The July 2026 Network Detection Newsletter includes detection highlights across our network product portfolio. In the past month, over 200 network rules have been created across NX / NDRS / IPS to identify malicious / suspicious network traffic spanning C2 communication, lateral movement, as well as vulnerability exploits.
NDR detection in July focused on various areas such as
-
Lateral movement
Detection has been added for lateral movement techniques such as SPN enumeration across Big Data services (VMware, HDFS, Kafka), SQL services, Kerberoasting (T1558.003) including weak cipher downgrades (DES-CBC), and AS-REP Roasting (T1558.004) with Impacket tool-signature detection. -
Malware command and control
Cross-platform backdoor coverage — BPFDOOR (Linux BPF rootkit, APT-linked), CHERRYQUIRK and SANDGLASS (Python), NEATSNAKE (PowerShell), GRIDTIDE (Linux). Infostealer: SNARESEND (.NET). Loader: HOTAIR (.NET). macOS-specific: AppleScript dropper and a fake Zoom SDK update lure and others.
For IPS, over 110 rules were added / updated to detect various network-based exploits across multiple software platforms including:
- Elevation of Privilege — Windows Kernel, Win32k, Windows Media, DirectX, etc.
- SQL Injection — Django, OpenEMR, FacturaScripts, ManageEngine, WordPress plugins, etc.
- Remote Code Execution — Splunk, Datart, Group Office, Slash CMS, Yamcs, and others
- Authentication Bypass — UniFi OS, WordPress plugins, Craft CMS, Cisco Secure Workload
- Command Injection — PTZOptics, Linksys, Tenda routers, CtrlPanel, HRConvert2
- Path Traversal / LFI — Dify, Cacti, LibreNMS, SGLangs, Ivanti Avalanche
- Cross-Site Scripting (XSS) — WordPress plugins, SiYuan, Cobham SAILOR VSAT
- Malware Detection — POLLREGISTER and MacSync activity
For more details about the detections, see the Knowledge article Trellix Network Detection Newsletter - July 2026.