Attack Chain

This brief describes a machine learning detection mechanism for identifying suspicious process behavior rather than a specific, linear attack chain. The detection targets various stages where attackers might employ defense evasion techniques, such as using LOLbins or process masquerading. The rule aims to identify the outcome of such techniques on a Windows host, which could occur during initial access, execution, persistence, or privilege escalation phases of an attack. The specific methods leading to these suspicious processes are diverse and depend on the adversary's chosen TTPs, but the ML model identifies the resulting anomalous process clusters.

Impact

Failure to detect and respond to the suspicious process clusters flagged by this ML rule can lead to successful defense evasion by attackers. If adversaries successfully employ LOLbins and masquerading, they can establish persistence, escalate privileges, move laterally, and exfiltrate data without triggering conventional security alerts. The ultimate impact can include data breaches, ransomware deployment, system damage, and significant operational disruption, as the initial signs of compromise through these evasive techniques were not addressed.

Recommendation

• Enable the LotL Attack Detection integration: Ensure the Living off the Land Attack Detection integration is correctly installed and configured in your Elastic environment, as detailed in the "Setup" section, to enable the underlying ML jobs.
• Install Elastic Defend or Winlogbeat: Collect Windows process events using either Elastic Defend or Winlogbeat, as specified in the "Setup" section, to feed the necessary data to the ML jobs.
• Review affected hosts: Upon detection, review the host name associated with the suspicious process cluster to determine its criticality and history, as described in the "Investigating Host Detected with Suspicious Windows Process(es)" guide.
• Examine flagged processes and command lines: Investigate the specific processes and their command-line arguments flagged by the ProblemChild supervised ML model to identify known LOLbins or unusual usage patterns, as suggested in the "Investigating Host Detected with Suspicious Windows Process(es)" guide.
• Investigate parent-child process relationships: Examine the parent-child relationships of the processes to identify any unexpected or unauthorized process spawning, as recommended in the "Investigating Host Detected with Suspicious Windows Process(es)" guide.
• Correlate with other security events: Correlate the alert with other security events or logs from the same host to identify additional indicators of compromise, as outlined in the "Investigating Host Detected with Suspicious Windows Process(es)" guide.