Detection of Security Alerts Correlated with High CPU Utilization

This rule provides a mechanism for identifying malicious processes by correlating endpoint security alerts with system-level resource utilization data. By monitoring for processes that trigger security alerts while simultaneously consuming 70% or more of CPU cycles, security teams can distinguish between standard administrative alerts and potentially active threats, such as unauthorized cryptominers or exploit payloads that impose significant system load.

The detection requires the Elastic Agent 'System' integration to collect CPU metrics, which are then evaluated alongside existing security alerts in the Elastic Security index. This higher-order correlation helps reduce the noise associated with isolated security alerts by highlighting processes that are both suspicious and demonstrably active in a way that impacts host performance. The rule includes built-in filters for common high-resource benign processes such as ESET security agents and UiPath compiler tools.

Impact

Successful attacks involving high-resource abuse can lead to performance degradation of critical business systems, potential exfiltration of credentials during process injection, or unauthorized utilization of cloud compute resources. This detection helps identify these scenarios early, allowing for host isolation before broader compromise or resource exhaustion occurs.

Recommendation

• Deploy the Elastic Agent with the 'System' integration to all critical endpoints to collect host CPU metrics.
• Enable the 'system.cpu' and 'system.process' datasets in the integration policy to provide the necessary telemetry for high-CPU correlation.
• Utilize the provided detection logic to monitor for processes that concurrently generate a security alert and exceed 70% normalized CPU usage.
• Tune the detection by adding specific organizational baseline software that performs intensive but benign tasks to the exclusion list defined in the rule logic.
• Establish an automated response workflow to isolate hosts identified by this rule for forensic analysis if malicious activity is confirmed.