The 2025 State of Detection Engineering at Elastic explores how we create, maintain, and assess our SIEM and EDR rulesets. Today, Elastic Security Labs is releasing the 2025 State of Detection Engineering at Elastic! This brand new report is the first of its kind — we’re pulling back the curtain on our Detection Engineering practices, going beyond the traditional survey-style … [Read more...] about Elastic Security Labs provides an under-the-hood look at its detection engineering processes
Processes
Streamline configuration processes with an official Elastic Stack Terraform provider
Or, by using an elasticsearch_connection block with the same parameters on a per-resource level. This lets you use the provider to configure multiple Elastic Stack instances in a single configuration file and spin up a fully configured Elastic deployment on Elastic Cloud. The Elastic Stack, as codeThe Elastic Stack Terraform provider allows you to manage crucial Elasticsearch … [Read more...] about Streamline configuration processes with an official Elastic Stack Terraform provider
How DopplePaymer Hunts & Kills Windows Processes
In a July 2019 blog post about DoppelPaymer, Crowdstrike Intelligence reported that ProcessHacker was being hijacked to kill a list of targeted processes and gain access, delivering a “critical hit.” Although the blog is now a couple of years old, the hijacking technique is interesting enough to dig into its implementation. The hijack occurs when ProcessHacker loads a malicious … [Read more...] about How DopplePaymer Hunts & Kills Windows Processes