How a team of entity maintainers monitors, connects and scores entities in Elastic Security
Inside Elastic Security, background jobs called maintainers each own one piece of every user, host and service record, f
#detection
共收录 84 条相关情报。
← 返回所有主题A Lifecycle-Oriented Detection and Defense Framework for Price Manipulation Attacks in DeFi
本文针对去中心化金融（DeFi）中频繁发生的预言机价格操纵攻击，系统性地研究了攻击模式、漏洞类型、风险评估、自动检测与防御策略。作者基于预言机生命周期理论，构建了一个覆盖物理层、协议层和应用层的三层攻击树，用于分析攻击链，并识别出数据选举阶
RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
检索增强生成（RAG）将外部语料库作为推理证据，但这也引入了安全风险：攻击者可通过注入恶意文档（知识投毒）来引导模型输出特定主张。现有检测方法通常依赖可信参考文档、特定攻击痕迹或全局阈值，这些方法在复杂语料拓扑下鲁棒性不足。本文提出 RAG
The Imitation Game: Exploring Brand Impersonation Attacks on Social Media Platforms.
本文研究社交媒体平台上的品牌冒充攻击（Brand Impersonation Attacks），这类攻击中，恶意行为者创建与知名品牌高度相似的账号、页面或内容，利用用户对品牌的信任实施钓鱼、诈骗、传播虚假信息等活动，严重威胁品牌声誉与用户安
Rethinking System Audit Architectures for High Event Coverage and Synchronous Log Availability.
本文针对现有系统审计架构在事件覆盖率和日志可用性之间的两难问题展开研究。传统审计机制通常以内核模块或系统服务的形式实现，在记录高细粒度事件时往往面临严重的性能开销，导致系统管理员必须在“记录更多事件”与“保证业务响应速度”之间做出取舍。作者
Living off the coding agent: Two tales of tunnels and LaunchAgents
Agent-parented reverse tunnels and LaunchAgents can expose a local admin app to the internet. Endpoint still needs to tr
An Analysis of Architectural and Operational Dynamics of Phishkits in the Wild
本文对2020年至2023年间收集的1300个真实世界中的钓鱼工具包（Phishkits）进行了深度分析，旨在揭示其架构和操作动态。钓鱼攻击一直是攻击者绕过现代防御、渗透关键系统的常用手段，而Phishkits在其中扮演了关键角色，它们通常
LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes
本文提出了一种名为 LoRAScan 的新型防御方法，用于检测大型语言模型（LLM）低秩适配器（LoRA）中的后门提示。LoRA 是一种高效的模型微调技术，通过引入小型适配器模块来降低计算成本，但也带来了供应链安全风险：不可信的适配器可能包
The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
A 40-line CEL integration snapshots .npmrc files every 6 hours to catch cooldown removals. This post walks through the t
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAIND
Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows
Public leaderboards can't tell you which LLM to trust in your SOC, so Elastic built an evaluation framework that grades
FakeI2V-Bench: Benchmarking the Applicability of Image-level Deepfake Detectors for Deepfake Video Detection
近年来，视频生成模型的快速进步显著加剧了深度伪造（deepfake）威胁，然而现有的深度伪造视频检测基准仍不成熟，特别是图像级检测器在视频域中的有效性尚未得到系统性评估。为了填补这一空白，本文提出了FakeI2V-Bench基准，专门用于在
Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human
LLMs made it cheap to flood bug bounty programs with submissions. Here's how Elastic built an AI triage agent that match
SOC case management and detection rule history in Elastic Security
Elastic Security now tracks every detection rule change with one-click rollback and makes case data queryable out of the
Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas
Attack Discovery turns raw alerts into validated threats and Elastic Defend closes vulnerable driver gaps as fast as the
Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC
Elastic Security 9.5 gives SOC teams AI that handles first-pass alert triage and investigation, so analysts can get back
Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend
Every stage of the Hugging Face breach maps to Elastic Defend and SIEM rules already shipping, from worker RCE and crede
What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support
Elastic Defend automatically generates and instantly deploys vulnerable driver YARA rules from VirusTotal, LOLDrivers an
Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here
Elastic's first automatic migration from a modern SIEM. Translate your Sentinel detection rules into Elastic Security wi
SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents
随着AI编程助手（如Cursor、Claude Code、GitHub Copilot）在软件工程团队中的广泛部署，开发者经常通过下载领域特定的技能文件（skill files）来定制代理行为，以适配项目API、框架约定和组织工作流。这些复