Lost in relocation: analysis of a new loader distributing CASTLESTEALER
Find out how a new obfuscated loader evades static detection using .reloc section abuse, five anti-VM/language checks an
#labs
共收录 62 条相关情报。
← 返回所有主题Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap
Azure AD Graph Activity Logs land in Elastic with full ECS parsing. Detect ROADrecon and AADInternals enumeration with r
LABScon25 Replay | Keynote: Steps to an Ecology of Cyber
Decades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade mak
LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine
ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FS
From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence
Find out how Elastic Security ingests Google Threat Intelligence for continuous detection and uses AI-driven workflows t
Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
Tycoon 2FA bypasses MFA on Entra ID and Google Workspace. We map telemetry fingerprints across both platforms, ship dete
LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout
Mick Baccio and Scott Roberts examine whether public breach signals and market timing models can turn cyber incidents in
Elastic Security MCP App: Interactive security operations inside your AI Tools
Elastic Security is the first security vendor to ship an interactive UI in AI tools. Triage alerts, hunt threats, correl
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
This research analyzes the Linux kernel privilege escalation vulnerabilities Copy Fail and DirtyFrag, which exploit subt
Detecting Web Server Probing & Fuzzing in Traefik with Automated Cloudflare Response
This article shows how a customized Elastic Security ES|QL detection rule can identify web server probing and fuzzing ac
PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
Cloud attack framework skips cryptomining, harvests financial, messaging, and enterprise credentials for fraud, spam, an
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payl
LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience
Joe FitzPatrick reveals how consumer imports of networked devices pose a real security risk to small businesses and crit
Elastic Workflows GA: automation where your security data already lives
Elastic Workflows is generally available in 9.4, bringing production-ready security automation with deeper case manageme
Know who to watch before the incident finds you
Elastic Security v9.4 introduces Entity Analytics Watchlists, a way to codify what your team already knows about high-ri
AI-generated hunting leads: The hunt starts before you ask the question
Introducing AI-generated hunting leads, proactive, environment-aware threat hypotheses powered by Elastic Entity analyti
Your UEBA is lying to you: Why entity record quality decides everything
Most entity analytics systems are confidently wrong. They track users who do not exist, generate risk scores built on no
From plain English to production rule: AI-native Elasticsearch ES|QL detection in Elastic Security
Elastic Security now lets analysts describe a threat behavior in plain language and receive a complete, validated Elasti
Elastic Conversational Entity Analytics: threat hunting in a single conversation
Conversational Entity Analytics delivers Entity Analytics features as rich inline attachments and Canvas previews into A
One agent, the right skills: Elastic Security 9.4 brings domain expertise on demand to every SOC workflow
Elastic Security 9.4 introduces skills, modular AI capabilities that teach the Elastic AI Agent how to detect, investiga