Tricks and Treats: GHOSTPULSE’s new pixel-level deception
Update This research covers an update to stage 2 of GHOSTPULSE, originally disclosed by Elastic Security Labs in October 2023. Key takeaways
Category: ThreatIntelligence-IncidentResponse
Announcing the Elastic Bounty Program for Behavior Rule Protections
Introduction We’re excited to introduce a new chapter in our security bounty program on HackerOne that we soft launched in December 2024. Elastic is now…
Now available: the 2025 State of Detection Engineering at Elastic
We’ve been working hard at Elastic Security Labs! We’ve just published a brand new report: the 2025 State of Detection Engineering at Elastic. This report…
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
Background The Huntress Security Operations Center (SOC) recently came across two interesting variants of the same attack involving a browser-in-the-browser (BiTB) phishing technique. BiTB is…
Grand Theft Auto VI hype leads to malware
Acknowledgments: Special thanks to Jon Semon, Andrew Brant, and Lindsey O’Donnell-Welch for their contributions to this investigation and writeup. Background There’s still three months until…
Elastic Security scores 100% in AV-Comparatives Business Security Test
We’re thrilled to share that Elastic Security achieved a score of 100% in the recent AV-Comparatives Business Security Test. Why the AV-Comparatives Business Security Test…
Elastic excels in AV-Comparatives EPR Test 2025: A closer look
In a threat landscape defined by sophisticated, multistage attacks, enterprises demand endpoint security solutions that not only detect threats but also actively prevent them and…
FlipSwitch: a Novel Syscall Hooking Technique
FlipSwitch: a Novel Syscall Hooking Technique Syscall hooking, particularly by overwriting pointers to syscall handlers, has been a cornerstone of Linux rootkits like Diamorphine and…
WARMCOOKIE One Year Later: New Features and Fresh Insights
Revisiting WARMCOOKIE Elastic Security Labs continues to track developments in the WARMCOOKIE codebase, uncovering new infrastructure tied to the backdoor. Since our original post, we…
What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape
For the fourth consecutive year, Elastic Security Labs presents its 2025 Global Threat Report, distilling real-world user telemetry to offer critical insights into the evolving…
From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect
Introduction Elastic Security Labs is observing malicious campaigns delivering a multi-stage infection involving a previously undocumented loader. The infection begins when users are diverted to…
How we caught the Axios supply chain attack
Preamble Last Monday night I was working late and a Slack alert came in from a monitoring tool I had built three days earlier. Axios…