At Elastic Security Labs, together with Eric Forte and Samir Bousseaden, we analyzed the Linux kernel privilege escalation vulnerabilities Copy Fail (CVE-2026-31431), Copy Fail 2, and DirtyFrag. These issues exploit subtle page cache corruption bugs to create reliable paths to root access, using legitimate kernel …

In the second part of our two-part Linux rootkit series at Elastic Security Labs, Remco Sprooten and I turn from theory to detection engineering. We begin by demonstrating why static detection is often unreliable against Linux rootkits—even trivial modifications like stripping binaries or appending a single null byte …

At Elastic Security Labs, I published a real-world walkthrough of TeamPCP's multi-stage container compromise, demonstrating how Elastic's Defend for Containers (D4C) surfaces runtime signals across each stage of the attack chain. Rather than analyzing isolated techniques in abstraction, we follow the attack as it …

At Elastic Security Labs, I published a comprehensive walkthrough of Elastic's Defend for Containers (D4C) integration, covering Kubernetes-based deployment, BPF-enriched runtime telemetry analysis, and the practical application of policy-driven security controls for containerized Linux environments. Defend for …

In the fifth and final part of the Linux Persistence Detection Engineering series, we bring the journey to its grand finale by exploring some of the most obscure, creative, and complex persistence mechanisms. Building on the foundational concepts covered in previous publications, this final installment focuses on …

In the fourth part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment delves into additional creative and complex methods adversaries use to maintain persistence on Linux …

In the third part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment dives into more creative and complex persistence methods, providing security researchers and defenders …

At Elastic, we recognize the critical need for securing containerized applications in Kubernetes and cloud environments. To enhance runtime security, we’ve integrated Falco—an open-source cloud-native security tool—directly with Elastic Security. Falco leverages Linux kernel events and plugins to detect abnormal …

At Elastic Security Labs, we analyzed a critical set of vulnerabilities in the CUPS printing system, disclosed by security researcher Simone Margaritelli (@evilsocket) on September 26, 2024. These flaws, affecting CUPS versions ≤ 2.0.1, enable unauthenticated remote attackers to achieve remote code execution (RCE) via …

In this second part of the Linux Persistence Detection Engineering series, I explore the world of more advanced Linux persistence techniques. This part builds upon the knowledge obtained from the previous persistence blog dubbed "Linux Detection Engineering - A Primer on Persistence Mechanisms". This sequel …