elastic/detection-rules

cups2root dropped after my Linux LPE detection blog. There was no cups2root-specific rule. The general layer still fired on my Ubuntu 26.04 lab run. Python to root. SUID/SGID abuse. A system-binary…

Elastic Defend 9.5.0 now carries the taint state on Linux kernel module loading events. I loaded Singularity (the stealthiest open source rootkit I know). On load, it hides from lsmod, /proc/modules,…

We are observing active exploitation using publicly available #wp2shell PoCs. In current telemetry, web and PHP runtimes (httpd, apache2, php-fpm) are spawning shells and executing commands such as…

You can fake a process's name: exec -a sets argv[0], and prctl(PR_SET_NAME) even rewrites comm. What a userspace process cannot fake is the identity the kernel gives a real kernel thread: no on-disk…

Second tell: a kernel-named process opening an outbound connection. Some in-kernel networking (NFS) connects out legitimately, and the public rule accounts for that; it excludes the NFS ports…