Blog

Hunting for persistence

Hunt WMI event subscriptions, scheduled tasks and BITS jobs with EQL, using detection logic you can run as-is.

Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1)
Security Labs
Threat Hunting

Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1)

Learn how Elastic Endpoint Security and Elastic SIEM can be used to hunt for and detect malicious persistence techniques at scale.

David French
Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2)
Security Labs
Threat Hunting

Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2)

Learn how Elastic Endpoint Security and Elastic SIEM can be used to hunt for and detect malicious persistence techniques at scale.

Brent Murphy