Skip to content
Threat Feed
Subscribe

Product

Endpoint

1 brief RSS
low advisory

Unusual Process Spawned by a User Detected by ML

A machine learning job from Elastic's ProblemChild integration detects suspicious Windows processes, classified as malicious by a supervised ML model and anomalous due to unusual user contexts identified by an unsupervised ML model, indicating potential misuse of LOLbins or masquerading tactics for defense evasion.

problemchild +6 Endpoint Windows Elastic Defend Elastic Endgame Living off the Land Attack Detection ML Machine Learning Defense Evasion +1
2t