Loading story…
Elastic Security Labs detailed a detection pipeline that uses ES|QL COMPLETION to reduce noise from curl and wget execution alerts tied to MITRE ATT&CK T1105 Ingress Tool Transfer, a technique widely used by threat actors to download second-stage payloads, post-exploitation tools, and ransomware from command-and-control infrastructure. The approach preserves deterministic detections, then extracts destination hosts, applies allow-lists, redacts secrets from command lines, aggregates remaining events, and submits only a small set of high-value records to an LLM for a structured verdict of true positive, false positive, or suspicious.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic described a detection-engineering workflow that uses ES|QL COMPLETION to triage noisy curl and wget execution events before they become analyst-facing alerts in cloud environments. The approach preserves deterministic rules, applies destination parsing and allow-listing, redacts secrets, and sends only limited high-value rows to an LLM for structured verdicts.
Elastic ran its wget-focused ES|QL COMPLETION triage pipeline over seven days on its own cloud fleet in June 2026. After deterministic filtering, only three destinations remained, with two classified as false positives and one as suspicious, resulting in no analyst-opened alerts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceelastic.co
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic has outlined an evidence-based framework to benchmark large language models used in agentic security operations centers. The methodology keeps the Elastic AI Agent, prompts, tools, and datasets fixed while routing runs to different models and anonymizing model identities for blind scoring. Evaluations measure whether models select the correct skills, make appropriate tool calls with valid parameters, execute tasks in the right order, and produce findings grounded in collected evidence—not merely whether their final prose appears convincing. The Agent Builder suite uses a synthetic Windows intrusion involving Chrysalis DLL side-loading, with the **EICAR** test-file hash serving as a deterministic malicious VirusTotal result and live case-management and Slack-response tools. Additional suites test Attack Discovery's ability to correlate roughly 95 alerts into eight intrusions and Automatic Migration's conversion of 52 Splunk detection rules, including macro-dependent rules, into Elastic rules. The scoring rubric evaluates both answer quality and correct tool or skill use, caps unsupported answers when required evidence-gathering calls are absent, and reports reliability independently from quality.
Sep 9, 2026
Elastic detailed enhanced Windows user-mode call-stack telemetry in **Elastic Defend** that attributes dual-use behavior to the code that initiated it. The telemetry enriches stack addresses with module exports and identifies the final user module’s path, SHA-256 hash, signature state, memory protections, and provenance, helping analysts identify direct syscalls, proxy execution, shellcode, ROP-like activity, unbacked RWX memory, and truncated or manipulated stacks. Dispatcher functions in captured stacks can also reveal early-thread execution, exception-handler abuse, APC-based execution, and GUI-thread hijacking. The approach addresses a longstanding control-flow defense problem: ordinary stack walking reconstructs return addresses but can be misled by tail calls, trampolines, and stack manipulation. Earlier hardware-assisted CFI research, including Endgame’s HA-CFI, used Intel PMU branch-misprediction traps and Last Branch Record data to validate indirect-call targets and reported detection of ROP and ROPless exploit techniques across tested exploit samples. Elastic’s telemetry-focused implementation makes suspicious control-flow context available in endpoint alerts by default; organizations can also enable it for routine events, balancing additional visibility against increased telemetry volume.
Sep 9, 2026
Elastic Security Labs published a series of Linux detection-engineering guides covering attacker persistence through scheduled tasks, `systemd` units, shell profiles, XDG autostart, permission and account changes, SSH keys, SysV/Upstart/`rc.local` startup paths, dynamic MOTD scripts, udev rules, package-manager hooks, Git hooks, process capabilities, and system-binary hijacking. The research maps techniques to MITRE ATT&CK and uses the PANIX simulation tool to demonstrate how adversaries can retain access or launch reverse shells, while recommending endpoint, file-integrity, process, network, service-state, and syslog telemetry alongside Elastic rules, ES|QL, and OSQuery hunts. The latest guidance highlights high-impact persistence through malicious PAM changes, DPKG/RPM lifecycle scripts, and dangerous Docker deployments. Defenders should monitor PAM and package-management paths, suspicious child processes and outbound connections, lifecycle-script execution, and container settings such as privileged mode, host PID namespaces, and sensitive host mounts. Elastic cautions that boot-time persistence may execute before endpoint agents collect process events, making early file-change detection and proactive hunting essential; organizations should also tune detections for legitimate administration and remove obsolete Upstart systems from production.
Sep 9, 2026