Detonating Beacons to Illuminate Detection Gaps

Elastic describes a detection engineering approach that leverages Beacon Object Files (BOFs), its internal Detonate service, and the Elastic AI Assistant to validate and enhance behavior detections. The process includes scraping and standardizing BOFs, automated detonation and result collection, and AI-generated query recommendations, demonstrated via examples such as port scanning, privilege escalation via SetThreadToken, ETW tampering, and registry-based persistence. The post highlights the limitations of log-reliant SIEMs for memory-only techniques and underscores the need for EDR visibility, along with practical challenges in building a scalable BOF testing pipeline.