2026 tradecraft gap closure: kernel LPE, Copilot, AiTM, supply chain#39

Merged

AndrewAltimit merged 18 commits into

mainfrom

feature/2026-tradecraft-gap-closure

Apr 22, 2026

Commits on Apr 20, 2026

WS1: Chrome cookie theft crate with v10/v11 key path, domain filter, detection artifacts

AI Agent Bot
and
claude
committed
WS1: remove build artifacts from cookie-theft crate, add .gitignore

AI Agent Bot
and
claude
committed
WS5: Hell's Gate / Tartarus Gate indirect syscall crate with compile-time allowlist

AI Agent Bot
and
claude
committed
WS3: Kubernetes post-exploitation recon module with IMDS, SA enum, escape checks

AI Agent Bot
and
claude
committed

Commits on Apr 22, 2026

Merge branch 'worktree-agent-a389a8df' into feature/2026-tradecraft-gap-closure
AI Agent Bot
committed
Merge branch 'worktree-agent-a8dc2093' into feature/2026-tradecraft-gap-closure
AI Agent Bot
committed
Merge branch 'worktree-agent-ac506051' into feature/2026-tradecraft-gap-closure
AI Agent Bot
committed
Batch 1: P0 Sprint 1 — ESC16, RC4 migration, Silver SAML, FOCI, cross-cutting infra

AI Agent Bot
and
claude
committed
Batch 2: P0 Sprint 2+3 — EchoLeak/ShareLeak/PipeLeak, SyncJacking, Device-code 2026, kernel LPE (AFD/CLFS/I/O Ring), Shai-Hulud npm worm, LiteLLM PyPI .pth stealer

AI Agent Bot
and
claude
committed
Batch 3: P1 Sprint 4 — AiTM (Tycoon2FA/Sneaky2FA/Rockstar2FA), ClickFix/FileFix/ConsentFix, GitHub Actions OIDC chain, BYOVD LOLDrivers integration

AI Agent Bot
and
claude
committed
Batch 4: P1 Sprint 5 — C2 transports, K8s escapes, identity chains, RMM persistence, LLM eval

AI Agent Bot
and
claude
committed
Batch 5: P2 — eBPF rootkit, macOS/mobile/firmware research, CloudTrail blinding, passkey bench, vishing tabletop, C2 profiles, Rust callstack-detect, AMSI NtContinue

AI Agent Bot
and
claude
committed
Update README and CLAUDE.md index for all 42 PRD workstreams

AI Agent Bot
and
claude
committed
Fill review gaps + scrub planning labels from committed files

AI Agent Bot
and
claude
committed
Teach detection-pairing check to descend into umbrella modules

AI Agent Bot
and
claude
committed
Revise catalog docs for professionalism + add topology detection mapping

AI Agent Bot
and
claude
committed
Convert flow diagrams from ASCII to mermaid

AI Agent Bot
and
claude
committed
Fix Rust workspace build: remove stray [workspace] roots, target-gate windows dep

AI Agent Bot
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

2026 tradecraft gap closure: kernel LPE, Copilot, AiTM, supply chain#39

2026 tradecraft gap closure: kernel LPE, Copilot, AiTM, supply chain#39
AndrewAltimit merged 18 commits into
mainfrom
feature/2026-tradecraft-gap-closure

Commits on Apr 20, 2026

WS1: Chrome cookie theft crate with v10/v11 key path, domain filter, detection artifacts

WS1: remove build artifacts from cookie-theft crate, add .gitignore

WS5: Hell's Gate / Tartarus Gate indirect syscall crate with compile-time allowlist

WS3: Kubernetes post-exploitation recon module with IMDS, SA enum, escape checks

Commits on Apr 22, 2026

Merge branch 'worktree-agent-a389a8df' into feature/2026-tradecraft-gap-closure

Merge branch 'worktree-agent-a8dc2093' into feature/2026-tradecraft-gap-closure

Merge branch 'worktree-agent-ac506051' into feature/2026-tradecraft-gap-closure

Batch 1: P0 Sprint 1 — ESC16, RC4 migration, Silver SAML, FOCI, cross-cutting infra

Batch 2: P0 Sprint 2+3 — EchoLeak/ShareLeak/PipeLeak, SyncJacking, Device-code 2026, kernel LPE (AFD/CLFS/I/O Ring), Shai-Hulud npm worm, LiteLLM PyPI .pth stealer

Batch 3: P1 Sprint 4 — AiTM (Tycoon2FA/Sneaky2FA/Rockstar2FA), ClickFix/FileFix/ConsentFix, GitHub Actions OIDC chain, BYOVD LOLDrivers integration

Batch 4: P1 Sprint 5 — C2 transports, K8s escapes, identity chains, RMM persistence, LLM eval

Batch 5: P2 — eBPF rootkit, macOS/mobile/firmware research, CloudTrail blinding, passkey bench, vishing tabletop, C2 profiles, Rust callstack-detect, AMSI NtContinue

Update README and CLAUDE.md index for all 42 PRD workstreams

Fill review gaps + scrub planning labels from committed files

Teach detection-pairing check to descend into umbrella modules

Revise catalog docs for professionalism + add topology detection mapping

Convert flow diagrams from ASCII to mermaid

Fix Rust workspace build: remove stray [workspace] roots, target-gate windows dep