Ingeniero de Detección: 2026-09-21

1. HTTP QUERY Method: The Grey Zone Between GET And POST

   SANS Internet Storm Center, 2026-09-18. Leer, 4 min.

   Xavier Mertens writes for the SANS Internet Storm Center that RFC 10008, published by the IETF in June 2026, defines a new HTTP method called QUERY that carries the query in the request body instead of the URL, is safe, idempotent and explicitly cacheable, and is the first new standard HTTP verb since PATCH in 2010. He reports that handling is inconsistent in the wild, with nginx's limit_except pattern and Django's View class rejecting QUERY while curl, FastAPI's explicit routes, Caddy and Traefik pass it through, so controls written in terms of GET, POST, PUT, DELETE and PATCH each now have to make a deliberate decision about the new verb.

   Por qué importa para este rol: Send the same payload over POST and over QUERY against your own stack and compare what the detection sees. If the signatures are bound to POST bodies, the QUERY result is your coverage gap measured rather than assumed.

2. ChainScript: Tracing a Node.js RAT Through the Blockchain

   Blackpoint Cyber, 2026-09-18. Leer, 17 min.

   Blackpoint's Adversary Pursuit Group named ChainScript, a Node.js remote access trojan it found while investigating ClickFix activity that ended in a malicious Windows Installer disguised as Spotify software. The installer deploys its own Node.js runtime and launches a JavaScript agent through hidden PowerShell and VBScript stages, and the agent has appeared under build names including ComponentTask33, UpdateDigital, HostShared and OrchidViolet66 while presenting itself as Spotify, Zoom Workplace and Microsoft Teams software.

   Por qué importa para este rol: The command and control address is resolved from a Polygon smart contract at runtime, so a blocklist built from observed panel addresses goes stale by design. Detection has to sit on the installer and loader behaviour: the bundled Node.js runtime, the hidden PowerShell and VBScript stages, and the software the installer claims to be.

Ingeniero de Detección