elastioSearchRequest a demo

Search platform and solution pages, partners, blog posts, events, webinars, FAQs, and ransomware families.

Elastio Pursuit / Agentic Compromise Investigation

Investigate system compromises.

Elastio AI follows leads through code and system records to investigate attacker access, persistence, and credential theft. Turn the findings into a guided response plan, with source evidence and follow-up investigations. No agent on the inspected host.

Request a demo

Know what to remove and why.

Pursuit connects each finding to the code and system records behind it. Responders can review the assessment, confidence, and source evidence before deciding what to remediate.

In this recorded investigation, Windows accessibility programs magnify.exe and sethc.exe were configured to launch cmd.exe. The report identifies the backdoor mechanism and distinguishes it from expected system activity.

Pursuit turns the finding into an ordered response plan. Your team reviews and executes containment and recovery steps; Pursuit investigates related systems and new snapshots to inform what happens next.

Keep compromised images out of production.

Machine images are part of your software supply chain. A compromised image can give new systems attacker access from startup.

Pursuit examines machine images for malicious code, persistence, and exposed credentials before deployment, without starting them.

42 of 500 public marketplace machine images carried malicious persistence in Elastio’s 2026 research. Systems built from a compromised image can inherit the attacker’s access.

Review the research evidence

If an image is compromised, trace the systems launched from it and the launch configurations that still reference it. Use each system's findings to assess the impact.

Pursuit / Guided response

Turn the finding into a response plan.

Pursuit builds an ordered plan around the image, VM, or snapshot under investigation. Investigate related systems, follow guidance to contain the threat and preserve evidence, and plan the rebuild or recovery. As new findings emerge, the plan changes with them.

Pursuit runs the investigations and provides steps and scripts for your team to review and execute. Follow-up investigations examine replacement systems and images. Findings, recorded actions, and ownership stay together.

Explore a response plan · illustrative workflow

A compromised image can reach more than one system.

  1. Pursuit investigates systems derived from the image to determine which have evidence of compromise.

  2. Your team acts on guidance to stop new launches, contain affected systems, and preserve forensic copies.

  3. Your team rebuilds the image and affected systems. Pursuit investigates the replacements.

Image lineage defines where to investigate; it does not make every related VM a confirmed compromise.

Recorded completion of a customer step is distinct from a follow-up investigation result. Containment, credential changes, and restores remain actions your team reviews and executes.

Investigate outside the compromised system.

  1. Follow the lead.

    AI agents connect a suspicious setting to the code, credentials, files, and system records behind it.

  2. Test the explanation.

    The investigation examines behavior and seeks corroborating evidence, including recorded activity when it is present in the copy.

  3. Explain the finding.

    Review the assessment, source evidence, confidence, and remaining uncertainty. Add context about approved tools and expected activity.

What does persistence mean?

MITRE ATT&CK describes persistence as maintaining a foothold despite disruptions such as restarts or changed credentials. It includes startup mechanisms and valid-account access; it does not always require a startup change on the target machine.

Analysis runs on a read-only snapshot outside the running system. No Pursuit agent runs on the host for an attacker to disable.

You choose the model endpoint: Amazon Bedrock, Microsoft Foundry, or OpenAI. Pursuit’s agents use language models through that endpoint to investigate the evidence.

Run Pursuit where your systems run. Windows is supported today on AWS, Azure, and VMware. GCP support is planned for late October 2026. Linux support is planned by January 2027.

  1. HostNo Pursuit agent installed.

  2. Off-hostOutside the inspected host

    1. SnapshotRead-only system copy.
    2. PursuitAgentic investigation
  3. EvidenceFindings linked to source records.
Explore the investigation overview

See which systems need your response.

The product view brings hosts, severity, and first-detection times together. Open each assessment to review the evidence window and determine what needs a response. A first-detection time does not establish that activity is occurring now.

See where to investigate next. The timeline shows when compromise was first detected on each host. Use the underlying evidence to investigate whether the attacker moved between systems.

Give responders the evidence to act. Open a host’s assessment and findings to decide what to contain and remediate through your existing controls.

See response integrations

Explore recorded backdoor and script findings
Recorded investigations

Find malicious code without a known signature.

Pursuit analyzes what the machine is configured to run and investigates the code behind it.

HIGH · WINDOWS SERVER 2022

Find the backdoor and what keeps it running.

A custom backdoor on a domain controller posed as the Windows print spooler.

Evidence fields · recorded backdoor finding

Binary
spoolserver.exe
Size
6,144 bytes, custom-compiled .NET
Launched by
Scheduled task \fakespool, At Boot
Runs as
NT AUTHORITY\SYSTEM
Behavior
Named-pipe server posing as the print spooler
  • T1053.005 · Scheduled task
  • T1036.004 · Masquerading

Responders see both the program and the task that preserves access.

CRITICAL · WINDOWS SERVER 2019

Connect the scripts to secret harvesting.

Pursuit connected a startup task, custom scripts, LSASS injection, and the traffic-capture destination.

Evidence fields · recorded script finding

Script
packet_buffer.ps1
Script
tls.js
Launched by
Scheduled task \PacketBuffer, AtStartup
Behavior
frida.exe injects tls.js into lsass.exe to harvest TLS secrets
Capture
dumpcap.exe captures traffic
  • T1055 · Process injection
  • T1040 · Network sniffing

One finding connects the startup mechanism to the code and its behavior.

Explore the recorded backdoor finding

A custom backdoor posed as the print spooler.

Pursuit connected the suspicious binary to its startup mechanism.

Recorded finding · Windows Server 2022 domain controller

Assessment
High
Binary
spoolserver.exe
Size
6,144 bytes
Type
Custom-compiled .NET
Behavior
Named-pipe server posing as the print spooler

Recorded evidence walkthrough. The steps illustrate the response decision; they do not execute actions.

Review credential examples and their sources
Credentials

Find stolen secrets and exposed credentials.

See the code, tools, and stored credentials that could give an attacker access to other systems.

CRITICAL

TLS secrets harvested from LSASS.

The PacketBuffer finding connects frida.exe, tls.js, and dumpcap.exe to secret harvesting and traffic capture.

Secret theft behavior

HIGH

Attack tools inside nested archives.

Pursuit opened nested ZIP files and found Mimikatz and Rubeus in the recorded test set.

Concealed credential-theft tooling

MEDIUM

Administrator password in plain text.

aws-ec2-windows-password-update.ps1 passed a fixed password to net.exe user Administrator.

Credential exposure · T1552.001

Explore observed techniques
Observed attacker techniques

Techniques Pursuit finds.

Pursuit connects code, startup settings, and system records to identify how attackers maintain access, weaken defenses, steal credentials, and move data. Above the waterline are nine technique examples from seven machines. Below it are the broader tactics observed across 42 malicious public marketplace images.

Found on the machines in this deck

  • Sticky Keys logon backdoorT1546.008
  • Scheduled task at bootT1053.005
  • Defender and firewall offT1562.001, T1562.004
  • Injection into LSASST1055
  • Traffic capture to a shareT1040
  • Vulnerable driver as a serviceT1543.003, T1068
  • Email out through GmailT1048
  • Credentials in scriptsT1552.001
  • Posing as the print spoolerT1036.004

Tactics found in 42 malicious images over thousands of analyses

  • Persistence
  • Privilege escalation
  • Defense evasion
  • Credential access
  • Discovery
  • Lateral movement
  • Collection
  • Command and control
  • Exfiltration
Recorded findings above the waterline. Attacker tactics observed across the malicious-image analyses below it. Source: Elastio’s 2026 workshop investigations.
Review a low-suspicion assessment and its limits

Show the evidence when no attack is found.

Pursuit records what it checked and why the evidence supports its assessment. Your team can review expected system activity as well as suspicious findings.

For EC2AMAZ-897VQUN, Pursuit returned low suspicion, medium confidence. The report records expected Windows services, scheduled tasks, and startup settings. It found no validated attacker-controlled persistence.

The PowerShell entries did not have supporting evidence of a malicious command or persistence mechanism. Pursuit did not treat those entries alone as an attack. Process and Prefetch records were empty, and Amcache contained no records. Those limits matter when interpreting the result.

A copy made before encryption can still contain attacker persistence. Review both Pursuit and Hunt results for the same supported copy, with the completed checks, scope, and analysis time recorded.

A low-suspicion Pursuit assessment is one part of that evidence. Review Hunt’s result for the same copy and the system’s recovery requirements.

Explore Hunt

Review a Pursuit investigation and its source evidence on your systems.

Request a demo