From underground to detection: daily attack-chain synthesis

Open any incident report from a real intrusion and you will not find a single exploit. You will find a path: an exposed management surface that gave initial access, a secret read off the first host, a lateral hop into the network using that secret, and an objective at the end, data theft or encryption. Each step might be individually unremarkable. The damage is in how they connect. Yet most security testing is organized around individual findings, because findings are easy to enumerate and chains are hard to model. The result is a structural blind spot: programs that are excellent at listing exposures and poor at seeing the sequences those exposures enable.

We attack that blind spot with cadence. Every day, the threat landscape publishes new material: vendor advisories, government catalogs of actively exploited vulnerabilities, threat-research writeups that describe, step by step, what a campaign actually did. That material is a stream of real technique sequences. Our job is to turn the stream into detection. Verifiable security.

The daily cycle, end to end

The process runs as a tight loop with three stages, and it is deliberately structured so that nothing fictional or speculative survives to the end.

1. Intel review. Ingest the day's published sources: newly catalogued actively-exploited vulnerabilities, vendor advisories with assigned identifiers, and threat-research describing observed campaigns. Pull out the concrete technique sequences, the ordered steps an actor took, expressed in a standard vocabulary so they can be compared and composed.
2. Novelty synthesis. Take those sequences and ask whether any composition of them is genuinely new relative to what we already model. A chain is only worth building if it represents a path we do not already test. We cross-check every candidate against our existing chain catalog so we are not re-deriving something we already cover. Net-new compositions move forward; duplicates are dropped.
3. Zero-false-positive validation. Before a synthesized chain becomes a real detection, every link has to be grounded in a real, named primitive, an actual CVE or an actual observable technique, and the whole chain has to survive the same evidence discipline we apply to every finding. A chain that cannot be tied to real, citable building blocks does not ship. This is the gate that keeps the cadence honest: speed never buys us the right to invent.

Three stages, run daily. The last stage is the one that matters: a chain ships only when every link is a real, citable primitive. Speed does not earn the right to invent.

The worked example: a double-CVE controller takeover

This week's cycle produced a chain we had not modeled before, composed from two separate, publicly assigned vulnerabilities in the same product, Cisco Catalyst SD-WAN Manager, the management plane formerly branded vManage. Individually, each is serious. Composed, they are a complete path from the outside to administrative control of the controller that manages an entire software-defined network fabric. Both were added to the U.S. CISA Known Exploited Vulnerabilities catalog in mid-June 2026, with active exploitation observed in the wild.

The composition is what is new. We already had detection for management-surface discovery, for authentication-bypass primitives, and for path-traversal file reads as separate capabilities. What this week added was the specific sequence in which an attacker would walk them against the SD-WAN Manager, anchored on two real identifiers: CVE-2026-20182, an authentication-bypass weakness rated CVSS 10.0 that lets an unauthenticated remote attacker obtain administrative privileges through the peering authentication mechanism, and CVE-2026-20262, a path-traversal arbitrary-file-write weakness in the web UI. No prior chain in our catalog composed two CVEs on the same controller into a single takeover path, which is exactly why it cleared the novelty stage.

The chain is new; the links are not. Every step ties to a real, named primitive, which is the condition for a synthesized chain to ship.

The defensive value of modeling this as a chain rather than two findings is concrete. A team patching by severity might address the file-write and defer the auth-bypass, or vice versa, treating them as two items on a backlog. Seeing them as a composed path reframes the priority: together they are a controller takeover, and the controller is the keys to the network fabric. The chain tells you these two are not independent line items. They are one emergency. The public reporting bears this out: each was independently assigned, independently catalogued as exploited, and each carries its own remediation deadline, but an attacker reads them as one path.

A foothold you would have shrugged at becomes total takeover the moment it is the first link in a chain. The attacker thinks in paths. A defender who thinks in findings is always one composition behind.

Why we ground every link in a real primitive

It would be easy, and dishonest, to generate impressive-looking attack chains by stringing together plausible-sounding steps. The temptation in any threat-intelligence program is to let the narrative get ahead of the evidence, to describe a chain that "an attacker could" run without confirming that each step corresponds to a real, observable thing. We refuse that, and the refusal is the whole point of the validation stage.

Concretely, this means two disciplines. First, every link must map to a named primitive: a specific CVE with an assigned identifier, or a specific technique that is observable in the real world, not a hypothetical capability. Second, we keep a hard line between two categories of chain. There are chains every link of which is grounded and citable, which is what we ship as detection. And there are raw candidate sequences pulled straight from the intel stream that we have not yet grounded into testable primitives. Those candidates are genuinely useful, they tell us where to look next, but they are not detections, and we do not present them as if they were. Calling a candidate a detection would be a false positive at the level of the whole capability, and the same doctrine that governs a single finding governs a chain.

What the cadence buys a defender

The advantage of running this daily, rather than quarterly, is that the gap between "an actor starts using a technique sequence" and "your defensive program tests for it" shrinks from months to about a day. Active exploitation moves fast; the catalog of vulnerabilities under active attack updates constantly. The SD-WAN Manager pair is a clean illustration: both CVEs moved from advisory to actively-exploited to catalogued inside a single week. A chain library that is refreshed every day tracks that reality far more closely than one rebuilt on a release cycle.

How Celvex runs it

The honest framing is the one we hold ourselves to: we ship the chains whose every link is real and citable, and we keep raw candidate sequences from the intel stream clearly labeled as the leads they are. The cadence is what keeps us close to the threat. The grounding is what keeps us honest. Both are required.

Verifiable security. Find it. Prove it. Fix it. Verify the fix held. Composed the way the attacker actually works.