| Your decision | Backup platform role | Elastio |
|---|---|---|
| Keep and recover copies | Retain versions and restore systems and data. Immutability and recovery orchestration depend on the platform and configuration. | Analyze supported sources through cloud, storage, and backup connections. Keep your chosen platform responsible for retaining and restoring the copies. |
| Investigate a foothold | Security features differ. Rubrik Threat Hunting searches backup content with patterns, hashes, and YARA rules; other products use their own methods.[1] | Pursuit’s AI agents follow the mechanism through code and system records, including machine images before deployment. No Pursuit agent is installed on the inspected host. |
| Choose the next step | Recovery tooling uses its available threat findings and copy history. AWS Backup supports malware-aware selection for supported recovery points.[2] | Pursuit guides response and follow-up investigation. Hunt supplies data-analysis findings for recovery candidates. Your team restores and validates applications. |
Buyer’s guide / Backup security
Investigate the copies your recovery depends on.
Make compromise investigation part of everyday security. Pursuit investigates attacker footholds in supported images and snapshots before deployment, after remediation, and before recovery. Hunt examines live data, replicas, and backups for ransomware, malware, and corruption.
Security decisions / Supported by evidence
Add an investigation workflow to the copies you keep.
A retained copy preserves system state, including unwanted persistence. Elastio examines that state, explains the finding, and connects it to response. Backup security features vary: Rubrik, for example, provides YARA threat hunting, and AWS Backup offers malware protection.
Recorded Pursuit investigation / PacketBuffer
A startup script. A recurring secret-capture chain.
The recorded investigation links a persistent startup mechanism to code that captures TLS session secrets and writes them to a remote share.
- 01 / Persistence
Identify persistence.
Machine Group Policy Startup invokes
packet_buffer.ps1. - 02 / Code
Explain the behavior.
The script launches Frida with
tls.jsagainstlsass.exeto capture TLS secrets. - 03 / Corroboration
Connect the records.
A hidden scheduled job and Sysmon records support repeated execution of the chain.
Recorded findings F-001 and F-002. Historical execution is documented; the record does not establish current activity or a completed remediation.
Open the recorded investigation →Investigation → Response → Recovery
Put the finding to work.
Pursuit turns findings into a guided response plan. It investigates related systems, adapts the plan as results arrive, and examines replacement images and systems.
Your team reviews and executes containment, rebuild, and restore steps. Hunt’s analysis of the data and available copies informs the recovery decision.
A product demonstration of the evidence, response plan, and follow-up investigation.
Sources and scope · Reviewed October 10, 2026
Availability varies by product, edition, source, and deployment. The recorded case demonstrates Elastio’s investigation; it is not a head-to-head detection test.