의 글 Joe Desimone

This post includes a primer on kernel mode attacks, along with Elastic’s recommendations for securing users from kernel attacks leveraging vulnerable drivers.

Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

Elastic Security verifies new destructive malware targeting Ukraine: Operation Bleeding Bear

Elastic Security has identified active intrusions leveraging the newly identified BLISTER malware loader utilizing valid code-signing certificates to evade detection. We are providing detection guidance for security teams to protect themselves.

시그니처 기반 탐지(인메모리 스캔)는 중요한 탐지 전략이 될 수 있습니다. 이 블로그에서는 0의 유효 오탐율로 활성화된 구성 또는 스텔스 기능에 관계없이 코발트 스트라이크(Cobalt Strike)를 탐지하는 방법에 대해 알아봅니다.

Threat Hunters are charged with the difficult task of sifting through vast sources of diverse data to pinpoint adversarial activity at any stage in the attack.

As a follow up to my DerbyCon presentation, this post will investigate an emerging trend of adversaries using .NET-based in-memory techniques to evade detection