Loading story…
The independently maintained Elastic Container Project provides a Docker-based local lab that deploys Elasticsearch, Kibana, Fleet Server, Elastic Agent, and the Elastic Detection Engine. It can bulk-enable Elastic prebuilt detection rules for Linux, Windows, and macOS, giving security teams a self-contained environment for research and detection testing.
The project uses self-signed TLS certificates and ships with default elastic:changeme credentials, which must be changed. Maintainers warn that the environment is not intended for production or Internet exposure; teams deploying it on Ubuntu should use Docker Engine according to Docker’s supported installation guidance and restrict network access to the lab.
See real exploitation activity before you spend the cycle.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs published a series of Linux detection-engineering guides covering attacker persistence through scheduled tasks, `systemd` units, shell profiles, XDG autostart, permission and account changes, SSH keys, SysV/Upstart/`rc.local` startup paths, dynamic MOTD scripts, udev rules, package-manager hooks, Git hooks, process capabilities, and system-binary hijacking. The research maps techniques to MITRE ATT&CK and uses the PANIX simulation tool to demonstrate how adversaries can retain access or launch reverse shells, while recommending endpoint, file-integrity, process, network, service-state, and syslog telemetry alongside Elastic rules, ES|QL, and OSQuery hunts. The latest guidance highlights high-impact persistence through malicious PAM changes, DPKG/RPM lifecycle scripts, and dangerous Docker deployments. Defenders should monitor PAM and package-management paths, suspicious child processes and outbound connections, lifecycle-script execution, and container settings such as privileged mode, host PID namespaces, and sensitive host mounts. Elastic cautions that boot-time persistence may execute before endpoint agents collect process events, making early file-change detection and proactive hunting essential; organizations should also tune detections for legitimate administration and remove obsolete Upstart systems from production.
Sep 9, 2026
Elastic Security Labs detailed a detection pipeline that uses **ES|QL COMPLETION** to reduce noise from `curl` and `wget` execution alerts tied to **MITRE ATT&CK `T1105` Ingress Tool Transfer**, a technique widely used by threat actors to download second-stage payloads, post-exploitation tools, and ransomware from command-and-control infrastructure. The approach preserves deterministic detections, then extracts destination hosts, applies allow-lists, redacts secrets from command lines, aggregates remaining events, and submits only a small set of high-value records to an LLM for a structured verdict of **true positive**, **false positive**, or **suspicious**.
Aug 26, 2026
Elastic has outlined an evidence-based framework to benchmark large language models used in agentic security operations centers. The methodology keeps the Elastic AI Agent, prompts, tools, and datasets fixed while routing runs to different models and anonymizing model identities for blind scoring. Evaluations measure whether models select the correct skills, make appropriate tool calls with valid parameters, execute tasks in the right order, and produce findings grounded in collected evidence—not merely whether their final prose appears convincing. The Agent Builder suite uses a synthetic Windows intrusion involving Chrysalis DLL side-loading, with the **EICAR** test-file hash serving as a deterministic malicious VirusTotal result and live case-management and Slack-response tools. Additional suites test Attack Discovery's ability to correlate roughly 95 alerts into eight intrusions and Automatic Migration's conversion of 52 Splunk detection rules, including macro-dependent rules, into Elastic rules. The scoring rubric evaluates both answer quality and correct tool or skill use, caps unsupported answers when required evidence-gathering calls are absent, and reports reliability independently from quality.
Sep 9, 2026