, ffmpeg, exiftool) via Open3 or backtick calls during normal image processing.
• Deployment scripts that run as the Rails process user and invoke bash or python for configuration tasks.
• Outbound connections to S3, GCS, or Azure Blob Storage endpoints from the Rails worker after processing an upload.

Tuning notes:

• After baselining, build an allowlist of known-good child processes spawned by the Rails worker and add them to a not-in exclusion against ChildProcess.
• Add known CDN, S3, and object storage IP ranges to a RemoteIP exclusion dynamic list to reduce egress false positives.
• Consider splitting into two separate queries: one for shell spawn only (higher confidence) and one for egress only (lower confidence) to allow independent severity tuning.

Risks / caveats:

• RemoteUrl is not a standard field in DeviceNetworkEvents for non-HTTP events; the original query projected RemoteUrl which may be empty for TCP connections. Replaced with RemoteIP and RemotePort.
• InitiatingProcessName in DeviceProcessEvents reflects the direct parent process name; if libvips is invoked as a library rather than a standalone process, it will not appear as InitiatingProcessName and the query will produce no results for that spawn path.
• The leftouter join on DeviceName alone for egress can still produce false correlations if multiple Rails workers run on the same host; adding EgressProcessId to the join would be more precise but requires the egress to originate from the same PID as the spawn, which may not hold if the child process makes the outbound connection.
• The 10-minute egress correlation window is a heuristic; adjust based on observed application behavior.

Triage Runbook

First 15 minutes:

• Verify the child process name and command line to determine whether the Rails or libvips process spawned a shell, scripting interpreter, downloader, or other suspicious utility.
• Check whether the alert followed a recent image upload or inbound web request to the Rails application and whether the timing is consistent with request processing.
• Review the destination RemoteIP and RemotePort to decide whether the outbound connection is expected application traffic or an unusual external callback.
• Look for additional process creation, file access, or network activity from the same host that would indicate a broader compromise.

Evidence to collect:

• DeviceProcessEvents for the child process details, including FileName, ProcessCommandLine, InitiatingProcessName, and InitiatingProcessId.
• DeviceNetworkEvents for outbound connections from the same host and time window, including RemoteIP, RemotePort, and ActionType.
• DeviceFileEvents for any sensitive file reads or writes that occurred near the spawn time.
• Web server or application logs showing the upload request, source IP, request path, and any errors during image processing.

Pivot points:

• DeviceProcessEvents on the same DeviceName to find additional child processes spawned by the Rails worker or libvips process.
• DeviceNetworkEvents on the same DeviceName to identify repeated outbound connections or callbacks after the upload.
• DeviceFileEvents for the same DeviceName and InitiatingProcessId to check for sensitive file reads or credential access.
• Proxy, firewall, or DNS logs to validate whether the RemoteIP is a known cloud storage, CDN, or internal service endpoint.

Benign explanations:

• Rails applications sometimes shell out to ImageMagick, ffmpeg, exiftool, or similar utilities during normal media processing.
• Deployment or maintenance scripts may run as the application user and invoke bash, python, or ruby for legitimate configuration tasks.
• Outbound connections to S3, GCS, Azure Blob Storage, or internal APIs may be normal after file uploads or media processing.

Escalation criteria:

• Escalate if the child process is a shell, downloader, or reconnaissance tool such as bash, sh, curl, wget, nc, nmap, id, or whoami.
• Escalate if the outbound connection is to an unfamiliar external IP, especially if it occurs shortly after the upload and is not tied to a known cloud or internal service.
• Escalate if the same host also shows sensitive file reads, credential access, or repeated suspicious process spawning.
• Escalate if the command line indicates command injection, encoded payloads, or unexpected script execution from the Rails worker.

Containment actions:

• If the child process or outbound connection is suspicious, isolate the host or at minimum block the suspicious destination IP while investigation continues.
• Suspend the affected upload or image-processing workflow if exploitation is likely and the service can be safely paused.
• Preserve process, network, and application logs before restarting services or applying patches.
• Rotate credentials if the process accessed secrets or if there is evidence of command execution on the host.

Closure criteria:

• The child process is confirmed to be a known-good utility used by the application or deployment workflow and the destination is an approved service.
• No additional suspicious processes, file reads, or outbound connections are found on the host during the alert window.
• Application logs show the activity was triggered by a legitimate upload and matches expected processing behavior.
• The environment owner validates the command line and network destination as normal for this service.

Detection 3: XCSSET Malware Infection of Xcode Projects via Non-Xcode Process File Writes

Detection Opportunity

XCSSET malware infects macOS developer Xcode projects by writing or modifying files within Xcode project directories from processes that are not Xcode itself, indicating malicious injection into the development environment.

Intelligence Context

• Unit 42: The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version — https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/
  • Context: Unit 42 analysis of XCSSET v40 confirms the malware targets macOS developers by infecting Xcode projects. The infection mechanism involves file modifications within Xcode project directories initiated by processes other than Xcode, enabling persistence and propagation through shared developer repositories.

Search Metadata

• CVEs: Not specified
• Threat actors: Not specified
• ATT&CK tags: T1547, T1021
• Products: Xcode
• Platforms: macOS
• Malware: XCSSET
• Tools: Not specified
• Search tags: Xcode, macOS, XCSSET, T1547, T1021

Relevant IOCs

No explicit IOCs were preserved for this detection.

Metadata

• Readiness: hunting-only
• Platform: Defender XDR
• Analytic type: hunting
• Severity recommendation: medium
• MITRE ATT&CK: Persistence: T1547 Boot or Logon Autostart Execution (low); Lateral Movement: T1021 Remote Services (low)

Deployment Gates

• Do not schedule yet; validate as an analyst-led hunt first.

Required telemetry:

• DeviceFileEvents, DeviceProcessEvents

KQL

let xcodeTools = dynamic(["Xcode", "xcodebuild", "xcrun", "swift", "clang", "ld", "libtool", "dsymutil"]);
let xcssetIndicatorPaths = dynamic([".xcodeproj", ".xcworkspace", "/DerivedData/"]);
let suspiciousWriters = dynamic(["bash", "sh", "zsh", "python", "python3", "ruby", "perl", "osascript", "curl", "wget"]);
let lookback = 7d;
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath has_any (xcssetIndicatorPaths)
| where InitiatingProcessName has_any (suspiciousWriters)
| where not(InitiatingProcessName has_any (xcodeTools))
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName has_any (suspiciousWriters)
    | project
        DeviceName,
        ProcessId,
        ProcessCommandLine,
        ProcessTime = Timestamp
) on DeviceName, $left.InitiatingProcessId == $right.ProcessId
| project
    DeviceName,
    Timestamp,
    InitiatingProcessName,
    InitiatingProcessId,
    FolderPath,
    FileName,
    ActionType,
    ProcessCommandLine
| sort by Timestamp desc

False Positives / Tuning / Risks / Caveats

Expected false positives:

• CocoaPods (ruby) modifying .xcworkspace files during pod install or pod update operations.
• Fastlane (ruby) scripts that modify project files during automated build and release workflows.
• Git hooks implemented as bash or python scripts that touch files within .xcodeproj directories.
• IDE plugins or extensions (AppCode, Nova) that write to project structures.

Tuning notes:

• After baselining, add CocoaPods, Fastlane, and other legitimate ruby-based build tools to the xcodeTools exclusion list or create a separate allowlist matched on ProcessCommandLine patterns.
• Consider narrowing FolderPath matching to specific subdirectories within .xcodeproj such as project.pbxproj modifications, which are the most common XCSSET injection targets.
• Reduce lookback to 1d for higher-frequency scheduled hunting runs once the allowlist is established.

Risks / caveats:

• MDE macOS file event telemetry coverage for .xcodeproj and .xcworkspace directory writes depends on the macOS MDE sensor version and system extension permissions; FolderPath population for nested project structures may be incomplete on older sensor versions.
• DeviceFileEvents on macOS may not emit FileModified for all in-place file edits depending on the filesystem operation type; some XCSSET writes may appear only as FileCreated.
• The 7-day lookback window will produce a large result set in active development environments; analysts should filter by DeviceName or user context during triage.
• Joining DeviceProcessEvents on ProcessId to retrieve ProcessCommandLine assumes the process creation event is within the lookback window; for long-running ruby or bash processes the creation event may have aged out.

Triage Runbook

First 15 minutes:

• Identify the exact file path written and confirm whether it is inside an .xcodeproj, .xcworkspace, or DerivedData path.
• Check the initiating process name and command line to see whether the writer is a known build tool, dependency manager, or script used by the development team.
• Determine whether the affected host is a developer workstation, CI runner, or build server and whether the timing matches a normal build or dependency install.
• Look for other recent file writes in the same project directory that could indicate broader tampering or propagation.

Evidence to collect:

• DeviceFileEvents for the modified files, including FolderPath, FileName, ActionType, InitiatingProcessName, and InitiatingProcessId.
• DeviceProcessEvents for the writer process to capture ProcessCommandLine, parent process, and any related child processes.
• Source control or build system logs to determine whether the file change was expected from a commit, dependency install, or automated build.
• User context and host role information to confirm whether the machine is used for Xcode development or CI automation.

Pivot points:

• DeviceFileEvents on the same DeviceName and project path to find additional file modifications or renames.
• DeviceProcessEvents for the same DeviceName to identify suspicious scripting, archive, or download activity around the write time.
• Source control audit logs or CI logs to correlate the file change with a known build or commit.
• Endpoint telemetry for the same user or host to check for other developer project tampering across repositories.

Benign explanations:

• CocoaPods, Fastlane, Carthage, or other build automation tools may legitimately modify Xcode project files during dependency installation or release workflows.
• Git hooks, IDE plugins, or custom build scripts may write to .xcodeproj or .xcworkspace directories as part of normal development.
• DerivedData and workspace files are often rewritten during builds and may generate noisy file events on developer machines.

Escalation criteria:

• Escalate if the writer is an unexpected script, downloader, or shell process and the file path is a project file rather than a build artifact.
• Escalate if multiple Xcode projects or repositories are modified from the same non-Xcode process, suggesting propagation.
• Escalate if the host is not a developer or build system but still writes into Xcode project directories.
• Escalate if the file changes are not tied to a known commit, build job, or approved automation account.

Containment actions:

• If malicious modification is likely, isolate the developer workstation or CI runner from the network to prevent further spread through shared repositories.
• Quarantine or revert the affected project files from a known-good source control revision.
• Preserve the modified project files and process telemetry before cleaning the host.
• Reset credentials or tokens used by the affected developer or build automation account if the host is compromised.

Closure criteria:

• The file write is confirmed to be from an approved build tool, dependency manager, or developer workflow.
• Source control or CI logs match the file change to a known commit, build, or automation task.
• No additional suspicious file writes, downloads, or script execution are found on the host.
• The project owner confirms the modified files are expected and no other repositories are affected.

Recommended Next Actions

Pre-Deployment Checklist by Dependency Type

Schema / correlation keys:

• CVE-2026-66066 Rails Active Storage Sensitive File Read via libvips Process: Do not schedule yet; validate as an analyst-led hunt first.
• CVE-2026-66066 Rails libvips Spawning Unexpected Child Processes or Outbound Connections Post Image Upload: Do not schedule yet; validate as an analyst-led hunt first.
• XCSSET Malware Infection of Xcode Projects via Non-Xcode Process File Writes: Do not schedule yet; validate as an analyst-led hunt first.

Shared-table notes:

• DeviceFileEvents: shared by CVE-2026-66066 Rails Active Storage Sensitive File Read via libvips Process; XCSSET Malware Infection of Xcode Projects via Non-Xcode Process File Writes
• DeviceNetworkEvents: shared by CVE-2026-66066 Rails Active Storage Sensitive File Read via libvips Process; CVE-2026-66066 Rails libvips Spawning Unexpected Child Processes or Outbound Connections Post Image Upload
• DeviceProcessEvents: shared by CVE-2026-66066 Rails libvips Spawning Unexpected Child Processes or Outbound Connections Post Image Upload; XCSSET Malware Infection of Xcode Projects via Non-Xcode Process File Writes

Sequenced Deployment Plan

1. Keep hunting-only detections in analyst-led mode until their promotion criteria are met: CVE-2026-66066 Rails Active Storage Sensitive File Read via libvips Process; CVE-2026-66066 Rails libvips Spawning Unexpected Child Processes or Outbound Connections Post Image Upload; XCSSET Malware Infection of Xcode Projects via Non-Xcode Process File Writes.

Hunting Agenda and Promotion Criteria

• CVE-2026-66066 Rails Active Storage Sensitive File Read via libvips Process: Do not schedule yet; validate as an analyst-led hunt first.; confirm required file-access telemetry exists and produces representative events; prove correlation keys join correctly on real tenant telemetry.
• CVE-2026-66066 Rails libvips Spawning Unexpected Child Processes or Outbound Connections Post Image Upload: Do not schedule yet; validate as an analyst-led hunt first.; baseline expected benign activity and define an alert-volume threshold; prove correlation keys join correctly on real tenant telemetry.
• XCSSET Malware Infection of Xcode Projects via Non-Xcode Process File Writes: Do not schedule yet; validate as an analyst-led hunt first.; baseline expected benign activity and define an alert-volume threshold; prove correlation keys join correctly on real tenant telemetry.

Unique Blind Spot Callout

This run exposes a file-access telemetry blind spot: browser cookie theft and resource-file loader behaviors depend on file-read style events that may not be emitted in every Defender deployment. Validate that coverage before treating these as scheduled analytics.

Generated by DevSecOpsDadAttack threat intelligence and detection engineering. Validate detections before deployment.