Agentic Frameworks Summary
Agentic systems require security teams to balance autonomy with alignment, ensuring that AI agents can act independently while remaining goal-consistent and ...
Elastic Security Labs
20 articles
MaaS Appeal: An Infostealer Rises From The Ashes
NOVABLIGHT is a NodeJS infostealer developed and sold as a MaaS offering; it is used primarily to steal credentials and compromise cryptowallets.
Taking SHELLTER: a commercial evasion framework abused in-the-wild
Elastic Security Labs detected the recent emergence of infostealers using an illicitly acquired version of the commercial evasion framework, SHELLTER, to dep...
How AI and contextual search enhance defence cybersecurity
Contextual search brings clarity, speed, and insight to defence security teams
Microsoft Entra ID OAuth Phishing and Detections
This article explores OAuth phishing and token-based abuse in Microsoft Entra ID. Through emulation and analysis of tokens, scope, and device behavior during...
A Wretch Client: From ClickFix deception to information stealer deployment
Elastic Security Labs detected a surge in ClickFix campaigns, using GHOSTPULSE to deploy Remote Access Trojans and data-stealing malware.
Call Stacks: No More Free Passes For Malware
We explore the immense value that call stacks bring to malware detection and why Elastic considers them to be vital Windows endpoint telemetry despite the ar...
Elastic Security scores 100% in AV-Comparatives Business Security Test
Elastic Security nailed it with a perfect score of 100% in the most recent AV-Comparatives Business Security Test.
Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns
Elastic Security Labs walks through EDDIESTEALER, a lightweight commodity infostealer used in emerging CAPTCHA-based campaigns.
De-obfuscating ALCATRAZ
An exploration of techniques used by the obfuscator ALCATRAZ.
Misbehaving Modalities: Detecting Tools, Not Techniques
We explore the concept of Execution Modality and how modality-focused detections can complement behaviour-focused ones.
Elastic and Keep join forces to help users manage alerts and automate workflows
Elastic announces the acquisition of Keep Alerting
Elastic changes the SIEM game with AI-driven security analytics
Learn more about Elastic's AI-driven security analytics
Bit ByBit - emulation of the DPRK's largest cryptocurrency heist
A high-fidelity emulation of the DPRK's largest cryptocurrency heist via a compromised macOS developer and AWS pivots.
How to achieve full-spectrum financial risk detection with AI and unified data
Financial services can’t rely on manual review alone. Discover how unified data and explainable AI are helping firms detect risk, reduce cost, and stay ahead...
Now available: the 2025 State of Detection Engineering at Elastic
The 2025 State of Detection Engineering at Elastic explores how we create, maintain, and assess our SIEM and EDR rulesets.
Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective
Outlaw is a persistent Linux malware leveraging simple brute-force and mining tactics to maintain a long-lasting botnet.
The Shelby Strategy
An analysis of REF8685's abuse of GitHub for C2 to evade defenses.
Shedding light on the ABYSSWORKER driver
Elastic Security Labs describes ABYSSWORKER, a malicious driver used with the MEDUSA ransomware attack-chain to disable anti-malware tools.
AWS SNS Abuse: Data Exfiltration and Phishing
During a recent internal collaboration, we dug into publicly known SNS abuse attempts and our knowledge of the data source to develop detection capabilities.