Maritime Cyberattacks Through the IT–OT–IoT Lens
Three real port cyberattacks show how stolen data, compromised software and ransomware disrupt operations—and what IT, OT and IoT teams can do.
Read More
Blog Entries
Velociraptor: Endpoint Visibility and Incident Response
When a cyber incident occurs, one of the first challenges is understanding what happened, which systems were involved, and what traces were left behind. In this context, Velociraptor can help: It’s an open-source DFIR tool that can collect and examine endpoint data in a centralized, targeted, and repeatable way. After completing a course focused on…
Read MoreFrom Threat Intelligence to Detection: Building an Intelligence-Driven Detection Model
Turning Relevant Campaigns into Actionable Security Content To prioritize detection rule deployment based on threats that could realistically affect our organization or customer environments, we’ve developed an intelligence-driven detection model. Rather than prioritizing rules solely by mapping MITRE ATT&CK techniques and addressing coverage gaps indiscriminately, the model uses threat intelligence to identify which campaigns, behaviors,…
Read MoreDetecting Data Exfiltration with Elastic Machine Learning
Data exfiltration is rarely as obvious as a large file being copied to an attacker-controlled server. In many environments, sensitive information leaves through channels that look legitimate: a cloud storage service, a familiar application, an unusual destination country, or a removable device. This is where Elastic’s Data Exfiltration Detection (DED) package can help. Instead of…
Read MoreInside Password Attacks: A SOC Perspective
The View from the SOC From inside the SOC, authentication traffic never really stops. Most of it is ordinary business: people signing in, services renewing sessions, or developers moving between tools. Mixed into that stream is something far less ordinary: repeated, automated attempts to become someone else. That’s why identity work sits so close to…
Read MoreLOLDrivers Is More Than a Simple List: A New Approach to BYOVD Detection
1. Introduction The abuse of vulnerable drivers has become an increasingly common technique adopted by attackers to bypass modern security controls. This attack pattern, commonly referred to as Bring Your Own Vulnerable Driver (BYOVD), consists of loading legitimately signed but vulnerable drivers into the operating system in order to gain kernel-level privileges, disable security products,…
Read MoreDevice Isolation with SOAR
SOAR for Controlled Response SOAR is often described in broad terms: orchestration, automation, response, integration. That’s true, but it can also feel vague. A simpler way to explain it is this: SOAR helps a SOC turn a decision into action without repeating the same manual steps every time. This matters most when the action is…
Read MoreBridging The Gap
Why a Purple Team Program Makes Cybersecurity More Effective In today’s cybersecurity landscape, having defensive tools in place is no longer enough. Firewalls, SIEM platforms, detection rules, playbooks, and threat intelligence feeds are all essential components, but the real question is this: how well do they actually perform under realistic attack conditions? This is where…
Read MoreInside Elastic Security Detection Rules: Internal Structure & Upgrade Mechanics
A Rule Is More Than a Query In modern detection engineering, a rule is often misunderstood as just a query that triggers alerts. In reality, within Elastic Security, a detection rule is a structured, versioned, and lifecycle-managed object that goes far beyond simple query logic. Understanding this structure is essential for anyone operating in a…
Read MoreFrom Static Lists to Threat Intelligence: Better Domain Detection in Elastic
A scalable approach to detecting malicious domains using Threat Intelligence and Indicator Match Rules One of the most common techniques used in phishing and initial access campaigns is the creation of domains that closely resemble legitimate ones. Attackers exploit typosquatting, homograph attacks, and brand impersonation to deceive users and steal credentials. For a Security Operations…
Read MorePurple Teaming is a MUST, not a PLUS
In modern security programs the silos between offensive and defensive teams is no longer sustainable: attackers iterate faster, tooling evolves daily, and detection gaps are exploited in minutes, not months. In this environment purple teaming is not an optional maturity enhancement, but it becomes a foundational requirement for organizations that take risk management seriously. Purple…
Read MoreMeet The CDC! Our Innovative Concept For A Modern SOC
Introduction If you work in the Cyber Security field, you probably know how a traditional Security Operations Center (SOC) operates. It’s often characterized by a demanding workload, extended night shifts, and high personnel turnover. These factors can lead to alert fatigue among analysts and lower morale. The stressful nature of such environments can also result…
Read MoreInfection Chain – Behind the Scenes
The year is almost over and there’s one thing that always marks this period: the end of one of our biggest and most hyped events. You probably already know what I’m talking about… but just in case you don’t (or even worse, have no idea what the most awaited event of the year is) let…
Read MoreHunting Silent Kerberoasting: Detecting RC4 TGS Floods with Elastic
Introduction Kerberoasting remains one of the most popular techniques for attackers attempting to escalate privileges inside a Windows domain. By requesting service tickets (TGS – Ticket Granting Service) encrypted with weak algorithms, an attacker can extract hashes and crack them offline to recover service account passwords. It should be mentioned that a Kerberos ticket request…
Read MoreYou’ve Got a New Message! Oh No… It’s Malware!
On October 1, 2025, Würth Group employees were targeted by a WhatsApp-based cyberattack. A few users fell for it and some devices got infected. The attack was promptly detected by our Cyber Defense Center, and was stopped before it could spread further. Investigating the threat more deeply, we discovered it was part of a wider…
Read More