Skip to content

docs(changelog): release v2.7.0 #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Gerrrt merged 1 commit into from
Aug 2, 2026
Merged

docs(changelog): release v2.7.0 #64

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ Add user-visible changes under `[Unreleased]`. To cut a release, move the
`main`: `auto-tag.yml` sees the new top version, tags `vX.Y.Z`, and publishes a
GitHub Release; `sync-fanout.yml` then opens the Kali sync PR.

## [Unreleased]
## [v2.7.0] - 2026-08-01

Comment on lines +21 to 22
### Added

- **Cloud-IdP escalation parity — 2 new red↔blue pairs** closing the two gaps that
were the most visible *relative to what the corpus already claimed to cover*
were the most visible _relative to what the corpus already claimed to cover_
(#62): each is the direct analogue of a pair that already existed for the
neighbouring platform.
- **Entra privileged directory-role grant (`T1098.003`)** —
Expand Down Expand Up @@ -59,7 +59,7 @@ GitHub Release; `sync-fanout.yml` then opens the Kali sync PR.
correction — both halves of the pair move together to stay in sync.
- **`web-service-c2-beacon` gained a host-role tuning caveat.** The entry's prose
promises process-context discipline, but the deployable SPL excludes only a
hardcoded Windows *desktop* image list. On servers and CI/build agents,
hardcoded Windows _desktop_ image list. On servers and CI/build agents,
`python.exe`/`node.exe`/`curl.exe` and agents under `\ProgramData\` clear the
`conns>3 AND active_hours>2` floor doing ordinary work — and the query's own
`user_writable` heuristic (whose regex matches `\ProgramData\` as a proxy for
Expand Down