Elastic Security Detection Rules

Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score

Last updated 6 months ago on 2025-01-15
Created 2 years ago on 2023-10-16

About

A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with low probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious.
Tags
OS: WindowsData Source: Elastic EndgameUse Case: Living off the Land Attack DetectionRule Type: MLRule Type: Machine LearningTactic: Defense EvasionData Source: Elastic DefendLanguage: eql
Severity
low
Risk Score
21
MITRE ATT&CK™

Defense Evasion (TA0005)(opens in a new tab or window)

↳ Masquerading (T1036)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
endgame-*logs-endpoint.events.process-*winlogbeat-*
Related Integrations

problemchild(opens in a new tab or window)

endpoint(opens in a new tab or window)

Query
process where ((problemchild.prediction == 1 and problemchild.prediction_probability <= 0.98) or
blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*")

Install detection rules in Elastic Security

Detect Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).