Newsletter Article
THREAT SPOTLIGHT:The Tools You Trust Are Becoming Attack Paths
Snare Insider Newsletter Series Article
Make sure you Subscribe
Cybersecurity has traditionally concentrated heavily on identifying obviously malicious software.
Increasingly, attackers do not need obviously malicious software. They can use legitimate identities, remote-management platforms, SaaS applications, cloud services, developer tools, authentication workflows, AI services and administrative utilities, all of which your controls are configured to permit.
CrowdStrike’s 2026 Threat Hunting Report, drawn from roughly seven trillion daily telemetry events and more than 36,000 customer notifications between July 2025 and June 2026, describes adversaries systematically abusing trusted relationships across identities, cloud environments, SaaS applications, AI services, software supply chains and developer workflows.
The speed problem
The most consequential finding for anyone designing a logging architecture is not about any single technique. It is about the collapse of the window in which a defender can react.
| Finding | Source |
| 88% of observed exploitation involving a public proof of concept occurred within 48 hours of PoC release (1H 2026); VAULT PANDA and GENESIS PANDA moved inside 24 hours of disclosure | CrowdStrike 2026 Threat Hunting Report |
| Median time to fully remediate a CISA KEV entry rose to 43 days, up from 32; only 26% of KEV entries were fully remediated, down from 38% | Verizon 2026 DBIR |
| SNARKY SPIDER moved from account takeover to data theft in under five minutes in a single SSO-integrated SaaS incident | CrowdStrike 2026 Threat Hunting Report |
| Cloud-conscious eCrime activity rose 171%; monthly device-code phishing attempts rose 15x; vishing intrusions doubled | CrowdStrike 2026 Threat Hunting Report |
| ALTERED SPIDER compromised more than 300 software dependencies in a single day; 87% of identified software registry threats involved malicious npm packages | CrowdStrike 2026 Threat Hunting Report |
| One in four malicious breaches were AI-enabled, up 56% year on year, averaging roughly US$6M against a US$4.99M global average | IBM Cost of a Data Breach 2026 |
Put the first two rows next to each other. A 48-hour exploitation window against a 43-day remediation median means that for the majority of newly disclosed, actively exploited vulnerabilities, the organisation will be exposed for a period measured in weeks regardless of how well the patching programme runs.
That exposure window can only be covered by telemetry, and telemetry only helps if it was already being collected when the exposure began.
What actually distinguishes each trusted path
| Attack path | What it looks like in the logs | Telemetry that must be collected and retained |
| RMM / remote administration abuse | A valid technician session initiating remote control or script execution outside its normal pattern, right feature, wrong context | RMM console authentication and session audit (with source IP and ASN), script and task execution records, API token issuance and use; endpoint process creation (4688 / Sysmon 1) with the RMM agent as parent process |
| Device-code and vishing-driven authentication | A successful sign-in with no password prompt on the target device, frequently from a different ASN than the user’s normal pattern | Identity-provider sign-in logs including authentication protocol and device identifier; non-interactive sign-in logs for refresh-token reuse; MFA registration and security-info change events |
| SSO / OAuth-integrated SaaS abuse | A new application consent grant, or a service principal authenticating and then reading at volume | Directory audit for consent grants and app-role assignment; service-principal sign-ins; SaaS admin and file-access audit including bulk download and external sharing events |
| CI/CD and build-pipeline compromise | A build-server process spawning a command shell; build configuration or artifact changed outside a merge | Build-server application logs, process creation on build servers and agents, service-account token issuance, artifact publish and signing events, version-control audit |
| Tunnelling for persistence | A managed endpoint making sustained outbound connections to a tunnelling service it has never used | Process-level network telemetry (Sysmon 3), DNS query logs, firewall and proxy egress attributed by process and destination |
| Insider or intermediary credential capture | Valid authentication, then a registered-attribute change, then a high-value action, repeated across unrelated identities | Identity audit for contact and recovery attribute changes, session device fingerprint, downstream application transaction logs, correlated across accounts |
| Anti-forensic activity | The evidence trail ending rather than showing something anomalous | Windows Event ID 1102 (Security log cleared) and 104 (other log cleared), audit-policy change (4719), service installation (7045), and confirmation that the collection pipeline itself did not stop |
The logging implication
The attack surface is becoming broader. That does not mean every event from every source belongs permanently in the SIEM.
It means organisations need a strategy for ensuring that relevant security evidence is:
| COLLECTED | At the source, under a policy you set, not only where an analytics platform happens to reach. |
| PROTECTED | Forwarded off-host at the moment of the event, outside the blast radius of the system under investigation. |
| NORMALISED | Consistently enough to correlate identity, endpoint, SaaS and network activity into a single timeline. |
| RETAINED | Past the detection lag, 247 days on current averages, not merely past the alerting window. |
| ROUTABLE | To more than one destination, and re-routable without touching the endpoint estate. |
| SEARCHABLE | Within a timeframe that fits an incident and a notification deadline, not an archive restore request. |
Those are log-management decisions before they are SIEM decisions.
