Endpoint-Security

CrowdStrike has introduced a native security integration with Anthropic’s Claude Cowork that deploys the Falcon Linux sensor inside agent virtual machines to mitigate supply chain and execution risks within isolated AI environments.

A vulnerability in the Rapid7 Insight Agent for Linux and macOS allows an authenticated local user to achieve privilege escalation by supplying a crafted filesystem path during inventory collection.

A critical vulnerability (CVE-2026-30612) in the abandoned Time4Popcorn application allows remote attackers to hijack the unauthenticated background updater to execute arbitrary code with SYSTEM or root privileges.

Attackers utilize the wget utility with post-upload flags to exfiltrate staged local data to external servers, a technique observable through process creation monitoring.

This detection identifies instances where svchost.exe is spawned by an atypical parent process, potentially indicating process masquerading or injection techniques.

This detection identifies the creation of specific file extensions indicative of the Mimikatz 'crypto' module, which is used to export cryptographic keys and certificates during credential theft activities.

The Windows 'forfiles.exe' utility can be abused by attackers to execute arbitrary commands as a proxy, enabling evasion of command-line monitoring and facilitating post-exploitation activity.

Attackers often terminate the Windows Event Log service, documented via Event ID 1100, to disrupt auditing and obscure malicious post-exploitation activities.

Adversaries leverage the Deployment Image Servicing and Management (DISM) tool to disable or remove Windows Defender components as a defense evasion technique.

Adversaries utilize hidden files and directories, prefixed with a dot, within world-writable Linux directories to conceal malicious artifacts and establish persistence.

This brief describes the identification of Windows AppLocker policy violations, which may indicate adversary efforts to bypass application execution controls or execute unauthorized code.

Adversaries move native Windows .NET binaries to unconventional directories to bypass security controls and facilitate malicious code execution or persistence.

This brief details the ingestion and correlation of Microsoft Defender Attack Surface Reduction (ASR) events to identify policy bypasses, configuration tampering, and malicious execution attempts.

Adversaries frequently attempt to disable security-related services on Windows endpoints using standard administration tools to facilitate defense evasion and destructive activity.

This brief addresses the detection of Windows system processes executing from unexpected file paths, a technique frequently used by threat actors for masquerading and defense evasion.

Detection of previously unseen child processes spawned by Zoom clients may indicate exploitation of the application for code execution or unauthorized system access.

This brief addresses the detection of unauthorized shared object (.so) file creation in sensitive system directories, a technique commonly used by attackers for persistence and code injection on Linux systems.

A missing authentication vulnerability in the WatchGuard Endpoint Security kernel memory access driver allows local attackers to perform arbitrary kernel memory access, potentially facilitating privilege escalation.

Adversaries may use the legitimate Windows Task Manager utility to create a memory dump of the Local Security Authority Subsystem Service (LSASS) process to harvest sensitive credentials.

Detection engineering logic that correlates Elastic Defend endpoint alerts with network security events from PAN-OS, FortiGate, and Suricata to identify potentially compromised hosts based on multi-source telemetry.

This detection rule identifies suspicious endpoint activity, such as malicious file creation or shellcode execution, originating from or triggered by AI-assisted coding and assistant tools indicating potential supply chain or prompt injection abuse.

This intelligence brief details a behavioral detection strategy for identifying widespread malware infections by correlating alerts across multiple endpoints to facilitate rapid incident response.

Detection of unauthorized GenAI workflows utilizing local compression or encoding utilities followed by outbound network communication, indicating potential staging and exfiltration of sensitive data.

An information disclosure vulnerability in the Prisma Access Agent for Linux allows local, low-privileged users to access sensitive configuration data and stored credentials (CVE-2026-0305).

A local privilege escalation vulnerability known as FalconFlank exists in the CrowdStrike Falcon Sensor Windows agent due to a TOCTOU race condition in the Office macro remediation workflow.

This brief details the detection of local account creation on macOS systems, a technique often used by adversaries to establish persistence or facilitate privilege escalation through administrative utilities.

Adversaries leverage native utilities like icacls.exe to modify file and directory permissions via deny flags, effectively hindering security operations and maintaining persistence.

This detection identifies adversary attempts to impair security monitoring by detecting a complete cessation of host telemetry immediately following a security alert generated by the Elastic Defend agent.

Detection rule monitoring for the creation of binfmt configuration files which can be abused by threat actors to execute arbitrary code or maintain persistence on Linux systems.

High volumes of nslookup.exe executions detected via dynamic thresholding can indicate DNS tunneling used for data exfiltration or command-and-control communication.

This brief details a detection strategy for identifying unauthorized collection of clipboard data on Linux systems by monitoring the execution of common clipboard utilities from uncommon parent processes.

Adversaries are abusing the Python site module by planting malicious sitecustomize.py or usercustomize.py files in package directories to ensure persistent code execution during Python initialization.

A local privilege escalation vulnerability in Citrix Workspace App for macOS allows a local attacker to elevate their system permissions.

A local privilege escalation vulnerability (CVE-2026-0299) in the Palo Alto Networks GlobalProtect app allows authenticated local users to escalate to SYSTEM or root privileges via untrusted search path exploitation.

Adversaries leverage network sniffing utilities such as Wireshark and tcpdump on Windows endpoints to conduct reconnaissance, intercept sensitive traffic, and exfiltrate credentials.

Adversaries frequently leverage the 'dir' command piped to 'findstr' for reconnaissance to identify sensitive files and credentials on compromised Windows systems.

Elastic's machine learning job, utilizing the ProblemChild supervised model and unsupervised techniques, detects Windows hosts exhibiting clusters of suspicious processes with unusually high malicious probability scores, often indicative of defense evasion through Living Off The Land Binaries (LOLbins) and masquerading techniques.

Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.

This brief details the detection of DNS queries originating from local Large Language Model (LLM) frameworks like Ollama, LM Studio, and GPT4All on Windows endpoints, leveraging Sysmon Event ID 22 to identify potential unauthorized AI tool usage or data exfiltration risks associated with model downloads, updates, and telemetry from repositories such as huggingface.co and ollama.ai.

This brief describes how the creation of Large Language Model (LLM) files, including formats like .gguf, .safetensors, .ggml, and Modelfiles, by local AI inference frameworks such as Ollama, llama.cpp, GPT4All, and LM Studio can be detected on Windows endpoints, indicating potential shadow AI deployments, unauthorized model downloads, or rogue LLM infrastructure which poses data exfiltration risks and policy violations.

This brief details the detection of files commonly associated with ransomware notes on endpoints, indicating active data encryption and potential extortion attempts by various threat actors.

Elastic Security's statistical model identifies command-and-control (C2) beaconing activity in network logs on Windows and Linux systems by analyzing network traffic patterns and excluding known benign processes, enabling defenders to detect and respond to stealthy adversary communications for persistence and data exfiltration.

This content introduces AI Detection and Response (AIDR) as a new cybersecurity category to address emerging threats from autonomous AI agents, including supply chain attacks and unintended data sharing, highlighting their ability to execute with inherited privileges across endpoints, SaaS, and cloud environments.

Attackers who compromise Elastic Endpoint console access can leverage its legitimate remote support feature to execute arbitrary shell commands on Linux endpoints, turning it into a command and control channel for persistence, tool deployment, and data exfiltration.

This threat involves adversaries with root privileges using the `insmod` or `modprobe` utilities to load malicious Linux kernel object files (.ko), often rootkits, which provides complete system control and evasion capabilities, making detection of this uncommon activity critical.

A vulnerability, identified as CVE-2026-6424, has been discovered in various ESET Endpoint Antivirus and Server Security product versions, allowing an attacker to cause a denial of service, impacting the availability of the affected systems.

A vulnerability, CVE-2026-6423, in ESET Inspect Connector versions prior to 3.1.6017.0 for Windows allows an attacker to achieve privilege escalation on affected systems.

This brief details the detection of shell command execution initiated by the Elastic Endpoint agent on Linux systems, indicating potential post-exploitation activity such as remote access or command and control via misuse of the endpoint's response capabilities.

A technique brief describes how adversaries may use `wmic.exe` to tamper with Windows Defender settings, specifically to add exclusions via the `\root\Microsoft\Windows\Defender` WMI namespace, reducing the host's security posture and enabling further malicious activity.

This brief describes the detection of attackers uninstalling Sysinternals Sysmon, a critical endpoint monitoring tool, as a defense evasion technique to obscure malicious activities and maintain stealth.

Adversaries may add malicious Windows Filtering Platform (WFP) rules to prevent endpoint security solutions from sending telemetry data, impairing defenses, which this rule detects by identifying multiple WFP block events where the process name is associated with endpoint security software.

CrowdStrike Falcon Data Security provides organizations with the ability to discover, classify, and protect sensitive data across various environments, providing real-time visibility into data movement and enabling the detection and prevention of data theft.

Organizations adopting AI tools and agents face emerging threats like prompt injection, data leaks, and agentic tool chain attacks, exacerbated by shadow AI adoption, requiring enhanced security measures across endpoints, SaaS, and cloud environments.

CrowdStrike is introducing innovations to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments by extending AI detection and response (AIDR) capabilities to cover desktop AI applications and provide visibility into AI-related components, helping to prevent prompt attacks, data leaks, and policy violations.

CrowdStrike Falcon Data Security aims to help organizations discover and classify sensitive data, monitor its movement in real-time, and prevent data theft across various environments including endpoints, SaaS applications, and cloud services.

CrowdStrike is enhancing its Falcon platform with AI Detection and Response (AIDR) to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud, addressing threats like prompt injection attacks, data leaks, and policy violations.

CrowdStrike is enhancing its Falcon platform to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing threats like prompt injection attacks, data leaks, and policy violations associated with personal AI agents and shadow AI adoption.

CrowdStrike is enhancing its Falcon platform to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, including AI Detection and Response (AIDR) capabilities extended to desktop AI applications and AI Discovery in Falcon Exposure Management.

CrowdStrike is enhancing its Falcon platform with new AI Detection and Response (AIDR) capabilities to secure AI agent adoption and development across endpoints, SaaS, and cloud environments, addressing threats like prompt injection, data leaks, and policy violations.

CrowdStrike is enhancing its Falcon platform with new AI detection and response (AIDR) capabilities to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing threats like indirect prompt injection, agentic tool chain attacks, and risks associated with shadow AI adoption.

CrowdStrike's Falcon platform introduces new features to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments, addressing prompt injection, data leaks, and policy violations.

Objective-See details how to create a file monitor for macOS 10.15 using Apple's Endpoint Security Framework to capture file I/O events and process information.

This brief discusses the use of Apple's Endpoint Security Framework in macOS 10.15 and later for user-mode process monitoring, offering improved capabilities over the older OpenBSM subsystem.