Elastic is launching an expansion of its security bounty program, inviting researchers to test its SIEM and EDR rules for evasion and bypass techniques, starting with Windows endpoints. This initiative strengthens collaboration with the security community, ensuring Elastic’s defenses remain robust against evolving threats.

Introduction

Elastic’s security bug bounty program offering 

A new bounty focus: Elastic Security rule assessments

Why this is important

Summary scope and rewards

Time bounds

Current offering

Behavior detections

What we’re looking for

Rule definition

Submission guidelines

Feature details scope

Questions and disclosure

How to get involved

Introducing a new focus on behavior rule protections, empowering researchers to enhance Elastic Security through innovative detection rule testing.

Announcing the Elastic Bounty Program for Behavior Rule Protections

Elastic Security Labs discusses detection and mitigation strategies for vulnerabilities in the CUPS printing system, which allow unauthenticated attackers to exploit the system via IPP and mDNS, resulting in remote code execution (RCE) on UNIX-based systems such as Linux, macOS, BSDs, ChromeOS, and Solaris.

Update October 2, 2024

Key takeaways

The CUPS RCE at a glance

Elastic’s POC analysis

Executing the ‘Cupshax’ POC

Assessing impact

Remediations

Elastic protections

cupsd or foomatic-rip shell execution

Printer user (lp) shell execution

Network connection by CUPS foomatic-rip child

File creation by CUPS foomatic-rip child

Suspicious execution from foomatic-rip or cupsd parent

Elastic’s Attack Discovery

Conclusion

Key References

Cups Overflow: When your printer spills more than Ink

This article introduces a previously-unnamed class of Windows vulnerability that demonstrates the dangers of assumption and describes some unintended security consequences.

Windows file sharing

Sharing enforcement

Authenticode

Code integrity

Incorrect assumptions

Page hashes

Attacking code integrity

Paging exploitation

New research

Planning the attack

Implementation and considerations

Exploit demo

Understanding these vulnerabilities

Affected Operations

What else could be vulnerable?

Don’t forget about user mode

MapViewOfFile

ReadFile

LoadLibrary

Stopping the exploit

End-user detection and mitigation

Disclosure

Fixing Code Integrity

Summary and conclusion

Introducing a New Vulnerability Class: False File Immutability

Elastic Security Labs is releasing an initial analysis of the XZ Utility backdoor, including YARA rules, osquery, and KQL searches to identify potential compromises.

Key Takeaways

The XZ / liblzma backdoor at a glance

Backdoor analysis

XZ backdoor build process:

Assessing impact:

Malware protection

Behavior Detection

Linux: the final frontier

500ms to midnight: XZ A.K.A. liblzma backdoor

Elastic is deploying a new malware signature to identify the use of the Follina vulnerability. Learn more in this post.

Summary

References

Vulnerability summary: Follina, CVE-2022-30190

In this post, we cover next steps the Elastic Security team is taking for users to continue to protect themselves against CVE-2021-44228, or Log4Shell.

Elastic Security response

A new contender: CVE-2021-45046

Thank you (again!), from Elastic Security

Analysis of Log4Shell vulnerability & CVE-2021-45046

KNOTWEED deploys the Subzero spyware through the use of 0-day exploits for Adobe Reader and the Windows operating system. Once initial access is gained, it uses different sections of Subzero to maintain persistence and perform actions on the host.

Assessment

Risk

Impact

Countermeasures

Terminology

KNOTWEED Assessment Summary

This blog post provides a summary of CVE-2021-44228 and provides Elastic Security users with detections to find active exploitation of the vulnerability in their environment. Further updates will be provided to this post as we learn more.

Overview

Summary of CVE-2021-44228 (Log4Shell)

Detecting Exploitation of Log4Shell in Elastic Security

Update: Detection & hunting improvements

Elastic Endgame EQL Queries

Community Detections

Additional Mitigation Strategies

Thank you, from Elastic Security.

Reference Material

Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security

The SIGRed vulnerability impacts all systems leveraging the Windows DNS server service (Windows 2003+). To defend your environment, we recommend implementing the detection logic included in this blog post using technology like Elastic Security.

Executive summary

Timeline of events

Tactics

Techniques

Detection

Detection logic

Unusual child of dns.exe - Kibana Query Language (KQL)

Unusual file operations of dns.exe (KQL)

Network (Packetbeat and Filebeat with the Zeek or Suricata modules)

Defensive recommendations

Detection rules for SIGRed vulnerability

Provide executive-level details about CVE-2022-22965, a recently-disclosed remote code execution (RCE) vulnerability also known as “Spring4Shell”.

What is the threat?

What is the impact?

Leveraging Elastic for exploit detection

Artifacts

Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965)

Vulnerability updates

카테고리

취약성 업데이트

29 1월 2025

행동 규칙 보호를 위한 Elastic 바운티 프로그램 발표

CUPS 위기: 프린터에서 새어 나오는 보안 허점

새로운 취약성 클래스를 소개합니다: 잘못된 파일 불변성

500ms to midnight: XZ A.K.A. liblzma backdoor

취약점 요약: 폴리나, CVE-2022-30190

Log4Shell 취약점 분석 & CVE-2021-45046

KNOTWEED 평가 요약

Elastic Security를 통한 CVE-2021-44228 (Log4j2) 익스플로잇 탐지

SIGRed 취약점에 대한 탐지 규칙

Spring4Shell 취약점(CVE-2022-22965)에 대한 Elastic의 대응