Air-gapped environments isolate critical systems from the internet and less trusted networks to reduce exposure to external threats. However, isolation alone doesn’t eliminate security risks. Removable media, file transfers, and insider activity can still introduce threats into these environments. In 2010, the Stuxnet malware demonstrated how removable media can introduce threats into industrial networks. In […]

Detecting PHP2Shell remote code execution with Wazuh

REVSTEALER is a Windows information stealer that targets browser credentials, cryptocurrency wallets, gaming accounts, and other sensitive data. Researchers have documented its distribution through game-cheat lures and applications disguised as legitimate software. The malware uses environmental checks to evade sandbox analysis and may terminate when it detects specific regional locales. It also retrieves fallback command-and-control […]

Extended Berkeley Packet Filter (eBPF) is a Linux technology that allows sandboxed programs to run in the Linux kernel. The kernel manages system memory, running processes, and hardware resources. eBPF supports application performance monitoring, network traffic management, and security monitoring without requiring changes to the kernel source code. eBPF programs run when specific events occur. […]

Kubernetes workloads introduce security risks when deployed with excessive privileges, unsafe configurations, or settings that do not meet organizational requirements. Admission controls evaluate resource requests before Kubernetes creates or updates resources. These policy decisions provide useful security telemetry by identifying non-compliant workloads, rejected deployment attempts, and configuration changes. Kyverno is a Kubernetes-native policy engine that […]

Privilege escalation is the process by which an attacker gains permissions beyond those assigned to their current account. On Windows endpoints, threat actors who gain initial access as a standard user may exploit misconfigurations to obtain administrator or NT AUTHORITY\SYSTEM privileges. With elevated privileges, an attacker can disable security controls, access protected files, dump credentials, […]

Web application firewalls (WAFs) secure web applications by inspecting HTTP traffic and blocking malicious requests before they reach backend services. They help protect applications from attacks such as SQL injection, cross-site scripting (XSS), path traversal, command injection, and other threats covered by the OWASP Core Rule Set (CRS). Coraza is an open source WAF engine […]

Attackers often abuse legitimate Windows features and applications to execute malicious code, steal credentials, establish persistence, and evade security controls. Detecting these behaviors early helps security teams identify suspicious activity before it leads to further compromise. Microsoft Defender Attack Surface Reduction (ASR) rules help protect Windows endpoints by restricting behaviors commonly abused by malware and […]