Elastic Security Labs
@elasticseclabs
Followers
4K
Following
264
Media
56
Statuses
465
Elastic Security Labs is democratizing security by sharing knowledge and capabilities necessary to prepare for threats. Spiritually serving humanity since 2019.
Global
Joined November 2022
RT @bluish_red_: Didn't make the (already long) blog, but there is a pile of infrastructure with the same cert characteristics. At least o….
0
5
0
RT @_devonkerr_: Should anyone need to get ahold of me about @elasticseclabs research, DMs are open and I just had lunch so I’m feeling hos….
0
5
0
New research from our #ElasticSecurityLabs team: we dive into how infostealers are leveraging a stolen Shellter evasion tool to deploy data-stealing malware. Learn more & get our unpacker: . #malware #rhadamanthys #ghostpulse.
2
48
137
Deep dive into Azure OAuth phishing & detection! This article from @_xDeJesus shows how rich telemetry is crucial for spotting identity-based attacks. Stop relying on static indicators & start: #CloudSecurity #ThreatDetection #Azure.
1
16
50
New research from #ElasticSecurityLabs uncovers a new ClickFix campaign! Learn how attackers are using GHOSTPULSE and ARECHCLIENT2 (SECTOPRAT) in multi-stage attacks to deploy RATs and steal data. Stay informed:
0
32
103
Dive deep into malware detection with the latest article by John Uhlmann: "Call Stacks: No More Free Passes for Malware." Discover how call stacks provide vital insights into malware behavior. Read more:
1
43
128
In May, #ElasticSecurityLabs published 52 new rules! Take a look at the overview and learn how we manage these rulesets: #detectionengineering #SIEM #EDR
1
16
83
RT @SCMagazine: A new Rust-based infostealer dubbed EDDIESTEALER is being spread via the popular ClickFix social engineering technique, whi….
0
4
0
Do you want a quick recap on what #ElasticSecurityLabs has been up to? Under the Microscope is the #newsletter for our favorite article highlights. Sign up here:
0
2
20
#ElasticSecurityLabs has uncovered EDDIESTEALER, a novel Rust-based info stealer distributed via fake CAPTCHA campaigns. This malware targets credentials, browser info, & crypto wallets. Read our full analysis here: . #Cybersecurity #MalwareAnalysis.
1
21
61
REF6138 was a #Linux #cryptomining attack campaign focused on BitCoin/XMR. Threat actors used a mixture of tools and malware including C2, cron jobs, GSOCKET, KAIJI, RUDEDEVIL, and more. Check out the details:
0
9
38
RT @keowu: @DanielStepanic @birdrockrock @elasticseclabs I really appreciate your response. Don’t worry, there’s no connection between our….
0
1
0
Analyzing DOUBLELOADER malware & its use of Alcatraz, an open-source obfuscator! 🚨 Learn how Alcatraz employs control flow flattening, anti-disassembly tricks, and more to evade detection. Dive into our research on de-obfuscating these techniques:
2
29
92
Back at @nullcon, @AsuNa_jp explored hotkey-based #keyloggers. You can watch her talk on detection techniques here:
0
5
16
RT @jdu2600: ATT&CK never felt quite right to me. I originally thought it was just that the taxonomy was incomplete. Then @jaredcatkinson….
0
3
0
Join @jdu2600 to explore the concept of Execution Modality within #detections — specifically, how modality-focused detections can complement behavior-focused ones: #ElasticSecurityLabs #detectionengineering.
0
17
43
In April, #ElasticSecurityLabs published 62 new rules! Take a look at the overview and learn how we manage these rulesets: #detectionengineering #SIEM #EDR
0
7
25
RT @DefSecSentinel: This @elasticseclabs blog was the result of a really fun 4 day exercise my colleague @_xDeJesus….
0
24
0
RT @_xDeJesus: I joined forces with @DefSecSentinel and did additional analysis on #DPRK's 2025 ETH heist of ~$1.4b from ByBit following ap….
0
12
0