ICEDIDs network infrastructure is alive and well
Key takeaways li]:list-disc”> Initial access Command and control Persistence Core functionality Network infrastructure As mentioned in the Preamble, ICEDID has been around for many years…
Category: ThreatIntelligence-IncidentResponse
Detection rules for SIGRed vulnerability
To defend your environment from the SIGRed vulnerability, we recommend implementing the detection logic included below into your environment using technology such as Endpoint security,…
Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security
li]:list-disc”> A series of payloads have been shared by the GreyNoise team, including payloads containing both encoded and decoded variants for analysts looking to explore…
Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
Attackers are increasingly turning to trusted software your business already depends on instead of custom malware or exploits. In one recent Huntress Security Operations Center…
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Background Huntress researchers recently came across a unique incident where, after gaining initial access via exploiting a known Samsung MagicINFO vulnerability and installing a rogue…
Managed or Modified: Choose How Huntress Hardens Microsoft 365
Picture your Microsoft 365 environment being hardened around the clock, controls rolling out on a set schedule based on expert best practices, without you having…
Elastic’s response to the Spring4Shell vulnerability (CVE-2022-22965)
On March 29, 2022 a vulnerability in the Spring framework was disclosed to the public by VMware. This vulnerability had several prerequisites affecting impact:
Sneak Peek: Elastic’s 2022 Global Threat Report
Reports Elastic Security Labs has compiled the 2022 Global Threat Report to share trends and tactics adversaries and attack groups use, as observed by our…
Analysis of Log4Shell vulnerability & CVE-2021-45046
To understand how Elastic is currently assessing internal risk of this vulnerability in our products please see the advisoryhere. This document was updated on December…
Forecast and Recommendations: 2022 Elastic Global Threat Report
Today, we released our first-ever Global Threat Report at Elastic. Now, customers, partners, and the security community at large will be able to identify many…
KNOTWEED Assessment Summary
Key Takeaways li]:list-disc”> 0-day exploit – vulnerability previously unknown to defenders and does not have a public patch Activity Group – individuals, groups, or organizations…
CISA BOD 26-04 Timelines for Three Linux Kernel CVEs
Executive Summary CISA added three actively exploited Linux kernel vulnerabilities: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its KEV Catalog on September 18, 2026, triggering a 3-day…