Detection of Newly Observed Processes with High CPU Usage

This detection rule identifies suspicious host activity by monitoring for processes that exhibit sustained CPU usage exceeding 90 percent and have been observed for the first time within a 5-day window. This behavior is a common indicator of post-compromise resource hijacking, specifically unauthorized cryptomining or the execution of resource-intensive exploit payloads. By focusing on newly observed processes, the rule effectively filters out established system or application baseline behaviors.

Defenders should use this signal to surface potential indicators of host compromise where an attacker has introduced new tooling that significantly degrades system performance. While effective for detecting malicious resource abuse, this detection may also identify unexpected legitimate software deployments, requiring analysts to differentiate between intended performance degradation and malicious activity.

Impact

Successful resource hijacking can lead to significant degradation of system and application performance, increased operational costs, and the potential for a compromised host to be used as a platform for further network lateral movement or data exfiltration. If left unmitigated, these threats can persist across an enterprise environment, affecting server availability and increasing the risk of larger-scale security incidents.

Recommendation

Prioritized actions for detection and response teams:

• Deploy the Elastic Agent with the 'System' integration enabled to collect system.process and system.cpu metrics.
• Implement the provided ESQL detection logic to monitor for newly observed processes exceeding 90 percent CPU usage.
• Establish an investigative workflow to cross-reference identified processes against known-good baseline hash lists and expected binary paths.
• Monitor for process ancestry that links these high-CPU spikes to unauthorized child-process spawning or unexpected persistence mechanisms (services, scheduled tasks).
• Isolate hosts identified with confirmed malicious activity to prevent the spread of resource hijacking or further malicious payload delivery.