Detection Engineer: 2026-09-25

1. One URL, Three Different Tricks

   SANS Internet Storm Center, 2026-09-24. Read, 3 min.

   SANS Internet Storm Center handler Xavier Mertens examined a phishing link that combines a random userinfo string before an @, a hostname label ending in hyphens on a lookalike domain, and the recipient's email address appended to the path. A naive filter sees email addresses or a link to the recipient's own domain, a strict validator may drop the link as an invalid hostname, and the browser follows a valid URL to the phishing page.

   Why it matters for this role: Test whether your URL extraction copes with hyphen-edged labels and multiple @ signs, since Mertens notes that strict validators and regex extractors may skip such a link and never scan it.

2. Stealing OAuth Tokens Through Microsoft’s Front Door

   Huntress, 2026-09-23. Read, 24 min.

   Huntress describes a post-compromise technique in which a sideloaded AppX package uses Microsoft-signed AppX web hosts to present a legitimate Microsoft sign-in and capture the resulting OAuth tokens, leaving nothing for signature-based detection to flag. It requires code execution in the user's session and Developer Mode or an enterprise sideloading policy already enabled, and Huntress says stolen refresh tokens give durable access to the victim's Microsoft 365 data.

   Why it matters for this role: One network rule on the MSAppHost/3.0 user agent covers every AppX web host in this class, with an allow-list of Microsoft domains to tune before it goes live.

Detection Engineer