Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a
#detection
共收录 84 条相关情报。
← 返回所有主题How CVE-2026-73570 turns a Zimbra log file into remote code execution
CVE-2026-73570
We reproduced the Zimbra command injection vulnerability and found that several public PoCs write a payload Swatchdog ne
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 · CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is ve
Auditing the auditor: Unmasking Apex Accelerator
REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled
Introducing AlertZero: Inbox zero for your alert queue
AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your p
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules acr
SEW: Style-Encoded Watermarking of LLM-Generated Code
该论文关注 LLM 生成代码的来源追踪(provenance)问题, 提出名为 SEW(Style-Encoded Watermarking)的代码水印方案。研究背景是: 现有代码水印大体分为两类路线——一类在模型生成过程中修改 token
No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current
Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Cod
Quarantined isn't contained: Agentic phishing response with Elastic and Sublime
The native Sublime Security integration sends email detections into Elastic Security, where phishing incident response c
A Gmail-Based Phishing Detection Prototype for Nigerian Fintech Emails Using Sender Checks and BiLSTM Classification
该论文面向尼日利亚金融科技（fintech）场景的钓鱼邮件问题，提出并实现了一个基于 Gmail 的浏览器扩展原型。研究背景是：冒充尼日利亚本土金融科技服务商的钓鱼邮件往往同时具备三类特征——伪造或高度相似的发件人地址、与官方域名近似的仿冒
One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
We linked one Elastic Security project to 100 others and ran the full prebuilt detection catalog from the origin, with a
A GAN-Based Framework for Robust DDoS Attack Detection
该论文关注分布式拒绝服务（DDoS）攻击检测中的鲁棒性问题。作者指出，在线服务可用性持续受到 DDoS 威胁，攻击者不断采用更复杂策略规避传统网络安全系统；同时，机器学习检测模型虽有效，但面对针对性对抗攻击时分类准确率会下降。为此，论文提出
Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs
该论文研究的是多源 LLM Agent 输入场景下的"片段级投毒"（segment-level poisoning）检测与定位问题。现代 LLM Agent 通常把检索到的文段、用户评论、外部文档等多来源内容聚合成一个 prompt，攻击者
Mitigating 51% Attacks in Blockchain Systems Through Early Detection and Checkpoint-Based Defense
本文针对 Proof-of-Work (PoW) 区块链中长期存在的 51% 攻击风险提出一套双层防御方案。研究背景是：随着矿池与算力向少数实体集中，攻击者一旦掌握超过半数的算力，就具备实施恶意多数控制并触发链重组（chain reorga
Linux Detection Engineering - Local Privilege Escalation
Seven of the thirteen Linux privilege escalation CVEs we tracked in 2026 turned out to be the same copy-on-write bug poi
The History Is the Detector: Executing CVE Patch History, End-to-End
本文提出 BUGSTONE-E2E，一种将漏洞历史（尤其是 CVE 修复提交）转化为可执行检测规则并自动化验证的端到端框架。当前公共漏洞数据库虽然记录了已知软件缺陷的类型、影响组件和补丁信息，但这些信息主要用于人工查阅，缺乏自动化复用机制，
Data access: the hidden cost of security vendor lock-in
Getting data into a security platform is always easy; getting it back out is where vendors add cost, extra tooling, and
Poster: Detecting Adversarial Examples Hidden under Watermark Perturbation via Usable Information Theory.
本论文探讨图像水印扰动作为对抗性噪声时，对深度学习模型产生的欺骗威胁。传统对抗样本 (AE) 检测方法通常假设噪声为典型的扰动模式（如 Lp 范数约束），因此面对嵌入水印标志这类结构化噪声时往往失效，即水印扰动 AE 可绕过现有检测。文章提
Understanding and Detecting International Revenue Share Fraud.
本文研究国际收入分成欺诈（International Revenue Share Fraud, IRSF）问题。高级费率电话号码通常被恶意方滥用（例如通过电话诈骗、移动恶意软件等）以获取经济利益。这种利益来源于'收入分成'机制，即高级费率号
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 3