Tag
medium
advisory
Monitor Email for Brand Abuse via Domain Permutations
2 rules 1 TTPThis analytic identifies emails claiming to originate from domains similar to those being monitored for abuse by cross-referencing sender addresses with a lookup table of domain permutations, indicating potential phishing or brand impersonation.
Splunk Enterprise +2
brand-abuse
email
phishing
impersonation
2r
1t
critical
advisory
Rancher Fleet Helm Impersonation Bypass Vulnerability
2 rules 1 TTPFleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.
Fleet +5
rancher
helm
kubernetes
impersonation
privilege-escalation
cve-2026-41050
2r
1t