CYBERSECURITYTRACKER
Permanent story citation

Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7893

As cited

Copy frozen at (site build).

research

Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks

Elastic Security 8.11 incorporates kernel telemetry call stack-based detections to improve identification of in-memory threats. The enhancement leverages Event Tracing for Windows (ETW) kernel data to strengthen detection capabilities.

Why it matters: Security teams using Elastic can better identify sophisticated attacks that operate entirely in memory without touching disk, reducing the window for detection evasion.

Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary