The 2024 Elastic Global Threat Report: Basic Security Settings Are Easily Exploited by Adversaries

Rhea-AI Summary

Elastic (NYSE: ESTC) has released its 2024 Elastic Global Threat Report, revealing key cybersecurity trends based on over 1 billion data points. The report highlights three main findings:

1. Adversaries are heavily using offensive security tools (OSTs), with Cobalt Strike and Metasploit accounting for ~54% of observed malware alerts.

2. Cloud environment misconfigurations are creating vulnerabilities, with nearly 47% of Microsoft Azure failures tied to storage account misconfigurations and 44% of Google Cloud users failing BigQuery encryption checks.

3. Attackers are increasingly focusing on credential access, making up ~23% of all cloud behaviors, primarily in Microsoft Azure environments. There's also a 12% increase in Brute Force techniques.

The report notes a 6% decrease in Defense Evasion behaviors over the last year, suggesting that defender technologies are working but adversaries are adapting their strategies.

Positive

• Release of comprehensive 2024 Elastic Global Threat Report based on over 1 billion data points
• 6% decrease in Defense Evasion behaviors over the last year, indicating improved defender technologies

Negative

• Offensive security tools (OSTs) account for ~54% of observed malware alerts
• High rate of cloud environment misconfigurations, creating vulnerabilities
• 12% increase in Brute Force techniques, making up nearly 35% of all techniques in Microsoft Azure

Insights

Security Expert

The 2024 Elastic Global Threat Report reveals concerning trends in cybersecurity. The prevalence of offensive security tools (OSTs) in 54% of malware alerts, with Cobalt Strike alone accounting for 27%, indicates a shift towards easily accessible attack vectors. This trend is particularly worrying as it lowers the barrier for less sophisticated attackers.

Cloud misconfigurations present a significant vulnerability, with nearly half of Azure and Google Cloud users failing basic security checks. The 30% failure rate in AWS S3 bucket configurations, specifically lacking MFA, is a glaring weakness. These findings underscore the critical need for organizations to prioritize proper cloud security configurations and regular audits.

The 12% increase in brute force attacks, particularly in Azure environments, coupled with the focus on credential access, signals a shift in attacker strategies. This trend highlights the importance of robust authentication mechanisms and continuous monitoring of user activities.

Financial Analyst

For Elastic (NYSE: ESTC), this report serves as both a challenge and an opportunity. As a leader in search and analytics, Elastic's insights into global threat landscapes position it well in the cybersecurity market. However, the report's findings may also increase pressure on Elastic to enhance its own security offerings.

The widespread use of OSTs and cloud misconfigurations could drive demand for Elastic's security solutions, potentially boosting revenue. With a market cap of $7.87 billion, Elastic has the resources to capitalize on these trends by developing targeted products or expanding its security services.

Investors should watch for Elastic's response to these findings, such as new product announcements or strategic partnerships in cloud security. The company's ability to address these emerging threats could significantly impact its market position and financial performance in the cybersecurity sector.

Off-the-shelf offensive security tools and poorly configured cloud environments create openings in the attack surface

SAN FRANCISCO--(BUSINESS WIRE)-- Elastic (NYSE: ESTC), the Search AI Company, today released its 2024 Elastic Global Threat Report, produced by Elastic Security Labs. Based on observations from over 1 billion data points, the report reveals adversary success from using offensive security tools (OSTs) — testing tools created to proactively identify security flaws — alongside misconfigured cloud environments and a growing emphasis on credential access.

“As a global platform used by more than 200 million people, we’re committed to building the world's most trusted visual communication platform for our community across the globe. The Elastic Global Threat Report is a great asset that ensures our threat detection stays laser-focused on real-world adversary activity," said Raymond Schippers, Canva's Director of Security Engineering for Detection and Response. "Understanding the top adversary techniques in the cloud is critical, and unlike other vendor reports that simply drop a name, Elastic’s diamond models give us a fast, in-depth look at adversary movements, helping us stay ahead of the game.

Key findings in the report include:

Adversaries are utilizing off-the-shelf tools

• Offensive security tools (OSTs), including Cobalt Strike and Metasploit, made up ~54% of observed malware alerts
• Cobalt Strike accounted for 27% of malware attacks

Enterprises are misconfiguring cloud environments, allowing adversaries to thrive

• Nearly 47% of Microsoft Azure failures were tied to storage account misconfigurations
• Nearly 44% of Google Cloud users failed checks coming from BigQuery — specifically, a lack of customer-managed encryption
• S3 checks accounted for 30% of Amazon Web Services (AWS) failures — specifically a lack of multifactor authentication (MFA) being implemented by security teams

In the wake of successful counters for Defense Evasion, attackers are leaning into legitimate credentials to infiltrate

• Credential Access accounted for ~23% of all cloud behaviors, primarily in Microsoft Azure environments
• There was a 12% increase in Brute Force techniques — making up nearly 35% of all techniques in Microsoft Azure
• While endpoint behaviors accounted for ~3% of the total behaviors in Linux, 89% of them involved brute-force attacks
• There has been a 6% decrease in Defense Evasion behaviors over the last year

“The discoveries in the 2024 Elastic Global Threat Report reinforce the behavior we continue to witness: defender technologies are working. Our research shows a 6% decrease in Defense Evasion from last year,” said Jake King, head of threat and security intelligence at Elastic. “Adversaries are more focused on abusing security tools and investing in legitimate credential gathering to act on their objectives, which reinforces the need for organizations to have well-tuned security capabilities and policies. “

Additional Resources

• Download the report to obtain actionable recommendations to address these findings
• Read the blog

About the Report

The 2024 Elastic Global Threat Report is a summary of observations distilled down to a small number of distinct categories. Analyzed with the Elastic Search AI Platform, Elastic telemetry, public, and third-party data is voluntarily submitted to Elastic Security Labs to surface threats. These observations are compiled from more than one billion data points over the last 12 months. All information has been responsibly sanitized where applicable to protect the identities of those involved.

About Elastic

Elastic (NYSE: ESTC), the Search AI Company, enables everyone to find the answers they need in real-time using all their data, at scale. Elastic’s solutions for search, observability and security are built on the Elastic Search AI Platform, the development platform used by thousands of companies, including more than 50% of the Fortune 500. Learn more at elastic.co.

Elastic and associated marks are trademarks or registered trademarks of Elastic N.V. and its subsidiaries. All other company and product names may be trademarks of their respective owners.

View source version on businesswire.com: https://www.businesswire.com/news/home/20241001922181/en/

Media Contact

Elastic PR

PR-team@elastic.co

Source: Elastic N.V.

FAQ

What are the key findings of Elastic's 2024 Global Threat Report?

The key findings include: 1) Increased use of offensive security tools by adversaries, 2) Cloud environment misconfigurations creating vulnerabilities, and 3) Growing focus on credential access by attackers, especially in Microsoft Azure environments.

How much of observed malware alerts were attributed to offensive security tools (OSTs) according to Elastic's report?

According to the report, offensive security tools (OSTs), including Cobalt Strike and Metasploit, made up approximately 54% of observed malware alerts.

What percentage of cloud behaviors were attributed to Credential Access in Elastic's 2024 report?

The report states that Credential Access accounted for approximately 23% of all cloud behaviors, primarily in Microsoft Azure environments.

Has there been an increase or decrease in Defense Evasion behaviors according to Elastic's (ESTC) latest threat report?

Elastic's 2024 Global Threat Report indicates a 6% decrease in Defense Evasion behaviors over the last year, suggesting that defender technologies are working effectively.