Microsoft's WESP aims to move EDR out of the Windows kernel
Insider builds already include wesp.sys, a mini-filter at altitude 329500, and user-mode API espclient.dll.
42
Organization
Elastic Security Labs
- Mentions · 7d1
- Mentions · 30d4
- All mentions13
- First seenAug 15, 2026
- Last mentioned5d ago
Timeline
13 articles · newest firstCVE-2026-73570 command injection in Zimbra yields remote code execution
A malformed SMTP recipient is logged and run by Swatchdog as the zimbra user; fix is 10.1.20 or later.
64
Fake Apex Accelerator npm packages spread stealers and backdoors
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
74
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
Elastic now grades more than 2,100 prebuilt SIEM rules monthly on noise, speed, and threat coverage.
32
Linux Detection Engineering - Local Privilege Escalation
Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.
48
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.
45
How to correlate Kubernetes audit logs with container runtime data
Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.
30
REVSTEALER ramps up: analysis of up-and-coming infostealer
Elastic Security Labs analyzes REVSTEALER, an emerging infostealer harvesting browser credentials, cryptocurrency wallets, and gaming accounts.
40
Linux Detection Engineering - Fileless Execution
Elastic Security Labs reproduces five Linux fileless execution patterns, including memfd_create staging and in-memory kernel module loads, and maps each to Elastic Defend rules.
30
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team raised AI alert-triage accuracy from 60% to 92% using three self-correcting agents integrated into Slack triage.
35
How a team of entity maintainers monitors, connects and scores entities in Elastic Security
Elastic Security explains how background 'maintainer' jobs build user, host and service entities from raw logs and drive identity resolution and risk scoring.
25
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
Bitdefender reports SilkParasite, a China-nexus espionage cluster targeting Central Asian governments with seven RATs, five newly documented, delivered via spearphished RAR archives.
70
China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.
76
Related CVEs
by mentions- CVE-2026-7357072%8.9Unauthenticated OS Command Injection RCE in Synacor Zimbra Collaboration Suite
Appears with
- Elasticvendor · 8
- Claudeproduct · 2
- Anthropicorganization · 2
- Anthropicvendor · 2
- Elastic Defendproduct · 2
- REVSTEALERmalware · 2
- Amazon EKSproduct · 1
- ClientKingproduct · 1
- @apexacc/auditproduct · 1
- BLOODALCHEMYproduct · 1
- TeamPCPorganization · 1
- wesp.sysproduct · 1
- Zimbravendor · 1
- Apex Foundationorganization · 1
- Hugging Facevictim · 1
- Trend Microorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.