Cybersecurity News

Once in a while I go build some fun new tools to adopt new tech. Just last week OpenAI made their gpt-3.5-turbo model accessible via API endpoints. Update: The latest version also supports GPT-4. So, I thought it’s time to start building a tool to leverage it. What is yolo? Do you know those moments when you can’t remember a shell command, or some arguments to it? How do you pipe all errors to /dev/null again? Things along those lines. This is where yolo comes to the rescue.

Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

See how we’ve been improving the processes that allow us to make updates quickly in response to new information and propagate those protections to our users, with the help of machine learning models.

Tutorial that walks through setting up Filebeat to push threat intelligence feeds into your Elastic Stack.

Elastic Endpoint Security provides events that enable defenders with visibility on techniques and procedures which are commonly leveraged to access sensitive files and registry objects.

We added a Living off the land (LotL) detection package to the Integrations app in Kibana. In a single click, you can install and start using the ProblemChild model and associated assets including anomaly detection configurations and detection rules.

Elastic Event Query Language (EQL) correlation capabilities enable practitioners to capture complex behavior for adversary Lateral Movement techniques. Learn how to detect a variety of such techniques in this blog post.

In this blog, we walk users through identifying beaconing malware in their environment using our beaconing identification framework.

This post includes a primer on kernel mode attacks, along with Elastic’s recommendations for securing users from kernel attacks leveraging vulnerable drivers.

The Elastic Container Project provides a single shell script that will allow you to stand up and manage an entire Elastic Stack using Docker. This open source project enables rapid deployment for testing use cases.

Learn more about discovering threats by hunting through DLL load events, one way to reveal the presence of known and unknown malware in noisy process event data.

Elastic Security Labs is tracking an active intrusion into a Vietnamese organization using a recently discovered triggerable, multi-hop backdoor we are calling PIPEDANCE. This full-featured malware enables stealthy operations through the use of named

This article demonstrates a flaw that allows attackers to bypass a Windows security mechanism which protects anti-malware products from various forms of attack.

Elastic Security has performed a deep technical analysis of the CUBA ransomware family. This includes malware capabilities as well as defensive countermeasures.

Elastic Security Labs releases a QBOT malware analysis report covering the execution chain. From this research, the team has produced a YARA rule, configuration-extractor, and indicators of compromises (IOCs).

Elastic Security Labs is providing an update to the REF2924 research published in December of 2022. This update includes malware analysis of the implants, additional findings, and associations with other intrusions.

Elastic Security Labs discusses the NETWIRE trojan and is releasing a tool to dynamically extract configuration files.

Python script to extract the configuration from NETWIRE samples.

Let's discuss three benefits that Hardware Stack Protections brings beyond the intended exploit mitigation capability, and explain some limitations.

Recently I got the feedback to create more tutorials and videos, and I thought SSH Agent Hijacking on Linux and macOS (which I wrote about before here) would make a good one. The video tutorial is here. If you like this kind of content, then comment or like the video on YouTube and I’ll create more. Hope it’s useful to get a good basic understanding of this TTP, and help build detections for it.

Elastic is deploying a new malware signature to identify the use of the Follina vulnerability. Learn more in this post.

There is a combination of lesser known tools and techniques to capture and later decrypt SSL/TLS network traffic on Windows. This technique is neat because it does not require the installation of additional driver/software when capturing the traffic. Technique, Tools and Steps It is quite straight forward and consists of: Setting the SSLKEYLOGFILE environment variable to capture TLS session keys on target host Use netsh trace start to capture traffic (no need to install additional driver/software!) Convert the .etl file to a pcap using Microsoft’s etl2pcapng Start Wireshark, open the pcap and set the sslkeys under: Preferences->Protocols->TLS->Pre-Master secret. This does not have to be on the same host as steps 1-2. Enjoy the decrypted traffic! If you can or want to capture traffic with Wireshark also, there is no need to use netsh of course.

This year's FLARE-ON consisted of 11 different reverse engineering challenges with a range of interesting binaries. We really enjoyed working on these challenges and have published our solutions here to Elastic Security Labs.

During part two of this multipart series, we’ll help you understand how to setup a GW lab for threat detection and research.

During this multipart series, we’ll help you understand what GW is and some of the common risks to be aware of, while encouraging you to take control of your enterprise resources.

Elastic Security Labs is tracking likely multiple on-net threat actors leveraging Exchange exploits, web shells, and the newly discovered SiestaGraph implant to achieve and maintain access, escalate privilege, and exfiltrate targeted data.

Threat intelligence resources like the 2022 Elastic Global Threat Report are critical to helping teams evaluate their organizational visibility, capabilities, and expertise in identifying and preventing cybersecurity threats.

In this blog, we will demonstrate how to detect each of four classes of process trampolining and release an updated PowerShell detection script – Get-InjectedThreadEx

The Elastic Security Labs team has been tracking REF2731, an 5-stage intrusion set involving the PARALLAX loader and the NETWIRE RAT.

Elastic Security verifies new destructive malware targeting Ukraine: Operation Bleeding Bear