Ruben Groenewoud

@RFGroenewoud

A security research engineer at @Elastic focusing mainly on Linux behavior-, signature- and ML-based detection engineering. Github: github.com/Aegrah

aegrah.github.io

Joined January 2022

324 Following

874 Followers

Replies Reposts Media

Pinned
Ruben Groenewoud
@RFGroenewoud
Aug 1, 2024
Very excited to release PANIX, a highly flexible Linux persistence tool for security research and detection engineering. Test your security posture and learn about Linux persistence. github.com/Aegrah/PANIX #DetectionEngineering #SecurityResearch #Persistence #Linux #Security
5
Ruben Groenewoud
@RFGroenewoud
Oct 21
Two unauthenticated PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619. Update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. On 8.1 and older, use a vendor backport or upgrade. The bugs are memory corruption in the engine. After code execution, it looks like any other PHP RCE:
php2shell: detecting PHP RCE before a public exploit exists
From elastic.co
Ruben Groenewoud
@RFGroenewoud
Sep 18
cups2root dropped after my Linux LPE detection blog. There was no cups2root-specific rule. The general layer still fired on my Ubuntu 26.04 lab run. Python to root. SUID/SGID abuse. A system-binary symlink into a writable path. Writeup and rules ↓
1
Ruben Groenewoud
@RFGroenewoud
Sep 15
I wrote about some Linux Detection Engineering research: detecting local privilege escalation. Instead of chasing individual CVEs, the framework detects the behaviors they tend to share: suspicious UID changes, unexpected SUID/SGID execution, user namespace creation, and more.
Linux Detection Engineering - Local Privilege Escalation
From elastic.co
1
Ruben Groenewoud
@RFGroenewoud
Sep 3
Fileless execution on Linux still leaves (a lot of) observable behavior. My latest research identifies five common patterns and maps each to the telemetry and detection rules that underlie them. Read it here ↓
Linux Detection Engineering - Fileless Execution
From elastic.co
2