Into The Weeds: How We Run Detonate
Preamble In our first post in our Detonate series, we introduced the Detonate system and what we use it for at Elastic. We also discussed…
Category: ThreatIntelligence-IncidentResponse
Initial research exposing JOKERSPY
Key takeaways li]:list-disc”> How Elastic Security Labs identified reconnaissance from the adversary group The adversary’s steps to evade detection using xcc , installing the sh.py…
Centralized alert triage: one SOC, 100 linked projects
Run security operations for more than one team, region, or customer, and you inherit a familiar tradeoff. One giant deployment gives you a single view…
Oracle September 2026 Critical Security Patch Update
Oracle addresses 672 CVEs in its September 2026 Critical Security Patch Update with 673 patches, including 104 critical updates. Key Takeaways The September 2026 Critical…
The End of Point-in-Time Compliance | Continuous Audit
Key Takeaways Periodic audits provide a point-in-time assessment, but they cannot demonstrate whether controls remain effective between audit cycles. Qualys platform data shows 10.5 billion…
NAPLISTENER: more bad dreams from developers of SIESTAGRAPH
Introduction While continuing to monitor the REF2924 activity group, Elastic Security Labs observed that the attacker shifted priorities from data theft to persistent access using…
Autonomous Remediation and What Finally Makes It Safe
Executive Summary Vulnerability exploitation now happens at a speed that manual, ticket-based remediation can’t match. Qualys’s Enterprise TruRisk Management Platform closes that gap with autonomous…
Revisiting BLISTER: New development of the BLISTER loader
Preamble In a fast-paced and ever-changing world of cybercrime threats, the tenacity and adaptability of malicious actors is a significant concern. BLISTER, a malware loader…
Automate Asset Isolation to Meet Remediation Deadlines
Executive Summary Remediation deadlines slip for reasons outside your control: a patch does not exist yet, a patch is delayed, or a remediation attempt fails.…
Before You Patch. Why Patch Reliability Matters for Confident Deployment
Executive Summary Microsoft’s September 2026 security updates, KB5124008 and KB5124012, have been linked to USB audio failures on some Windows systems, highlighting the operational risk that can…
Inside Microsoft’s plan to kill PPLFault
On September 1, 2023, Microsoft released a new build of Windows Insider Canary, version 25941. Insider builds are pre-release versions of Windows that include experimental…
Accelerating Elastic detection tradecraft with LLMs
In line with our Openness Initiative, we remain committed to transparency and want to share how our internal AI R&D efforts have increased the productivity…