Skip to content
Threat Feed
Subscribe
low advisory

Unusual Process Detection for Windows Hosts via Machine Learning

An Elastic Security machine learning rule detects rare and unusual processes on individual Windows hosts, indicating potential unauthorized services, malware execution, or persistence mechanisms.

Elastic Security has developed a machine learning detection rule designed to identify unusual process activity on Windows hosts. This rule flags processes that are rarely observed on an individual host compared to its typical operational baseline, suggesting the presence of unauthorized software, malware, or illicit persistence mechanisms. The detection is crucial for identifying stealthy threats that deviate from established normal behavior, helping defenders uncover malicious activity that might otherwise go unnoticed. This rule utilizes an anomaly detection job, v3_rare_process_by_host_windows_ea, to analyze process execution patterns on Windows systems and requires either Elastic Defend or the Windows integration for data ingestion. The detection works by continuously learning what processes typically run on each host and highlighting significant deviations.

Impact

Successful execution of unauthorized services, malware, or persistence mechanisms, as indicated by this detection, can lead to various detrimental impacts including unauthorized data access, system compromise, lateral movement within the network, and establishment of long-term presence for further malicious activities like data exfiltration or ransomware deployment. The early detection of such anomalies can significantly reduce the dwell time of attackers and mitigate the overall damage to an organization's systems and data.

Recommendation

  • Deploy the Elastic Security rule "Unusual Process For a Windows Host" to your Elastic environment to leverage machine learning for anomaly detection.
  • Ensure Elastic Defend or the Windows integration is properly configured and collecting process_creation logs from all Windows endpoints as detailed in the "Setup" section.
  • Investigate alerts generated by the v3_rare_process_by_host_windows_ea machine learning job, focusing on the process execution chain, metadata (digital signatures, directory), user context, and command line arguments.
  • Analyze associated artifacts such as DNS cache entries ($osquery_0), registry modifications, and service entries ($osquery_1, $osquery_2, $osquery_3) for suspicious indicators using the provided Osquery commands.
  • Implement a robust process for triaging false positives, focusing on new legitimate software installations or scheduled, infrequent tasks, by adding specific exceptions preferably with a combination of user and command line conditions.