The article describes a detection engineering technique developed by Elastic's internal InfoSec team that uses ES|QL COMPLETION (an LLM-invoking query command) to triage curl and wget process execution alerts (mapped to MITRE ATT&CK T1105, Ingress Tool Transfer) after deterministic allow-list filtering and secret redaction. In a 7-day production test, only three destinations survived filtering, and LLM triage correctly classified all three without generating an analyst-facing false positive, demonstrating a hybrid deterministic+LLM approach to reduce alert fatigue on noisy cloud detection rules.
Detection Engineering
6 posts
How Elasticsearch ES|QL COMPLETION turns noisy curl and wget rules into high-fidelity cloud security alerts Introducing EvidenceForge: Synthetic security logs that don’t look (as) fake Cisco Talos has introduced EvidenceForge, an open-source tool designed to generate high-fidelity, correlated synthetic security logs across multiple formats. The tool addresses the data bottleneck in detection engineering and SOC training by providing realistic datasets with causal ordering, background noise, and AI-assisted scenario authoring.
Prioritizing Alerts Triage with Higher-Order Detection Rules Elastic outlines the methodology and operational benefits of Higher-Order Rules (HOR), which correlate atomic security alerts across entities, data sources, and timeframes. By aggregating signals from endpoints, network devices, and observability metrics, HORs significantly reduce alert fatigue and surface high-confidence malicious activity for prioritized SOC triage.
Hooked on Linux: Rootkit Detection Engineering This article details behavioral detection engineering strategies for Linux rootkits, emphasizing the failure of static signatures against trivial binary modifications. It provides actionable detection logic for userland and kernel-space rootkits, including emerging threats leveraging eBPF and io_uring, alongside common persistence and defense evasion techniques.
Linux & Cloud Detection Engineering - Getting Started with Defend for Containers (D4C) Elastic has introduced Defend for Containers (D4C) in version 9.3.0, providing runtime visibility and detection capabilities for Linux container workloads in Kubernetes environments. The integration captures process and file activity enriched with orchestration metadata, enabling detection engineers to build robust, behavior-based security policies.
OAuth Device Code Phishing: A New Microsoft 365 Account Breach Vector Threat actors are increasingly utilizing OAuth Device Code phishing to compromise Microsoft 365 accounts. By tricking victims into entering a verification code on the legitimate Microsoft device login page, attackers can obtain OAuth access and refresh tokens without ever harvesting the user's credentials. This technique bypasses traditional phishing defenses by operating over encrypted channels and legitimate Microsoft infrastructure.
