Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2023-06-29 ⋅ Elastic ⋅ Colson Wilhoit, Salim Bitam, Seth Goodwin, Andrew Pease, Ricardo Ungureanu
@online{wilhoit:20230629:dprk:e7dd437, author = {Colson Wilhoit and Salim Bitam and Seth Goodwin and Andrew Pease and Ricardo Ungureanu}, title = {{The DPRK strikes using a new variant of RUSTBUCKET}}, date = {2023-06-29}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket}, language = {English}, urldate = {2023-07-02} } The DPRK strikes using a new variant of RUSTBUCKET
RustBucket
2023-06-21 ⋅ Elastic ⋅ Colson Wilhoit, Salim Bitam, Seth Goodwin, Andrew Pease, Ricardo Ungureanu
@online{wilhoit:20230621:initial:4eacdf5, author = {Colson Wilhoit and Salim Bitam and Seth Goodwin and Andrew Pease and Ricardo Ungureanu}, title = {{Initial research exposing JOKERSPY}}, date = {2023-06-21}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/inital-research-of-jokerspy}, language = {English}, urldate = {2023-07-11} } Initial research exposing JOKERSPY
JokerSpy
2023-06-09 ⋅ Elastic ⋅ Cyril François, Daniel Stepanic, Seth Goodwin
@online{franois:20230609:elastic:42d37cb, author = {Cyril François and Daniel Stepanic and Seth Goodwin}, title = {{Elastic charms SPECTRALVIPER}}, date = {2023-06-09}, organization = {Elastic}, url = {https://www.elastic.co/fr/security-labs/elastic-charms-spectralviper}, language = {English}, urldate = {2023-07-26} } Elastic charms SPECTRALVIPER
SPECTRALVIPER
2023-06-09 ⋅ Elastic ⋅ Cyril François, Daniel Stepanic, Seth Goodwin
@online{franois:20230609:elastic:910c520, author = {Cyril François and Daniel Stepanic and Seth Goodwin}, title = {{Elastic charms SPECTRALVIPER}}, date = {2023-06-09}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/elastic-charms-spectralviper}, language = {English}, urldate = {2023-07-26} } Elastic charms SPECTRALVIPER
2023-02-02 ⋅ Elastic ⋅ Salim Bitam, Remco Sprooten, Cyril François, Andrew Pease, Devon Kerr, Seth Goodwin
@online{bitam:20230202:update:57ea3a2, author = {Salim Bitam and Remco Sprooten and Cyril François and Andrew Pease and Devon Kerr and Seth Goodwin}, title = {{Update to the REF2924 intrusion set and related campaigns}}, date = {2023-02-02}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns}, language = {English}, urldate = {2023-03-21} } Update to the REF2924 intrusion set and related campaigns
DoorMe ShadowPad SiestaGraph
2022-12-16 ⋅ Elastic ⋅ Samir Bousseaden, Andrew Pease, Daniel Stepanic, Salim Bitam, Seth Goodwin, Devon Kerr
@online{bousseaden:20221216:siestagraph:bb73ce7, author = {Samir Bousseaden and Andrew Pease and Daniel Stepanic and Salim Bitam and Seth Goodwin and Devon Kerr}, title = {{SiestaGraph: New implant uncovered in ASEAN member foreign ministry}}, date = {2022-12-16}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry}, language = {English}, urldate = {2022-12-19} } SiestaGraph: New implant uncovered in ASEAN member foreign ministry
DoorMe SiestaGraph
2022-10-31 ⋅ Elastic ⋅ Seth Goodwin, Derek Ditch, Daniel Stepanic, Andrew Pease
@online{goodwin:20221031:icedids:df089be, author = {Seth Goodwin and Derek Ditch and Daniel Stepanic and Andrew Pease}, title = {{ICEDIDs network infrastructure is alive and well}}, date = {2022-10-31}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/icedids-network-infrastructure-is-alive-and-well}, language = {English}, urldate = {2022-11-02} } ICEDIDs network infrastructure is alive and well
IcedID
2022-07-27 ⋅ Elastic ⋅ Cyril François, Andrew Pease, Seth Goodwin
@online{franois:20220727:exploring:67dc644, author = {Cyril François and Andrew Pease and Seth Goodwin}, title = {{Exploring the QBOT Attack Pattern}}, date = {2022-07-27}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern}, language = {English}, urldate = {2022-08-05} } Exploring the QBOT Attack Pattern
QakBot
2022-06-01 ⋅ Elastic ⋅ Daniel Stepanic, Derek Ditch, Seth Goodwin, Salim Bitam, Andrew Pease
@online{stepanic:20220601:cuba:333f7c1, author = {Daniel Stepanic and Derek Ditch and Seth Goodwin and Salim Bitam and Andrew Pease}, title = {{CUBA Ransomware Campaign Analysis}}, date = {2022-06-01}, organization = {Elastic}, url = {https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis}, language = {English}, urldate = {2022-06-09} } CUBA Ransomware Campaign Analysis
Cobalt Strike Cuba Meterpreter MimiKatz SystemBC
2022-01-19 ⋅ Elastic ⋅ Derek Ditch, Daniel Stepanic, Andrew Pease, Seth Goodwin
@online{ditch:20220119:extracting:39bd5e5, author = {Derek Ditch and Daniel Stepanic and Andrew Pease and Seth Goodwin}, title = {{Extracting Cobalt Strike Beacon Configurations}}, date = {2022-01-19}, organization = {Elastic}, url = {https://elastic.github.io/security-research/intelligence/2022/01/03.extracting-cobalt-strike-beacon/article/}, language = {English}, urldate = {2022-01-25} } Extracting Cobalt Strike Beacon Configurations
Cobalt Strike
2022-01-19 ⋅ Elastic ⋅ Derek Ditch, Daniel Stepanic, Andrew Pease, Seth Goodwin
@online{ditch:20220119:collecting:696e5d0, author = {Derek Ditch and Daniel Stepanic and Andrew Pease and Seth Goodwin}, title = {{Collecting Cobalt Strike Beacons with the Elastic Stack}}, date = {2022-01-19}, organization = {Elastic}, url = {https://elastic.github.io/security-research/intelligence/2022/01/02.collecting-cobalt-strike-beacons/article/}, language = {English}, urldate = {2022-01-25} } Collecting Cobalt Strike Beacons with the Elastic Stack
Cobalt Strike
2022-01-18 ⋅ Elastic ⋅ Derek Ditch, Daniel Stepanic, Andrew Pease, Seth Goodwin
@online{ditch:20220118:formbook:3f03c56, author = {Derek Ditch and Daniel Stepanic and Andrew Pease and Seth Goodwin}, title = {{FORMBOOK Adopts CAB-less Approach}}, date = {2022-01-18}, organization = {Elastic}, url = {https://elastic.github.io/security-research/intelligence/2022/01/01.formbook-adopts-cabless-approach/article/}, language = {English}, urldate = {2022-01-25} } FORMBOOK Adopts CAB-less Approach
Formbook
2020-02-13 ⋅ Elastic ⋅ Daniel Stepanic, Andrew Pease, Seth Goodwin
@online{stepanic:20200213:playing:ae77be6, author = {Daniel Stepanic and Andrew Pease and Seth Goodwin}, title = {{Playing defense against Gamaredon Group}}, date = {2020-02-13}, organization = {Elastic}, url = {https://www.elastic.co/blog/playing-defense-against-gamaredon-group}, language = {English}, urldate = {2020-06-26} } Playing defense against Gamaredon Group
Pteranodon