Skip to content
Threat Feed

Product

Windows Management Instrumentation (WMI)

1 brief RSS
low advisory

User Detected with Suspicious Windows Process(es)

A machine learning job combination has identified a user with one or more suspicious Windows processes exhibiting unusually high malicious probability scores, potentially involving LOLbins for defense evasion.

Elastic Defend +3 Domain: Endpoint OS: Windows Use Case: Living off the Land Attack Detection Rule Type: ML Rule Type: Machine Learning Tactic: Defense Evasion Resources: Investigation Guide defense-evasion
2r 2t