Elastic Security Detection Rules

Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score

Last updated 15 days ago on 2025-03-20
Created a year ago on 2023-10-16

About

A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious.
Tags
OS: WindowsData Source: Elastic EndgameUse Case: Living off the Land Attack DetectionRule Type: MLRule Type: Machine LearningTactic: Defense EvasionData Source: Elastic DefendLanguage: eql
Severity
high
Risk Score
73
MITRE ATT&CK™

Defense Evasion (TA0005)(opens in a new tab or window)

↳ Masquerading (T1036)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
endgame-*logs-endpoint.events.process-*winlogbeat-*
Related Integrations

problemchild(opens in a new tab or window)

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

Query
process where ((problemchild.prediction == 1 and problemchild.prediction_probability > 0.98) or
blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*")

Install detection rules in Elastic Security

Detect Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).