Skip to content
Threat Feed
Subscribe

Tag

Resources: Investigation Guide

4 briefs RSS
high threat

Suspicious Web Server Child Process Execution via Elastic Defend for Containers

This rule detects the exploitation of a web server through the execution of a suspicious process by common web server user accounts within a containerized environment, potentially indicating the uploading of a web shell to maintain system access, and covers persistence, execution, and command and control tactics.

Elastic Defend for Containers Data Source: Elastic Defend for Containers Domain: Container OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Execution Tactic: Command and Control Resources: Investigation Guide
2r 3t
low advisory

User Detected with Suspicious Windows Process(es)

A machine learning job combination has identified a user with one or more suspicious Windows processes exhibiting unusually high malicious probability scores, potentially involving LOLbins for defense evasion.

Elastic Defend +3 Domain: Endpoint OS: Windows Use Case: Living off the Land Attack Detection Rule Type: ML Rule Type: Machine Learning Tactic: Defense Evasion Resources: Investigation Guide defense-evasion
2r 2t
low advisory

Host Detected with Suspicious Windows Process(es)

A machine learning job combination has identified a host with one or more suspicious Windows processes that exhibit unusually high malicious probability scores, indicating potential masquerading tactics for defense evasion.

Elastic Defend +1 Use Case: Living off the Land Attack Detection Rule Type: ML Rule Type: Machine Learning Tactic: Defense Evasion Resources: Investigation Guide defense-evasion windows
2r 2t
critical advisory

LLM-Based Compromised User Triage

This rule correlates multiple security alerts involving the same user, analyzes them with an LLM, and flags potentially compromised accounts based on MITRE tactics, geographic anomalies, and multi-host activity, helping analysts prioritize users exhibiting indicators of credential theft or unauthorized access.

Elastic Cloud Domain: Identity Domain: LLM Use Case: Threat Detection Use Case: Identity and Access Audit Resources: Investigation Guide Rule Type: Higher-Order Rule
2r 2t