Elastic low stable eql

High Mean of Process Arguments in an RDP Session

A machine learning job has detected unusually high number of process arguments in an RDP session. Executing sophisticated attacks such as lateral movement can involve the use of complex commands, obfuscation mechanisms, redirection and piping, which in turn increases the number of arguments in a command.

View Source

Detection Logic

Field Validations

Loading…

Comments (0)

Loading comments...