Topic
Detection science
Using this maturity model, security teams can make structured, measurable, and iteritive improvements to their detection engineering teams..
![Linux Detection Engineering - A Sequel on Persistence Mechanisms](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fsequel-on-persistence-mechanisms%2Fsequel-on-persistence-mechanisms.jpg&w=828&q=75)
Linux Detection Engineering - A Sequel on Persistence Mechanisms
In this final part of this Linux persistence series, we'll continue exploring persistence mechanisms on Linux systems, focusing on more advanced techniques and how to detect them.
![Linux Detection Engineering - A primer on persistence mechanisms](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fprimer-on-persistence-mechanisms%2Fprimer-on-persistence-mechanisms.jpg&w=828&q=75)
Linux Detection Engineering - A primer on persistence mechanisms
In this second part of the Linux Detection Engineering series, we map multiple Linux persistence mechanisms to the MITRE ATT&CK framework, explain how they work, and how to detect them.
![Now in beta: New Detection as Code capabilities](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fdac-beta-release%2FSecurity%20Labs%20Images%2018.jpg&w=828&q=75)
Now in beta: New Detection as Code capabilities
![Protecting your devices from information theft](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fprotecting-your-devices-from-information-theft-keylogger-protection%2FSecurity%20Labs%20Images%2010.jpg&w=828&q=75)
Protecting your devices from information theft
In this article, we will introduce the keylogger and keylogging detection features added this year to Elastic Defend (starting from version 8.12), which is responsible for endpoint protection in Elastic Security.
![Elastic Advances LLM Security with Standardized Fields and Integrations](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Felastic-advances-llm-security%2FSecurity%20Labs%20Images%204.jpg&w=828&q=75)
Elastic Advances LLM Security with Standardized Fields and Integrations
Discover Elastic’s latest advancements in LLM security, focusing on standardized field integrations and enhanced detection capabilities. Learn how adopting these standards can safeguard your systems.
![Embedding Security in LLM Workflows: Elastic's Proactive Approach](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fembedding-security-in-llm-workflows%2FSecurity%20Labs%20Images%205.jpg&w=828&q=75)
Embedding Security in LLM Workflows: Elastic's Proactive Approach
Dive into Elastic's exploration of embedding security directly within Large Language Models (LLMs). Discover our strategies for detecting and mitigating several of the top OWASP vulnerabilities in LLM applications, ensuring safer and more secure AI-driven applications.
![Linux detection engineering with Auditd](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Flinux-detection-engineering-with-auditd%2FSecurity%20Labs%20Images%2030.jpg&w=828&q=75)
Linux detection engineering with Auditd
In this article, learn more about using Auditd and Auditd Manager for detection engineering.
![Accelerating Elastic detection tradecraft with LLMs](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Faccelerating-elastic-detection-tradecraft-with-llms%2Fphoto-edited-09%402x.jpg&w=828&q=75)
Accelerating Elastic detection tradecraft with LLMs
Learn more about how Elastic Security Labs has been focused on accelerating our detection engineering workflows by tapping into more generative AI capabilities.
![Using LLMs and ESRE to find similar user sessions](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fusing-llms-and-esre-to-find-similar-user-sessions%2Fphoto-edited-03%402x.jpg&w=828&q=75)
Using LLMs and ESRE to find similar user sessions
In our previous article, we explored using the GPT-4 Large Language Model (LLM) to condense Linux user sessions. In the context of the same experiment, we dedicated some time to examine sessions that shared similarities. These similar sessions can subsequently aid the analysts in identifying related suspicious activities.
![Peeling back the curtain with call stacks](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fpeeling-back-the-curtain-with-call-stacks%2Fphoto-edited-10%402x.jpg&w=828&q=75)
Peeling back the curtain with call stacks
In this article, we'll show you how we contextualize rules and events, and how you can leverage call stacks to better understand any alerts you encounter in your environment.
![Using LLMs to summarize user sessions](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fusing-llms-to-summarize-user-sessions%2Fphoto-edited-01%402x.jpg&w=828&q=75)
Using LLMs to summarize user sessions
In this publication, we will talk about lessons learned and key takeaways from our experiments using GPT-4 to summarize user sessions.
![Into The Weeds: How We Run Detonate](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Finto-the-weeds-how-we-run-detonate%2Fphoto-edited-02%402x.jpg&w=828&q=75)
Into The Weeds: How We Run Detonate
Explore the technical implementation of the Detonate system, including sandbox creation, the supporting technology, telemetry collection, and how to blow stuff up.
![Detect domain generation algorithm (DGA) activity with new Kibana integration](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fdetect-domain-generation-algorithm-activity-with-new-kibana-integration%2Flibrary-branding-elastic-stack-midnight-1680x980-no-logo.jpg&w=828&q=75)
Detect domain generation algorithm (DGA) activity with new Kibana integration
We have added a DGA detection package to the Integrations app in Kibana. In a single click, you can install and start using the DGA model and associated assets, including ingest pipeline configurations, anomaly detection jobs, and detection rules.
![Exploring Windows UAC Bypasses: Techniques and Detection Strategies](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fexploring-windows-uac-bypasses-techniques-and-detection-strategies%2Fllustration-desktop-security-webinar-1680x980.jpg&w=828&q=75)
Exploring Windows UAC Bypasses: Techniques and Detection Strategies
In this research article, we will take a look at a collection of UAC bypasses, investigate some of the key primitives they depend on, and explore detection opportunities.
![Click, Click… Boom! Automating Protections Testing with Detonate](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fclick-click-boom-automating-protections-testing-with-detonate%2Fblog-thumb-tools-various.jpg&w=828&q=75)
Click, Click… Boom! Automating Protections Testing with Detonate
To automate this process and test our protections at scale, we built Detonate, a system that is used by security research engineers to measure the efficacy of our Elastic Security solution in an automated fashion.
![Exploring the Future of Security with ChatGPT](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fexploring-applications-of-chatgpt-to-improve-detection-response-and-understanding%2Fblog-elastic-train.jpg&w=828&q=75)
Exploring the Future of Security with ChatGPT
Recently, OpenAI announced APIs for engineers to integrate ChatGPT and Whisper models into their apps and products. For some time, engineers could use the REST API calls for older models and otherwise use the ChatGPT interface through their website.
![Hunting for Suspicious Windows Libraries for Execution and Defense Evasion](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2FHunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion%2Fblog-thumb-roman-columns.jpg&w=828&q=75)
Hunting for Suspicious Windows Libraries for Execution and Defense Evasion
Learn more about discovering threats by hunting through DLL load events, one way to reveal the presence of known and unknown malware in noisy process event data.
![Automating the Security Protections rapid response to malware](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fautomating-security-protections-rapid-response-to-malware%2Fblog-security-endpoint-720x420.png&w=828&q=75)
Automating the Security Protections rapid response to malware
See how we’ve been improving the processes that allow us to make updates quickly in response to new information and propagate those protections to our users, with the help of machine learning models.
![Detect Credential Access with Elastic Security](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fdetect-credential-access%2Fblog-thumb-blind-spots.png&w=828&q=75)
Detect Credential Access with Elastic Security
Elastic Endpoint Security provides events that enable defenders with visibility on techniques and procedures which are commonly leveraged to access sensitive files and registry objects.
![Detecting Living-off-the-land attacks with new Elastic Integration](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fdetecting-living-off-the-land-attacks-with-new-elastic-integration%2Fsecurity-threat-hunting-incidence-response-1200x628.jpg&w=828&q=75)
Detecting Living-off-the-land attacks with new Elastic Integration
We added a Living off the land (LotL) detection package to the Integrations app in Kibana. In a single click, you can install and start using the ProblemChild model and associated assets including anomaly detection configurations and detection rules.
![Hunting for Lateral Movement using Event Query Language](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fhunting-for-lateral-movement-using-event-query-language%2Fblog-thumb-security-honeycomb.jpg&w=828&q=75)
Hunting for Lateral Movement using Event Query Language
Elastic Event Query Language (EQL) correlation capabilities enable practitioners to capture complex behavior for adversary Lateral Movement techniques. Learn how to detect a variety of such techniques in this blog post.
![Identifying beaconing malware using Elastic](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fidentifying-beaconing-malware-using-elastic%2Fblog-thumbnail-securitymaze.jpg&w=828&q=75)
Identifying beaconing malware using Elastic
In this blog, we walk users through identifying beaconing malware in their environment using our beaconing identification framework.
![Ingesting threat data with the Threat Intel Filebeat module](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fingesting-threat-data-with-the-threat-intel-filebeat-module%2Fphoto-edited-12-t.jpg&w=828&q=75)
Ingesting threat data with the Threat Intel Filebeat module
Tutorial that walks through setting up Filebeat to push threat intelligence feeds into your Elastic Stack.
![Stopping Vulnerable Driver Attacks](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fstopping-vulnerable-driver-attacks%2Fblog-thumb-clock-gears.jpg&w=828&q=75)
Stopping Vulnerable Driver Attacks
This post includes a primer on kernel mode attacks, along with Elastic’s recommendations for securing users from kernel attacks leveraging vulnerable drivers.
![The Elastic Container Project for Security Research](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fthe-elastic-container-project%2Fblog-thumb-container-barge.jpg&w=828&q=75)
The Elastic Container Project for Security Research
The Elastic Container Project provides a single shell script that will allow you to stand up and manage an entire Elastic Stack using Docker. This open source project enables rapid deployment for testing use cases.
![情報窃取から端末を守る](/security-labs/_next/image?url=%2Fsecurity-labs%2Fassets%2Fimages%2Fprotecting-your-devices-from-information-theft-keylogger-protection-jp%2FSecurity%20Labs%20Images%2010.jpg&w=828&q=75)
情報窃取から端末を守る
本記事ではElastic Securityにおいて、エンドポイント保護を担っているElastic Defendに今年(バージョン8.12より)新たに追加された、キーロガーおよびキーロギング検出機能について紹介します。