DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector
Learn how Elastic Defend's ransomware protection successfully detects and prevents DYNOWIPER execution using canary file monitoring.
Elastic Security Labs
20 articles
Automating GOAD and Live Malware Labs
Stop building labs by hand. Automate the deployment of a fully instrumented Purple Team range using Ludus and Elastic Security.
The Engineer's Guide to Elastic Detections as Code
This post details the latest evolution of Elastic Security's Detections as Code (DaC) framework, including its development timeline, current feature highligh...
From Alert Fatigue to Agentic Response: How Workflows and Agent Builder Close the Loop
Attempting to chase individual alerts is a losing strategy. To succeed, we have to move beyond simple automation scripts and into the era of Agentic AI.
From Qradar to Elastic: Automate your Detection Rule Migration
Today, we are excited to announce a major expansion to our Automatic Migration feature that changes that narrative. In Elastic Security 9.
How Elastic Infosec Optimizes Defend for Cost and Performance
This article details the internal Elastic Infosec team's process to optimize our endpoint data collection using Event Filtering and Advanced Policy Settings ...
From Hypothesis to Action: Proactive Threat Hunting with Elastic Security
Elastic Security is designed to enable hypothesis-driven threat hunting at speed and scale. By unifying security telemetry and enabling analytics across clus...
NANOREMOTE, cousin of FINALDRAFT
The fully-featured backdoor we call NANOREMOTE shares characteristics with malware described in REF7707 and is similar to the FINALDRAFT implant.
Automating detection tuning requests with Kibana cases
Learn how to automate detection rule tuning requests in Elastic Security. This guide shows how to add custom fields to Cases, create a rule to detect tuning ...
RONINGLOADER: DragonBreath’s New Path to PPL Abuse
Elastic Security Labs uncovers RONINGLOADER, a multi-stage loader deploying DragonBreath’s updated gh0st RAT variant. The campaign weaponizes signed drivers,...
TOR Exit Node Monitoring Overview
Learn how to monitor your enterprise for TOR exit node activity.
Time-to-Patch Metrics: A Survival Analysis Approach Using Qualys and Elastic
In this article, we describe how we applied survival analysis to vulnerability management (VM) data from Qualys VMDR, using the Elastic Stack.
TOLLBOOTH: What's yours, IIS mine
REF3927 abuses publicly disclosed ASP.NET machine keys to compromise IIS servers and deploy TOLLBOOTH SEO cloaking modules globally.
NightMARE on 0xelm Street, a guided tour
This article describes nightMARE, a python-based library for malware researchers that was developed by Elastic Security Labs to help scale analysis. It descr...
What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape
The 2025 Elastic Global Threat Report provides current insights on adversary trends and defender strategies derived from real-world telemetry.
WARMCOOKIE One Year Later: New Features and Fresh Insights
A year later: Elastic Security Labs re-examines the WARMCOOKIE backdoor.
FlipSwitch: a Novel Syscall Hooking Technique
FlipSwitch offers a fresh look at bypassing Linux kernel defenses, revealing a new technique in the ongoing battle between cyber attackers and defenders.
Elastic excels in AV-Comparatives EPR Test 2025: A closer look
Elastic shares results of the 2025 AV Comparatives EPR test
MCP Tools: Attack Vectors and Defense Recommendations for Autonomous Agents
This research examines how Model Context Protocol (MCP) tools expand the attack surface for autonomous agents, detailing exploit vectors such as tool poisoni...
Investigating a Mysteriously Malformed Authenticode Signature
An in-depth investigation tracing a Windows Authenticode validation failure from vague error codes to undocumented kernel routines.