Practical security engineering: Stateful detection
Detection engineering at Elastic is both a set of reliable principles — or methodologies — and a collection of effective tools. In this series, we’ll…
Category: ThreatIntelligence-IncidentResponse
Detection and response for the actively exploited ProxyShell vulnerabilities
Blog In the last week, Elastic Security has observed the exploitation of Microsoft Exchange vulnerabilities associated with ProxyShell. Review the post to find newly released…
Linux endpoint management without MDM via Elastic Workflows
Our mobile device management (MDM) covers macOS and Windows but not Linux. So, for Linux endpoint management, we turned to Elastic Agent and Elastic Defend,…
Testing your Okta visibility and detection with Dorothy and Elastic Security
When approached by stakeholders in their organization, few security teams can confidently demonstrate that logging and alerting capabilities are working as expected. Organizations have become…
Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate
How reliability scoring keeps risky patches out of zero-touch jobs, and how one blocking rule stops a paused update across your environment. Executive Summary Microsoft…
Ransomware, interrupted: Sodinokibi and the supply chain
Last month, the Elastic Security Protections Team prevented an attempted ransomware attack targeting an organization monitored by one of our customers, an IT Managed Service…
Okta and LAPSUS$: What you need to know
Readers Note: Elastic has undergone a series of investigations internally and has not yet identified malicious actions that may pertain to this event. Okta has…
Phishing incident response with Elastic and Sublime Security
Critical signals still land in different security tools, so early signs of a campaign might go unnoticed. That visibility gap is getting more expensive as…
Nimbuspwn: Leveraging vulnerabilities to exploit Linux via Privilege Escalation
Summary The Microsoft 365 Defender team released a post detailing several identified vulnerabilities. These vulnerabilities allow adversarial groups to easily escalate privileges on Linux systems,…
Hunting In Memory | Elastic Security Labs
Threat Hunters are charged with the difficult task of sifting through vast sources of diverse data to pinpoint adversarial activity at any stage in the…
Hunting For In-Memory .NET Attacks
Hunting-memory-hunting_in_memory_.net_1.png In past blog posts, we shared our approach to hunting for traditional in-memory attacks along with in-depth analysis of many injection techniques. As a…
A close look at the advanced techniques used in a Malaysian-focused APT campaign
The Elastic Security Intelligence & Analytics Team researches adversary innovations of many kinds, and has recently focused on an activity group that leveraged remote templates,…