Elastic Security has introduced automated protections against Bring Your Own Vulnerable Driver (BYOVD) attacks. By continuously monitoring public disclosure sources like VirusTotal and LOLDrivers, Elastic now automatically generates and deploys YARA rules to block vulnerable drivers as soon as they are disclosed. This proactive approach closes the window of opportunity for attackers who exploit signed but flawed drivers to gain kernel-level access and disable security software, effectively shifting defense earlier in the attack lifecycle.
Additionally, the update introduces an Automatic Troubleshooting skill within the Elastic Agent Builder, allowing security teams to diagnose policy and performance issues using natural language. Elastic Defend has also expanded its coverage to include Windows on ARM, supporting Snapdragon and Copilot+ PCs. These enhancements collectively aim to reduce alert fatigue by improving prevention at the endpoint and streamlining management across diverse hardware environments.
Top comments (0)