Discover Elastic’s latest advancements in LLM security, focusing on standardized field integrations and enhanced detection capabilities. Learn how adopting these standards can safeguard your systems.

Introduction

Integrating LLM logs into Elastic

Vendor selection and API capabilities

Elastic AWS Bedrock model integration

Overview

Configuring integration data collection method

Collecting logs from S3 buckets

Collecting logs from CloudWatch

Integration installation

Configuring Bedrock Guardrails

The importance of ECS mappings

Broader Implications and Benefits of Standardization

Sample LLM-specific fields: AWS Bedrock use case

LLM detection engineering examples

Basic detection of sensitive content refusal

Potential denial of service or resource exhaustion attacks

Monitoring for latency anomalies

Advanced LLM detection engineering use cases

Malicious model uploads and cross-tenant escalation

Unauthorized URLs and external communication

Hierarchical instruction prioritization

Extended detections featuring additional Elastic rule types

Summary

Explore How Elastic's New LLM Security Strategies Enhance Detection, Standardization, and Protection Across the LLM Ecosystem

Elastic Advances LLM Security with Standardized Fields and Integrations

Elastic Security Labs is releasing an initial analysis of the XZ Utility backdoor, including YARA rules, osquery, and KQL searches to identify potential compromises.

Key Takeaways

The XZ / liblzma backdoor at a glance

Backdoor analysis

XZ backdoor build process:

Assessing impact:

Malware protection

Behavior Detection

Linux: the final frontier

500ms to midnight: XZ / liblzma backdoor

In this post, we cover next steps the Elastic Security team is taking for users to continue to protect themselves against CVE-2021-44228, or Log4Shell.

Elastic Security response

A new contender: CVE-2021-45046

Thank you (again!), from Elastic Security

References

Analysis of Log4Shell vulnerability & CVE-2021-45046

This blog post provides a summary of CVE-2021-44228 and provides Elastic Security users with detections to find active exploitation of the vulnerability in their environment. Further updates will be provided to this post as we learn more.

Summary of CVE-2021-44228 (Log4Shell)

Detecting Exploitation of Log4Shell in Elastic Security

Update: Detection & hunting improvements

Elastic Endgame EQL Queries

Community Detections

Additional Mitigation Strategies

Thank you, from Elastic Security.

Reference Material

Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security

Elastic Security is releasing detection logic for the Dirty Pipe exploit.

Preamble

What is Dirty Pipe (CVE-2022-0847)?

What is the impact?

What is Elastic doing about it?

Dirty Pipe Details

Linux Pipes & CVE-2022-0847

Proof Of Concept Code

Finding systems vulnerable to Dirty Pipe

Using the Elastic Security Integration

Using the Osquery Manager Integration

Detecting CVE-2022-0847 exploitation using Auditd

Auditd rules

Linux Auditing System event collection with Elastic

The Elastic Agent w/Auditd Integration

Auditbeat

Define audit rules here

Create file watches (-w) or syscall audits (-a or -A). Uncomment these

examples or add your own rules

Filebeat

Detecting Dirty Pipe with Elastic

Hunt queries in Kibana

Detection Engine alerts

Respond to Observed Threats

Defense in Depth Recommendations

Detecting and responding to Dirty Pipe with Elastic

Analysis of the HERMETICWIPER malware targeting Ukranian organizations.

Malware Wipers & Ukrainian Targets

Malware Stage Analysis

Interesting Functionality

Shredding Component Analysis

Driver Analysis

Prebuilt Detection Engine Alerts

YARA Rules

Observables

Artifacts

Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER

In this research piece, we explore BPFDoor — a backdoor payload specifically crafted for Linux in order to gain re-entry into a previously or actively compromised target environment.

Attack Lifecycle

Defense Evasion Insights

BPF Filters

Historical Analysis

Linux Malware Sophistication

Detection of BPFDoor

Existing Detection Rules

Hunting Queries

Interacting with BPFDoor

BPFDoor Scanner

BPFDoor Configuration Extractor

BPFDoor Client POC

Impact

Tactics

Techniques (sub-techniques)

Source Pseudocode

A peek behind the BPFDoor

Microsoft 365 Defender team released a post detailing several identified vulnerabilities. These vulnerabilities allow adversarial groups to escalate privileges on Linux systems, allowing for deployment of payloads, ransomware, or other attacks.

Detecting Nimbuspwn activity within Elastic

Defensive recommendations

Nimbuspwn: Leveraging vulnerabilities to exploit Linux via Privilege Escalation

The latest organization under the microscope of the LAPSUS$ group is Okta. Threat hunt for the recent breach targeting Okta users using these simple steps in Elastic

The LAPSUS$ group

The latest target: Okta

Threat hunting Okta logs in Elastic

event.module:"okta" AND event.action:"user.mfa.factor.reset_all"

event.module:"okta" AND event.action:"user.account.update_primary_email"

event.module:"okta" AND event.action:"user.account.privilege.grant"

event.module:okta AND (event.action:user.session.impersonation.grant OR event.action:user.session.impersonation.initiate)

Earlier events: Microsoft, Nvidia, Samsung, Ubisoft

Okta and LAPSUS$: What you need to know

作者

杰克·金

文章

Elastic 通过标准化字段和集成推进 LLM 安全性

午夜倒计时 500 毫秒：XZ / liblzma 后门

Log4Shell 漏洞和 CVE-2021-45046 分析

使用 Elastic Security 检测 CVE-2021-44228 (Log4j2) 的利用

使用 Elastic 检测和响应 Dirty Pipe

Elastic 防御针对乌克兰的数据擦除恶意软件：HERMETICWIPER

BPFDoor 背后的秘密

Nimbuspwn：利用漏洞通过特权升级来攻击 Linux

Okta 和 LAPSUS$：您需要了解的内容