Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns
Elastic Security Labs walks through EDDIESTEALER, a lightweight commodity infostealer used in emerging CAPTCHA-based campaigns.
research
20 articles
De-obfuscating ALCATRAZ
An exploration of techniques used by the obfuscator ALCATRAZ.
Misbehaving Modalities: Detecting Tools, Not Techniques
We explore the concept of Execution Modality and how modality-focused detections can complement behaviour-focused ones.
Elastic and Keep join forces to help users manage alerts and automate workflows
Elastic announces the acquisition of Keep Alerting
Elastic changes the SIEM game with AI-driven security analytics
Learn more about Elastic's AI-driven security analytics
Bit ByBit - emulation of the DPRK's largest cryptocurrency heist
A high-fidelity emulation of the DPRK's largest cryptocurrency heist via a compromised macOS developer and AWS pivots.
Drag and Pwnd: Leverage ASCII characters to exploit VS Code
Control characters like SOH, STX, EOT and ETX were never meant to run your code - but in the world of modern terminal emulators, they sometimes do.
How to achieve full-spectrum financial risk detection with AI and unified data
Financial services can’t rely on manual review alone. Discover how unified data and explainable AI are helping firms detect risk, reduce cost, and stay ahead...
Now available: the 2025 State of Detection Engineering at Elastic
The 2025 State of Detection Engineering at Elastic explores how we create, maintain, and assess our SIEM and EDR rulesets.
Document My Pentest: you hack, the AI writes it up!
Tired of repeating yourself? Automate your web security audit trail.
Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective
Outlaw is a persistent Linux malware leveraging simple brute-force and mining tactics to maintain a long-lasting botnet.
The Shelby Strategy
An analysis of REF8685's abuse of GitHub for C2 to evade defenses.
Shedding light on the ABYSSWORKER driver
Elastic Security Labs describes ABYSSWORKER, a malicious driver used with the MEDUSA ransomware attack-chain to disable anti-malware tools.
SAML roulette: the hacker always wins
Introduction In this post, we’ll show precisely how to chain round-trip attacks and namespace confusion to achieve unauthenticated admin access on GitLab Ent...
AWS SNS Abuse: Data Exfiltration and Phishing
During a recent internal collaboration, we dug into publicly known SNS abuse attempts and our knowledge of the data source to develop detection capabilities.
Detecting Hotkey-Based Keyloggers Using an Undocumented Kernel Data Structure
In this article, we explore what hotkey-based keyloggers are and how to detect them. Specifically, we explain how these keyloggers intercept keystrokes, then...
Linux Detection Engineering - The Grand Finale on Linux Persistence
By the end of this series, you'll have a robust knowledge of both common and rare Linux persistence techniques; and you'll understand how to effectively engi...
Shadow Repeater:AI-enhanced manual testing
Have you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice?
Emulating AWS S3 SSE-C Ransom for Threat Detection
In this article, we’ll explore how threat actors leverage Amazon S3’s Server-Side Encryption with Customer-Provided Keys (SSE-C) for ransom/extortion operati...
You've Got Malware: FINALDRAFT Hides in Your Drafts
During a recent investigation (REF7707), Elastic Security Labs discovered new malware targeting a foreign ministry. The malware includes a custom loader and ...