How Elastic Infosec Optimizes Defend for Cost and Performance — Elastic Security Labs
In the world of Security Operations Centers (SOCs), data is valuable, but excessive data can be problematic. Collecting every single event from every endpoint is…
Category: ThreatIntelligence-IncidentResponse
Accelerate Attack Surface Discovery with new AI-Powered Connectors
Discovery: The foundation of exposure management To understand your attack surface, and all related exposures, Rapid7’s Command Platform provides Attack Surface Management, (included in Surface…
How Workflows and Agent Builder Close the Loop — Elastic Security Labs
SOC leaders face a daily battle against basic math that doesn’t add up. Data volumes are growing exponentially, attack surfaces are expanding globally, yet your…
Securing Your Business: The Vital Role of Cyber Insurance
Let’s talk about Shelby. Shelby runs a successful online artisanal soap store, priding herself on quality and attention to detail. So when an email lands…
Rising Supply Chain Attacks on Cybersecurity Ecosystems
Cybersecurity has always relied on trust. Every software update, hardware purchase, and cloud integration depends on the implicit belief that vendors will protect their customers.…
Automate your Detection Rule Migration — Elastic Security Labs
Migrating to a new SIEM is often viewed as a daunting task. The sheer volume of legacy detection rules, dashboards, and custom configurations can keep…
Automating GOAD and Live Malware Labs — Elastic Security Labs
Introduction: The Need for a Scalable, Automated Simulation Range In modern security operations, detection engineering is no longer a “set it and forget it” discipline.…
Destructive Malware Targeting Poland’s Energy Sector — Elastic Security Labs
Summary On December 29, 2025, a coordinated campaign of destructive cyberattacks targeted Poland’s energy infrastructure, affecting over 30 renewable energy facilities and a major combined…
SolarWinds Web Help Desk Exploitation
Summary On February 6, 2026, Microsoft reported the exploitation of SolarWinds Web Help Desk (WHD) servers The exploitation facilitated multi-stage intrusions leveraging remote monitoring and…
Tradecraft Tuesday Recap: React2Shell, ClickFix, and the Rise of AI Scams
Every security professional knows the drill. You go home for the holidays and, without volunteering, you become the family’s help desk, incident responder, and fraud…
Rogue RMMs: Common Social Engineering Tactics We Saw in 2025
Special thanks to Austin Worline for his contributions to this blog post. The Huntress Security Operations Center (SOC) frequently comes across incidents involving rogue ScreenConnect…
Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft
Background Reflecting on 2025, AI didn’t produce omnipotent, mind-bending offensive capabilities as many commentators heralded. The reality we observed was much more grounded. Adversaries leaned…