Tag

Ml-Detection

1 brief RSS

Host Detected with Suspicious Windows Processes via Machine Learning

Elastic's machine learning job, utilizing the ProblemChild supervised model and unsupervised techniques, detects Windows hosts exhibiting clusters of suspicious processes with unusually high malicious probability scores, often indicative of defense evasion through Living Off The Land Binaries (LOLbins) and masquerading techniques.

Elastic Defend +6 defense-evasion masquerading lolbins machine-learning windows ml-detection endpoint-security

2t 17h ago