DFIR Radar

macOS 27 (Golden Gate) adds a Siri app that keeps persistent conversation history in a SQLite database. The write-up shows where it lives and how to parse it, including entries flagged as removable. - Why it matters: Siri is now in Unified Search (Cmd+Space, the old Spotlight bar) and in right-click menus across the OS and many third-party apps. The report's example is "Ask Siri" on an email in Microsoft Outlook, with the reply saved in Siri conversations. Most Siri interaction, even without opening the app, ends up stored there. The default retention setting on the author's machine was Forever, with 30 days and 1 Year as the other options. Unless someone changed it, a lot of user-to-Siri content may be recoverable. - Where to look: ~/Library/Daemon Containers/<UUID>/Data/AgentSessionKit/AgentSessionStore.sqlite. The UUID differs on every host. Events are stored in ZAGENTSESSIONEVENTENTITY. Session records are in ZAGENTSESSIONRECORDENTITY, which the report's query joins to the event table on ZSESSION = Z_PK. Agent identity comes from ZBUNDLEID in ZAGENTPROVENANCEENTITY. - Parsing: the report gives a full query. It returns the agent bundle ID, session ID, pinned flag, session and event creation times, summary, title, role (ZROLERAWVALUE), message text (ZTEXTCONTENT), source bundle ID, and record last-modified time. Timestamps are Cocoa epoch, so the query adds 978307200 before converting with unixepoch. Do the same in any ad hoc work or the times will be wrong. - Attachments: Siri can process files, but the main query does not return them. Files are generally not stored in the database. They are referenced in ZARTIFACTENTITY, usually as a JSON string with nested bookmark objects and plists. Some of those hold bookmarks to files on disk, so you may be able to tie a Siri conversation to a specific file the user handed over. - Deletion angle: ZPERSISTABLESTATERAW in ZAGENTSESSIONRECORDENTITY indicates whether an entry can be removed. At zero, the entry does not show in the conversations UI and can be purged later. The report shows session 15 with no events retained while session 17 still has data. So the session records and their state flags are worth reviewing alongside the visible conversation list, because the UI view may not match what the database holds. Takeaway: on macOS 27 triage, collect the AgentSessionKit folder from the Daemon Containers path and check the retention setting. Run the report's query, then review ZARTIFACTENTITY for bookmarks to files that were fed to Siri. Compare ZPERSISTABLESTATERAW values against what the UI shows. The query is in the report. A Siri App plugin has been added to mac_apt, and standalone databases can be read with mac_apt_artifact_only. #DFIR_Radar

Thalium's BinQL brings CodeQL to stripped binaries via IDA Pro's decompiler ctree. Match a patch's compiled artifact to find CVE-2018-25032 zlib copies bundled in shipped apps. #DFIR_Radar

A report outlines a four-step automated triage workflow: baseline the host, decide on bad items, then suspicious ones. Then manually fill gaps like initial access or credential theft. #DFIR_Radar

Datadog and Mandiant report ARTEX, an agentic pentest framework, hitting AWS with stolen IAM keys. Hunt S3 requests for zzz_nonexistent_abc.txt and FilterLogEvents calls capped at 1000 events. #DFIR_Radar

FortiGuard Labs found attackers brute-forcing weak passwords on exposed SQL Servers to deploy an XMRig miner and Gh0st RAT. Check for enabled xp_cmdshell and Edge-update-lookalike scheduled tasks. #DFIR_Radar

NVISO found CVE-2026-89032, a LiteLLM flaw letting different API keys share semantic cache buckets, enabling PII leaks and poisoned tool calls. Patch to v1.101.0-rc.1 and never cache tool calls. #DFIR_Radar

Huntback reports N-able N-central chain 4EverAble2Shell installed XMRig miners on 21 live servers. Hunt for new admin accounts and logins since November 8, and confirm Legacy API is off. #DFIR_Radar

N-central's Able2Shell disclosure, 33 alleged zero-days with exploit code, shows probing but no confirmed exploitation. Hunt logs since early November for XXE probes on /dms/services/ServerUI and 5.231.45[.]175 traffic. #DFIR_Radar

Exploited Outlook zero-day CVE-2026-124194 (CVSS 6.5, CISA KEV) leaks NTLMv2 hashes when a crafted message file is opened. Hunt OUTLOOK.EXE making outbound SMB on port 445 to external hosts. #DFIR_Radar

Nyasher reverse-proxy phishing used Google Calendar invites to hijack live Google sessions past MFA. Check Workspace audit logs, revoke sessions and OAuth grants; IOCs are in the companion whitepaper. #DFIR_Radar