As cited
Copy frozen at (site build).
Detecting Living-off-the-land attacks with new Elastic Integration
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Detecting Living-off-the-land attacks with new Elastic Integration
Elastic released a Living off the Land (LotL) Attack Detection package integrated into Kibana that combines machine learning classification, anomaly detection, and detection rules to identify suspicious parent-child process relationships on Windows systems. The package automates deployment of the ProblemChild framework, which uses a trained model to flag potentially malicious process execution and anomaly detection jobs to surface rare process lineage patterns that evade traditional heuristic-based detection. Organizations can install the package in one click and configure ingest pipelines, anomaly detection jobs, and detection rules to alert on LotL activity across their Windows event data.
Why it matters: Windows environments running Elastic Stack can now reduce false positives and accelerate triage of living-off-the-land attacks by deploying machine learning-based detection that surfaces anomalous process relationships rather than relying on rule-based methods alone.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Detecting Living-off-the-land attacks with new Elastic Integration
Elastic released a Living off the Land (LotL) Attack Detection package integrated into Kibana that combines machine learning classification, anomaly detection, and detection rules to identify suspicious parent-child process relationships on Windows systems. The package automates deployment of the ProblemChild framework, which uses a trained model to flag potentially malicious process execution and anomaly detection jobs to surface rare process lineage patterns that evade traditional heuristic-based detection. Organizations can install the package in one click and configure ingest pipelines, anomaly detection jobs, and detection rules to alert on LotL activity across their Windows event data.
Why it matters: Windows environments running Elastic Stack can now reduce false positives and accelerate triage of living-off-the-land attacks by deploying machine learning-based detection that surfaces anomalous process relationships rather than relying on rule-based methods alone.
- Source published
- First seen by Cybersecurity Tracker