Red Canary
redcanary · B · active
Red Canary detection engineering and IR. URL UPDATED 2026-05-08 to the RSS feed: /resources-center/category/blog/ returned a STUB (resource hub navigation) on WebFetch, but /feed/ returns 5 dated items cleanly. Drill into the canonical /blog/<slug>/ URL when citing. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://redcanary.com/feed/ 5 (then bridge url <blog/<category>/<slug>/> for full body). AVOID: /resources-center/ hub is a navigation stub to WebFetch, use the /feed/ RSS, not the resource hub. | 2026-07-05 admiralty audit: B, original detection-engineering/IR research lab, first-hand MDR telemetry. Live via /feed/; active retained. | 2026-07-24 health-sweep flagged /feed/ RSS unreachable (fast-fail during concurrent probe), but direct `python3 tools/fetch_source.py url https://redcanary.com/blog/` returned full live HTML; a reachable transport exists, so NOT demoted (transient feed-probe failure, not source death). When the RSS endpoint flaps, fall back to url/bridge on /blog/. active retained.
Cited in 3 entries
Citation cadence
Citation days per ISO week (13 weeks of coverage span, total 3).
- Dead-drop command-and-control went commodity: three of four new entrants on Red Canary's monthly list resolve their C2 from a dead drop, two of them from a public blockchain, and the fourth is a GUI for Entra ID device-code phishing2026-08-23
- Red Canary: Microsoft Entra Agent ID abuse, OBO OAuth flow turns a compromised AI agent into a delegated phishing sender2026-06-10
- Red Canary: detecting Entra Agent ID privilege escalation, credential injection into agent blueprints enables lateral movement across the entire tenant2026-05-30