{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/cortex-xdr/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Cortex XDR","Cortex XSIAM","Unit 42 Frontier AI Defense","Prisma Cloud","Cortex XSOAR","Cortex Xpanse","Prisma SASE","Prisma Access","Prisma SD-WAN"],"_cs_severities":["high"],"_cs_tags":["cloud-security","iam","incident-response","threat-detection"],"_cs_type":"advisory","_cs_vendors":["Palo Alto Networks"],"content_html":"\u003cp\u003eThe 2026 Unit 42 Global Incident Response Report highlights that threat actors are moving 4x faster to exfiltration than in 2025, exploiting blind spots due to an over-reliance on endpoint data. The proliferation of cloud services, microservices, and remote users has expanded the attack surface beyond what any single tool can monitor. Unit 42 found that in 75% of incidents, critical evidence was present in logs but wasn\u0026rsquo;t accessible or operationalized, allowing attackers to exploit the gaps. Organizations need to evolve their SOCs to ingest and correlate telemetry across their entire IT landscape, including IAM, cloud assets, OT/IoT, and AI workloads. Unit 42 recommends a single-pane-of-glass strategy powered by an AI-driven SOC platform like Cortex XSIAM to combat these threats.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access via Cloud Misconfiguration:\u003c/strong\u003e The attacker gains initial access through a misconfigured cloud service access key.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCloud Console Manipulation:\u003c/strong\u003e The attacker manipulates the cloud console to hide their tracks from endpoint detection.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePivot to Cloud-Hosted Server:\u003c/strong\u003e From the cloud console, the attacker pivots to a cloud-hosted server to begin discovery.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCredential Theft (Covert C2):\u003c/strong\u003e The attacker utilizes DNS tunneling to a cloud storage location for C2 communication and steals credentials to use legitimate applications.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement:\u003c/strong\u003e The attacker moves laterally using the stolen credentials, triggering impossible travel alerts across SaaS apps.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRogue Asset Introduction:\u003c/strong\u003e The attacker introduces a rogue device into the network, bypassing traditional endpoint security measures.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence:\u003c/strong\u003e The attacker maintains persistence through the rogue device, using it for covert movement and access.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration:\u003c/strong\u003e The attacker exfiltrates sensitive data, taking advantage of the gaps in security visibility.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eOrganizations are increasingly vulnerable to rapid data exfiltration due to the expanded attack surface and reliance on endpoint-centric security. The inability to correlate telemetry across diverse IT zones allows attackers to operate undetected, leading to significant data breaches, financial losses, and reputational damage. Unit 42\u0026rsquo;s research shows that attackers are moving 4x faster to exfiltration, exacerbating the impact of successful intrusions. The attacks target cloud environments, identity systems, and networks, creating a complex threat landscape for security teams to navigate.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIngest and correlate telemetry from all IT zones (IAM, cloud, OT/IoT, AI workloads) into a single repository, as described in the overview, to eliminate data silos and gain holistic visibility.\u003c/li\u003e\n\u003cli\u003eImplement User and Entity Behavior Analytics (UEBA) as mentioned in the overview, to detect anomalous behavior indicative of compromised credentials by using a centralized workbench.\u003c/li\u003e\n\u003cli\u003eDeploy Cortex XSIAM, as discussed in the overview, to leverage AI-driven alert stitching, ML-based incident scoring, and UEBA for automated detection, investigation, and response.\u003c/li\u003e\n\u003cli\u003eImplement continuous network monitoring and external attack surface management to detect and manage rogue assets, as highlighted in the attack chain.\u003c/li\u003e\n\u003cli\u003eEvaluate your current visibility through a formal assessment as recommended in the conclusion, to identify gaps in security coverage.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-01T23:13:22Z","date_published":"2026-05-01T23:13:22Z","id":"/briefs/2026-06-detection-beyond-endpoint/","summary":"Threat actors are rapidly exfiltrating data by exploiting blind spots created by an over-reliance on endpoint data, necessitating a comprehensive security approach that incorporates cloud, identity, and network telemetry for effective threat detection and response.","title":"Expanding Detection Beyond Endpoints to Counter Evolving Threats","url":"https://feed.craftedsignal.io/briefs/2026-06-detection-beyond-endpoint/"}],"language":"en","title":"CraftedSignal Threat Feed — Cortex XDR","version":"https://jsonfeed.org/version/1.1"}