Skip to content
Threat Feed
Subscribe

Product

Elastic Stack

2 briefs RSS
medium advisory

LLM-Based Triage of Wget Activity on Linux Hosts

Elastic has developed a detection rule that monitors non-allowlisted `wget` activity on Linux hosts using Auditd Manager or Auditbeat, leveraging an Elastic LLM to triage `wget` executions for potential ingress tool transfer, command and control, or data exfiltration attempts to untrusted destinations, generating alerts only for high-confidence positive or suspicious verdicts.

Elastic Stack +6 endpoint llm linux threat-detection collection command-and-control exfiltration auditd +1
1r 3t 13i updated
medium advisory

LLM-Based Detection of Suspicious Curl Activity on Linux

Elastic's LLM-based detection rule identifies suspicious `curl` activity on Linux systems, aiming to detect command and control, data exfiltration, or ingress tool transfer by analyzing command-line parameters and network destinations via Auditd Manager or Auditbeat logs, which, if left unaddressed, could lead to system compromise or data breach.

Azure +3 Endpoint LLM Linux Threat Detection Collection Command and Control Exfiltration Auditd Manager
3t updated