Machine Learning — CraftedSignal Threat Feed

Unusual Spike in Bytes Written to External Device Detected by Machine Learning

hello@craftedsignal.io — Thu, 02 Apr 2026 12:00:00 +0000

The Data Exfiltration Detection integration, part of the Elastic Security suite, includes a machine learning job designed to detect anomalies in data transfer patterns to external devices. This job, named “ded_high_bytes_written_to_external_device,” identifies unusual increases in the amount of data written to external devices, which could indicate data exfiltration attempts. The system establishes a baseline of normal activity and flags deviations from that baseline, operating on a 15-minute interval and examining data from the preceding two hours. While this rule is intended to detect malicious data exfiltration, legitimate activities like backups, software updates, archiving, and media creation can trigger false positives. The rule is enabled via the Data Exfiltration Detection integration.

Attack Chain

The attacker gains initial access to a system via compromised credentials or other means.
The attacker enumerates sensitive data on the compromised system.
The attacker stages the data for exfiltration, possibly compressing or archiving it.
The attacker connects an external device (e.g., USB drive) to the system.
The attacker initiates a large data transfer to the external device.
The Data Exfiltration Detection machine learning job detects a significant increase in bytes written to the external device, triggering an alert.
The attacker removes the external device containing the exfiltrated data.
The attacker uses the external device to access the stolen data.

Impact

A successful data exfiltration event can result in the loss of sensitive information, potentially leading to financial losses, reputational damage, legal repercussions, and competitive disadvantage. Although the specific number of victims and targeted sectors are not specified, the potential impact is broad, affecting any organization that stores sensitive data on systems accessible to malicious actors. The severity depends on the nature and volume of the exfiltrated data.

Recommendation

Review and tune the Data Exfiltration Detection integration’s configuration, specifically the “ded_high_bytes_written_to_external_device” machine learning job, to reduce false positives related to legitimate data transfer activities.
Implement and enforce data transfer policies to restrict the unauthorized use of external devices and ensure compliance with organizational security standards.
Deploy endpoint detection and response (EDR) solutions to enhance visibility and control over data movements to external devices, as recommended in the rule’s response and remediation guidance.
Investigate any alerts generated by the “Spike in Bytes Sent to an External Device” rule (rule_id: “35a3b253-eea8-46f0-abd3-68bdd47e6e3d”) to determine the legitimacy of the data transfer and take appropriate action.
Consult the investigation guide provided in the rule’s notes section to aid in the triage and analysis of potential data exfiltration incidents.

Potential Data Exfiltration to Unusual Geographic Region via Machine Learning

hello@craftedsignal.io — Thu, 02 May 2024 10:00:00 +0000

This alert is triggered by a machine learning job, ded_high_sent_bytes_destination_region_name_ea, that detects data exfiltration to unusual geographical regions based on network traffic patterns. The Data Exfiltration Detection integration, including Elastic Defend and Network Packet Capture, is required for this detection to function. This integration analyzes network and file events to identify abnormalities in data transfer volumes to different geographical locations, specifically by region name. Anomalous traffic patterns, particularly those involving high volumes of data being sent to regions outside the organization’s typical network activity, could indicate malicious actors attempting to exfiltrate sensitive data via command and control channels. This detection provides defenders with an early warning of potential data breaches. Version requirements: Elastic Stack version 9.4.0 or later is required to leverage the Entity Analytics (EA) fields.

Attack Chain

Initial Access: An attacker gains initial access to a system within the network through various means, such as exploiting a vulnerability or using compromised credentials.
Command and Control: The attacker establishes a command and control (C2) channel to communicate with the compromised system.
Data Collection: The attacker identifies and collects sensitive data from various sources within the network.
Staging: The collected data is staged in a temporary location, compressed, and potentially encrypted for exfiltration.
Exfiltration: The attacker uses the C2 channel to transfer the staged data to an external location in an unusual geographic region.
Evasion: The attacker may attempt to obfuscate the data transfer by using techniques such as tunneling or encryption to avoid detection.
Cleanup: The attacker may attempt to remove traces of their activity, such as deleting logs or files, to hinder investigation.

Impact

A successful data exfiltration attack can result in the loss of sensitive information, including intellectual property, customer data, and financial records. The risk score for this rule is 21, which indicates a moderate level of risk. Detection of this activity allows security teams to quickly respond and mitigate the potential damage. Early detection helps prevent large-scale data breaches and minimizes the impact on the organization.

Recommendation

Ensure that the Data Exfiltration Detection integration assets are installed and properly configured, including Elastic Defend and Network Packet Capture (see Setup instructions in content).
Review the geo-location details flagged by the alert to determine if the region is indeed unusual for the organization’s typical network traffic patterns (see Triage and Analysis in content).
Analyze the network traffic logs associated with the alert to identify the volume and type of data being transferred to the unusual region (see Triage and Analysis in content).
Implement geo-blocking measures to restrict data transfers to the identified unusual region, ensuring that only approved regions can communicate with the network (see Response and Remediation in content).
Deploy the Sigma rule below to detect processes initiating network connections to unusual regions based on the DestinationGeoRegion field.

Unusual Remote File Size Indicating Lateral Movement

hello@craftedsignal.io — Tue, 30 Apr 2024 10:00:00 +0000

This detection leverages machine learning to identify unusual remote file sizes, a tactic often used during lateral movement. After gaining initial access, adversaries frequently aim to locate and exfiltrate valuable data. To avoid raising alarms with numerous small transfers, they may consolidate data into a single large file. This rule, built upon the Elastic Lateral Movement Detection integration, specifically uses the lmd_high_file_size_remote_file_transfer_ea machine learning job. The integration requires the host.ip field to be populated and Elastic Defend to be properly configured. This detection is critical for organizations seeking to identify and prevent data exfiltration attempts early in the attack lifecycle. The integration assets must be installed and file and Windows RDP process events collected by Elastic Defend.

Attack Chain

Initial Access: An attacker gains access to a host within the network, potentially through compromised credentials or exploitation of a vulnerability.
Discovery: The attacker performs reconnaissance to identify valuable data stores, network shares, and potential exfiltration targets.
Collection: The attacker gathers sensitive data from various sources within the compromised network. This data could include documents, databases, or other confidential information.
Data Consolidation: To avoid detection, the attacker bundles the collected data into a single, large file. This could involve archiving, compression, or other methods of aggregation.
Lateral Tool Transfer: The attacker uses remote services or tools to transfer the large file to a remote host within the network (T1570).
Exfiltration Preparation: The attacker stages the large file on the remote host, preparing it for exfiltration outside the network.
Exfiltration: The attacker initiates the transfer of the large file from the compromised network to an external destination, potentially using protocols like RDP.
Cleanup: The attacker attempts to remove traces of the activity, such as deleting temporary files or logs, to avoid detection.

Impact

A successful attack can lead to the exfiltration of sensitive data, potentially resulting in financial loss, reputational damage, and legal liabilities. The detection of unusual remote file sizes can help organizations identify and prevent data exfiltration attempts before they cause significant harm. Depending on the sensitivity of the exfiltrated data, the impact could range from minor inconvenience to a major security breach affecting thousands of individuals or customers.

Recommendation

Ensure the host.ip field is populated as required by the rule. For Elastic Defend versions 8.18 and above, verify that host IP collection is enabled following the provided helper guide.
Install the Lateral Movement Detection integration assets, including the lmd_high_file_size_remote_file_transfer_ea machine learning job. Follow the setup instructions detailed in the documentation.
Review and tune the anomaly threshold (anomaly_threshold = 70) of the machine learning job based on your environment’s baseline to reduce false positives.
Implement network segmentation to limit lateral movement, as suggested in the “Response and remediation” section of the rule documentation.
Enhance monitoring and logging for unusual file transfer activities and remote access attempts as stated in the rule documentation.

Unusually High Mean of RDP Session Duration Detected by Machine Learning

hello@craftedsignal.io — Wed, 24 Jan 2024 18:10:00 +0000

This threat brief addresses the detection of unusually long Remote Desktop Protocol (RDP) sessions, identified by a pre-built Elastic machine learning job named lmd_high_mean_rdp_session_duration_ea. Attackers can abuse RDP for lateral movement and maintaining persistence within a network. Extended RDP sessions can also be used to evade detection mechanisms. This detection leverages machine learning to identify deviations from normal RDP session durations, potentially indicating malicious activity. The detection rule has been available since October 2023, and the corresponding ML job is part of the Lateral Movement Detection integration, requiring Elastic Stack version 9.4.0 or later. The rule depends on the host.ip field to be populated, which may require enabling host IP collection in Elastic Defend versions 8.18 and above.

Attack Chain

An attacker gains initial access to a system within the network, possibly through phishing or exploiting a public-facing application.
The attacker leverages valid credentials or exploits a vulnerability to establish an RDP connection to a target system.
The RDP session is maintained for an extended period, significantly longer than typical RDP sessions within the environment.
During the prolonged RDP session, the attacker performs reconnaissance, gathering information about the network and target systems.
The attacker moves laterally to other systems within the network, using the established RDP session as a persistent access point.
The attacker executes malicious commands or transfers files, potentially installing malware or exfiltrating sensitive data.
The unusually long RDP session duration helps the attacker to remain undetected and evade security measures.
The attacker achieves their final objective, such as data theft, system compromise, or ransomware deployment.

Impact

Successful exploitation and undetected lateral movement via prolonged RDP sessions can lead to significant data breaches, system compromise, and financial loss. The impact includes potential theft of sensitive information, disruption of business operations, and reputational damage. If an adversary establishes a persistent foothold via RDP, they can maintain long-term access to the compromised environment.

Recommendation

Ensure host.ip field is populated by enabling host IP collection if using Elastic Defend versions 8.18 and above, as described in the helper guide.
Install and configure the Lateral Movement Detection integration in Kibana as described in the setup guide.
Tune the machine learning job lmd_high_mean_rdp_session_duration_ea by adjusting the anomaly_threshold based on your environment and RDP usage patterns.
Investigate triggered alerts from the “High Mean of RDP Session Duration” rule following the triage and analysis guide.
Monitor Windows RDP process events collected by the Elastic Defend integration for suspicious activity.

Unusual Process Spawned by a Parent Process via Machine Learning

hello@craftedsignal.io — Tue, 23 Jan 2024 12:00:00 +0000

This alert originates from an Elastic machine learning job named problem_child_rare_process_by_parent_ea designed to detect Living off the Land (LotL) attacks on Windows systems. The model identifies processes spawned by parent processes that are statistically rare and have a high probability of being malicious based on the “ProblemChild” supervised learning model. This approach aims to uncover malicious activities that utilize legitimate system binaries (LOLbins) for nefarious purposes, effectively bypassing traditional signature-based detections. The alert relies on Windows process events collected by Elastic Defend or Winlogbeat with the LotL Attack Detection integration. This detection method becomes particularly important as attackers increasingly rely on existing tools to blend in with normal system activity and avoid raising suspicion.

Attack Chain

Attacker gains initial access via unspecified means (e.g., phishing, compromised credentials).
Attacker leverages a legitimate system binary (LOLbin) such as powershell.exe or cmd.exe.
The LOLbin is used to execute a malicious payload or script.
The malicious process is spawned as a child process of the LOLbin.
Elastic’s machine learning model identifies the child process as rare and potentially malicious based on its parent-child relationship and other features.
The rare process executes malicious commands, possibly downloading further payloads.
The attacker achieves their objective, such as data exfiltration or lateral movement.

Impact

A successful attack utilizing LOLbins can lead to significant compromise, including data theft, system disruption, and further propagation within the network. The reliance on trusted system binaries makes these attacks difficult to detect with traditional methods, potentially allowing attackers to operate undetected for extended periods. The impact is directly correlated to the privileges of the initial compromised account and the effectiveness of lateral movement techniques employed by the attacker.

Recommendation

Ensure that the Living off the Land (LotL) Attack Detection integration is installed and configured correctly, along with either Elastic Defend or Winlogbeat, as described in the rule’s setup section.
Review the parent and child process names identified in the alert to determine if they are legitimate applications or associated with LOLbins, as detailed in the investigation guide within the rule’s note section.
Investigate the command-line arguments used by the suspicious process for potentially malicious commands or scripts as described in the rule note section.
Tune the anomaly_threshold setting in the machine learning job configuration based on your environment’s baseline activity to reduce false positives, as described in the rule documentation.
Implement exceptions for legitimate administrative tools and software updates to reduce false positives, as mentioned in the rule’s note section.

Unusual Remote File Directory Lateral Movement Detection

hello@craftedsignal.io — Mon, 22 Jan 2024 12:00:00 +0000

This detection identifies potential lateral movement within a network by flagging unusual remote file transfers to directories that are not commonly monitored. Attackers often leverage less scrutinized file paths to evade standard security measures and deploy malicious payloads. This detection relies on the “lmd_rare_file_path_remote_transfer_ea” machine learning job within Elastic Security, which analyzes file and Windows RDP process events to identify anomalous file transfers based on the destination directory. The detection is part of the Lateral Movement Detection integration and requires Elastic Defend and Fleet for full functionality. This is important for defenders because attackers will try to blend in with normal file transfer activity by using uncommon directories.

Attack Chain

The attacker gains initial access to a system within the network (e.g., via phishing or exploitation of a vulnerability).
The attacker identifies a target host for lateral movement.
The attacker uses a remote service (e.g., RDP, SMB) to connect to the target host.
The attacker attempts to transfer malicious files to the target host.
Instead of using common directories like “C:\Windows\Temp” or “C:\ProgramData”, the attacker chooses a less monitored directory to evade detection.
The remote service is leveraged to perform the file transfer to the atypical directory.
The transferred file is then executed, potentially leading to command execution or privilege escalation.
The attacker achieves their objective (e.g., data exfiltration, ransomware deployment) on the target host.

Impact

A successful attack can lead to unauthorized access to sensitive data, compromise of critical systems, and potential disruption of business operations. Although this detection is rated as low severity, successful lateral movement can lead to significant damage. The number of affected hosts and the severity of the impact depends on the attacker’s objectives and the organization’s security posture. Lateral movement allows attackers to gain a deeper foothold within the network and increase the scope of their malicious activities.

Recommendation

Ensure the host.ip field is populated in Elastic Defend events by following the configuration steps in the Elastic documentation.
Install the Lateral Movement Detection integration assets as described in the setup instructions.
Tune the anomaly_threshold in the machine learning job configuration based on your environment’s baseline activity to minimize false positives, as mentioned in the rule’s configuration.
Investigate any alerts generated by this rule, paying close attention to the source and destination IP addresses, the user account involved, and the specific directory used for the file transfer as outlined in the triage and analysis section.

ProblemChild ML Detection of Suspicious Windows Processes

hello@craftedsignal.io — Mon, 22 Jan 2024 12:00:00 +0000

The Elastic ProblemChild integration leverages machine learning to identify suspicious Windows process clusters associated with specific users. This detection focuses on processes flagged as malicious by a supervised ML model, further refined by an unsupervised ML model that identifies unusually high aggregate scores within process clusters. This combination aims to detect activity that may evade traditional signature-based detections, such as the use of Living-off-the-Land Binaries (LOLbins) for masquerading. The models are trained to identify processes exhibiting characteristics indicative of malicious intent, making it possible to expose attackers using legitimate system tools for malicious purposes. The integration requires Windows process events collected by Elastic Defend or Winlogbeat and the Living off the Land (LotL) Attack Detection integration assets to be installed.

Attack Chain

An attacker gains initial access to a Windows system.
The attacker attempts to execute malicious commands using LOLbins (e.g., PowerShell, cmd.exe, mshta.exe).
These processes are spawned with potentially obfuscated or unusual command-line arguments to evade basic detection.
The ProblemChild supervised ML model analyzes process characteristics and assigns a malicious probability score.
An unsupervised ML model aggregates the scores of related processes associated with the same user, identifying unusually high clusters.
The rule triggers based on the combined supervised and unsupervised ML scores, indicating a high likelihood of malicious activity.
The attacker may attempt to use masquerading techniques to further disguise their actions by renaming files or using legitimate process names.
The ultimate goal could be data exfiltration, lateral movement, or establishing persistence on the compromised system.

Impact

A successful attack leveraging LOLbins and masquerading techniques can lead to significant damage, including data breaches, system compromise, and disruption of services. The use of legitimate tools makes detection challenging, potentially allowing attackers to operate undetected for extended periods. While the number of victims and specific sectors are unknown, any organization running Windows systems is potentially vulnerable. The impact of a successful attack depends on the attacker’s objectives but can range from minor data theft to complete system takeover.

Recommendation

Ensure the Living off the Land (LotL) Attack Detection integration assets are installed and properly configured as described in the setup instructions of the rule.
Deploy the “User Detected with Suspicious Windows Process(es)” ML job (machine_learning_job_id: problem_child_high_sum_by_user_ea) and tune the anomaly threshold for your environment.
Enable Windows process event collection via Elastic Defend or Winlogbeat (Rule Setup) to provide the necessary data for the ML models.
Review and whitelist legitimate administrative tools and software updates that may trigger false positives, as described in the False Positive Analysis section of the rule note.
Implement enhanced monitoring and detection rules to identify similar patterns of behavior in the future, focusing on the specific tactics and techniques used in this incident (Rule Note).

Potential DGA Activity Detected by Machine Learning

hello@craftedsignal.io — Tue, 09 Jan 2024 15:00:00 +0000

This brief describes a detection of potential DGA (Domain Generation Algorithm) activity identified by an Elastic machine learning job. DGAs are often used by malware for command and control (C2) communication, generating domain names dynamically to evade detection. The machine learning job, dga_high_sum_probability_ea, analyzes DNS requests to identify source IP addresses that exhibit a high probability of DGA activity. This detection relies on the DGA Detection integration, which includes an ML-based framework to detect DGA activity in DNS events. The integration requires Fleet and DNS events collected by integrations such as Elastic Defend, Network Packet Capture, or Packetbeat. This activity matters for defenders because successful DGA-based C2 channels can allow malware to maintain communication and control even when individual malicious domains are blocked.

Attack Chain

The attacker compromises a host within the network, potentially through unpatched vulnerabilities or social engineering.
Malware is deployed on the compromised host. This malware contains a DGA.
The malware uses the DGA to generate a list of potential domain names.
The compromised host initiates DNS requests to resolve the generated domain names.
The DNS requests are sent to internal or external DNS servers.
The machine learning job dga_high_sum_probability_ea analyzes the DNS requests, specifically looking for source IPs with a high aggregate probability of generating DGA domains.
If the anomaly score exceeds the threshold (70), an alert is triggered.
The malware successfully establishes a C2 channel with a dynamically generated domain, enabling further malicious activities such as data exfiltration or lateral movement.

Impact

The successful exploitation of DGA-based command and control can lead to persistent malware infections, data exfiltration, and further compromise of systems within the network. While the severity is rated low, the potential impact can escalate quickly if the C2 channel is used for more damaging activities. This detection focuses on identifying potential DGA activity, enabling security teams to investigate and prevent further damage.

Recommendation

Ensure the DGA Detection integration is installed and properly configured, including the machine learning job dga_high_sum_probability_ea (references: Elastic DGA Detection documentation, prebuilt ML jobs).
Verify that DNS events are being collected by Elastic Defend, Network Packet Capture, or Packetbeat and that the data view used by the machine learning job includes these events (references: Elastic Defend, Network Packet Capture, Packetbeat).
Tune the anomaly threshold (currently 70) in the machine learning job based on your environment to reduce false positives and ensure timely detection of DGA activity.
Review and implement the triage and analysis steps outlined in the rule’s note section, focusing on identifying the source IP, analyzing DNS request patterns, and cross-referencing domains with threat intelligence feeds.

Unusual Source IP for Okta Privileged Operations Detected

hello@craftedsignal.io — Tue, 09 Jan 2024 10:00:00 +0000

This alert leverages machine learning to identify deviations in IP usage patterns associated with privileged Okta operations, flagging unusual access attempts that could signify privilege escalation or account compromise. It identifies a user performing privileged operations in Okta from an uncommon source IP, potentially indicating account compromise, misuse of administrative privileges, or an attacker leveraging a new network location. The detection rule analyzes Okta logs, specifically focusing on events related to privileged operations and source IP addresses, to establish baseline behavior and detect anomalies. This detection is important because Okta controls access to many downstream applications, and any compromise of Okta privileges can lead to widespread data breaches. The rule requires the Privileged Access Detection integration assets to be installed, as well as Okta logs collected by integrations such as Okta. The minimum stack version is 9.4.0

Attack Chain

Adversary gains initial access to a valid user account through phishing, credential stuffing, or other means (T1078, T1078.004).
The adversary leverages the compromised account to authenticate to Okta, potentially bypassing or circumventing MFA.
The adversary attempts to perform privileged operations within Okta, such as modifying user permissions, accessing sensitive applications, or changing security settings.
Okta logs record the privileged operation attempt, including the source IP address of the request.
The machine learning job analyzes the source IP address and compares it to the user’s historical access patterns.
If the source IP address is determined to be unusual or rare for the user, the machine learning job generates an anomaly.
The “Unusual Source IP for Okta Privileged Operations Detected” rule triggers based on the anomaly score exceeding a predefined threshold (anomaly_threshold = 75).
The alert triggers, potentially leading to account takeover, data exfiltration, or further privilege escalation.

Impact

A successful attack can lead to unauthorized access to sensitive applications and data managed by Okta. This can result in data breaches, financial loss, reputational damage, and legal liabilities. Since Okta is a widely used identity management service, a compromise can impact numerous downstream applications and services that rely on Okta for authentication and authorization. The number of affected users and systems can vary depending on the scope of the privileged access and the attacker’s objectives.

Recommendation

Install the Privileged Access Detection integration assets, as well as Okta logs collected by integrations such as Okta, as described in the “Setup” section of the rule to enable the machine learning job.
Review the source IP address flagged by the alert to determine its geolocation and assess if it aligns with the user’s typical access patterns or known locations, as described in the rule’s “Triage and analysis” section.
Tune the anomaly_threshold parameter in the machine learning job based on your environment to reduce false positives.
Correlate the flagged IP address with any known threat intelligence feeds to check for any history of malicious activity associated with it, as described in the rule’s “Triage and analysis” section.

High Command Line Entropy Detected for Privileged Commands on Linux

hello@craftedsignal.io — Wed, 03 Jan 2024 15:30:00 +0000

This alert originates from a machine learning job designed to detect anomalous command-line activity on Linux systems. Specifically, it focuses on identifying instances where privileged commands are executed with unusually high entropy. High entropy in command lines often signifies obfuscation, which threat actors use to mask their activities and evade detection. This rule leverages the Privileged Access Detection (PAD) integration from Elastic to identify these anomalies. The PAD integration requires Linux logs collected by Elastic Defend or Sysmon Linux. The detection logic analyzes command lines associated with privileged commands, flagging those with a high degree of randomness or complexity. This can indicate unauthorized use of valid accounts (T1078) or attempts at privilege escalation, especially if combined with defense evasion techniques (T1027) such as obfuscating commands. The rule and associated ML job have been in production since Feb 2025 and require Elastic Stack version 9.4.0 or higher.

Attack Chain

An attacker gains initial access to a Linux system, potentially through a compromised account or vulnerability exploitation.
The attacker identifies privileged commands they need to execute to achieve their objectives, such as gaining root access or modifying sensitive files.
To evade detection, the attacker obfuscates their commands using techniques like encoding, compression, or complex string manipulation.
The attacker executes the obfuscated privileged commands via the command line.
Elastic Defend or Sysmon Linux captures the command-line activity and logs it to Elasticsearch.
The Privileged Access Detection ML job analyzes the command lines and calculates their entropy.
If the entropy exceeds a predefined threshold, the ML job flags the activity as anomalous and generates an alert.
Security analysts investigate the alert to determine the nature of the suspicious activity and take appropriate action.

Impact

A successful privilege escalation can grant an attacker complete control over a Linux system, allowing them to steal sensitive data, install malware, or disrupt critical services. While this rule itself triggers on unusual command line activity, the underlying behavior could lead to a full system compromise. The number of potential victims is directly related to the scope of the Linux environment being monitored. Sectors commonly targeted by privilege escalation attacks include technology, finance, and government.

Recommendation

Deploy the Privileged Access Detection integration and ensure that Linux logs from Elastic Defend or Sysmon Linux are being ingested (Setup section).
Review and tune the machine learning job pad_linux_high_median_process_command_line_entropy_by_user_ea to minimize false positives based on your environment (False positive analysis section in rule).
Create a case management workflow triggered by the “High Command Line Entropy Detected for Privileged Commands” rule to ensure alerts are promptly investigated.
Implement the remediation steps outlined in the investigation guide to contain and eradicate any confirmed malicious activity (Response and remediation section).

Unusual Remote File Extension Detected via Machine Learning

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This brief focuses on a detection rule from Elastic’s Lateral Movement Detection (LMD) integration that utilizes machine learning to identify unusual remote file transfers. The rule, “Unusual Remote File Extension,” is designed to detect anomalies in file transfers, specifically those involving rare file extensions, which could be indicative of lateral movement within a network. This rule leverages the lmd_rare_file_extension_remote_transfer_ea machine learning job ID. The rule requires the Lateral Movement Detection integration assets to be installed, as well as file and Windows RDP process events collected by the Elastic Defend integration. The rule operates by analyzing host.ip and detecting anomalies in file transfers, where host IP collection needs to be enabled on Elastic Defend versions 8.18 and above.

Attack Chain

An attacker gains initial access to a system within the network.
The attacker attempts to move laterally to other systems using remote services like RDP or SMB.
As part of the lateral movement, the attacker transfers tools or files to the remote system.
The attacker uses a rare or uncommon file extension for the transferred files, potentially to evade detection based on known file types.
The file transfer occurs over the network, triggering file event logs on the source and destination systems.
Elastic Defend, with host IP collection enabled, monitors these file events and forwards the data to the Elastic Security platform.
The “Unusual Remote File Extension” machine learning job identifies the transfer of a file with a rare extension, comparing it against historical data.
If the file extension is deemed anomalous based on its rarity, the rule triggers, indicating potential lateral movement.

Impact

A successful lateral movement attack can allow an adversary to gain access to sensitive data, critical systems, or privileged accounts. By using uncommon file extensions, attackers attempt to bypass security measures that rely on identifying known file types. This can lead to undetected malware deployment, data exfiltration, or further compromise of the network. Though this rule is of low severity, it can provide an early warning signal to stop an attack before greater damage occurs.

Recommendation

Enable the host.ip field within Elastic Defend configurations (versions 8.18 and above) to ensure proper data collection for the machine learning job.
Install the Lateral Movement Detection integration assets within Kibana as per the provided setup instructions to activate the “Unusual Remote File Extension” rule.
Tune the anomaly threshold of the machine learning job to reduce false positives, considering your organization’s typical file transfer patterns.
Deploy the “Detect Remote File Extension Transfer” Sigma rule to identify file transfers with rare extensions using process creation logs.
Review the triage and analysis steps in the rule’s documentation to effectively investigate and respond to triggered alerts.

Machine Learning Detects High Bytes Written to External Device

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

This brief addresses a machine learning detection identifying anomalous data transfer volumes to external devices. The Elastic Data Exfiltration Detection integration includes a prebuilt machine learning job, ded_high_bytes_written_to_external_device_ea, designed to detect spikes in data written to external devices. This behavior is considered anomalous because typical operational settings usually exhibit predictable patterns or ranges of data transfer to external storage. The detection is triggered when the amount of data written significantly deviates from the established baseline, potentially signaling unauthorized data copying or exfiltration attempts. This detection focuses on identifying abnormalities, providing an alert for investigation of possible illicit data transfer activities. The integration requires the Elastic Defend integration to collect file events.

Attack Chain

An attacker gains initial access to a system via compromised credentials or exploiting a vulnerability.
The attacker uses their access to locate and stage sensitive data for exfiltration.
The attacker connects an external storage device, such as a USB drive, to the compromised system.
The attacker initiates a large data transfer operation, copying the staged data to the external device.
Elastic Defend monitors file events and detects a significant increase in bytes written to the external device.
The ded_high_bytes_written_to_external_device_ea machine learning job identifies the unusual data transfer volume.
An alert is triggered based on the anomaly threshold defined in the Data Exfiltration Detection rule.
The attacker removes the external device, completing the exfiltration of the sensitive data.

Impact

Successful exfiltration of data to external devices can lead to significant data breaches. The impact varies depending on the sensitivity and volume of the data stolen. This activity can result in financial losses, reputational damage, legal repercussions, and compromise of intellectual property. While the specific number of affected organizations is unknown, any organization that allows the use of external storage devices is potentially vulnerable. This issue poses a risk across various sectors, particularly those handling sensitive data, such as finance, healthcare, and technology.

Recommendation

Install the Data Exfiltration Detection integration and configure the preconfigured anomaly detection jobs as described in the rule’s setup instructions.
Review and tune the anomaly_threshold (currently set to 75) based on your environment’s baseline data transfer patterns to reduce false positives.
Deploy endpoint detection and response (EDR) solutions to enhance visibility and control over data movements to external devices as mentioned in the “Response and remediation” section of the rule’s note.
Create exceptions for known backup operations, software updates, and data archiving processes that may trigger false positives, referencing the “False positive analysis” section of the rule’s note.
Implement additional monitoring on similar devices and network segments to detect any further anomalous data transfer activities, based on the rule’s description and “Response and remediation” section of the note.

Okta Group Privilege Change Spike via ML Detection

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This alert focuses on detecting potential privilege escalation attempts within Okta environments. The Elastic Security prebuilt machine learning job pad_okta_spike_in_group_privilege_changes_ea identifies unusual spikes in Okta group privilege change events. Attackers may add themselves or compromised accounts to high-privilege groups to gain unauthorized access and persist within the environment. This activity can lead to significant data breaches, system compromise, and long-term persistence. The rule leverages Elastic’s Anomaly Detection feature. This detection is particularly relevant for organizations heavily reliant on Okta for identity and access management, especially those with sensitive data or critical infrastructure.

Attack Chain

An attacker compromises a low-privilege user account through phishing or credential stuffing.
The attacker logs into Okta using the compromised credentials, bypassing MFA if possible.
The attacker attempts to add the compromised account to a high-privilege Okta group, such as “Administrators” or “Security Admins.”
Okta logs an event indicating a group privilege change for the compromised account.
The machine learning job pad_okta_spike_in_group_privilege_changes_ea detects a statistically significant spike in these group privilege change events.
The attacker gains elevated privileges within Okta and connected applications.
The attacker leverages the newly acquired privileges to access sensitive data or modify critical system configurations.
The attacker establishes persistence by creating new administrative accounts or modifying existing account permissions, ensuring continued access even if the initial compromised account is discovered.

Impact

A successful privilege escalation attack in Okta can have severe consequences. Attackers can gain complete control over the Okta environment, leading to unauthorized access to all connected applications and systems. This can result in data breaches, financial losses, and reputational damage. The number of affected users and systems depends on the scope of the attacker’s access and the sensitivity of the data stored within the connected applications.

Recommendation

Deploy the “Spike in Group Privilege Change Events” machine learning job in your Elastic Security environment and tune the anomaly_threshold for your specific Okta usage patterns (references: Elastic ML Jobs, Privileged Access Detection Setup).
Investigate any alerts generated by the machine learning job, focusing on identifying the accounts involved in the privilege changes, the source IP addresses, and the affected groups (reference: Investigation Guide section in the content).
Implement multi-factor authentication (MFA) for all Okta users, especially those with administrative privileges, to prevent account compromise (reference: remediation steps in the content).
Review and update access control policies to ensure that only authorized personnel can modify group memberships, reducing the risk of future privilege escalation (reference: remediation steps in the content).
Enable Okta integration and collect Okta logs in Elastic Agent policy (reference: Okta integration).
Implement the Sigma rule “Okta Suspicious Group Membership Changes” to detect specific patterns of malicious group modifications, and tune for your environment.

Unusual Process Spawned by a User Detected by Machine Learning

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

A machine learning (ML) rule has identified unusual process execution on a Windows endpoint. This detection leverages two ML models from the Elastic ProblemChild integration: a supervised model that predicts malicious processes and an unsupervised model that identifies processes anomalous to the user’s typical behavior. The rule focuses on detecting defense evasion tactics, specifically the potential use of Living-off-the-Land Binaries (LOLbins) or masquerading techniques, which can be difficult to detect with traditional signature-based methods. This detection uses data from the Elastic Endpoint or Winlogbeat and requires the Living off the Land (LotL) Attack Detection integration assets to be installed. This rule was last updated April 1, 2026 and requires Elastic Stack version 9.4.0 or higher.

Attack Chain

Initial Access: The attacker gains initial access through an existing user account.
Execution: The attacker executes a standard Windows process (e.g., cmd.exe, powershell.exe).
Defense Evasion: The attacker leverages LOLbins to perform malicious actions, blending in with legitimate system activity.
Masquerading: The attacker renames or moves malicious tools to mimic legitimate system files.
Privilege Escalation (Optional): The attacker attempts to escalate privileges using the compromised process.
Lateral Movement (Optional): The attacker uses the compromised process to move laterally to other systems.
Command and Control (Optional): The process establishes a connection to a command and control server for further instructions.
Impact: The attacker achieves their objective, such as data exfiltration, system compromise, or persistence.

Impact

A successful attack using these techniques can lead to a full system compromise, data theft, or the installation of persistent backdoors. The use of LOLbins makes detection difficult, potentially allowing attackers to operate undetected for extended periods. The impact is amplified by the potential for lateral movement to other systems within the network. While the severity is rated “low”, successful exploitation allows attackers to move laterally and establish persistence in the network.

Recommendation

Ensure the Living off the Land (LotL) Attack Detection integration is installed and properly configured, as detailed in the rule setup (Elastic Defend or Winlogbeat).
Investigate alerts generated by the “Unusual Process Spawned by a User” rule (rule_id: 40155ee4-1e6a-4e4d-a63b-e8ba16980cfb) to determine the legitimacy of the flagged process.
Tune the anomaly threshold (anomaly_threshold: 75) based on your environment to reduce false positives, as mentioned in the rule parameters.
Review the “False positive analysis” section in the rule’s note for guidance on identifying and excluding legitimate processes.
Implement the provided Sigma rule to detect unusual command line arguments associated with LOLBins.

ProblemChild ML Model Detects Unusual Process on Windows Host

hello@craftedsignal.io — Wed, 03 Jan 2024 10:00:00 +0000

This detection leverages the ProblemChild supervised machine learning model to identify unusual Windows processes that may be indicative of defense evasion tactics. The model flags processes that are both statistically unusual for a given host and predicted to be suspicious based on their characteristics. This approach aims to detect Living off the Land (LotL) attacks, where adversaries use legitimate system binaries (LOLbins) to evade traditional signature-based detection methods. The rule specifically targets processes observed on hosts that do not commonly exhibit malicious behavior. The alert requires the Elastic’s Living off the Land (LotL) Attack Detection integration assets to be installed, processing Windows process events collected by Elastic Defend or Winlogbeat. This detection rule was last updated on 2026-04-01 and requires Elastic Stack version 9.4.0 or higher.

Attack Chain

Adversary gains initial access to a Windows system.
The attacker leverages a LOLbin (e.g., powershell.exe, cmd.exe, mshta.exe) to execute malicious commands.
The LOLbin spawns a child process to perform a specific task, such as downloading a file or modifying system settings.
The spawned process exhibits characteristics flagged as suspicious by the ProblemChild ML model.
The suspicious process attempts to evade detection by masquerading as a legitimate system process or by obfuscating its activity.
The attacker uses the process to establish persistence, escalate privileges, or move laterally within the network.
The ultimate objective is to exfiltrate sensitive data, deploy ransomware, or disrupt business operations.

Impact

A successful defense evasion attack can allow adversaries to operate undetected within a network, leading to data breaches, financial losses, and reputational damage. The use of LOLbins makes it difficult to distinguish malicious activity from legitimate system operations. This detection rule aims to reduce the dwell time of attackers by identifying suspicious processes early in the attack chain, even if they are using legitimate tools. False positives may occur due to routine administrative tasks, software updates, or custom scripts.

Recommendation

Ensure that the Living off the Land (LotL) Attack Detection integration is installed and properly configured, as described in the “Setup” section of this brief.
Verify that Windows process events are being collected by Elastic Defend or Winlogbeat, as required by the detection rule.
Deploy the following Sigma rule to detect unusual process spawns and tune the Image|endswith and CommandLine|contains conditions for your specific environment.
Review the investigation guide provided in the rule description to triage and analyze potential false positives.
Adjust the anomaly_threshold (currently 75) in the Elastic detection rule based on your environment’s baseline to reduce noise.
Monitor for MITRE ATT&CK Technique T1218 (System Binary Proxy Execution) to identify potential LOLbin abuse.

Unusual Source IP for Windows Privileged Operations Detected via ML

hello@craftedsignal.io — Tue, 02 Jan 2024 15:00:00 +0000

This alert leverages Elastic’s machine learning capabilities to identify anomalous network activity related to privileged operations in Windows. Specifically, it flags instances where a user performs privileged actions from a source IP address that is not typically associated with their account. The detection rule, Unusual Source IP for Windows Privileged Operations Detected, is triggered by the pad_windows_rare_source_ip_by_user_ea machine learning job. The underlying machine learning model analyzes network patterns and user behavior to detect deviations from established baselines. Such deviations can indicate account compromise, insider threat activity, or attackers leveraging new network locations for privilege escalation within a Windows environment. This detection is enabled through the Privileged Access Detection integration assets within Elastic Security, supporting deployments of Elastic Defend and the Windows integration.

Attack Chain

Initial Access (TA0001): An attacker gains initial access to a user account through credential compromise or other means.
Privilege Escalation (TA0004): The attacker attempts to escalate privileges using the compromised account.
Unusual Network Location: The attacker leverages a VPN, proxy, or compromised host in a different network segment to conduct privileged operations.
Windows Privileged Operation: The attacker performs a privileged action on a Windows system, such as modifying system files, creating new accounts, or accessing sensitive data.
ML Anomaly Detection: Elastic’s machine learning job pad_windows_rare_source_ip_by_user_ea detects the unusual source IP for the privileged operation.
Alert Triggered: The “Unusual Source IP for Windows Privileged Operations Detected” rule triggers an alert in Elastic Security.
Potential Lateral Movement: If successful, the attacker can use the elevated privileges to move laterally within the network and compromise other systems.
Data Exfiltration/Impact: The attacker achieves their final objective, such as data exfiltration, system disruption, or ransomware deployment, leveraging the escalated privileges.

Impact

Successful exploitation and privilege escalation can allow an attacker to move laterally through the network, access sensitive data, and disrupt critical systems. While the alert itself is low severity, the underlying activity can lead to significant damage if not addressed promptly. The risk score associated with the rule is 21, indicating a moderate level of risk. Affected organizations may experience data breaches, financial loss, and reputational damage.

Recommendation

Review and tune the machine learning job pad_windows_rare_source_ip_by_user_ea to reduce false positives and ensure accurate detection of anomalous activity.
Investigate any alerts triggered by the “Unusual Source IP for Windows Privileged Operations Detected” rule, focusing on identifying the root cause of the unusual source IP and the nature of the privileged operations performed.
Implement the setup steps outlined in the rule documentation to ensure proper collection and ingestion of Windows events required for the machine learning job to function correctly.
Correlate the alerts with other security events or logs, such as firewall logs, VPN logs, or endpoint security alerts, to gather additional context about the source IP and user activity.

Unusual Process Writing Data to an External Device via Machine Learning

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection identifies unusual processes writing data to external devices, a tactic often used by malicious actors to exfiltrate data while masking their activities with seemingly benign processes. The detection leverages machine learning to identify deviations from typical behavior patterns, specifically focusing on processes that have no legitimate reason to write data to external devices. The rule relies on the “ded_rare_process_writing_to_external_device_ea” machine learning job from the Elastic Data Exfiltration Detection integration, version 9.4.0 or later. The rule analyzes file events collected by integrations such as Elastic Defend and Network Packet Capture. This detection is important because it can uncover exfiltration attempts that might otherwise go unnoticed due to the use of legitimate-looking processes.

Attack Chain

An attacker gains initial access to a system through various means (e.g., compromised credentials, software vulnerability).
The attacker establishes persistence on the system, potentially using scheduled tasks or autorun keys.
The attacker identifies sensitive data on the system or network.
The attacker copies the sensitive data to a staging directory.
The attacker uses a renamed or masqueraded legitimate process (e.g., svchost.exe, powershell.exe) to write the staged data to an external device connected to the system.
The system’s file events are monitored by Elastic Defend, capturing the process writing data to the external device.
The Elastic Data Exfiltration Detection integration analyzes the file events and identifies the process as rare or unusual for writing to external devices.
The “Unusual Process Writing Data to an External Device” rule is triggered, alerting security analysts to the potential exfiltration attempt.

Impact

A successful attack could result in the exfiltration of sensitive data, leading to financial loss, reputational damage, and legal repercussions. While the severity is “low,” a successful exfiltration can have significant consequences. The number of victims and the specific sectors targeted depend on the attacker’s objectives and the compromised system’s access to sensitive information.

Recommendation

Install and configure the Data Exfiltration Detection integration in Elastic, ensuring the machine learning job ded_rare_process_writing_to_external_device_ea is enabled, as described in the setup documentation.
Enable file event collection using Elastic Defend to provide the necessary data for the machine learning job, as detailed in the Elastic Defend documentation.
Deploy the provided Sigma rule to your SIEM and tune the anomaly_threshold based on your environment’s baseline behavior to reduce false positives.
Investigate any alerts generated by this rule, following the triage and analysis guidance to determine the legitimacy of the activity.

Spike in Remote File Transfers via Lateral Movement

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

The “Spike in Remote File Transfers” detection identifies potential lateral movement activity within a network by monitoring for unusual volumes of remote file transfers. Attackers often aim to locate and exfiltrate valuable information after gaining initial access. To evade detection, they may attempt to mimic normal egress activity through numerous small transfers. This detection leverages machine learning to establish a baseline of normal transfer activity and identify deviations that may indicate malicious behavior. The rule requires the Lateral Movement Detection integration assets to be installed. For Elastic Defend events on versions 8.18 and above, host.ip collection must be enabled.

Attack Chain

Initial Access: An attacker gains initial access to a host within the network through an exploit or compromised credentials.
Internal Reconnaissance: The attacker performs internal reconnaissance to identify valuable data and potential target systems.
Lateral Movement: The attacker uses stolen credentials or exploits remote services (T1210) to gain access to other systems on the network.
Tool Transfer: The attacker transfers malicious tools or scripts (T1570) to the compromised systems to facilitate further actions.
Data Collection: The attacker gathers sensitive data from the compromised systems.
Egress Activity: The attacker initiates numerous small remote file transfers, attempting to blend in with normal network traffic.
Data Exfiltration: The attacker exfiltrates the stolen data to an external location.

Impact

A successful lateral movement attack involving anomalous file transfers can lead to data exfiltration, intellectual property theft, and reputational damage. Even though the severity is low, undetected lateral movement can escalate quickly into high severity incidents like ransomware or data breaches. This detection focuses on the early stages of lateral movement, allowing security teams to respond before significant damage occurs.

Recommendation

Ensure host IP collection is enabled in Elastic Defend configurations, following the steps in the helper guide.
Install the Lateral Movement Detection integration assets as described in the setup instructions in the rule documentation.
Investigate alerts generated by the “Spike in Remote File Transfers” rule, paying close attention to the source and destination of the file transfers.
Review authentication logs for signs of compromised accounts, such as unusual login times or locations, as described in the rule’s triage notes.
Tune the machine learning job’s anomaly threshold based on your environment’s baseline activity and false positive analysis.

Okta Privileged Operations from Unusual Host Name Detected

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This alert identifies potentially malicious Okta activity based on unusual host names associated with privileged operations. The Elastic prebuilt machine learning job pad_okta_rare_host_name_by_user_ea analyzes Okta logs to detect anomalies in device usage, specifically focusing on unusual host names. This activity could indicate a compromised user account, an attacker using stolen credentials, or an insider threat leveraging an unauthorized device to escalate privileges within the Okta environment. This detection is part of the Privileged Access Detection (PAD) integration, designed to identify abnormalities across Windows, Linux, and Okta events, starting with Elastic Stack version 9.4.0. Defenders should investigate users exhibiting this behavior to determine the legitimacy of the access and the device being used.

Attack Chain

An attacker gains initial access to an Okta user’s credentials, possibly through phishing (not specified in source, but likely).
The attacker authenticates to Okta using the compromised credentials.
The attacker attempts to perform privileged operations within Okta (e.g., modifying user permissions, accessing sensitive applications).
The attacker uses a device with a host name that is uncommon for the compromised user, triggering the machine learning alert.
Okta logs the privileged operation and the associated host name.
Elastic’s machine learning job, pad_okta_rare_host_name_by_user_ea, detects the unusual host name based on historical data.
A security alert is generated, indicating potential privileged access from an unusual host.
The attacker escalates privileges within the Okta environment, potentially gaining access to sensitive resources or data.

Impact

A successful attack could lead to unauthorized access to sensitive applications and data managed by Okta. The potential impact includes data breaches, financial loss, and reputational damage. While the rule severity is low, successful privilege escalation can significantly increase the attacker’s access and control, impacting all applications and services integrated with Okta. The exact number of potential victims varies depending on the organization’s size and the scope of Okta’s usage.

Recommendation

Ensure the Privileged Access Detection integration assets are installed and configured properly as per the official Elastic documentation.
Investigate alerts from the pad_okta_rare_host_name_by_user_ea machine learning job by reviewing user login history, device usage patterns, and associated IP addresses as outlined in the rule’s “Triage and analysis” section.
Implement multi-factor authentication (MFA) for all privileged accounts to add an additional layer of security as mentioned in the “Response and remediation” section.
Enable Okta integration and configure the Fleet agent policy according to the Elastic documentation to ensure proper data collection.