Network Packet Capture

Elastic's machine learning job, utilizing the ProblemChild supervised model and unsupervised techniques, detects Windows hosts exhibiting clusters of suspicious processes with unusually high malicious probability scores, often indicative of defense evasion through Living Off The Land Binaries (LOLbins) and masquerading techniques.

Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.

Elastic's machine learning job identifies potential data exfiltration activity to unusual geo-locations by detecting anomalies in network traffic patterns, indicating adversaries leveraging command and control channels to transfer data outside normal organizational patterns.

Elastic's machine learning rule detects potential data exfiltration by identifying anomalous network traffic, specifically large data transfers to unusual geo-locations via IP addresses, indicating possible exfiltration over command and control channels.

This Elastic machine learning rule detects anomalous network activity originating from Linux processes that typically do not engage in network communication, signifying potential command-and-control, lateral movement, persistence, or data exfiltration activity, often via process exploitation or injection.

An Elastic machine learning rule detects unusual user logon times, which can indicate credential compromise or unauthorized access, particularly when attackers operate from different time zones or during non-business hours, prompting investigation into the affected user account and related activities.