Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAIND
#labs
共收录 62 条相关情报。
← 返回所有主题Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows
Public leaderboards can't tell you which LLM to trust in your SOC, so Elastic built an evaluation framework that grades
Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human
LLMs made it cheap to flood bug bounty programs with submissions. Here's how Elastic built an AI triage agent that match
SOC case management and detection rule history in Elastic Security
Elastic Security now tracks every detection rule change with one-click rollback and makes case data queryable out of the
Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas
Attack Discovery turns raw alerts into validated threats and Elastic Defend closes vulnerable driver gaps as fast as the
Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC
Elastic Security 9.5 gives SOC teams AI that handles first-pass alert triage and investigation, so analysts can get back
Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend
Every stage of the Hugging Face breach maps to Elastic Defend and SIEM rules already shipping, from worker RCE and crede
What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support
Elastic Defend automatically generates and instantly deploys vulnerable driver YARA rules from VirusTotal, LOLDrivers an
Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here
Elastic's first automatic migration from a modern SIEM. Translate your Sentinel detection rules into Elastic Security wi
Inside Elastic InfoSec's agentic SOC: How we cut AI agent LLM calls by 60%
We run fourteen AI agents that triage Elastic InfoSec alerts. They were taking 19 LLM calls to do work that needed 8. He
Inside Elastic InfoSec's agentic SOC: When to inline your agent's skills for a 5× cost reduction
We tested two agentic SOC architectures in parallel across 36,822 real Agent Builder conversations. One won by 5.7x: a s
How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts
Elastic InfoSec tested this detection rule pattern on their own cloud fleet, filtering noisy curl and wget events with d
wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution
We ran the wp2shell WordPress RCE chain end-to-end with Elastic Defend. Detection rule walkthrough, IOCs, and hunt guida
Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?
A real-world benchmark tests whether powerful AI models can keep an investigation trustworthy when new evidence invalida
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
In April, SentinelLABS’ Tom Hegel published an initial assessment of the first five weeks of the conflict. Three months
New North Korean campaign uses fake coding interviews to steal developer credentials
DPRK-aligned hackers hid malware inside SVG flag images to backdoor developer job interview coding tests. Not one antivi
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
TELEPUZ is a modular malware that emerged through CLICKFIX-VIDAR attacks in April. We reverse-engineered it to show you
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement
China and India ran separate espionage operations against the same Pakistani police force, each drawn by different stake
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
Elastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer a