Wazuh Rule 92900 Silently Misses LSASS Credential Dumps Due to Incomplete Logic

·1 views

Wazuh rule 92900, designed to detect LSASS credential dumping, fails silently when attackers use access mask 0x1fffff via rundll32 and comsvcs.dll, a value not included in its enumerated match list. Because the rule remains present and enabled, coverage reports still mark the technique as protected, masking a real detection gap. The root issue is that enumerated-list rules answer only whether a value matches a known-bad list, not whether a technique actually occurred. Security researchers found that keying on dbgcore.dll in the CallTrace field — rather than comsvcs.dll — catches both comsvcs-based dumps and tools like ProcDump that share the same code path. The findings are documented in public Wazuh GitHub issue 38716, with live endpoint test results verifying the behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Retrieval Quality, Not Model Choice, Is the Real Bottleneck in Production AI

A systems architect at Synapsis Medical Technologies argues that retrieval pipeline quality matters far more than model selection in production AI applications, based on experience shipping 18 apps across platforms. While switching between top LLMs like GPT-4o, Claude 3.5 Sonnet, or Llama 3 yielded only a 2–3% improvement in output quality, optimizing chunking strategies and reranking delivered significantly larger gains. The author warns against 'naive RAG' — basic embedding and cosine similarity search — which proves inadequate for domain-specific healthcare data such as FHIR/HL7 records. Instead, a three-pillar retrieval architecture is recommended: semantic chunking to preserve logical context, hybrid search combining vector and keyword (BM25) methods, and a reranking step that most teams skip. The piece highlights that even the most advanced reasoning model will hallucinate confidently when fed irrelevant or poorly retrieved context.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

KindWood App Turns Real-Life Acts of Kindness into a Shared Virtual Garden

A developer built KindWood, a web app where users grow a virtual garden by logging genuine acts of kindness toward others. When a user helps someone, they describe the act in a sentence, and Google's Gemini AI classifies it into one of six plant species with a short piece of lore. A temporary code is generated and shared with the recipient, who must confirm the act before a plant blooms in both users' gardens simultaneously. Each memory card stores the details of the moment and can be narrated aloud using ElevenLabs voice technology. The project was created for DEV.to's Weekend Challenge: Generosity Edition, and is built using React, Tailwind, Firebase, and Framer Motion.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cybersecurity Instructor Shares Beginner Tips, Career Advice, and Key Threats

An intern at Early Code Institute interviewed Miss Perceptual Anyaogu, a cybersecurity instructor, to explore the field's fundamentals and career prospects in Nigeria. Anyaogu described cybersecurity as the practice of protecting networks, computers, and digital information from unauthorized access and malicious attacks. She identified phishing, social engineering, and urgency-based voice scams as among the most common threats facing everyday internet users. The instructor stressed that young people should treat cybersecurity as both a practical life skill and a viable career path given the growing volume of online activity. Her key safety advice was to pause, read, and verify before responding to any suspicious or urgent digital request.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Runs Smart Home on Kubernetes Cluster Using GitOps and Open Source Tools

A software developer has built a fully self-managed smart home infrastructure using DevSecOps practices typically reserved for enterprise environments. The setup runs on a four-node Kubernetes cluster of Raspberry Pi 4B boards housed in a converted outbuilding, with Talos Linux as the immutable operating system and ArgoCD managing configuration sync. Home Assistant serves as the central hub, unifying separate subsystems including solar power, networking, and IoT devices into a single interface. Terraform provisions cloud resources, and a Git repository acts as the single source of truth for the entire stack. The project, called Home Automated Infrastructure, is open source and was motivated by the owner's desire to avoid proprietary home automation platforms after purchasing the house in 2021.

0 comments Read more at DEV Community