Kernel ETW is the best ETW
This research focuses on the importance of native audit logs in secure-by-design software, emphasizing the need for kernel-level ETW logging over user-mode h...
Transportation
20 articles
A hacking hat-trick: previewing three PortSwigger Research publications coming to DEF CON & Black Hat USA
We're delighted to announce three major research releases from PortSwigger Research will be published at both Black Hat USA and DEF CON 32.
Firefox will upgrade more Mixed Content in Version 127
Most of the web already supports HTTPS: In fact, 93% of requests made by Firefox are already HTTPS. As a reminder, HTTP over TLS (HTTPS) fixes the security s...
Monitoring Okta threats with Elastic Security
This article guides readers through establishing an Okta threat detection lab, emphasizing the importance of securing SaaS platforms like Okta. It details cr...
Fall 2023 Global Threat Report Outro
This article highlights the essential contributions to the Global Threat Report from the Security Intelligence team, and describes three major phenomena impa...
Inside Microsoft's plan to kill PPLFault
In this research publication, we'll learn about upcoming improvements to the Windows Code Integrity subsystem that will make it harder for malware to tamper ...
Into The Weeds: How We Run Detonate
Explore the technical implementation of the Detonate system, including sandbox creation, the supporting technology, telemetry collection, and how to blow stu...
Exploring Windows UAC Bypasses: Techniques and Detection Strategies
In this research article, we will take a look at a collection of UAC bypasses, investigate some of the key primitives they depend on, and explore detection o...
Now available: The LLM safety assessment
Check out the newest report from Elastic Security Labs, which explores how you can protect your organization from LLM threats.
Elastic publishes 2023 Global Threat Report Spring Edition
This week, we’re publishing a new version of this report that’s online and interactive, which includes additional data covering the remainder of 2022, writte...
Elastic Global Threat Report Multipart Series Overview
Each month, the Elastic Security Labs team dissects a different trend or correlation from the Elastic Global Threat Report. This post provides an overview of...
QBOT Malware Analysis
Elastic Security Labs releases a QBOT malware analysis report covering the execution chain. From this research, the team has produced a YARA rule, configurat...
Elastic’s 2022 Global Threat Report: A roadmap for navigating today’s growing threatscape
Threat intelligence resources like the 2022 Elastic Global Threat Report are critical to helping teams evaluate their organizational visibility, capabilities...
Security operations: Cloud monitoring and detection with Elastic Security
As companies migrate to cloud, so too do opportunist adversaries. That's why our Elastic Security team members have created free detection rules for protecti...
Forecast and Recommendations: 2022 Elastic Global Threat Report
With the release of our first Global Threat Report at Elastic, customers, partners, and the security community at large are able to identify many of the focu...
Behind the scenes: The making of a Global Threat Report
What was our approach and process for creating a global threat report?
2022 Elastic Global Threat Report: Helping security leaders navigate today’s threat landscape
A significant percentage of all cyber threats achieve a degree of success against technical, procedural, and human mitigations. So what is a company to do in...
2022 Elastic Global Threat Report Announcement
Discover our latest findings & strategic recommendations to better stay informed of potential directions threat actors may focus on.
Going Coast to Coast - Climbing the Pyramid with the Deimos Implant
The Deimos implant was first reported in 2020 and has been in active development; employing advanced analysis countermeasures to frustrate analysis. This pos...
Practical security engineering: Stateful detection
By formalizing stateful detection in your rules, as well as your engineering process, you increase your detection coverage over future and past matches. In t...