Hunting for Suspicious Windows Libraries for Execution and Defense Evasion
Dynamic-link library (DLL) image loads is one of the noisiest types of event in Windows, which may discourage defenders from using it for detection engineering…
Category: ThreatIntelligence-IncidentResponse
Detecting Living-off-the-land attacks with new Elastic Integration
It is becoming more common that adversary attacks consist of more than a standalone executable or script. Advanced attacker techniques, like “living off the land”…
Detect Credential Access with Elastic Security
Preamble Credential Access consists of techniques for stealing credentials like cookies, API keys, and passwords. It is one of the top critical tactics that is…
Elastic Global Threat Report Multipart Series Overview
Blog Each month, the Elastic Security Labs team dissects a different trend or correlation from the Elastic Global Threat Report. This post provides an overview…
Unpacking ICEDID | Elastic Security Labs
Preamble ICEDID is a malware family discoveredin 2017 by IBM X-force researchers and is associated with the theft of login credentials, banking information, and other…
Click, Click… Boom! Automating Protections Testing with Detonate
Preamble Imagine you are an Endpoint artifact developer. After you put in the work to ensure protection against conventional shellcode injections or ransomware innovations, how…
Detect domain generation algorithm (DGA) activity with new Kibana integration
Searching for a way to help protect your network from potential domain generation algorithm (DGA) attacks? Look no further — a DGA detection package is…
Forget vulnerable drivers – Admin is all you need
Introduction Bring Your Own Vulnerable Driver (BYOVD) is an increasingly popular attacker technique wherein a threat actor brings a known-vulnerable signed driver alongside their malware,…
Using LLMs to summarize user sessions
Using LLMs to summarize user sessions With the introduction of the AI Assistant into the Security Solution in 8.8, the Security Machine Learning team at…
Using LLMs and ESRE to find similar user sessions
Using LLMs and ESRE to find similar user sessions In our previous article, we explored using the GPT-4 Large Language Model (LLM) to condense complex…
Streamlining ES|QL Query and Rule Validation: Integrating with GitHub CI
One of the amazing, recently premiered 8.11.0 features, is the Elasticsearch Query Language (ES|QL). As highlighted in an earlier post by Costin Leau, it’s a…