Elastic low stable eql

Unusual Remote File Directory

An anomaly detection job has detected a remote file transfer on an unusual directory indicating a potential lateral movement activity on the host. Many Security solutions monitor well-known directories for suspicious activities, so attackers might use less common directories to bypass monitoring.

View Source

Detection Logic

Field Validations

Loading…

Comments (0)

Loading comments...