From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence
Find out how Elastic Security ingests Google Threat Intelligence for continuous detection and uses AI-driven workflows t
#detection
共收录 84 条相关情报。
← 返回所有主题Limits of I/O Based Ransomware Detection: An Imitation Based Attack.
该论文研究了基于输入/输出（I/O）行为的勒索软件检测技术的局限性。作者首先指出，现有检测技术通常假设勒索软件与良性程序在行为上存在显著差异，并通过监控用户空间的I/O行为应用自定义启发式规则进行识别。然而，通过对良性程序和勒索软件的实际行
Prompt Injection Detection is Regime-Dependent: A Deployment-Aware Evaluation with Interpretable Structural Signals
本文针对大型语言模型（LLM）面临的提示注入攻击威胁，提出了一种部署感知的评估框架，用于比较多种检测方法在不同部署条件下的表现。现有检测方法通常在有限设定下评估，未反映真实操作约束。作者构建了多模型、多场景的实验框架，涵盖词法、语义、结构以
Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
Tycoon 2FA bypasses MFA on Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship dete
Detecting Ransomware Despite I/O Overhead: A Practical Multi-Staged Approach.
该论文提出了一种针对勒索软件检测的实用多阶段方法，旨在解决现有检测方案在监控文件系统活动时产生的I/O开销问题。作者首先分析了勒索软件的行为特征，即大量加密操作导致高频率的I/O事件。为了在检测准确性与系统性能之间取得平衡，他们设计了一个两
ERW-Radar: An Adaptive Detection System against Evasive Ransomware by Contextual Behavior Detection and Fine-grained Content Analysis.
本文提出了一种名为 ERW-Radar 的适应性检测系统，旨在应对日益复杂的逃避型勒索软件。这类勒索软件通过模仿良性程序或减弱加密过程中的恶意行为来规避传统杀毒软件和检测系统，导致现有防御手段效果有限。作者通过大量观察发现，逃避型勒索软件在
Elastic Security MCP App: Interactive security operations inside your AI Tools
Elastic Security is the first security vendor to ship an interactive UI in AI tools. Triage alerts, hunt threats, correl
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
This research analyzes the Linux kernel privilege escalation vulnerabilities Copy Fail and DirtyFrag, which exploit subt
Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response
This article shows how a customized Elastic Security ES|QL detection rule can identify web server probing and fuzzing ac
Hopper: Modeling and Detecting Lateral Movement.
本文提出了一种名为Hopper的横向移动检测系统。在企业网络攻击中，攻击者常在初始入侵后通过横向移动访问更多内部机器。Hopper利用企业常见的登录日志，构建内部机器之间的登录活动图，然后识别异常的登录序列。为了理解每个登录的上下文，Hop
Beyond Collection: Measuring the Detection Efficacy of Modern Security Logging Standards
该论文首次系统评估了现代安全日志标准的检测效能。针对当前日志标准（CIM、OCSF、ECS）在捕获关键攻击指标方面的相对有效性缺乏实证研究的问题，作者提出了一种基于自动化安全利用遥测收集（SETC）框架的新型评估方法。SETC 在容器化环境
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payl
Constructive Noise Defeats Adversarial Noise: Adversarial Example Detection for Commercial DNN Services.
本文针对商用深度学习服务中的对抗样本检测问题，提出了一种名为“建设性噪声”的新型防御方法。该方法通过向输入数据添加精心设计的噪声，使得正常样本和对抗样本在模型内部表示上产生可区分的差异，从而有效检测出对抗扰动。核心思路是利用噪声的构造性来对
Elastic Workflows GA: automation where your security data already lives
Elastic Workflows is generally available in 9.4, bringing production-ready security automation with deeper case manageme
Know who to watch before the incident finds you
Elastic Security v9.4 introduces Entity Analytics Watchlists, a way to codify what your team already knows about high-ri
AI-generated hunting leads: The hunt starts before you ask the question
Introducing AI-generated hunting leads, proactive, environment-aware threat hypotheses powered by Elastic Entity analyti
Your UEBA is lying to you: Why entity record quality decides everything
Most entity analytics systems are confidently wrong. They track users who do not exist, generate risk scores built on no
From plain English to production rule: AI-native Elasticsearch ES|QL detection in Elastic Security
Elastic Security now lets analysts describe a threat behavior in plain language and receive a complete, validated Elasti
Elastic Conversational Entity Analytics: threat hunting in a single conversation
Conversational Entity Analytics delivers Entity Analytics features as rich inline attachments and Canvas previews into A
One agent, the right skills: Elastic Security 9.4 brings domain expertise on demand to every SOC workflow
Elastic Security 9.4 introduces skills, modular AI capabilities that teach the Elastic AI Agent how to detect, investiga