An Elastic approach to large-scale dynamic malware analysis

Elastic Security Labs presents a workflow for large-scale dynamic malware analysis using the Detonate sandbox and chained Elasticsearch ingest pipelines to normalize events, compute fingerprints, create enrich policies of known benign telemetry, and filter noise; they provide automation scripts and report that after detonating 332 samples the pipeline reduced benign/duplicate telemetry by ~96.8% while exposing malicious behaviors such as ransomware file activity and C2 connection attempts.