Elastic high stable eql
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious.
Detection Logic
process where ((problemchild.prediction == 1 and problemchild.prediction_probability > 0.98) or
blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*") and
process.parent.executable != null and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
not process.parent.name : ("cmd.exe", "powershell.exe", "Perplexity.exe", "vmtoolsd.exe", "Code.exe", "explorer.exe", "git.exe") and
not (process.name : "msedgewebview2.exe" and process.parent.name : "msedgewebview2.exe") and
not (process.name : "opera.exe" and process.parent.name : "opera.exe") and
not (process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
process.name : ("UCPDMgr.exe", "sdbinst.exe", "gpupdate.exe", "rundll32.exe", "taskhostw.exe", "taskeng.exe", "rdpclip.exe", "firefox.exe", "w3wp.exe")) and
not process.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe") and
not (process.name : "MpCmdRun.exe" and process.parent.name : ("MsMpEng.exe", "MpCmdRun.exe", "svchost.exe")) and
not (process.name : "slack.exe" and process.parent.name : "slack.exe") and
not (process.name : "reg.exe" and process.parent.name : "pycharm64.exe") and
not (process.name : "reg.exe" and process.parent.name : "rider64.exe") and
not (process.name : "LogiLuUpdater.exe" and process.parent.name : "LogiOptionsMgr.exe") and
not (process.name : "chrome.exe" and process.parent.name : "node.exe" and process.command_line : "*playwright*") and
not (process.name : "powershell.exe" and process.command_line : "*\\Zabbix_Scripts\\*.ps1*") and
not (process.parent.name : "opera.exe" and process.command_line: "*--type=renderer*") Field Validations
Loading…
Comments (0)
Loading comments...