Omri Refaeli 🇮🇱

Threat hunting with humans alone doesn't scale. Talent is scarce, hypotheses per cycle are limited, investigations are manual. Threat hunting with AI alone doesn't work. No domain expertise, no hypothesis worth pursuing, no judgment for what actually looks off. The interesting shape is the combination — experts defining what to hunt, agents running the work end-to-end, continuously. Today the team at Daylight Security are shipping just that: Managed Agentic Threat Hunting Read about it here! (Link in the first comment)

40

‏2‏ ‏תגובות‏

Something cool I learned over the past few weeks: you can see a backdoor inside a model. The harder part is actually knowing what you’re seeing. I wanted to know what happens when we do not know the trigger? In a small simulation, finding every exception required checking every possibility. A cheaper scan missed many of the regions where the behavior could hide. So not finding a backdoor may simply mean we looked in the wrong place. Then I looked inside the model. I found strong signals, but some also appeared in the clean model. Others identified the model version, but not whether its special rule was approved or malicious. So I tested whether those signals caused the behavior. Across several models, internal activity clearly separated triggered texts from nearly identical controls. Yet removing almost all of that separation left most of the backdoor behavior intact. All three experiments pointed to the same conclusion: Internal signals can show that something is happening, but they cannot tell us whether we found the whole backdoor, why the answer changed, or whether the behavior was authorized. A serious audit must combine behavior, internal signals, causal interventions, a trusted reference model, and sandboxed testing of the real system with its identity, tools, and permissions. I brought these three lines of evidence together in a new paper you can check out in the comments.

9

‏2‏ ‏תגובות‏

Shachar Hirshberg will be sharing the stage with Crowdstrike’s Chief Business Officer, Daniel Bernard in 2 weeks at Fal.con. The talk will cover how frontier AI has changed the economics of attacks and how defenders can keep up with a narrowing window of time to detect and stop threats. The talk will also cover how Artemis Security augments CrowdStrike Falcon and Next-Gen SIEM with a better-together model that provides machine-speed detection, investigation, and containment without duplicating your data. Beating the Exploit Window: Agentic SecOps with Falcon and Artemis. Hub Theater, Aug 31, 6:40 PM PDT. If you're at Fal.Con, come find us!

48

‏5‏ ‏תגובות‏

A single click. That's all it takes. I just discovered CoSnitch — a critical vulnerability chain in Microsoft Copilot that can compromise your sensitive data. Microsoft has addressed these CRITICAL issues under CVE-2026-24301. You can review the official advisory here: https://lnkd.in/grGRNEtr Read the full research breakdown here: https://lnkd.in/gTA3vvPa Full research by Varonis Threat Labs.

45

‏11‏ ‏תגובות‏

CrowdStrike is acquiring browser security startup Seraphic Security for $400 million! This acquisition marks CrowdStrike’s sixth in Israel. By integrating Seraphic’s technology into the CrowdStrike Falcon platform, the deal will provide natively secure enterprise browsing for the modern agentic workforce, anywhere they work. We are proud to have supported this transaction and to see another Israeli cybersecurity pioneer join forces with a global leader. Congratulations to the entire Seraphic team on this incredible achievement! 🥳 https://lnkd.in/dYNKBwdc Keren Talmor Tzvika Bernstein Ronen Shitrit - רונן שיטרית Sarit Foox Loren Yom Tov Shahar Moyal

33

A quiet data exfiltration path hiding in plain sight 🤫 We uncovered a way Outlook add-ins can be abused to exfiltrate email data without leaving any audit traces - exposing a visibility gap in Microsoft 365 that security teams should be aware of. By leveraging the trusted add-in framework, an attacker can maintain a persistent, low-noise tap into a user’s mailbox that bypasses standard logging. It’s a reminder that the tools we use for productivity are often the most overlooked parts of the attack surface. More details in the blog: https://lnkd.in/dxTTCp38

91

‏12‏ ‏תגובות‏

Plaintext keyword detections are not enough to secure the hypervisor layer, especially as ransomware groups increasingly target these environments. Because ESX shell logs capture telemetry during the parsing stage, traditional keyword detections looking for "esxcli" are easily bypassed. I systematically mapped 21 distinct obfuscation techniques that function inside BusyBox, including zero-width Unicode injections and ciphers, and included the regex-based CQL patterns to hunt for them. Read the full technical breakdown on the CrowdStrike blog: Threat Hunts for Shell Command Obfuscation on VMware ESX 🔗 https://lnkd.in/dZyDWkAc

31

Check out this research by Erez Goldberg on our team. He tested how far shell command obfuscation can go on VMware ESX and found 21 techniques that work on BusyBox - invisible Unicode characters, cryptographic ciphers in awk, payloads keyed to host infrastructure, VMFS steganography, Morse code. Every technique has a CQL detection pattern and correlation rule template ready to deploy in Falcon NG-SIEM library. https://lnkd.in/g89J3B4v #ThreatDetection #CrowdStrike #VMware #ThreatHunting

80

🚀 Why TenRoot Chose TandemTrace TenRoot Cyber Security is an elite Israeli DFIR firm delivering red teaming, incident response, and breach recovery across four continents. It has deployed TandemTrace as the AI SOC layer on top of CrowdStrike Falcon for its customers. The thesis is simple: Falcon is best in class at detection, but EDR generates alerts faster than humans can investigate them. The outcome in production: ➡️ Sub-2-minute verdict on every Falcon, SIEM, and identity alert, investigated end-to-end. ➡️ Zero Tier-1 noise reaching senior analysts — false positives auto-close with full reasoning. ➡️ 24/7 autonomous hunts on Falcon + SIEM telemetry, with evidence-backed findings ready by morning. "Our customers buy outcomes, not tools. Falcon prevents the breach at the endpoint. TandemTrace closes the investigation loop on top of it — with our seniors in front of the customer instead of stuck in an outsourced MDR queue." Read the full story → https://lnkd.in/e-5_6hR7

32

‏4‏ ‏תגובות‏