Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks
Introduction We were pleased to see that the kernel call stack capability we released in 8.8 was met with extremely positive community feedback – both…
Category: ThreatIntelligence-IncidentResponse
Sinking macOS Pirate Ships with Elastic Behavior Detections
Preamble On January 12, 2024, Malwrhunterteam, an X account that surfaces interesting malware samples, usually found via VirusTotal, released a Tweet about a pirated macOS…
Unlocking Power Safely: Privilege Escalation via Linux Process Capabilities
Preamble In the realm of Linux security, administrators constantly grapple with a delicate balance between safeguarding sensitive system resources and accessibility. One helpful avenue that…
500ms to midnight: XZ A.K.A. liblzma backdoor
Key Takeaways li]:list-disc”> Stage 0: The initial malicious code additions attempt to decode the Stage 1 script (hidden code segments) by changing byte values from…
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part One
In the first article in this multipart series, malware researchers on the Elastic Security Labs team give a short introduction about the REMCOS threat and…
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Two
In the previous article in this series on the REMCOS implant, we shared information about execution, persistence, and defense evasion mechanisms. Continuing this series we’ll…
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Three
In previous articles in this multipart series, malware researchers on the Elastic Security Labs team analyzed REMCOS execution flow, detailing its recording capabilities and its…
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four
In previous articles in this multipart series [1] [2] [3], malware researchers on the Elastic Security Labs team decomposed the REMCOS configuration structure and gave…
Microsoft Management Console for initial access and evasion
Overview After Microsoft disabled office macros by default for internet-sourced documents, other infection vectors like JavaScript, MSI files, LNK objects, and ISOs have surged in…
Dismantling Smart App Control
Introduction Reputation-based protections like Elastic’s reputation service can significantly improve detection capabilities while maintaining low false positive rates. However, like any protection capability, weaknesses exist…
Beyond the wail: deconstructing the BANSHEE infostealer
Preamble In August 2024, a novel macOS malware named “BANSHEE Stealer” emerged, catching the attention of the cybersecurity community. Reportedly developed by Russian threat actors,…
Elastic publishes 2024 Global Threat Report
Reports Elastic Security Labs has released the 2024 Elastic Global Threat Report, surfacing the most pressing threats, trends, and recommendations to help keep organizations safe…