Stealthy adversaries continually exploit system utilities to execute malicious code. A particularly potent and frequently misused tactic is MITRE ATT&CK® T1059 - Command and Scripting Interpreter, wherein attackers harness built-in interpreters like PowerShell, Bash, Python, or JavaScript to run arbitrary commands. This strategy enables adversaries to conduct … [Read more...] about Detect script-based threats with ES|QL: MITRE T1059 in action
ESQL
Hunting with Elastic Security: Detecting credential dumping with ES|QL
In the shadowy depths of your network, whispers grow louder — something isn’t right. Adversaries are on the prowl, targeting the very keys to your kingdom: your credentials. T1003 - OS Credential Dumping is their weapon of choice to steal password hashes and sensitive authentication materials. They quietly harvest secrets to impersonate users, escalate privileges, and move … [Read more...] about Hunting with Elastic Security: Detecting credential dumping with ES|QL