Skip to content
Threat Feed
Subscribe

Product

General Purpose LLM V2

1 brief RSS
medium advisory

LLM-Based Triage of Wget Activity on Linux Hosts

Elastic has developed a detection rule that monitors non-allowlisted `wget` activity on Linux hosts using Auditd Manager or Auditbeat, leveraging an Elastic LLM to triage `wget` executions for potential ingress tool transfer, command and control, or data exfiltration attempts to untrusted destinations, generating alerts only for high-confidence positive or suspicious verdicts.

Elastic Stack +3 endpoint llm linux threat-detection collection command-and-control exfiltration auditd +1
1r 3t 13i