30
From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.
The ClickFix campaign side-loads a malicious mscoree.dll next to a signed Microsoft binary and also ships a driver to kill Elastic Endpoint. Elastic rebuilt the DLL as a NativeAOT library, dropped it beside the signed binary, and confirmed that Elastic Defend 9.5.0 flags the load. The post replaces 88 lines of detection logic with a single rule for DLL search-order hijacking.
28
30
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
Elastic's InfoSec team raised AI alert-triage accuracy from 60% to 92% using three self-correcting agents integrated into Slack triage.
Elastic's InfoSec team deployed three AI agents that read detection-rule investigation guides and closure reasons from 30 days of historical cases to triage alerts. The agentic pipeline lifted triage accuracy from 60% to 92%. Analysts now clear most alerts with a single click in Slack.
35
How a team of entity maintainers monitors, connects and scores entities in Elastic Security
Elastic Security explains how background 'maintainer' jobs build user, host and service entities from raw logs and drive identity resolution and risk scoring.
Elastic Security Labs describes the internal background jobs, called maintainers, that each own one piece of every user, host and service record in Elastic Security. The maintainers construct entities from raw logs, resolve identities across sources and compute risk scores, and the write-up explains how the team keeps this entity machinery consistent.
25
30
30
55
55
30
55
55
30
55
42
30
30
55
30
30
42
30
30