Skip to content
Threat Feed
Subscribe

Product

Elastic Endpoint

9 briefs RSS
high advisory

Shell Command Execution via Elastic Endpoint Console

Attackers who compromise Elastic Endpoint console access can leverage its legitimate remote support feature to execute arbitrary shell commands on Linux endpoints, turning it into a command and control channel for persistence, tool deployment, and data exfiltration.

Elastic Endpoint command-and-control defense-evasion execution linux endpoint-security remote-access
1r 3t
medium advisory

Shell Execution via Elastic Endpoint on Linux

This brief details the detection of shell command execution initiated by the Elastic Endpoint agent on Linux systems, indicating potential post-exploitation activity such as remote access or command and control via misuse of the endpoint's response capabilities.

Elastic Endpoint +2 linux endpoint-security command-and-control defense-evasion execution detection-rule
1r 3t
low advisory

Uncommon DNS Requests via Bun or Node.js

Detection of uncommon DNS requests originating from Bun or Node.js processes, potentially indicating malicious code execution following a supply chain attack.

Elastic Endpoint supply-chain command-and-control dns nodejs bun
2r 2t
low advisory

Suspicious Windows Process Cluster Detected from Parent Process

A machine learning job has identified a parent process spawning one or more suspicious Windows processes exhibiting unusually high malicious probability scores, indicating potential defense evasion tactics like masquerading and LOLBins usage.

Elastic Endpoint +2 defense-evasion windows ml lolbins
2r 2t
high advisory

Privilege Elevation via Parent Process PID Spoofing

This rule detects parent process spoofing used to create an elevated child process, specifically targeting privilege escalation to SYSTEM, where adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges on Windows systems.

Elastic Endpoint +2 privilege-escalation windows ppid-spoofing
2r 1t
high advisory

UAC Bypass Attempt via Windows Directory Masquerading

Detects attempts to bypass User Account Control (UAC) by masquerading as a trusted Microsoft Windows directory, abusing a trailing-space in the path to execute code with elevated privileges.

Elastic Endpoint +4 privilege-escalation uac-bypass windows
2r 1t
medium advisory

Potential Evasion via Windows Filtering Platform Blocking Security Software

Adversaries may add malicious Windows Filtering Platform (WFP) rules to prevent endpoint security solutions from sending telemetry data, impairing defenses, which this rule detects by identifying multiple WFP block events where the process name is associated with endpoint security software.

Windows Filtering Platform +2 defense-evasion windows-filtering-platform endpoint-security
2r 2t
high advisory

Long Base64 Encoded Command via Scripting Interpreter

Detection of oversized command lines used by Python, PowerShell, Node.js, or Deno interpreters containing base64 decoding or encoded-command patterns, indicating potential evasion and malicious execution.

Elastic Endpoint defense-evasion execution scripting-interpreter base64 command-line
2r 5t
medium advisory

Suspicious DNS Queries to RMM Domains from Non-Browser Processes

Detection of DNS queries to remote monitoring and management (RMM) domains from non-browser processes indicating potential misuse of legitimate remote access tools for command and control.

Elastic Endpoint +1 command-and-control remote-access windows
2r