Skip to content
Threat Feed
Subscribe

Tag

Ml

4 briefs RSS
low advisory

Unusual Linux Process Discovery Activity

An Elastic machine learning rule detects unusual Linux process discovery activity from atypical user contexts, indicating a potentially compromised account performing reconnaissance for privilege escalation or persistence on Linux systems.

endpoint linux elastic-defend auditd-manager threat-detection ml machine-learning discovery +1
1t
low advisory

Unusual Process Spawned by a User Detected by ML

A machine learning job from Elastic's ProblemChild integration detects suspicious Windows processes, classified as malicious by a supervised ML model and anomalous due to unusual user contexts identified by an unsupervised ML model, indicating potential misuse of LOLbins or masquerading tactics for defense evasion.

problemchild +6 Endpoint Windows Elastic Defend Elastic Endgame Living off the Land Attack Detection ML Machine Learning Defense Evasion +1
2t
low advisory

Unusual Process Writing Data to an External Device Detected by Machine Learning

Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.

Elastic Defend +15 exfiltration machine-learning elastic-defend endpoint lateral-movement rdp anomaly-detection privilege-escalation +29
22t
low advisory

Suspicious Windows Process Cluster Detected from Parent Process

A machine learning job has identified a parent process spawning one or more suspicious Windows processes exhibiting unusually high malicious probability scores, indicating potential defense evasion tactics like masquerading and LOLBins usage.

Elastic Endpoint +2 defense-evasion windows ml lolbins
2r 2t