57
30
30
30
30
30
30
30
42
30
30
55
30
30
30
30
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.
Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.
45
60
30
45
30
42
30
55
60
Linux Detection Engineering - Local Privilege Escalation
Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.
Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.
48
From 88 lines to 1: Detecting DLL hijacking with Elastic Defend
Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.
The ClickFix campaign side-loads a malicious mscoree.dll next to a signed Microsoft binary and also ships a driver to kill Elastic Endpoint. Elastic rebuilt the DLL as a NativeAOT library, dropped it beside the signed binary, and confirmed that Elastic Defend 9.5.0 flags the load. The post replaces 88 lines of detection logic with a single rule for DLL search-order hijacking.
28
30
30
55
30
13 million tool calls: auditing every AI coding agent action with Elastic Agent
Elastic Security Labs shows how Cursor hooks plus Elastic Agent turn AI coding agent activity into 13 million huntable security events.
Elastic Security Labs demonstrates auditing AI coding agent behavior by pairing Cursor hooks with Elastic Agent, capturing every tool call, shell command, file read, and MCP request as structured events. The dataset of 13 million captured events can be hunted with ES|QL, giving defenders visibility into agent actions.
45
30
SolarWinds Web Help Desk Exploited for RCE in Multi
60
60
60
30
57
60
42