The August 2026 network detection newsletter includes detection highlights across our network product portfolio. In the past month, over 150 network rules have been created across NX/NDRS/IPS to identify malicious / suspicious network traffic spanning C2 communication, lateral movement, as well as vulnerability exploits.
For recent publication, see our blog post No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations (August 27, 2026).
NDR detection in August focused on various areas such as:
-
Lateral movement
The bulk of this release targets attacker post-exploitation tradecraft. Coverage was added for brute-force tools commonly seen in red-team and ransomware operations — including CrackMapExec, NetExec, Evil-WinRM, and several WinRM client variants — detected via distinctive HTTP User-Agent strings. A large set of LOLBAS (Living-off-the-Land Binaries) rules now catches remote execution abuse through Windows Remote Shell (winrs), covering over 20 native binaries such as msbuild.exe, rundll32.exe, powershell.exe, and mshta.exe. Additional rules address Group Policy Preferences (GPP) credential-harvesting tools (for example, SharpGPP, Group3r, pygpoabuse) and LDAP-based Group Policy discovery, as well as MySQL brute-force patterns including blank passwords and rapid authentication failures.
-
Vulnerabilities
New exploit detection covers high-impact CVEs targeting widely deployed infrastructure: two Microsoft SharePoint RCE vulnerabilities (CVE-2026-63520 and CVE-2026-65665), a Fluentd path traversal RCE (CVE-2026-44024), Rails Active Storage RCE (CVE-2026-66066), Apache Tomcat Tribes security bypass (CVE-2026-34486), and Windows Deployment Services TFTP RCE (CVE-2026-62893).
-
Malware command and control
New C2 signatures cover the SANDCLOCK infostealer (Python, shell, and standard variants), DINODANCE JavaScript trojan, and several generic trojan families using phishing delivery (VBA droppers, JavaScript agents, PowerShell runners). A detection for Telegram bot-based C2 traffic was also added, reflecting a growing attacker trend of abusing legitimate messaging platforms for exfiltration.
For IPS, over 90 rules were added / updated to detect various network-based exploits across multiple software platforms including:
- Windows Privilege Escalation — Heavy Patch Tuesday Coverage
- 26 EoP signatures dominate August, aligned with Microsoft's Patch Tuesday cadence. Coverage spans Win32k (CVE-2026-50297, -50688, -54114, -54986, -62712), Windows Kernel (CVE-2026-49798, -50390, -50436, -62737), Ancillary Function Driver (CVE-2026-61348, -68820), Cloud Files Mini Filter Driver (CVE-2026-58536, -62713), and several others including Kerberos, WPAD, GDI, DWM Core Library, and Windows Storage.
- High-Priority RCE Coverage:
- CVE-2026-56188 — Microsoft Windows Server Network Driver RCE (SMB)
- CVE-2026-50518 — Windows DHCP Server RCE
- CVE-2026-50522 / CVE-2026-56164 — Microsoft SharePoint RCE (two signatures)
- CVE-2026-4480 — Samba Printer Subsystem RCE
- CVE-2026-66066 — Ruby on Rails Active Storage Arbitrary RCE
- CVE-2026-53435 — Jenkins Deserialization RCE
- CVE-2026-46442 — Flowise RCE
- Network Device & IoT
- Multiple router and embedded device vulnerabilities covered: Tenda (CVE-2026-11499, CVE-2025-70656), Edimax BR-6428NS (CVE-2026-8775), Lantronix EDS5000 (CVE-2025-67038), GeoVision DVR stack overflow (CVE-2026-12485), ZTE Router command injection, and Check Point Remote Access VPN IKEv1 Auth Bypass (CVE-2026-50751).
- Enterprise & Application Stack:
- Cisco Catalyst SD-WAN file upload (CVE-2026-20262) and Communications Manager SSRF (CVE-2026-20230)
- Check Point CPMI Auth Bypass (CVE-2026-16232)
- Adobe ColdFusion path traversal (two signatures: CVE-2026-48282, CVE-2026-47932)
- Developer / AI Toolchain:
- New coverage for Node.js SSRF (CVE-2026-69192), AngularJS ReDoS (CVE-2024-21490), Lodash RCE (CVE-2026-4800), NLTK downloader RCE (CVE-2025-14009), and Dify Plugin Daemon path traversal (CVE-2026-41948) — reflecting growing attacker interest in AI / developer infrastructure.
For more details about the detections, see the Knowledge article Trellix Network Detection Newsletter - August 2026.