The 2024 Elastic Global Threat Report: Basic security settings are easily exploited by adversaries

Elastic, the Search AI Company, released its 2024 Elastic Global Threat Report, produced by Elastic Security Labs. Based on observations from over 1 billion data points, the report reveals adversary success from using offensive security tools (OSTs) — testing tools created to proactively identify security flaws — alongside misconfigured cloud environments and a growing emphasis on credential access.

“As a global platform used by more than 200 million people, we are committed to building the world’s most trusted visual communication platform for our community across the globe. The Elastic Global Threat Report is a great asset that ensures our threat detection stays laser-focused on real-world adversary activity,” said Raymond Schippers, Canvas Director of Security Engineering for Detection and Response. “Understanding the top adversary techniques in the cloud is critical, and unlike other vendor reports that simply drop a name, Elastic’s diamond models give us a fast, in-depth look at adversary movements, helping us stay ahead of the game.

Key findings in the report include:

Adversaries are utilising off-the-shelf tools

• Offensive security tools (OSTs), including Cobalt Strike and Metasploit, made up to around 54 percent of observed malware alerts
• Cobalt Strike accounted for 27 percent of malware attacks

Enterprises are misconfiguring cloud environments, allowing adversaries to thrive

• Nearly 47 percent of Microsoft Azure failures were tied to storage account misconfigurations
• Nearly 44 percent of Google Cloud users failed checks coming from BigQuery — specifically, a lack of customer-managed encryption
• S3 checks accounted for 30 percent of Amazon Web Services (AWS) failures — specifically a lack of multifactor authentication (MFA) being implemented by security teams

In the wake of successful counters for defense evasion, attackers are leaning into legitimate credentials to infiltrate

• Credential Access accounted for approximately 23 percent of all cloud behaviors, primarily in Microsoft Azure environments
• There was a 12 percent increase in Brute Force techniques — making up nearly 35 percent of all techniques in Microsoft Azure
• While endpoint behaviors accounted for around three percent of the total behaviors in Linux, 89 percent of them involved brute-force attacks
• There has been a six percent decrease in defense evasion behaviors over the last year

“The discoveries in the 2024 Elastic Global Threat Report reinforce the behavior we continue to witness: defender technologies are working. Our research shows a six percent decrease in Defense Evasion from last year,” said Jake King, Head of Threat and Security Intelligence at Elastic. “Adversaries are more focused on abusing security tools and investing in legitimate credential gathering to act on their objectives, which reinforces the need for organisations to have well-tuned security capabilities and policies.”