Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2023-04-07 ⋅ Elastic ⋅ Salim Bitam
Attack chain leads to XWORM and AGENTTESLA
Agent Tesla XWorm
2023-03-30 ⋅ Elastic ⋅ Daniel Stepanic, Devon Kerr, Joe Desimone, Remco Sprooten, Samir Bousseaden
Elastic users protected from SUDDENICON’s supply chain attack
3CX Backdoor
2023-03-27 ⋅ Elastic ⋅ Remco Sprooten
REF2924: how to maintain persistence as an (advanced?) threat
Godzilla Webshell Behinder NAPLISTENER SiestaGraph REF2924
2023-03-20 ⋅ Elastic ⋅ Remco Sprooten
NAPLISTENER: more bad dreams from developers of SIESTAGRAPH
NAPLISTENER SiestaGraph
2023-03-17 ⋅ Elastic ⋅ Cyril François, Daniel Stepanic
Thawing the permafrost of ICEDID Summary
IcedID PhotoLoader
2023-02-02 ⋅ Elastic ⋅ Andrew Pease, Cyril François, Devon Kerr, Remco Sprooten, Salim Bitam, Seth Goodwin
Update to the REF2924 intrusion set and related campaigns
DoorMe ShadowPad SiestaGraph
2022-12-16 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Devon Kerr, Salim Bitam, Samir Bousseaden, Seth Goodwin
SiestaGraph: New implant uncovered in ASEAN member foreign ministry
DoorMe SiestaGraph
2022-10-31 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Seth Goodwin
ICEDIDs network infrastructure is alive and well
IcedID
2022-10-28 ⋅ Elastic ⋅ @rsprooten, Elastic Security Intelligence & Analytics Team
EMOTET dynamic config extraction
Emotet
2022-09-09 ⋅ Elastic ⋅ Salim Bitam
BUGHATCH Malware Analysis
BUGHATCH
2022-08-24 ⋅ Elastic ⋅ Cyril François
QBOT Malware Analysis
QakBot
2022-07-27 ⋅ Elastic ⋅ Andrew Pease, Cyril François, Seth Goodwin
Exploring the QBOT Attack Pattern
QakBot
2022-07-27 ⋅ Elastic ⋅ Cyril François, Derek Ditch
QBOT Configuration Extractor
QakBot
2022-06-01 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Salim Bitam, Seth Goodwin
CUBA Ransomware Campaign Analysis
Cobalt Strike Cuba Meterpreter MimiKatz SystemBC
2022-06-01 ⋅ Elastic ⋅ Salim Bitam
CUBA Ransomware Malware Analysis
Cuba
2022-05-17 ⋅ Elastic ⋅ Alex Bell, Colson Wilhoit, Jake King, Rhys Rustad-Elliott
A peek behind the BPFDoor
BPFDoor
2022-05-05 ⋅ Elastic ⋅ Cyril François, Daniel Stepanic, Salim Bitam
BLISTER Loader
Blister
2022-03-07 ⋅ Elastic ⋅ Andrew Pease, Cyril François, Daniel Stepanic, Derek Ditch, Github (@1337-42), Joe Desimone, Samir Bousseaden
PHOREAL Malware Targets the Southeast Asian Financial Sector
PHOREAL
2022-03-01 ⋅ Elastic ⋅ Andrew Pease, Cyril François, Daniel Stepanic, Github (@1337-42), Github (@ayfaouzi), Github (@jtnk), Mark Mager, Samir Bousseaden
Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER
HermeticWiper
2022-02-07 ⋅ Elastic ⋅ Samir Bousseaden
Exploring Windows UAC Bypasses: Techniques and Detection Strategies