Elastic Security uncovers BLISTER malware campaign
Key takeaways:
Category: ThreatIntelligence-IncidentResponse
Getting the Most Out of Transformers in Elastic
Preamble In 8.3, our Elastic Stack Machine Learning team introduced a way to import third party Natural Language Processing (NLP) models into Elastic. As security…
Detecting and responding to Dirty Pipe with Elastic
Preamble Dirty Pipe is a local privilege escalation vulnerability that is easily exploitable with a handful of working exploit POCs already available. Its broad scope…
Extracting Cobalt Strike Beacon Configurations
Please check out our previous post on how to collect Cobalt Strike beacon implants. We’ll build on that information to extract the configurations from the…
Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER
Introduction On February 23, 2022, the ESET threat research team disclosed a series of findings pertaining to a Data Wiper malware campaign, impacting hundreds of…
Culture at Speed: Protecting What Makes Huntress Work
I’ve been fortunate to work for some truly great leaders at some amazing companies. The common thread is always the same: when culture is protected,…
Handy Elastic Tools for the Enthusiastic Detection Engineer
On August 3, we released Protections-artifacts as part of our Openness Initiative . One of the benefits of producing open and transparent security content is…
ICEDIDs network infrastructure is alive and well
Key takeaways li]:list-disc”> Initial access Command and control Persistence Core functionality Network infrastructure As mentioned in the Preamble, ICEDID has been around for many years…
Detection rules for SIGRed vulnerability
To defend your environment from the SIGRed vulnerability, we recommend implementing the detection logic included below into your environment using technology such as Endpoint security,…
Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security
li]:list-disc”> A series of payloads have been shared by the GreyNoise team, including payloads containing both encoded and decoded variants for analysts looking to explore…
Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
Attackers are increasingly turning to trusted software your business already depends on instead of custom malware or exploits. In one recent Huntress Security Operations Center…
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
Background Huntress researchers recently came across a unique incident where, after gaining initial access via exploiting a known Samsung MagicINFO vulnerability and installing a rogue…