# MITRE Published articles for MITRE. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How Attackers Abuse VSS, and How Huntress Detects It DevFeed: [How Attackers Abuse VSS, and How Huntress Detects It]() Original publisher: [Read original article]() Author: Shivangi Pandey; Matt Anderson Published: 2026-09-14T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [ransomware](), [Credential theft](), [Security](), [active directory](), [Cybercrime]() Tags: [active-directory](), [credential-theft](), [detection](), [making](), [microsoft](), [mitre](), [ransomware](), [security]() ### AI overview This article explains how attackers abuse Microsoft's Volume Shadow Copy Service for ransomware defense evasion, credential theft from the Active Directory database, and shadow copy manipulation. It also describes why detections must distinguish malicious activity from routine cleanup by backup and remote-management tools. ### Source excerpt Attackers exploit Volume Shadow Copy for credential theft and ransomware defense evasion. See how Huntress spots the difference from routine IT activity. ## The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment DevFeed: [The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment]() Original publisher: [Read original article]() Author: Gal Givon Published: 2026-09-11T13:33:33Z Content type: article Language: en Sources: [Rapid7 Cybersecurity]() Topics: [Security](), [Monitoring](), [processing](), [service](), [Server]() Tags: [collaboration](), [cybersecurity-company](), [dark-web](), [data](), [detection](), [ecosystem](), [exposure-assessment-platform](), [exposure-management](), [faas](), [fraud](), [infrastructure](), [intelligence](), [managed-detection-and-response](), [managed-security-solutions](), [marketplaces](), [mitre](), [operational](), [processing](), [security](), [server](), [services](), [threat-intel](), [threat-research](), [vulnerability-management]() ### AI overview This article examines how fraud marketplaces are fragmenting across social media, dark web channels, and smaller specialized storefronts. It discusses the resulting challenges for security teams, including monitoring diverse channels, processing varied data formats, coordinating across teams, and using the MITRE Fraud framework to guide detection and prevention. ### Source excerpt Introduction The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. Security teams today face evolving challenges, requiring them to continuously refine monitoring channels, adjust operational strategies, and foster cross-functional internal collaboration to capture actionable intelligence. With fraud damages anticipated to approach hundreds of billions of USD, security teams must navigate numerous non-compliant channels while ingesting and processing diverse data formats--such as documents, imagery, video, and unformatted text--linked to organizational assets. The recent introduction of a new Fraud framework by the MITRE organization underscores the critical need to combat fraud and highlights the significant danger these threat actors pose to all organizations. The MITRE organization has been taking a positive step towards standardizing the fight against fraud, while helping organizations target the relevant directions to look at. These marketplaces supply a range of services in need for the novice fraudster, encompassing server infrastructure, targeted lists, and even support for money laundering facilitated through compromised accounts across various platforms. As larger, well-known marketplaces have been dismantled, smaller, specialized shops are experiencing heightened activity from buyers seeking to engage in fraudulent endeavors. This blog post undertakes an exploration of these marketplaces and their operational modalities, illuminating the contemporary fraud economy and underscoring the enduring critical nature of robust detection and prevention initiatives. Fraud-as-a-Service (FaaS) Fraud is broadly defined as an intentional, dishonest act or misrepresentation of material facts, calculated to deceive oth ## From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI DevFeed: [From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI]() Original publisher: [Read original article]() Author: Paul McCann Published: 2026-06-23T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [AI Agent](), [Retrieval Augmented Generation (RAG)](), [Security](), [Artificial Intelligence](), [elasticsearch](), [common vulnerabilities and exposures](), [Crawler]() Tags: [ai](), [ai-agent](), [ai-automation](), [crawler](), [cve](), [cvss](), [cvss-scoring](), [elastic](), [generative](), [mitre](), [pipeline](), [product-security](), [rag](), [security](), [vulnerability]() ### AI overview Elastic's security team built an AI agent with retrieval-augmented generation over MITRE's CWE and CAPEC catalogues. Using Elastic Agent Builder and Elasticsearch, the system drafts CVE security advisories from raw vulnerability reports, including classifications, attack methodology, CVSS scoring, and mitigation guidance. ### Source excerpt How Elastic's security team built an AI agent with RAG against MITRE's CWE and CAPEC catalogues to draft CVE advisories from raw vulnerability reports, including the full prompt and crawler configs. ## Vulnerability management is reaching the limits of human scale DevFeed: [Vulnerability management is reaching the limits of human scale]() Original publisher: [Read original article]() Author: Sysdig Team Published: 2026-06-10T00:00:00Z Content type: article Language: en Sources: [Sysdig]() Topics: [vulnerability management](), [Vulnerabilities](), [Cybersecurity](), [Artificial Intelligence](), [.NET]() Tags: [2026](), [agentic-ai](), [ai](), [ai-in-cybersecurity](), [anthropic](), [cloud-native-security](), [cve](), [cybersecurity](), [exploit-weaponization](), [exploits](), [mitre](), [project-glasswing](), [runtime-security](), [security](), [vulncheck](), [vulnerabilities](), [vulnerability](), [vulnerability-management](), [vulnerability-remediation-automation]() ### AI overview Security teams have reduced exploitable in-use vulnerabilities, but the exponential growth of vulnerabilities and increasingly rapid AI-assisted exploit weaponization are outpacing human-scale defenses. The article argues that vulnerability management requires prioritization and AI-supported capabilities with human guardrails. ### Source excerpt Security teams reduced exploitable vulnerabilities by 75%, but exponential CVE growth and AI-powered exploits are outpacing human-scale defenses. Learn why agentic AI with human guardrails is becoming the new requirement for modern vulnerability management. ## Threat Actor Defense Evasion: How Attackers Disable AV & EDR DevFeed: [Threat Actor Defense Evasion: How Attackers Disable AV & EDR]() Original publisher: [Read original article]() Author: Toby Bussa Published: 2026-05-18T14:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Endpoint Security & XDR](), [Security](), [Threat Research](), [threat detection](), [Firewall](), [Authorization]() Tags: [attacks](), [av](), [detection](), [detection-and-response](), [drivers](), [edr](), [endpoint-security](), [firewall](), [huntress](), [learn](), [mitre](), [permissions](), [ransomware](), [real-time](), [security](), [techniques](), [telemetry](), [threat-detection]() ### AI overview This article explains how threat actors disable antivirus and EDR defenses using malicious firewall rules, privilege escalation, agent removal, and vulnerable drivers. These actions can suppress telemetry and create a blind spot for lateral movement, data exfiltration, and ransomware deployment. ### Source excerpt Threat actors are actively targeting your security tools. Learn how threat actors disable antivirus and EDR through vulnerable drivers, tampering attacks, and malicious firewall rules, and how Huntress detects. ## Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario DevFeed: [Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario]() Original publisher: [Read original article]() Author: Ruben Groenewoud Published: 2026-03-20T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [container](), [Detection engineering](), [telemetry](), [Cloud](), [Kubernetes](), [Linux](), [ransomware](), [Cybercrime](), [execution](), [Persistence]() Tags: [cloud](), [cloud-detection](), [command-and-control](), [containers](), [detection](), [detection-engineering](), [discovery](), [endpoint-protection-security](), [engineering](), [execution](), [kubernetes](), [lateral-movement](), [linux](), [mitre](), [persistence](), [ransomware](), [runtime-telemetry](), [teampcp]() ### AI overview A real-world walkthrough of TeamPCP's multi-stage container compromise, showing how Elastic's Defend for Containers surfaces runtime signals and detection logic across the attack chain. ### Source excerpt This publication provides a real-world walkthrough of TeamPCP's multi-stage container compromise, demonstrating how Elastic's D4C surfaces runtime signals across each stage of the attack chain. ## Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder DevFeed: [Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder]() Original publisher: [Read original article]() Author: James Spiteri,Dhrumil Patel Published: 2026-02-18T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Agentic SOC](), [Threat Research](), [Malware](), [backdoor](), [Persistence](), [Windows](), [incident](), [observability](), [Security Information and Event Management (SIEM)](), [VirusTotal]() Tags: [agentic-soc](), [ai-automation](), [article](), [backdoor](), [dll-sideloading](), [incident](), [logs](), [malware](), [mitre](), [persistence](), [security]() ### AI overview Elastic Security describes an Agentic SOC workflow that combines Attack Discovery, Workflows, and Agent Builder to correlate alerts, verify malware indicators, search logs, create cases, coordinate incident response, and generate summaries. The article uses the Chrysalis backdoor campaign as its example. ### Source excerpt This article walks through how Elastic Security's Attack Discovery, combined with Workflows and Agent Builder, can automatically detect, correlate, and confirm APT-level attacks like Chrysalis while reducing analyst response time from hours to minutes. ## From Qradar to Elastic: Automate your Detection Rule Migration DevFeed: [From Qradar to Elastic: Automate your Detection Rule Migration]() Original publisher: [Read original article]() Author: Charles Davidson Published: 2026-02-03T00:00:00Z Content type: release Language: en Sources: [Elastic Security Labs]() Topics: [Security Information and Event Management (SIEM)](), [observability](), [migration](), [Security](), [XML](), [Network](), [JOIN]() Tags: [announce](), [automate](), [capabilities](), [changes](), [cost](), [custom](), [dashboards](), [infrastructure](), [integrations-tools](), [mapping](), [migration](), [mitre](), [network](), [preview](), [reference](), [running](), [security](), [security-operations](), [siem](), [splunk]() ### AI overview Elastic Security 9.3 introduces Tech Preview support for automatically migrating QRadar detection rules, alongside existing Splunk translation capabilities. The feature translates supported event, flow, and common rules into Elastic-native logic while preserving reference sets, MITRE mappings, and building block rules. ### Source excerpt Today, we are excited to announce a major expansion to our Automatic Migration feature that changes that narrative. In Elastic Security 9.3, we are introducing Automatic Migration support for QRadar detection rules (now in Tech Preview), joining our existing Splunk translation capabilities to further expedite your journey to Elastic Security. Let's take a closer look at what's supported. ## STIG in Action: 4 Lessons on Automating Compliance with MITRE SAF DevFeed: [STIG in Action: 4 Lessons on Automating Compliance with MITRE SAF]() Original publisher: [Read original article]() Author: Jono Bergquist Published: 2026-01-06T13:00:00Z Content type: opinion Language: en Sources: [Anchore]() Topics: [DevSecOps](), [Security](), [container](), [Cloud Native Ecosystem](), [anchore]() Tags: [anchore](), [blog](), [cloud-native](), [collaboration](), [compliance](), [containerized](), [devsecops](), [mitre](), [national-security](), [open](), [opinion](), [security](), [stig]() ### AI overview This post discusses four lessons from MITRE's Security Automation Framework about automating STIG compliance in containerized, cloud-native and DevSecOps environments. It emphasizes open, shared security validation standards and acknowledges operational realities such as drift, emergency patches and changes to running containers. ### Source excerpt The post STIG in Action: 4 Lessons on Automating Compliance with MITRE SAF appeared first on Anchore.If you have ever tried to manually apply a Security Technical Implementation Guide (STIG) to a modern containerized environment, you know it feels like trying to fit a square peg into a round hole...while the hole is moving at 60 miles per hour. The Department of Defense's move to DevSecOps (and adoption of the DoD [...] ## Triksha - Securing AI with AI at Flipkart DevFeed: [Triksha - Securing AI with AI at Flipkart]() Original publisher: [Read original article]() Author: Karan Arora Published: 2025-12-15T08:34:35Z Content type: article Language: en Sources: [Flipkart Tech Blog]() Topics: [Application Security](), [prompt injection](), [Artificial Intelligence](), [Large Language Model](), [AI Development](), [Security](), [AI-generated research reports](), [Retrieval Augmented Generation (RAG)](), [Model Context Protocol]() Tags: [adversarial](), [agent](), [ai](), [ai-security](), [apis](), [application](), [application-security](), [attack](), [attack-surface](), [authentication](), [core](), [gemini](), [genai-security](), [guardrails](), [llm-security](), [manipulate](), [markov](), [markov-chain](), [mistral](), [mitre](), [mitre-atlas](), [owasp-top-10](), [product-security](), [red-teaming](), [securing-ai]() ### AI overview Flipkart's Triksha is a contextual adversarial model designed to test and secure generative AI applications. It generates domain-aware attack prompts using reconnaissance, adversarial datasets, Markov-chain synthesis, and Gemini-based refinement, targeting risks such as prompt injection, data leakage, and malicious content generation. ### Source excerpt Triksha -- Securing AI with AI at FlipkartTL;DR GenAI apps introduce a new attack surface where prompts become the primary vector of exploitation, making generic application security ineffective for real-world, fine-tuned LLMs like e-commerce support bots. Triksha, Flipkart's purpose-built contextual adversarial model, generates domain-aware attack prompts using recon, adversarial pattern datasets, Markov-chain synthesis, and Gemini-based contextual refinement. It significantly outperforms leading guardrails (LLama-Guard, Model Armor), achieving a 14.6x higher bypass rate in internal tests. Triksha strengthens security across major OWASP-LLM risks, including prompt injection, data leakage, and malicious content generation, and will expand into multimodal testing, RAG attacks, agent workflows, and MCP servers. In short: AI securing AI -- contextually, systematically, and built for how GenAI systems actually fail. Problem Statement The AI landscape is evolving rapidly, and with it comes a shift in how we build, deploy, and secure applications. Today, we're no longer just testing traditional web apps or APIs. We're in the era of GenAI-based applications, where Large Language Models (LLMs) like OpenAI's GPT, Google's Gemini, and open-source models such as LLaMA and Mistral drive core functionalities. But with this shift comes a new kind of threat surface -- and a new way of thinking about security. The New Attack Surface: The Prompt In traditional application security, we test input validation, authentication, business logic, and more, often guided by frameworks like the OWASP Top 10 and MITRE ATLAS But in GenAI applications, the primary entry point for attack is the prompt. Everything starts with a prompt: a query, an instruction, a message. If malicious actors craft the right prompt, they can manipulate a model into harmful or private outputs. That's why prompt injection is one of the most critical and emerging attack vectors today, with OWASP ranking it #1 for 2025, res ## Elastic Security reports a 99.3% detection rate in the 2025 AV-Comparatives EPR Test DevFeed: [Elastic Security reports a 99.3% detection rate in the 2025 AV-Comparatives EPR Test]() Original publisher: [Read original article]() Author: Roxana Gheorghe Published: 2025-09-22T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Endpoint Security & XDR](), [Security](), [Protection](), [execution](), [Persistence]() Tags: [2025](), [attacks](), [av](), [detection](), [endpoint-security](), [mitre]() ### AI overview Elastic reports that Elastic Security achieved a 99.3% detection rate in the 2025 AV-Comparatives Endpoint Prevention and Response Test. The evaluation covered active and passive response across simulated multistage attacks. ### Source excerpt Elastic shares results of the 2025 AV Comparatives EPR test ## Kali Linux 2025.2 Release (Kali Menu Refresh, BloodHound CE & CARsenal) DevFeed: [Kali Linux 2025.2 Release (Kali Menu Refresh, BloodHound CE & CARsenal)]() Original publisher: [Read original article]() Published: 2025-06-13T00:00:00Z Content type: release Language: en Sources: [Kali Linux]() Topics: [changelog](), [Linux](), [Cybersecurity](), [Tool](), [Framework](), [Command-line interface](), [YAML]() Tags: [advanced](), [bloodhound](), [changelog](), [distribution](), [hacking](), [kali](), [kalilinux](), [linux](), [mitre](), [penetration](), [penetration-testing](), [release](), [terminal](), [testing]() ### AI overview Kali Linux 2025.2 introduces a redesigned Kali Menu organized around the MITRE ATT&CK framework, upgrades BloodHound Community Edition, adds smartwatch Wi-Fi injection support and the CARsenal car-hacking toolkit, and includes 13 new tools. The release also updates GNOME and KDE and automates menu management through a YAML-based system. ### Source excerpt We're almost half way through 2025 already, and we've got a lot to share with you in this release, Kali 2025.2. The summary of the changelog since the 2025.1 release from March is: Desktop Updates - Kali-Menu refresh, GNOME 48 & KDE 6.3 updates BloodHound Community Edition - Major upgrade with full set of ingestors Kali NetHunter Smartwatch Wi-Fi Injection - TicWatch Pro 3 now able to de-authenticate and capture WPA2 handshakes Kali NetHunter CARsenal - Car hacking tool set! New Tools - 13 new shinny tools added (and various updates) Desktop Updates Kali Menu Refresh We've completely reworked the Kali Menu! It's now reorganized to follow the MITRE ATT&CK framework structure - which means that finding the right tool for your task should now be a lot more intuitive for red and blue teams alike. Previously the Kali menu structure followed what was in BackTrack... which followed WHAX before it. The previous structure was an in-house item, before MITRE was a thing. When our menu was first created, there wasn't as much design planning done, which we suffered for later. It meant that over time, scaling and adding new tools became difficult for us. The knock on effect was that this made it harder for you, the end-users, to discover new tools as similar tools with overlapping functions were in different places or missing entries. Yes, seasoned professionals may not use the menu to start up items, using shortcuts such as super key and typing the tool name , or via a terminal window. We see the menu as a way to discover tools. The final nail in the coffin in the setup was the fact that it was manually managed. Yes, all those entries were previously created by-hand (which also may explain a few things). As a result, we had stopped adding new tools to the menu... until now. Now, we have created a new system and automated many aspects, making it easier for us to manage, and easier for you to discover items. Win win. Over time, we hope to start to add this to kali.org/tools/. Currentl ## Credential Theft: Expanding Your Reach, Pt. II DevFeed: [Credential Theft: Expanding Your Reach, Pt. II]() Original publisher: [Read original article]() Author: Huntress Adversary Tactics Published: 2025-04-24T05:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Credential theft](), [Security](), [active directory](), [Windows](), [Endpoint Security & XDR](), [Process](), [Server]() Tags: [active-directory](), [credential-theft](), [edr](), [mitre](), [processes](), [security](), [server](), [techniques](), [telemetry](), [windows]() ### AI overview This article explains how credential theft can use Windows LOLBins, including print.exe, to copy the Active Directory NTDS.DIT credential database from Volume Shadow Copies. It describes observed attacker activity and detection considerations using endpoint telemetry. ### Source excerpt As with many tactics within the MITRE ATT&CK framework, credential theft consists of a number of different techniques. Showing what many of them look like on an endpoint helps other security professionals understand what to look for and how to detect and respond to similar activity. ## Cloud Logging Tip & Tricks: Getting the most value out of your cloud logs DevFeed: [Cloud Logging Tip & Tricks: Getting the most value out of your cloud logs]() Original publisher: [Read original article]() Author: Chris Champa Published: 2024-10-08T14:12:15Z Content type: article Language: en Sources: [Wiz]() Topics: [Cloud Logging](), [cloud security](), [observability](), [Security Information and Event Management (SIEM)](), [AWS CloudTrail](), [Monitoring](), [control-plane](), [Amazon S3](), [data]() Tags: [cloud](), [cloud-detection](), [cloud-detection-and-response](), [cloud-logging](), [cloud-security](), [cloudtrail](), [control-plane](), [cyber](), [data](), [logging](), [logs](), [mitre](), [monitoring](), [product](), [real-time](), [visibility]() ### AI overview This article explains why cloud logging is central to cloud detection and response, and previews a framework for prioritizing log collection by security use case. It discusses cloud-provider differences, configuration and cost considerations, and examples involving CloudTrail, S3 data events, and control-plane activity. ### Source excerpt In the cloud, logs are often the only way to get real-time visibility into what's happening, making them critical to any cloud detection and response program. ## Password Spraying Tools: How Attackers Spray M365 DevFeed: [Password Spraying Tools: How Attackers Spray M365]() Original publisher: [Read original article]() Author: Anton Ovrutsky; Faith Stratton Published: 2024-10-03T00:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [password spraying](), [microsoft 365](), [Threat Hunting & Intel](), [Security](), [Authentication](), [Credential theft](), [Business Security](), [passwords]() Tags: [authentication](), [business](), [credential-theft](), [credentials](), [microsoft-365](), [mitre](), [password-spraying](), [security](), [threat-hunting]() ### AI overview Huntress explains how threat actors use password spraying against Microsoft 365 environments and contrasts the technique with brute-force attacks. The article describes threat-hunting approaches focused on failed authentications, IP addresses, targeted users, and effective detection strategies. ### Source excerpt Join Huntress Threat Hunters as they unpack the password-spraying techniques of threat actors, exposing how they target everything from small businesses to giants like Microsoft. ## Linux Detection Engineering - A primer on persistence mechanisms DevFeed: [Linux Detection Engineering - A primer on persistence mechanisms]() Original publisher: [Read original article]() Author: Ruben Groenewoud Published: 2024-08-21T00:00:00Z Content type: tutorial Language: en Sources: [Elastic Security Labs]() Topics: [Detection engineering](), [Linux](), [Persistence](), [Security](), [Security Information and Event Management (SIEM)](), [Malware]() Tags: [article](), [detection](), [detection-engineering](), [how-to](), [linux](), [malware](), [mitre](), [persistence](), [siem]() ### AI overview This tutorial examines Linux persistence mechanisms, maps them to the MITRE ATT&CK framework, and explains how defenders can set up tests, analyze logs, hunt for persistence, and develop detection strategies. It also introduces PANIX, a tool for testing persistence detections. ### Source excerpt In this second part of the Linux Detection Engineering series, we map multiple Linux persistence mechanisms to the MITRE ATT&CK framework, explain how they work, and how to detect them. ## Introducing the Cloud Threat Landscape, a new TI resource for cloud defenders DevFeed: [Introducing the Cloud Threat Landscape, a new TI resource for cloud defenders]() Original publisher: [Read original article]() Author: Alon Schindel Published: 2024-01-24T15:28:30Z Content type: release Language: en Sources: [Wiz]() Topics: [Cloud](), [Threat Research](), [Security](), [High Profile Threats](), [Vulnerabilities](), [data]() Tags: [cloud](), [cloud-threat-intelligence](), [data-exfiltration](), [malware](), [mitre](), [research](), [risk-assessment](), [security](), [threat-intel](), [threat-intelligence](), [tools](), [vulnerabilities](), [wiz](), [wiz-cloud]() ### AI overview Wiz introduces the Cloud Threat Landscape, a public threat intelligence database covering cloud security incidents, campaigns, threat actors, targeting patterns, initial access methods, and data exfiltration techniques. The resource is intended to help cloud defenders with risk assessment, threat modeling, and defensive planning. ### Source excerpt The Cloud Threat Landscape is a threat intelligence database that summarizes cloud incidents and offers insights into targeting patterns and initial access methods. ## Exploring the Value of Indicators In Small Business Defense DevFeed: [Exploring the Value of Indicators In Small Business Defense]() Original publisher: [Read original article]() Author: Joe Slowik Published: 2023-12-07T00:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Threat Hunting & Intel](), [IoC (Disambiguation)](), [Threat Research](), [Business Security](), [High Profile Threats]() Tags: [analysis](), [cybersecurity](), [indicators-of-compromise](), [mitre](), [small-business](), [threat-intelligence]() ### AI overview This article examines the role of technical indicators and indicators of compromise in cyber threat intelligence and information security. It distinguishes indicators from raw observables, explains their value in forensic analysis and threat hunting, and discusses their economical use in small and medium-sized business defense. ### Source excerpt Discover how leveraging technical indicators can boost cybersecurity effectiveness and empower small business defense. Read on for practical insights. ## CUBA Ransomware Malware Analysis DevFeed: [CUBA Ransomware Malware Analysis]() Original publisher: [Read original article]() Author: Salim Bitam Published: 2023-02-14T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [ransomware](), [Threat Research](), [Security](), [Cryptography](), [ChaCha](), [Encryption](), [Concurrency](), [threat detection](), [code analysis](), [Filesystems](), [Windows]() Tags: [c](), [command-line](), [detection](), [encryption](), [file](), [file-system](), [indicators-of-compromise](), [malware](), [malware-analysis](), [mitre](), [process](), [protocol](), [ransomware](), [security](), [sha256](), [technical](), [technical-analysis](), [threading]() ### AI overview Elastic Security analyzes the CUBA ransomware family, describing its capabilities, encryption of local and network-share files, multithreaded implementation, defensive countermeasures, and indicators for detection. ### Source excerpt Elastic Security has performed a deep technical analysis of the CUBA ransomware family. This includes malware capabilities as well as defensive countermeasures. ## SiestaGraph: New implant uncovered in ASEAN member foreign ministry DevFeed: [SiestaGraph: New implant uncovered in ASEAN member foreign ministry]() Original publisher: [Read original article]() Author: Samir Bousseaden,Andrew Pease,Daniel Stepanic,Salim Bitam,Seth Goodwin,Devon Kerr Published: 2022-12-16T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Security](), [Malware](), [PowerShell](), [backdoor](), [API](), [Reconnaissance](), [Process]() Tags: [api](), [backdoor](), [credentials](), [exfiltration](), [malware](), [microsoft-exchange](), [mitre](), [network](), [powershell](), [process](), [security](), [threat-intelligence]() ### AI overview Elastic Security Labs reports on a campaign targeting an ASEAN member's foreign ministry. The activity involved Exchange exploits, web shells, mailbox exfiltration, lateral movement, credential collection, and the newly identified SiestaGraph backdoor, which uses the Microsoft Graph API for command and control. ### Source excerpt Elastic Security Labs is tracking likely multiple on-net threat actors leveraging Exchange exploits, web shells, and the newly discovered SiestaGraph implant to achieve and maintain access, escalate privilege, and exfiltrate targeted data. ## A close look at the advanced techniques used in a Malaysian-focused APT campaign DevFeed: [A close look at the advanced techniques used in a Malaysian-focused APT campaign]() Original publisher: [Read original article]() Author: Samir Bousseaden,Daniel Stepanic,Elastic Security Intelligence & Analytics Team Published: 2022-06-22T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Security](), [Security research](), [DLL hijacking](), [Vulnerabilities](), [VBA](), [obfuscation](), [Microsoft]() Tags: [advanced](), [dll](), [mitre](), [obfuscation](), [phishing](), [research](), [security](), [security-research](), [techniques](), [threat-intelligence](), [vulnerability]() ### AI overview Elastic Security researchers analyze a Malaysian-focused APT campaign possibly linked to APT40. The report describes phishing with a Microsoft Word lure, remote template injection, VBA macro execution, embedded DLLs, obfuscation, and DLL search order exploitation, along with observed MITRE techniques and indicators of compromise. ### Source excerpt Our Elastic Security research team has focused on advanced techniques used in a Malaysian-focused APT campaign. Learn who's behind it, how the attack works, observed MITRE attack® techniques, and indicators of compromise. ## Elastic Security opens public detection rules repo DevFeed: [Elastic Security opens public detection rules repo]() Original publisher: [Read original article]() Author: Ross Wolf,Elastic Security Intelligence & Analytics Team Published: 2022-05-20T00:00:00Z Content type: release Language: en Sources: [Elastic Security Labs]() Topics: [Security](), [GitHub](), [Repository](), [threat detection](), [software-development](), [Software Testing](), [kibana](), [telemetry](), [Linux](), [macOS](), [Windows]() Tags: [community](), [coverage](), [detection](), [github](), [kibana](), [linux](), [logs](), [macos](), [mitre](), [open](), [open-source](), [operating-systems](), [repo](), [rules](), [security](), [soc]() ### AI overview Elastic Security announces that its detection rules repository is now public on GitHub, inviting community contributions and collaborative rule development. The repository supports automated threat detection and includes rules covering MITRE ATT&CK techniques across multiple operating systems and cloud services. ### Source excerpt Elastic Security has opened its detection rules repository to the world. We will develop rules in the open alongside the community, and we're welcoming your community-driven detections. This is an opportunity to share collective security knowledge.