Skip to content
Threat Feed
Subscribe

Product

Elastic Stack

3 briefs RSS
critical advisory

Automated LLM-Based User Account Compromise Triage

An automated detection framework that uses Large Language Models to correlate disparate security alerts and assess potential account compromise based on behavioral indicators.

Elastic Stack +2 identity-compromise llm-security detection-engineering automated-triage
3t updated
medium advisory

LLM-Based Triage of Wget Activity on Linux Hosts

Elastic has developed a detection rule that monitors non-allowlisted `wget` activity on Linux hosts using Auditd Manager or Auditbeat, leveraging an Elastic LLM to triage `wget` executions for potential ingress tool transfer, command and control, or data exfiltration attempts to untrusted destinations, generating alerts only for high-confidence positive or suspicious verdicts.

Elastic Stack +6 endpoint llm linux threat-detection collection command-and-control exfiltration auditd +1
1r 3t 13i updated
medium advisory

LLM-Based Detection of Suspicious Curl Activity on Linux

Elastic's LLM-based detection rule identifies suspicious `curl` activity on Linux systems, aiming to detect command and control, data exfiltration, or ingress tool transfer by analyzing command-line parameters and network destinations via Auditd Manager or Auditbeat logs, which, if left unaddressed, could lead to system compromise or data breach.

Azure +3 Endpoint LLM Linux Threat Detection Collection Command and Control Exfiltration Auditd Manager
3t updated