Loading story…
Elastic Security Labs released STIX2ECS, a Python tool that converts STIX 2.x JSON cyber-threat-intelligence documents into Elastic Common Schema (ECS)-formatted data. The utility can send converted records to standard output, NDJSON files, or directly to an Elasticsearch cluster, allowing teams to normalize and operationalize threat data shared through the OASIS Cyber Threat Intelligence (CTI) standard.
STIX2ECS supports recursive processing of directories of STIX documents and configurable, human-readable indicator-provider values. Organizations can ingest the resulting ECS data into Kibana and use it with Elastic Indicator Match rules for threat hunting and detection; the tool requires Python 3.10 or later and relies on the stix2, Elasticsearch, and getpass modules.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic contributed Elastic Common Schema to the OpenTelemetry Semantic Conventions.
Elastic released STIX2ECS, a tool for converting STIX 2.x JSON threat-intelligence documents into Elastic Common Schema data. It supports output to standard output, NDJSON files, or Elasticsearch.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs detailed a detection pipeline that uses **ES|QL COMPLETION** to reduce noise from `curl` and `wget` execution alerts tied to **MITRE ATT&CK `T1105` Ingress Tool Transfer**, a technique widely used by threat actors to download second-stage payloads, post-exploitation tools, and ransomware from command-and-control infrastructure. The approach preserves deterministic detections, then extracts destination hosts, applies allow-lists, redacts secrets from command lines, aggregates remaining events, and submits only a small set of high-value records to an LLM for a structured verdict of **true positive**, **false positive**, or **suspicious**.
Aug 26, 2026
Elastic has outlined an evidence-based framework to benchmark large language models used in agentic security operations centers. The methodology keeps the Elastic AI Agent, prompts, tools, and datasets fixed while routing runs to different models and anonymizing model identities for blind scoring. Evaluations measure whether models select the correct skills, make appropriate tool calls with valid parameters, execute tasks in the right order, and produce findings grounded in collected evidence—not merely whether their final prose appears convincing. The Agent Builder suite uses a synthetic Windows intrusion involving Chrysalis DLL side-loading, with the **EICAR** test-file hash serving as a deterministic malicious VirusTotal result and live case-management and Slack-response tools. Additional suites test Attack Discovery's ability to correlate roughly 95 alerts into eight intrusions and Automatic Migration's conversion of 52 Splunk detection rules, including macro-dependent rules, into Elastic rules. The scoring rubric evaluates both answer quality and correct tool or skill use, caps unsupported answers when required evidence-gathering calls are absent, and reports reliability independently from quality.
Sep 9, 2026
ESET published **Stadeo**, a free Python-based malware analysis toolset designed to help reverse engineers deobfuscate malicious code, with an initial focus on the **Stantinko** botnet. The framework targets two common protections used by malware authors—**control-flow flattening** and **string obfuscation**—and was presented at **Black Hat USA 2020**. Stadeo integrates with **IDA** and the **Miasm** reverse-engineering framework through an **RPyC** server to automate recovery of clearer program logic for analysts. The release includes workflows for deobfuscating individual functions, processing reachable or all functions in a sample, patching cross-references to recovered code, and revealing hidden strings. While built around Stantinko’s techniques, ESET said the approach was also extended to support **Emotet** control-flow flattening, broadening the tool’s usefulness for defenders and malware researchers investigating heavily obfuscated threats.
Aug 15, 2026