Two More Attack Paths Are Covered by Default
The May 19 threat cycle pointed at two places where modern attacks like to hide: short-lived Linux runtime artifacts and payloads buried deep inside large buffers. Both are now covered in the engine path.
Runtime Watcher now has a Linux real-time file monitor for executable temp-backed locations such as /dev/shm, /tmp, /var/tmp, /run, and /run/user. The goal is simple: catch the artifact when it appears, not only when the next polling interval happens to arrive. That matters for sandbox escapes, local privilege escalation chains, and fileless loaders that land briefly in memory-backed or temp-backed paths and then disappear.
Runtime Watcher Now Sees Transient LPE Artifacts Faster
The new path uses Linux inotify through the Go runtime layer and feeds events into the same alert pipeline customers already use. Suspicious scripts, shared objects, loaders, exploit-named artifacts, setuid markers, capability markers, pkexec/sudo clues, overlayfs references, and similar LPE indicators in transient execution locations are promoted into high or critical runtime alerts.
This does not add a separate daemon, cloud service, or detection dependency. It extends the existing Runtime Watcher module while preserving the normal file-integrity polling path for longer-lived baseline changes. Customers get faster coverage for short-lived runtime behavior and the same response policy surface they already operate.
The Rust Sidecar Now Streams Deep Buffers
The optional Rust sidecar no longer skips large string fields after a fixed size cutoff. It now scans large fields in overlapping chunks, then runs the normalized pass the same way. A SQLi, XSS, command-injection, prompt-injection, or exfiltration pattern buried deep inside a large event body can still be found without allocating one giant transformed buffer.
That is the important customer outcome: inspection depth improves while memory behavior stays bounded. Large payloads are handled as a stream of manageable slices, with overlap to preserve detections that cross chunk boundaries.
Quality Pass and Verification
The implementation stayed aligned with the core 1-SEC design: deterministic local detection, one engine surface, no extra runtime service, and no expansion of the customer dependency footprint. We also ran the broader Go checks against the current codebase: full Go tests, vet, focused runtime tests, and a Linux cross-compile for the inotify path. The Rust sidecar matcher/NATS bridge path passed its no-default-features test suite, including new regression tests proving large raw and normalized fields are streamed and detected.
The result is a cleaner security story for operators. The same modules now cover more of the attacker window, especially the places where a polling-only or header-only implementation can be too late or too shallow.