The #linux detection engineering saga continues! Breakdown persistence techniques both simple and complex in this new article from Ruben Groenewoud: go.es.io/3X6w7k9 #ElasticSecurityLabs #detectionengineering

Our latest research details a Gatekeeper bug we reported to Apple that affects Launch Services. While exploring this issue, we also found ways to bypass Gatekeeper using the “The Unarchiver”, a popular archiving application on macOS. Check out our blog: jamf.com/blog/gatekeepe…

Loader (sha256: 3bddd457ef5e29f9213a1853cebb315a179145a7a6f3cf83dafe838b02d1ce4a) gets and runs the stealer (sha256: c1b3a35ebcf757f2b1fa06d73e145720373d4bcb13dfc3a186f4264005b21838). But alas, it's not #AMOS, I think it's a new version of #Banshee.

very good analysis #Elastic Defend OOTB coverage of DWM CVE-2024030051 (ITW LPE)