🏈 Calling the infosec community! We had a spot open up to round out Year 4 of the "Secure the Ball" fantasy football league. If you love to talk shop, ball, and trash - join us! ⚠️ There are punishments 🙋🏻‍♂️ DM me for details #infosecfantasyfootball #fantasyfootball

Just announced: talks for #OBTS v9 🥳 Stoked on an epic lineup of cutting-edge 🍎- security research, covering exploitation, malware, reversing, security tools, AI, & more! Check out the full lineup: objectivebythesea.org/v9/tal… Which one(s) are you most looking forward to!? 🤔

Elastic Defend 9.5.0 now carries the taint state on Linux kernel module loading events. I loaded Singularity (the stealthiest open source rootkit I know). On load, it hides from lsmod, /proc/modules, and /sys/module, resets the kernel taint mask to 0, and filters "taint" and its own name out of dmesg, journalctl -k, and klogctl. Even though the system looked clean, detecting the tainted flag on the loading event already exposed it. What is even more suspicious? The endpoint recorded this module loading out-of-tree and unsigned. The live host says the mask is 0, and taint is sticky by design, so that needs explaining and is a good hunting reference. One caveat, because this is not a rule to switch on blind: OE is also what a DKMS build, an out-of-tree GPU driver, or a third-party filesystem module produces. Baseline the modules you load on purpose, then investigate what is left. Enforcing module signatures shrinks it further, since an unsigned module then fails to load. Rule PR and references in the reply. #Linux #DetectionEngineering #ThreatDetection #DFIR #Rootkits

Seen in the wild in REF6138. Full teardown, including the kernel-process masquerade and the detections: elastic.co/security-labs/bet… Rules that fire: • Executable Masquerading as Kernel Process: github.com/elastic/detection… • Process Masquerading as Kernel Process (Defend): github.com/elastic/protectio… • Network Activity Detected via Kworker: github.com/elastic/detection…

@SBousseaden and I did some investigations into Tycoon 2FA recently. Focused on the infrastructure, how the kit works for not only M365, but Google Workspace as well. Made a few detections for each platform. Give it a read. Hope you enjoy. #phishing #threatdetection Happy Hunting! elastic.co/security-labs/tyc…

MiniPlasma LPE exploit works perftectly. Elastic Defend behavior protection catches the exploit primitives involved in the chain, providing detection coverage even against fresh public exploit. github.com/Nightmare-Eclipse…

We just posted some additional detection guidance for #CopyFail and #DirtyFrag using EQL, ES|QL and Auditd detection rules/hunts + mitigations. Find them below! elastic.co/security-labs/cop…

Detection guidance for CopyFail (CVE-2026-31431) and DirtyFrag (ITW Linux page cache LPE): EQL, ES|QL, and auditd detection rules and hunts included: elastic.co/security-labs/cop…

Yesterday was my last day at @elastic. It was an incredible run. I’m grateful for the opportunity I was given to help build Elastic’s #macOS endpoint agent and endpoint/SIEM detections from the ground up, work that delivered real impact for customers and made life harder for the adversaries. It was truly an honor to work alongside so many talented people, and I’m very proud of everything we built together. Wishing Elastic and everyone there nothing but the best. I’ll be looking for my next adventure soon. Stay tuned!

good to see EXISTING Elastic generic privesc behavior detection/protection triggering on the RedSun LPE exploit with no prior knowledge of the vuln-details. github.com/elastic/protectio…

google workspace logs from reports API... here's a simple query (Elastic) to check for the vercel 3rd-party OAuth app auth event: ``` data_stream.dataset: "google_workspace.token" and event.action: "authorize" and google_workspace.token.client\.id: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent\.com ``` from there, the same app ID shows up in a few other GWS fields/datastreams: - token\.app_name -> human-readable app label - drive.originating_app_id: 110671459871 -> every file the app viewed/downloaded/copied (prefix only, it's typically the GCP project number IIRC) - admin.oauth2.application\.id / .name -> admin-side OAuth approvals + domain-wide delegation grants for everything else (gmail, login, meet, chat, calendar, groups, DLP rules) I'd try actor pivot on source.user.\email + a time window around the consent event (reports API can lag up to 3 days, so go wide and check ingestion). good luck hunters! #Vercel #GoogleWorkspace #threathunting

Attackers in containers don't leave persistent artifacts. No files on disk. No post-incident logs. Just short-lived runtime behavior. Traditional detection approaches weren't built for this. Defend for Containers is. @RFGroenewoud published a deep-dive on how D4C captures runtime signals inside containerized Linux workloads, and how to build detection logic on top of it. The key things D4C gives you that you don't get elsewhere: - process.interactive flags hands-on-keyboard activity in production containers — rare and high-signal - Linux capability fields (effective + permitted) let you assess actual exploit potential, not just process names - Every event enriched with pod name, namespace, cluster, and privilege context - Policy wildcards let you scope detections to specific images, namespaces, or directory trees go.es.io/48sPCtC

You are going to want to check out this awesome new research write-up from the team. Very interesting and somewhat creative initial access method. Includes a @macos piece as well. Shout out to @soolidsnakee, @SBousseaden and team working hard to get this out.

New #research together with @SBousseaden and @DanielStepanic at @elasticseclabs. We uncovered a campaign abusing Obsidian plugins and vault feature to deliver multi-platform payloads targeting both #Windows and #macOS. The final stage is #PHANTOMPULSE, an AI-built RAT that resolves its #C2 from Ethereum blockchain transactions and its loader #PHANTOMPULL A deep dive into the RAT internals is coming next. Stay tuned. elastic.co/security-labs/pha…

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB

Not every “old” GitHub repo is actually old. I break down DPRK-linked repo tradecraft abusing commit-date spoofing to fake legitimacy, while hiding obfuscated loaders in trusted config files. One sample had 100+ stars. Research: kl4r10n.tech/blog/when-git-h… Thanks @pcaversaccio for recreating the spoofed commit and helping validate the technique.

It seems possible that clickfix malware is already switching tactics to evade the new Terminal copy/paste security feature in macOS 26.4.