Endpoint-Security

Detection engineering logic that correlates Elastic Defend endpoint alerts with network security events from PAN-OS, FortiGate, and Suricata to identify potentially compromised hosts based on multi-source telemetry.

This detection rule identifies suspicious endpoint activity, such as malicious file creation or shellcode execution, originating from or triggered by AI-assisted coding and assistant tools indicating potential supply chain or prompt injection abuse.

This intelligence brief details a behavioral detection strategy for identifying widespread malware infections by correlating alerts across multiple endpoints to facilitate rapid incident response.

Detection of unauthorized GenAI workflows utilizing local compression or encoding utilities followed by outbound network communication, indicating potential staging and exfiltration of sensitive data.

An information disclosure vulnerability in the Prisma Access Agent for Linux allows local, low-privileged users to access sensitive configuration data and stored credentials (CVE-2026-0305).

A local privilege escalation vulnerability known as FalconFlank exists in the CrowdStrike Falcon Sensor Windows agent due to a TOCTOU race condition in the Office macro remediation workflow.

This brief details the detection of local account creation on macOS systems, a technique often used by adversaries to establish persistence or facilitate privilege escalation through administrative utilities.

Adversaries leverage native utilities like icacls.exe to modify file and directory permissions via deny flags, effectively hindering security operations and maintaining persistence.

This detection identifies adversary attempts to impair security monitoring by detecting a complete cessation of host telemetry immediately following a security alert generated by the Elastic Defend agent.

Detection rule monitoring for the creation of binfmt configuration files which can be abused by threat actors to execute arbitrary code or maintain persistence on Linux systems.

High volumes of nslookup.exe executions detected via dynamic thresholding can indicate DNS tunneling used for data exfiltration or command-and-control communication.

This brief details a detection strategy for identifying unauthorized collection of clipboard data on Linux systems by monitoring the execution of common clipboard utilities from uncommon parent processes.

Adversaries are abusing the Python site module by planting malicious sitecustomize.py or usercustomize.py files in package directories to ensure persistent code execution during Python initialization.

A local privilege escalation vulnerability in Citrix Workspace App for macOS allows a local attacker to elevate their system permissions.

A local privilege escalation vulnerability (CVE-2026-0299) in the Palo Alto Networks GlobalProtect app allows authenticated local users to escalate to SYSTEM or root privileges via untrusted search path exploitation.

Adversaries leverage network sniffing utilities such as Wireshark and tcpdump on Windows endpoints to conduct reconnaissance, intercept sensitive traffic, and exfiltrate credentials.

Adversaries frequently leverage the 'dir' command piped to 'findstr' for reconnaissance to identify sensitive files and credentials on compromised Windows systems.

Elastic's machine learning job, utilizing the ProblemChild supervised model and unsupervised techniques, detects Windows hosts exhibiting clusters of suspicious processes with unusually high malicious probability scores, often indicative of defense evasion through Living Off The Land Binaries (LOLbins) and masquerading techniques.

Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.

This brief details the detection of DNS queries originating from local Large Language Model (LLM) frameworks like Ollama, LM Studio, and GPT4All on Windows endpoints, leveraging Sysmon Event ID 22 to identify potential unauthorized AI tool usage or data exfiltration risks associated with model downloads, updates, and telemetry from repositories such as huggingface.co and ollama.ai.

This brief describes how the creation of Large Language Model (LLM) files, including formats like .gguf, .safetensors, .ggml, and Modelfiles, by local AI inference frameworks such as Ollama, llama.cpp, GPT4All, and LM Studio can be detected on Windows endpoints, indicating potential shadow AI deployments, unauthorized model downloads, or rogue LLM infrastructure which poses data exfiltration risks and policy violations.

This brief details the detection of files commonly associated with ransomware notes on endpoints, indicating active data encryption and potential extortion attempts by various threat actors.

Elastic Security's statistical model identifies command-and-control (C2) beaconing activity in network logs on Windows and Linux systems by analyzing network traffic patterns and excluding known benign processes, enabling defenders to detect and respond to stealthy adversary communications for persistence and data exfiltration.

This content introduces AI Detection and Response (AIDR) as a new cybersecurity category to address emerging threats from autonomous AI agents, including supply chain attacks and unintended data sharing, highlighting their ability to execute with inherited privileges across endpoints, SaaS, and cloud environments.

Attackers who compromise Elastic Endpoint console access can leverage its legitimate remote support feature to execute arbitrary shell commands on Linux endpoints, turning it into a command and control channel for persistence, tool deployment, and data exfiltration.

This threat involves adversaries with root privileges using the `insmod` or `modprobe` utilities to load malicious Linux kernel object files (.ko), often rootkits, which provides complete system control and evasion capabilities, making detection of this uncommon activity critical.

A vulnerability, identified as CVE-2026-6424, has been discovered in various ESET Endpoint Antivirus and Server Security product versions, allowing an attacker to cause a denial of service, impacting the availability of the affected systems.

A vulnerability, CVE-2026-6423, in ESET Inspect Connector versions prior to 3.1.6017.0 for Windows allows an attacker to achieve privilege escalation on affected systems.

This brief details the detection of shell command execution initiated by the Elastic Endpoint agent on Linux systems, indicating potential post-exploitation activity such as remote access or command and control via misuse of the endpoint's response capabilities.

A technique brief describes how adversaries may use `wmic.exe` to tamper with Windows Defender settings, specifically to add exclusions via the `\root\Microsoft\Windows\Defender` WMI namespace, reducing the host's security posture and enabling further malicious activity.

This brief describes the detection of attackers uninstalling Sysinternals Sysmon, a critical endpoint monitoring tool, as a defense evasion technique to obscure malicious activities and maintain stealth.

Adversaries may add malicious Windows Filtering Platform (WFP) rules to prevent endpoint security solutions from sending telemetry data, impairing defenses, which this rule detects by identifying multiple WFP block events where the process name is associated with endpoint security software.

CrowdStrike is introducing innovations to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments by extending AI detection and response (AIDR) capabilities to cover desktop AI applications and provide visibility into AI-related components, helping to prevent prompt attacks, data leaks, and policy violations.

CrowdStrike is enhancing its Falcon platform with AI Detection and Response (AIDR) to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud, addressing threats like prompt injection attacks, data leaks, and policy violations.

CrowdStrike is enhancing its Falcon platform with new AI detection and response capabilities to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing threats like prompt injection and data leaks.

Objective-See details how to create a file monitor for macOS 10.15 using Apple's Endpoint Security Framework to capture file I/O events and process information.

This brief discusses the use of Apple's Endpoint Security Framework in macOS 10.15 and later for user-mode process monitoring, offering improved capabilities over the older OpenBSM subsystem.