www.elastic.co Open in urlscan Pro
151.101.194.217  Public Scan

Form analysis
3 forms found in the DOM

<form role="combobox" aria-expanded="false" aria-haspopup="listbox" aria-labelledby="downshift-0-label">
  <div class="sui-search-box search-box">
    <div class="sui-search-box__wrapper">
      <div class="icon"> </div><input aria-autocomplete="list" aria-labelledby="downshift-0-label" autocomplete="off" id="downshift-0-input" placeholder="" class="sui-search-box__text-input " value="" style="padding-left: 421px;">
    </div><a href="#" class="header-search-cancel"></a>
  </div>
</form>

<form id="mktoForm_1398" class="jsx-3812957129 mktoForm mktoHasWidth mktoLayoutAbove" novalidate="novalidate" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 276px;">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 270px;">
          <div class="mktoAsterix">*</div>
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Email address" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 270px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Internal_CTA__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Internal_Page__c"
      class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Internal_Placement__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input
      type="hidden" name="Ad_Source__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Ad_technology__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-"
      style="margin-bottom: 5px;"><input type="hidden" name="Marketing_Internal_Search__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Marketing_Page__c"
      class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Marketing_CTA__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden"
      name="Marketing_Placement__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Marketing_Technology__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-"
      style="margin-bottom: 5px;"><input type="hidden" name="Marketing_Term__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Marketing_Content__c"
      class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Marketing_Medium__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden"
      name="Marketing_Source__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-" style="margin-bottom: 5px;"><input type="hidden" name="Marketing_Campaign__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="-"
      style="margin-bottom: 5px;"><input type="hidden" name="Form_Source" class="mktoField mktoFieldDescriptor mktoFormCol" value="Web.co Newsletter" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="GCLID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;"><input type="hidden" name="Ad_Campaign__c" class="mktoField mktoFieldDescriptor mktoFormCol"
      value="-" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset mktoHasWidth" style="width: 5px;"></div>
      <div class="mktoFieldWrap">
        <div class="mktoHtmlText mktoHasWidth" style="width: 255px;">
          <div id="gdpr">&nbsp;</div>
        </div>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Elastic_Cookie_UUID__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;"><input type="hidden" name="Form_Fill_Referrer__c"
      class="mktoField mktoFieldDescriptor mktoFormCol" value="https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Sign up</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="1398"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="813-MAM-392">
</form>

<form class="jsx-3812957129 mktoForm mktoHasWidth mktoLayoutAbove" novalidate="novalidate" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;">
</form>

Text Content

 * Products
 * Customers
 * Learn
 * Company
 * Pricing

Try Free

Already have an account?Log in

Have questions?Contact us

Products


SOLUTIONS


Elastic Enterprise Search

Workplace, website, and app search


Elastic Observability

Unified logs, metrics, and APM data


Elastic Security

SIEM, endpoint, and threat hunting


ELASTIC (ELK) STACK

Elasticsearch

Store, search, analyze

Kibana

Visualize, navigate, share


Elastic Cloud

Managed Elasticsearch service


NEW

8.1 Release

Deploy now

View integrations

View all products

Learn
Blogs

Tutorials, updates, people

Docs

Product guides

Events

ElasticON, meetups, virtual events

Videos

Tutorials and customer testimonials

Community

Groups, forums, code

Consulting

Project acceleration packages

Customer success

Customer guidance and resources

Training

Critical skill-building and certification


FEATURED TOPICS

Elastic (ELK) Stack Upgrading
Elastic Stack Getting Started
Kibana Getting Started
App Search Getting Started
Workplace Search Getting Started
APM Overview


Upgrade the Elastic Stack.

Watch video

Company
About

Our story, teams, Source Code

Customers

Case studies, videos, blogs

Careers

Peruse our opportunities

Partners

Find or become a partner

Investor Relations

Results, filings, resources

Awards

Recognizing remarkable work


NEWS

Elastic 8.1 released
What’s new in Elastic Enterprise Search 8.1
What’s new in Elastic Observability 8.1
What’s new in Elastic Security 8.1
What’s new in Elastic Platform 8.1


Elastic is a search company.

Watch video

 * Contact
 * Login
 * Try Free
 * 

 * Documentation
 * Security
 * 8.1






Docs
Elastic Security Solution [8.1] » Anomaly Detection with Machine Learning »
Prebuilt job reference
« Anomaly Detection with Machine Learning Optimizing anomaly results »


PREBUILT JOB REFERENCEEDIT

These anomaly detection jobs automatically detect file system and network
anomalies on your hosts. They appear in the Anomaly Detection interface of the
Elastic Security app in Kibana when you have data that matches their
configuration. For more information, refer to Anomaly detection with machine
learning.


SECURITY: AUDITBEATEDIT

Detect suspicious network activity and unusual processes in Auditbeat data.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

In 7.11 or later versions, use the Security: Linux jobs instead.[1]

Name Description Job Datafeed

linux_anomalous_network_activity_ecs

Looks for unusual processes using the network which could indicate
command-and-control, lateral movement, persistence, or data exfiltration
activity.





linux_anomalous_network_port_activity_ecs

Looks for unusual destination port activity that could indicate
command-and-control, persistence mechanism, or data exfiltration activity. NOTE:
This job is available only when you use Auditbeat to ship data. [2]





linux_anomalous_network_service

Looks for unusual listening ports that could indicate execution of unauthorized
services, backdoors, or persistence mechanisms. NOTE: This job is available only
when you use Auditbeat to ship data.[2]





linux_anomalous_network_url_activity_ecs

Looks for an unusual web URL request from a Linux instance. Curl and wget web
request activity is very common but unusual web requests from a Linux server can
sometimes be malware delivery or execution.





linux_anomalous_process_all_hosts_ecs

Looks for processes that are unusual to all Linux hosts. Such unusual processes
may indicate unauthorized services, malware, or persistence mechanisms.





linux_anomalous_user_name_ecs

Rare and unusual users that are not normally active may indicate unauthorized
changes or activity by an unauthorized user which may be credentialed access or
lateral movement.





linux_network_configuration_discovery

Looks for commands related to system network configuration discovery from an
unusual user context. This can be due to uncommon troubleshooting activity or
due to a compromised account. A compromised account may be used by a threat
actor to engage in system network configuration discovery in order to increase
their understanding of connected networks and hosts. This information may be
used to shape follow-up behaviors such as lateral movement or additional
discovery.





linux_network_connection_discovery

Looks for commands related to system network connection discovery from an
unusual user context. This can be due to uncommon troubleshooting activity or
due to a compromised account. A compromised account may be used by a threat
actor to engage in system network connection discovery in order to increase
their understanding of connected services and systems. This information may be
used to shape follow-up behaviors such as lateral movement or additional
discovery.





linux_rare_kernel_module_arguments

Looks for unusual kernel modules which are often used for stealth.





linux_rare_metadata_process

Looks for anomalous access to the metadata service by an unusual process. The
metadata service may be targeted in order to harvest credentials or user data
scripts containing secrets.





linux_rare_metadata_user

Looks for anomalous access to the metadata service by an unusual user. The
metadata service may be targeted in order to harvest credentials or user data
scripts containing secrets.





linux_rare_sudo_user

Looks for sudo activity from an unusual user context.





linux_rare_user_compiler

Looks for compiler activity by a user context which does not normally run
compilers. This can be ad-hoc software changes or unauthorized software
deployment. This can also be due to local privilege elevation via locally run
exploits or malware activity.





linux_system_information_discovery

Looks for commands related to system information discovery from an unusual user
context. This can be due to uncommon troubleshooting activity or due to a
compromised account. A compromised account may be used to engage in system
information discovery in order to gather detailed information about system
configuration and software versions. This may be a precursor to selection of a
persistence mechanism or a method of privilege elevation.





linux_system_process_discovery

Looks for commands related to system process discovery from an unusual user
context. This can be due to uncommon troubleshooting activity or due to a
compromised account. A compromised account may be used to engage in system
process discovery in order to increase their understanding of software
applications running on a target host or network. This may be a precursor to
selection of a persistence mechanism or a method of privilege elevation.





linux_system_user_discovery

Looks for commands related to system user or owner discovery from an unusual
user context. This can be due to uncommon troubleshooting activity or due to a
compromised account. A compromised account may be used to engage in system owner
or user discovery in order to identify currently active or primary users of a
system. This may be a precursor to additional discovery, credential dumping or
privilege elevation activity.





rare_process_by_host_linux_ecs

Detect unusually rare processes on Linux.






SECURITY: AUDITBEAT AUTHENTICATIONEDIT

Detect suspicious authentication events in Auditbeat data.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

Name Description Job Datafeed

suspicious_login_activity_ecs

Identifies an unusually high number of authentication attempts.






SECURITY: AUTHENTICATIONEDIT

Detect anomalous activity in your ECS-compatible authentication logs.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

By default, when you create these job in the Elastic Security app, it uses a
data view that applies to multiple indices. To get the same results if you use
the Machine Learning app, create a similar data view then select it in the job
wizard.

Name Description Job Datafeed

auth_high_count_logon_events

Looks for an unusually large spike in successful authentication events. This can
be due to password spraying, user enumeration or brute force activity.





auth_high_count_logon_events_for_a_source_ip

Looks for an unusually large spike in successful authentication events from a
particular source IP address. This can be due to password spraying, user
enumeration or brute force activity.





auth_high_count_logon_fails

Looks for an unusually large spike in authentication failure events. This can be
due to password spraying, user enumeration or brute force activity and may be a
precursor to account takeover or credentialed access.





auth_rare_hour_for_a_user

Looks for a user logging in at a time of day that is unusual for the user. This
can be due to credentialed access via a compromised account when the user and
the threat actor are in different time zones. In addition, unauthorized user
activity often takes place during non-business hours.





auth_rare_source_ip_for_a_user

Looks for a user logging in from an IP address that is unusual for the user.
This can be due to credentialed access via a compromised account when the user
and the threat actor are in different locations. An unusual source IP address
for a username could also be due to lateral movement when a compromised account
is used to pivot between hosts.





auth_rare_user

Looks for an unusual user name in the authentication logs. An unusual user name
is one way of detecting credentialed access by means of a new or dormant user
account. A user account that is normally inactive, because the user has left the
organization, which becomes active, may be due to credentialed access using a
compromised account password. Threat actors will sometimes also create new users
as a means of persisting in a compromised web application.






SECURITY: CLOUDTRAILEDIT

Detect suspicious activity recorded in your CloudTrail logs.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

Name Description Job Datafeed

high_distinct_count_error_message

Looks for a spike in the rate of an error message which may simply indicate an
impending service failure but these can also be byproducts of attempted or
successful persistence, privilege escalation, defense evasion, discovery,
lateral movement, or collection activity by a threat actor.





rare_error_code

Looks for unusual errors. Rare and unusual errors may simply indicate an
impending service failure but they can also be byproducts of attempted or
successful persistence, privilege escalation, defense evasion, discovery,
lateral movement, or collection activity by a threat actor.





rare_method_for_a_city

Looks for AWS API calls that, while not inherently suspicious or abnormal, are
sourcing from a geolocation (city) that is unusual. This can be the result of
compromised credentials or keys.





rare_method_for_a_country

Looks for AWS API calls that, while not inherently suspicious or abnormal, are
sourcing from a geolocation (country) that is unusual. This can be the result of
compromised credentials or keys.





rare_method_for_a_username

Looks for AWS API calls that, while not inherently suspicious or abnormal, are
sourcing from a user context that does not normally call the method. This can be
the result of compromised credentials or keys as someone uses a valid account to
persist, move laterally, or exfil data.






SECURITY: LINUXEDIT

Detect suspicious activity using ECS Linux events.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

In 7.11 or later versions, use these jobs instead of the Security: Auditbeat
jobs.[1]

Name Description Job Datafeed

v2_linux_anomalous_network_port_activity_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for unusual destination port activity that could
indicate command-and-control, persistence mechanism, or data exfiltration
activity.





v2_linux_anomalous_process_all_hosts_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for processes that are unusual to all Linux hosts. Such
unusual processes may indicate unauthorized services, malware, or persistence
mechanisms.





v2_linux_anomalous_user_name_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Rare and unusual users that are not normally active may
indicate unauthorized changes or activity by an unauthorized user which may be
credentialed access or lateral movement.





v2_linux_rare_metadata_process

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for anomalous access to the metadata service by an
unusual process. The metadata service may be targeted in order to harvest
credentials or user data scripts containing secrets.





v2_linux_rare_metadata_user

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for anomalous access to the metadata service by an
unusual user. The metadata service may be targeted in order to harvest
credentials or user data scripts containing secrets.





v2_rare_process_by_host_linux_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for processes that are unusual to a particular Linux
host. Such unusual processes may indicate unauthorized services, malware, or
persistence mechanisms.






SECURITY: NETWORKEDIT

Detect anomalous network activity in your ECS-compatible network logs.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

By default, when you create these jobs in the Elastic Security app, it uses a
data view that applies to multiple indices. To get the same results if you use
the Machine Learning app, create a similar data view then select it in the job
wizard.

Name Description Job Datafeed

high_count_by_destination_country

Looks for an unusually large spike in network activity to one destination
country in the network logs. This could be due to unusually large amounts of
reconnaissance or enumeration traffic. Data exfiltration activity may also
produce such a surge in traffic to a destination country which does not normally
appear in network traffic or business work-flows. Malware instances and
persistence mechanisms may communicate with command-and-control (C2)
infrastructure in their country of origin, which may be an unusual destination
country for the source network.





high_count_network_denies

Looks for an unusually large spike in network traffic that was denied by network
ACLs or firewall rules. Such a burst of denied traffic is usually either 1) a
misconfigured application or firewall or 2) suspicious or malicious activity.
Unsuccessful attempts at network transit, in order to connect to
command-and-control (C2), or engage in data exfiltration, may produce a burst of
failed connections. This could also be due to unusually large amounts of
reconnaissance or enumeration traffic. Denial-of-service attacks or traffic
floods may also produce such a surge in traffic.





high_count_network_events

Looks for an unusually large spike in network traffic. Such a burst of traffic,
if not caused by a surge in business activity, can be due to suspicious or
malicious activity. Large-scale data exfiltration may produce a burst of network
traffic; this could also be due to unusually large amounts of reconnaissance or
enumeration traffic. Denial-of-service attacks or traffic floods may also
produce such a surge in traffic.





rare_destination_country

Looks for an unusual destination country name in the network logs. This can be
due to initial access, persistence, command-and-control, or exfiltration
activity. For example, when a user clicks on a link in a phishing email or opens
a malicious document, a request may be sent to download and run a payload from a
server in a country which does not normally appear in network traffic or
business work-flows. Malware instances and persistence mechanisms may
communicate with command-and-control (C2) infrastructure in their country of
origin, which may be an unusual destination country for the source network.






SECURITY: PACKETBEATEDIT

Detect suspicious network activity in Packetbeat data.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

Name Description Job Datafeed

packetbeat_dns_tunneling

Looks for unusual DNS activity that could indicate command-and-control or data
exfiltration activity.





packetbeat_rare_dns_question

Looks for unusual DNS activity that could indicate command-and-control activity.





packetbeat_rare_server_domain

Looks for unusual HTTP or TLS destination domain activity that could indicate
execution, persistence, command-and-control or data exfiltration activity.





packetbeat_rare_urls

Looks for unusual web browsing URL activity that could indicate execution,
persistence, command-and-control or data exfiltration activity.





packetbeat_rare_user_agent

Looks for unusual HTTP user agent activity that could indicate execution,
persistence, command-and-control or data exfiltration activity.






SECURITY: WINDOWSEDIT

Detects suspicious activity using ECS Windows events.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

If there are additional requirements such as installing the Windows System
Monitor (Sysmon) or auditing process creation in the Windows security event log,
they are listed for each job.

In 7.11 or later versions, use these jobs instead of the Security: Winlogbeat
jobs.[3]

Name Description Job Datafeed

v2_rare_process_by_host_windows_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Detects unusually rare processes on Windows hosts.





v2_windows_anomalous_network_activity_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for unusual processes using the network which could
indicate command-and-control, lateral movement, persistence, or data
exfiltration activity.





v2_windows_anomalous_path_activity_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for activity in unusual paths that may indicate
execution of malware or persistence mechanisms. Windows payloads often execute
from user profile paths.





v2_windows_anomalous_process_all_hosts_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for processes that are unusual to all Windows hosts.
Such unusual processes may indicate execution of unauthorized services, malware,
or persistence mechanisms.





v2_windows_anomalous_process_creation

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for unusual process relationships which may indicate
execution of malware or persistence mechanisms.





v2_windows_anomalous_user_name_ecs

This is a new refactored job which works on ECS compatible events across
multiple indices. Rare and unusual users that are not normally active may
indicate unauthorized changes or activity by an unauthorized user which may be
credentialed access or lateral movement.





v2_windows_rare_metadata_process

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for anomalous access to the metadata service by an
unusual process. The metadata service may be targeted in order to harvest
credentials or user data scripts containing secrets.





v2_windows_rare_metadata_user

This is a new refactored job which works on ECS compatible events across
multiple indices. Looks for anomalous access to the metadata service by an
unusual user. The metadata service may be targeted in order to harvest
credentials or user data scripts containing secrets.






SECURITY: WINLOGBEATEDIT

Detect unusual processes and network activity in Winlogbeat data.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

In 7.11 or later versions, use the Security: Windows jobs instead.[3]

Name Description Job Datafeed

rare_process_by_host_windows_ecs

Detect unusually rare processes on Windows.





windows_anomalous_network_activity_ecs

Looks for unusual processes using the network which could indicate
command-and-control, lateral movement, persistence, or data exfiltration
activity.





windows_anomalous_path_activity_ecs

Looks for activity in unusual paths that may indicate execution of malware or
persistence mechanisms. Windows payloads often execute from user profile paths.





windows_anomalous_process_all_hosts_ecs

Looks for processes that are unusual to all Windows hosts. Such unusual
processes may indicate execution of unauthorized services, malware, or
persistence mechanisms.





windows_anomalous_process_creation

Looks for unusual process relationships which may indicate execution of malware
or persistence mechanisms.





windows_anomalous_script

Looks for unusual powershell scripts that may indicate execution of malware, or
persistence mechanisms.





windows_anomalous_service

Looks for rare and unusual Windows services which may indicate execution of
unauthorized services, malware, or persistence mechanisms.





windows_anomalous_user_name_ecs

Rare and unusual users that are not normally active may indicate unauthorized
changes or activity by an unauthorized user which may be credentialed access or
lateral movement.





windows_rare_metadata_process

Looks for anomalous access to the metadata service by an unusual process. The
metadata service may be targeted in order to harvest credentials or user data
scripts containing secrets.





windows_rare_metadata_user

Looks for anomalous access to the metadata service by an unusual user. The
metadata service may be targeted in order to harvest credentials or user data
scripts containing secrets.





windows_rare_user_runas_event

Unusual user context switches can be due to privilege escalation.






SECURITY: WINLOGBEAT AUTHENTICATIONEDIT

Detect suspicious authentication events in Winlogbeat data.

In the Machine Learning app, these configurations are available only when data
exists that matches the query specified in the manifest file. In the Elastic
Security app, it looks in the data view specified in the
securitySolution:defaultIndex advanced setting for data that matches the query.

Name Description Job Datafeed

windows_rare_user_type10_remote_login

Unusual RDP (remote desktop protocol) user logins can indicate account takeover
or credentialed access.





[1] If you cannot upgrade all your Beats to version 7.11 or later and you have
both Security: Linux and Security: Auditbeat jobs running, you can avoid
duplication by stopping the following jobs:
linux_anomalous_network_activity_ecs, linux_anomalous_network_port_activity_ecs,
linux_anomalous_process_all_hosts_ecs, linux_anomalous_user_name_ecs,
linux_rare_metadata_process, linux_rare_metadata_user,
rare_process_by_host_linux_ecs.
[2] Some jobs use fields that are not ECS-compliant. These jobs are available
only when you use Beats or the Elastic Agent to ship data.
[3] If you cannot upgrade all your Beats to version 7.11 or later and you have
both Security:Windows jobs and Security:Winlogbeat jobs running, you can avoid
duplication by stopping the following jobs: rare_process_by_host_windows_ecs,
windows_anomalous_network_activity_ecs, windows_anomalous_path_activity_ecs,
windows_anomalous_process_all_hosts_ecs, windows_anomalous_process_creation,
windows_anomalous_user_name_ecs, windows_rare_metadata_process,
windows_rare_metadata_user
« Anomaly Detection with Machine Learning Optimizing anomaly results »


ON THIS PAGE

 * Security: Auditbeat
 * Security: Auditbeat authentication
 * Security: Authentication
 * Security: CloudTrail
 * Security: Linux
 * Security: Network
 * Security: Packetbeat
 * Security: Windows
 * Security: Winlogbeat
 * Security: Winlogbeat authentication


ELASTICON SOLUTION SEMINAR




Join us for free to get the latest from Elastic's 8.x series, see live demos,
and hear user stories virtually on April 28.

Register now


RECOMMENDED FOR YOU

Distributed Elastic Architectures

Elastic 7.16: Streamlined data integrations drive results that matter

Accelerate app development and defend against novel attacks with Elastic 8.

Twilio

Elastic 8.0: A new era of speed, scale, relevance, and simplicity

 * Elastic Security: master8.1 (current)7.17other versionsother versions:
   master8.28.1 (current)8.07.177.167.157.147.137.127.117.107.97.8
 * Elastic Security overview
 * What’s new in 8.1
 * Upgrade Elastic Security
 * Post-upgrade steps (optional)
   * Enable analyze event feature after an upgrade
   * Migrate detection alerts enriched with threat intelligence
   * Index template script
   * Update a deprecated ServiceNow connector
 * Get started with Elastic Security
   * Elastic Security system requirements
     * Detections prerequisites and requirements
     * Cases prerequisites
     * Machine learning job and rule requirements
     * Configure network map data
     * Enable Full Disk Access for the Endgame sensor
   * Spaces and Elastic Security
   * Ingest data to Elastic Security
   * Configure and install the Endpoint Security integration
   * Install Elastic Endpoint manually
   * Configure the Endpoint Security integration policy
     * Turn off Endpoint Security diagnostic data
   * Enable threat intelligence integrations
   * Configure advanced settings
   * Uninstall an endpoint
 * Elastic Security UI
 * Explore
   * Network page overview
   * Hosts page overview
 * Anomaly Detection with Machine Learning
   * Prebuilt job reference
   * Optimizing anomaly results
 * Detections and alerts
   * Create a detection rule
   * Manage detection rules
   * Monitor and troubleshoot rule executions
   * Rule exceptions and value lists
   * About building block rules
   * Manage detection alerts
   * Visual event analyzer
   * Query alert indices
   * Tune detection rules
   * Prebuilt rule changes per release
   * Prebuilt rule reference
     * AWS Access Secret in Secrets Manager
     * AWS CloudTrail Log Created
     * AWS CloudTrail Log Deleted
     * AWS CloudTrail Log Suspended
     * AWS CloudTrail Log Updated
     * AWS CloudWatch Alarm Deletion
     * AWS CloudWatch Log Group Deletion
     * AWS CloudWatch Log Stream Deletion
     * AWS Config Service Tampering
     * AWS Configuration Recorder Stopped
     * AWS EC2 Encryption Disabled
     * AWS EC2 Flow Log Deletion
     * AWS EC2 Full Network Packet Capture Detected
     * AWS EC2 Network Access Control List Creation
     * AWS EC2 Network Access Control List Deletion
     * AWS EC2 Snapshot Activity
     * AWS EC2 VM Export Failure
     * AWS EFS File System or Mount Deleted
     * AWS ElastiCache Security Group Created
     * AWS ElastiCache Security Group Modified or Deleted
     * AWS EventBridge Rule Disabled or Deleted
     * AWS Execution via System Manager
     * AWS GuardDuty Detector Deletion
     * AWS IAM Assume Role Policy Update
     * AWS IAM Brute Force of Assume Role Policy
     * AWS IAM Deactivation of MFA Device
     * AWS IAM Group Creation
     * AWS IAM Group Deletion
     * AWS IAM Password Recovery Requested
     * AWS IAM User Addition to Group
     * AWS Management Console Brute Force of Root User Identity
     * AWS Management Console Root Login
     * AWS RDS Cluster Creation
     * AWS RDS Cluster Deletion
     * AWS RDS Instance Creation
     * AWS RDS Instance/Cluster Stoppage
     * AWS RDS Security Group Creation
     * AWS RDS Security Group Deletion
     * AWS RDS Snapshot Export
     * AWS RDS Snapshot Restored
     * AWS Root Login Without MFA
     * AWS Route 53 Domain Transfer Lock Disabled
     * AWS Route 53 Domain Transferred to Another Account
     * AWS Route Table Created
     * AWS Route Table Modified or Deleted
     * AWS Route53 private hosted zone associated with a VPC
     * AWS S3 Bucket Configuration Deletion
     * AWS SAML Activity
     * AWS STS GetSessionToken Abuse
     * AWS Security Group Configuration Change Detection
     * AWS Security Token Service (STS) AssumeRole Usage
     * AWS WAF Access Control List Deletion
     * AWS WAF Rule or Rule Group Deletion
     * Abnormally Large DNS Response
     * Access of Stored Browser Credentials
     * Access to Keychain Credentials Directories
     * Account Password Reset Remotely
     * AdFind Command Activity
     * Adding Hidden File Attribute via Attrib
     * AdminSDHolder Backdoor
     * Administrator Privileges Assigned to an Okta Group
     * Administrator Role Assigned to an Okta User
     * Adobe Hijack Persistence
     * Adversary Behavior - Detected - Elastic Endgame
     * Agent Spoofing - Mismatched Agent ID
     * Agent Spoofing - Multiple Hosts Using Same Agent
     * Anomalous Kernel Module Activity
     * Anomalous Linux Compiler Activity
     * Anomalous Process For a Linux Population
     * Anomalous Process For a Windows Population
     * Anomalous Windows Process Creation
     * Apple Script Execution followed by Network Connection
     * Apple Scripting Execution with Administrator Privileges
     * Application Added to Google Workspace Domain
     * Attempt to Create Okta API Token
     * Attempt to Deactivate MFA for an Okta User Account
     * Attempt to Deactivate an Okta Application
     * Attempt to Deactivate an Okta Network Zone
     * Attempt to Deactivate an Okta Policy
     * Attempt to Deactivate an Okta Policy Rule
     * Attempt to Delete an Okta Application
     * Attempt to Delete an Okta Network Zone
     * Attempt to Delete an Okta Policy
     * Attempt to Delete an Okta Policy Rule
     * Attempt to Disable Gatekeeper
     * Attempt to Disable IPTables or Firewall
     * Attempt to Disable Syslog Service
     * Attempt to Enable the Root Account
     * Attempt to Install Root Certificate
     * Attempt to Modify an Okta Application
     * Attempt to Modify an Okta Network Zone
     * Attempt to Modify an Okta Policy
     * Attempt to Modify an Okta Policy Rule
     * Attempt to Mount SMB Share via Command Line
     * Attempt to Remove File Quarantine Attribute
     * Attempt to Reset MFA Factors for an Okta User Account
     * Attempt to Revoke Okta API Token
     * Attempt to Unload Elastic Endpoint Security Kernel Extension
     * Attempted Bypass of Okta MFA
     * Attempts to Brute Force a Microsoft 365 User Account
     * Attempts to Brute Force an Okta User Account
     * Auditd Login Attempt at Forbidden Time
     * Auditd Login from Forbidden Location
     * Auditd Max Failed Login Attempts
     * Auditd Max Login Sessions
     * Authorization Plugin Modification
     * Azure AD Global Administrator Role Assigned
     * Azure Active Directory High Risk Sign-in
     * Azure Active Directory High Risk User Sign-in Heuristic
     * Azure Active Directory PowerShell Sign-in
     * Azure Alert Suppression Rule Created or Modified
     * Azure Application Credential Modification
     * Azure Automation Account Created
     * Azure Automation Runbook Created or Modified
     * Azure Automation Runbook Deleted
     * Azure Automation Webhook Created
     * Azure Blob Container Access Level Modification
     * Azure Blob Permissions Modification
     * Azure Command Execution on Virtual Machine
     * Azure Conditional Access Policy Modified
     * Azure Diagnostic Settings Deletion
     * Azure Event Hub Authorization Rule Created or Updated
     * Azure Event Hub Deletion
     * Azure External Guest User Invitation
     * Azure Firewall Policy Deletion
     * Azure Frontdoor Web Application Firewall (WAF) Policy Deleted
     * Azure Full Network Packet Capture Detected
     * Azure Global Administrator Role Addition to PIM User
     * Azure Key Vault Modified
     * Azure Kubernetes Events Deleted
     * Azure Kubernetes Pods Deleted
     * Azure Kubernetes Rolebindings Created
     * Azure Network Watcher Deletion
     * Azure Privilege Identity Management Role Modified
     * Azure Resource Group Deletion
     * Azure Service Principal Addition
     * Azure Service Principal Credentials Added
     * Azure Storage Account Key Regenerated
     * Azure Virtual Network Device Modified or Deleted
     * Base16 or Base32 Encoding/Decoding Activity
     * Bash Shell Profile Modification
     * Bypass UAC via Event Viewer
     * Clearing Windows Console History
     * Clearing Windows Event Logs
     * Cobalt Strike Command and Control Beacon
     * Command Execution via SolarWinds Process
     * Command Prompt Network Connection
     * Command Shell Activity Started via RunDLL32
     * Component Object Model Hijacking
     * Conhost Spawned By Suspicious Parent Process
     * Connection to Commonly Abused Free SSL Certificate Providers
     * Connection to Commonly Abused Web Services
     * Connection to External Network via Telnet
     * Connection to Internal Network via Telnet
     * Control Panel Process with Unusual Arguments
     * Creation of Hidden Files and Directories
     * Creation of Hidden Launch Agent or Daemon
     * Creation of Hidden Login Item via Apple Script
     * Creation of a Hidden Local User Account
     * Creation or Modification of Domain Backup DPAPI private key
     * Creation or Modification of Root Certificate
     * Creation or Modification of a new GPO Scheduled Task or Service
     * Credential Acquisition via Registry Hive Dumping
     * Credential Dumping - Detected - Elastic Endgame
     * Credential Dumping - Prevented - Elastic Endgame
     * Credential Manipulation - Detected - Elastic Endgame
     * Credential Manipulation - Prevented - Elastic Endgame
     * CyberArk Privileged Access Security Error
     * CyberArk Privileged Access Security Recommended Monitor
     * DNS Activity to the Internet
     * DNS Tunneling
     * DNS-over-HTTPS Enabled via Registry
     * Default Cobalt Strike Team Server Certificate
     * Delete Volume USN Journal with Fsutil
     * Deleting Backup Catalogs with Wbadmin
     * Direct Outbound SMB Connection
     * Disable Windows Event and Security Logs Using Built-in Tools
     * Disable Windows Firewall Rules via Netsh
     * Disabling User Account Control via Registry Modification
     * Disabling Windows Defender Security Settings via PowerShell
     * Domain Added to Google Workspace Trusted Domains
     * Dumping Account Hashes via Built-In Commands
     * Dumping of Keychain Content via Security Command
     * EggShell Backdoor Execution
     * Emond Rules Creation or Modification
     * Enable Host Network Discovery via Netsh
     * Encoded Executable Stored in the Registry
     * Encrypting Files with WinRar or 7z
     * Endpoint Security
     * Enumeration Command Spawned via WMIPrvSE
     * Enumeration of Administrator Accounts
     * Enumeration of Kernel Modules
     * Enumeration of Privileged Local Groups Membership
     * Enumeration of Users or Groups via Built-in Commands
     * Executable File Creation with Multiple Extensions
     * Execution from Unusual Directory - Command Line
     * Execution of COM object via Xwizard
     * Execution of File Written or Modified by Microsoft Office
     * Execution of File Written or Modified by PDF Reader
     * Execution of Persistent Suspicious Program
     * Execution via Electron Child Process Node.js Module
     * Execution via MSSQL xp_cmdshell Stored Procedure
     * Execution via TSClient Mountpoint
     * Execution via local SxS Shared Module
     * Execution with Explicit Credentials via Scripting
     * Exploit - Detected - Elastic Endgame
     * Exploit - Prevented - Elastic Endgame
     * Exporting Exchange Mailbox via PowerShell
     * External Alerts
     * External IP Lookup from Non-Browser Process
     * File Deletion via Shred
     * File Permission Modification in Writable Directory
     * File and Directory Discovery
     * Finder Sync Plugin Registered and Enabled
     * GCP Firewall Rule Creation
     * GCP Firewall Rule Deletion
     * GCP Firewall Rule Modification
     * GCP IAM Custom Role Creation
     * GCP IAM Role Deletion
     * GCP IAM Service Account Key Deletion
     * GCP Kubernetes Rolebindings Created or Patched
     * GCP Logging Bucket Deletion
     * GCP Logging Sink Deletion
     * GCP Logging Sink Modification
     * GCP Pub/Sub Subscription Creation
     * GCP Pub/Sub Subscription Deletion
     * GCP Pub/Sub Topic Creation
     * GCP Pub/Sub Topic Deletion
     * GCP Service Account Creation
     * GCP Service Account Deletion
     * GCP Service Account Disabled
     * GCP Service Account Key Creation
     * GCP Storage Bucket Configuration Modification
     * GCP Storage Bucket Deletion
     * GCP Storage Bucket Permissions Modification
     * GCP Virtual Private Cloud Network Deletion
     * GCP Virtual Private Cloud Route Creation
     * GCP Virtual Private Cloud Route Deletion
     * Google Workspace API Access Granted via Domain-Wide Delegation of
       Authority
     * Google Workspace Admin Role Assigned to a User
     * Google Workspace Admin Role Deletion
     * Google Workspace Custom Admin Role Created
     * Google Workspace MFA Enforcement Disabled
     * Google Workspace Password Policy Modified
     * Google Workspace Role Modified
     * Group Policy Abuse for Privilege Addition
     * Halfbaked Command and Control Beacon
     * High Number of Okta User Password Reset or Unlock Attempts
     * High Number of Process and/or Service Terminations
     * Hosts File Modified
     * Hping Process Activity
     * IIS HTTP Logging Disabled
     * IPSEC NAT Traversal Port Activity
     * Image File Execution Options Injection
     * ImageLoad via Windows Update Auto Update Client
     * Inbound Connection to an Unsecure Elasticsearch Node
     * Incoming DCOM Lateral Movement via MSHTA
     * Incoming DCOM Lateral Movement with MMC
     * Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows
     * Incoming Execution via PowerShell Remoting
     * Incoming Execution via WinRM Remote Shell
     * InstallUtil Process Making Network Connections
     * Installation of Custom Shim Databases
     * Installation of Security Support Provider
     * Interactive Terminal Spawned via Perl
     * Interactive Terminal Spawned via Python
     * KRBTGT Delegation Backdoor
     * Kerberos Cached Credentials Dumping
     * Kerberos Preauthentication Disabled for User
     * Kerberos Traffic from Unusual Process
     * Kernel Module Removal
     * Keychain Password Retrieval via Command Line
     * LSASS Memory Dump Creation
     * Lateral Movement via Startup Folder
     * Lateral Tool Transfer
     * Launch Agent Creation or Modification and Immediate Loading
     * LaunchDaemon Creation or Modification and Immediate Loading
     * Local Scheduled Task Creation
     * MFA Disabled for Google Workspace Organization
     * MS Office Macro Security Registry Modifications
     * Malware - Detected - Elastic Endgame
     * Malware - Prevented - Elastic Endgame
     * Microsoft 365 Exchange Anti-Phish Policy Deletion
     * Microsoft 365 Exchange Anti-Phish Rule Modification
     * Microsoft 365 Exchange DKIM Signing Configuration Disabled
     * Microsoft 365 Exchange DLP Policy Removed
     * Microsoft 365 Exchange Malware Filter Policy Deletion
     * Microsoft 365 Exchange Malware Filter Rule Modification
     * Microsoft 365 Exchange Management Group Role Assignment
     * Microsoft 365 Exchange Safe Attachment Rule Disabled
     * Microsoft 365 Exchange Safe Link Policy Disabled
     * Microsoft 365 Exchange Transport Rule Creation
     * Microsoft 365 Exchange Transport Rule Modification
     * Microsoft 365 Global Administrator Role Assigned
     * Microsoft 365 Inbox Forwarding Rule Created
     * Microsoft 365 Potential ransomware activity
     * Microsoft 365 Teams Custom Application Interaction Allowed
     * Microsoft 365 Teams External Access Enabled
     * Microsoft 365 Teams Guest Access Enabled
     * Microsoft 365 Unusual Volume of File Deletion
     * Microsoft 365 User Restricted from Sending Email
     * Microsoft Build Engine Loading Windows Credential Libraries
     * Microsoft Build Engine Started an Unusual Process
     * Microsoft Build Engine Started by a Script Process
     * Microsoft Build Engine Started by a System Process
     * Microsoft Build Engine Started by an Office Application
     * Microsoft Build Engine Using an Alternate Name
     * Microsoft Exchange Server UM Spawning Suspicious Processes
     * Microsoft Exchange Server UM Writing Suspicious Files
     * Microsoft Exchange Worker Spawning Suspicious Processes
     * Microsoft IIS Connection Strings Decryption
     * Microsoft IIS Service Account Password Dumped
     * Microsoft Windows Defender Tampering
     * Mimikatz Memssp Log File Detected
     * Modification of AmsiEnable Registry Key
     * Modification of Boot Configuration
     * Modification of Dynamic Linker Preload Shared Object
     * Modification of Environment Variable via Launchctl
     * Modification of OpenSSH Binaries
     * Modification of Safari Settings via Defaults Command
     * Modification of Standard Authentication Module or Configuration
     * Modification of WDigest Security Provider
     * Modification or Removal of an Okta Application Sign-On Policy
     * Mounting Hidden or WebDav Remote Shares
     * MsBuild Making Network Connections
     * Mshta Making Network Connections
     * Multi-Factor Authentication Disabled for an Azure User
     * NTDS or SAM Database File Copied
     * Net command via SYSTEM account
     * Netcat Network Activity
     * Network Connection via Certutil
     * Network Connection via Compiled HTML File
     * Network Connection via MsXsl
     * Network Connection via Registration Utility
     * Network Connection via Signed Binary
     * Network Logon Provider Registry Modification
     * Network Traffic to Rare Destination Country
     * New ActiveSyncAllowedDeviceID Added via PowerShell
     * New or Modified Federation Domain
     * Nping Process Activity
     * NullSessionPipe Registry Modification
     * O365 Email Reported by User as Malware or Phish
     * O365 Excessive Single Sign-On Logon Errors
     * O365 Exchange Suspicious Mailbox Right Delegation
     * O365 Mailbox Audit Logging Bypass
     * Okta Brute Force or Password Spraying Attack
     * OneDrive Malware File Upload
     * Outbound Scheduled Task Activity via PowerShell
     * Parent Process PID Spoofing
     * Peripheral Device Discovery
     * Permission Theft - Detected - Elastic Endgame
     * Permission Theft - Prevented - Elastic Endgame
     * Persistence via BITS Job Notify Cmdline
     * Persistence via DirectoryService Plugin Modification
     * Persistence via Docker Shortcut Modification
     * Persistence via Folder Action Script
     * Persistence via Hidden Run Key Detected
     * Persistence via KDE AutoStart Script or Desktop File Modification
     * Persistence via Login or Logout Hook
     * Persistence via Microsoft Office AddIns
     * Persistence via Microsoft Outlook VBA
     * Persistence via Scheduled Job Creation
     * Persistence via TelemetryController Scheduled Task Hijack
     * Persistence via Update Orchestrator Service Hijack
     * Persistence via WMI Event Subscription
     * Persistence via WMI Standard Registry Provider
     * Persistent Scripts in the Startup Directory
     * Port Forwarding Rule Addition
     * Possible Consent Grant Attack via Azure-Registered Application
     * Possible FIN7 DGA Command and Control Behavior
     * Possible Okta DoS Attack
     * Potential Abuse of Repeated MFA Push Notifications
     * Potential Admin Group Account Addition
     * Potential Application Shimming via Sdbinst
     * Potential Command and Control via Internet Explorer
     * Potential Cookies Theft via Browser Debugging
     * Potential Credential Access via DCSync
     * Potential Credential Access via DuplicateHandle in LSASS
     * Potential Credential Access via LSASS Memory Dump
     * Potential Credential Access via Renamed COM+ Services DLL
     * Potential Credential Access via Windows Utilities
     * Potential DLL Side-Loading via Microsoft Antimalware Service Executable
     * Potential DLL SideLoading via Trusted Microsoft Programs
     * Potential DNS Tunneling via Iodine
     * Potential DNS Tunneling via NsLookup
     * Potential Disabling of SELinux
     * Potential Evasion via Filter Manager
     * Potential Hidden Local User Account Creation
     * Potential JAVA/JNDI Exploitation Attempt
     * Potential Kerberos Attack via Bifrost
     * Potential LSA Authentication Package Abuse
     * Potential LSASS Clone Creation via PssCaptureSnapShot
     * Potential LSASS Memory Dump via PssCaptureSnapShot
     * Potential Microsoft Office Sandbox Evasion
     * Potential Modification of Accessibility Binaries
     * Potential OpenSSH Backdoor Logging Activity
     * Potential Password Spraying of Microsoft 365 User Accounts
     * Potential Persistence via Atom Init Script Modification
     * Potential Persistence via Login Hook
     * Potential Persistence via Periodic Tasks
     * Potential Persistence via Time Provider Modification
     * Potential Port Monitor or Print Processor Registration Abuse
     * Potential PrintNightmare Exploit Registry Modification
     * Potential PrintNightmare File Modification
     * Potential Privacy Control Bypass via Localhost Secure Copy
     * Potential Privacy Control Bypass via TCCDB Modification
     * Potential Privilege Escalation via InstallerFileTakeOver
     * Potential Privilege Escalation via PKEXEC
     * Potential Privilege Escalation via Sudoers File Modification
     * Potential Privileged Escalation via SamAccountName Spoofing
     * Potential Process Herpaderping Attempt
     * Potential Process Injection via PowerShell
     * Potential Protocol Tunneling via EarthWorm
     * Potential Remote Desktop Shadowing Activity
     * Potential Remote Desktop Tunneling Detected
     * Potential Reverse Shell Activity via Terminal
     * Potential SSH Brute Force Detected
     * Potential Secure File Deletion via SDelete Utility
     * Potential Shadow Credentials added to AD Object
     * Potential SharpRDP Behavior
     * Potential Shell via Web Server
     * Potential Windows Error Manager Masquerading
     * PowerShell Kerberos Ticket Request
     * PowerShell Keylogging Script
     * PowerShell MiniDump Script
     * PowerShell PSReflect Script
     * PowerShell Script Block Logging Disabled
     * PowerShell Suspicious Discovery Related Windows API Functions
     * PowerShell Suspicious Payload Encoded and Compressed
     * PowerShell Suspicious Script with Audio Capture Capabilities
     * PowerShell Suspicious Script with Screenshot Capabilities
     * Privilege Escalation via Named Pipe Impersonation
     * Privilege Escalation via Rogue Named Pipe Impersonation
     * Privilege Escalation via Root Crontab File Modification
     * Privilege Escalation via Windir Environment Variable
     * Process Activity via Compiled HTML File
     * Process Execution from an Unusual Directory
     * Process Injection - Detected - Elastic Endgame
     * Process Injection - Prevented - Elastic Endgame
     * Process Injection by the Microsoft Build Engine
     * Process Termination followed by Deletion
     * Program Files Directory Masquerading
     * Prompt for Credentials with OSASCRIPT
     * PsExec Network Connection
     * RDP (Remote Desktop Protocol) from the Internet
     * RDP Enabled via Registry
     * RPC (Remote Procedure Call) from the Internet
     * RPC (Remote Procedure Call) to the Internet
     * Ransomware - Detected - Elastic Endgame
     * Ransomware - Prevented - Elastic Endgame
     * Rare AWS Error Code
     * Rare User Logon
     * Registry Persistence via AppCert DLL
     * Registry Persistence via AppInit DLL
     * Remote Desktop Enabled in Windows Firewall
     * Remote Execution via File Shares
     * Remote File Copy to a Hidden Share
     * Remote File Copy via TeamViewer
     * Remote File Download via Desktopimgdownldr Utility
     * Remote File Download via MpCmdRun
     * Remote File Download via PowerShell
     * Remote File Download via Script Interpreter
     * Remote SSH Login Enabled via systemsetup Command
     * Remote Scheduled Task Creation
     * Remote System Discovery Commands
     * Remotely Started Services via RPC
     * Renamed AutoIt Scripts Interpreter
     * Roshal Archive (RAR) or PowerShell File Downloaded from the Internet
     * SIP Provider Modification
     * SMB (Windows File Sharing) Activity to the Internet
     * SMTP on Port 26/TCP
     * SSH Authorized Keys File Modification
     * SUNBURST Command and Control Activity
     * Scheduled Task Created by a Windows Script
     * Scheduled Task Execution at Scale via GPO
     * Scheduled Tasks AT Command Enabled
     * Screensaver Plist File Modified by Unexpected Process
     * Searching for Saved Credentials via VaultCmd
     * Security Software Discovery using WMIC
     * Security Software Discovery via Grep
     * Sensitive Files Compression
     * Sensitive Privilege SeEnableDelegationPrivilege assigned to a User
     * Service Command Lateral Movement
     * Service Control Spawned via Script Interpreter
     * Setuid / Setgid Bit Set via chmod
     * SharePoint Malware File Upload
     * Shell Execution via Apple Scripting
     * Shortcut File Written or Modified for Persistence
     * SoftwareUpdate Preferences Modification
     * SolarWinds Process Disabling Services via Registry
     * Spike in AWS Error Messages
     * Spike in Failed Logon Events
     * Spike in Firewall Denies
     * Spike in Logon Events
     * Spike in Logon Events from a Source IP
     * Spike in Network Traffic
     * Spike in Network Traffic To a Country
     * Startup Folder Persistence via Unsigned Process
     * Startup or Run Key Registry Modification
     * Startup/Logon Script added to Group Policy Object
     * Strace Process Activity
     * Sublime Plugin or Application Script Modification
     * Sudo Heap-Based Buffer Overflow Attempt
     * Sudoers File Modification
     * Suspicious .NET Code Compilation
     * Suspicious .NET Reflection via PowerShell
     * Suspicious Activity Reported by Okta User
     * Suspicious Automator Workflows Execution
     * Suspicious Browser Child Process
     * Suspicious Calendar File Modification
     * Suspicious CertUtil Commands
     * Suspicious Child Process of Adobe Acrobat Reader Update Service
     * Suspicious Cmd Execution via WMI
     * Suspicious DLL Loaded for Persistence or Privilege Escalation
     * Suspicious Emond Child Process
     * Suspicious Endpoint Security Parent Process
     * Suspicious Execution - Short Program Name
     * Suspicious Execution from a Mounted Device
     * Suspicious Execution via Scheduled Task
     * Suspicious Explorer Child Process
     * Suspicious Hidden Child Process of Launchd
     * Suspicious Image Load (taskschd.dll) from MS Office
     * Suspicious ImagePath Service Creation
     * Suspicious JAVA Child Process
     * Suspicious MS Office Child Process
     * Suspicious MS Outlook Child Process
     * Suspicious Managed Code Hosting Process
     * Suspicious PDF Reader Child Process
     * Suspicious Portable Executable Encoded in Powershell Script
     * Suspicious PowerShell Engine ImageLoad
     * Suspicious Powershell Script
     * Suspicious Print Spooler File Deletion
     * Suspicious Print Spooler Point and Print DLL
     * Suspicious PrintSpooler SPL File Created
     * Suspicious PrintSpooler Service Executable File Creation
     * Suspicious Process Access via Direct System Call
     * Suspicious Process Creation CallTrace
     * Suspicious Process Execution via Renamed PsExec Executable
     * Suspicious Process from Conhost
     * Suspicious RDP ActiveX Client Loaded
     * Suspicious Script Object Execution
     * Suspicious SolarWinds Child Process
     * Suspicious Startup Shell Folder Modification
     * Suspicious WMI Image Load from MS Office
     * Suspicious WMIC XSL Script Execution
     * Suspicious WerFault Child Process
     * Suspicious Zoom Child Process
     * Suspicious macOS MS Office Child Process
     * Svchost spawning Cmd
     * Symbolic Link to Shadow Copy Created
     * System Log File Deletion
     * System Shells via Services
     * SystemKey Access via Command Line
     * TCC Bypass via Mounted APFS Snapshot Access
     * Tampering of Bash Command-Line History
     * Telnet Port Activity
     * Third-party Backup Files Deleted via Unexpected Process
     * Threat Detected by Okta ThreatInsight
     * Threat Intel Filebeat Module (v8.x) Indicator Match
     * Threat Intel Indicator Match
     * Timestomping using Touch Command
     * UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
     * UAC Bypass Attempt via Privileged IFileOperation COM Interface
     * UAC Bypass Attempt via Windows Directory Masquerading
     * UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
     * UAC Bypass via DiskCleanup Scheduled Task Hijack
     * UAC Bypass via ICMLuaUtil Elevated COM Interface
     * UAC Bypass via Windows Firewall Snap-In Hijack
     * Unauthorized Access to an Okta Application
     * Uncommon Registry Persistence Change
     * Unexpected Child Process of macOS Screensaver Engine
     * Unusual AWS Command for a User
     * Unusual Child Process from a System Virtual Process
     * Unusual Child Process of dns.exe
     * Unusual Child Processes of RunDLL32
     * Unusual City For an AWS Command
     * Unusual Country For an AWS Command
     * Unusual DNS Activity
     * Unusual Executable File Creation by a System Critical Process
     * Unusual File Creation - Alternate Data Stream
     * Unusual File Modification by dns.exe
     * Unusual Hour for a User to Logon
     * Unusual Linux Network Activity
     * Unusual Linux Network Connection Discovery
     * Unusual Linux Network Port Activity
     * Unusual Linux Network Service
     * Unusual Linux Process Calling the Metadata Service
     * Unusual Linux Process Discovery Activity
     * Unusual Linux System Information Discovery Activity
     * Unusual Linux System Network Configuration Discovery
     * Unusual Linux System Owner or User Discovery Activity
     * Unusual Linux User Calling the Metadata Service
     * Unusual Linux Username
     * Unusual Linux Web Activity
     * Unusual Login Activity
     * Unusual Network Activity from a Windows System Binary
     * Unusual Network Connection via DllHost
     * Unusual Network Connection via RunDLL32
     * Unusual Network Destination Domain Name
     * Unusual Parent Process for cmd.exe
     * Unusual Parent-Child Relationship
     * Unusual Persistence via Services Registry
     * Unusual Print Spooler Child Process
     * Unusual Process Execution - Temp
     * Unusual Process Execution Path - Alternate Data Stream
     * Unusual Process For a Linux Host
     * Unusual Process For a Windows Host
     * Unusual Process Network Connection
     * Unusual Service Host Child Process - Childless Service
     * Unusual Source IP for a User to Logon from
     * Unusual Sudo Activity
     * Unusual Web Request
     * Unusual Web User Agent
     * Unusual Windows Network Activity
     * Unusual Windows Path Activity
     * Unusual Windows Process Calling the Metadata Service
     * Unusual Windows Remote User
     * Unusual Windows Service
     * Unusual Windows User Calling the Metadata Service
     * Unusual Windows User Privilege Elevation Activity
     * Unusual Windows Username
     * User Account Creation
     * User Added as Owner for Azure Application
     * User Added as Owner for Azure Service Principal
     * User Added to Privileged Group in Active Directory
     * VNC (Virtual Network Computing) from the Internet
     * VNC (Virtual Network Computing) to the Internet
     * Virtual Machine Fingerprinting
     * Virtual Machine Fingerprinting via Grep
     * Virtual Private Network Connection Attempt
     * Volume Shadow Copy Deleted or Resized via VssAdmin
     * Volume Shadow Copy Deletion via PowerShell
     * Volume Shadow Copy Deletion via WMIC
     * WMI Incoming Lateral Movement
     * Web Application Suspicious Activity: No User Agent
     * Web Application Suspicious Activity: POST Request Declined
     * Web Application Suspicious Activity: Unauthorized Method
     * Web Application Suspicious Activity: sqlmap User Agent
     * WebProxy Settings Modification
     * WebServer Access Logs Deleted
     * Webshell Detection: Script Process Child of Common Web Processes
     * Whitespace Padding in Process Command Line
     * Whoami Process Activity
     * Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)
     * Windows Defender Disabled via Registry Modification
     * Windows Defender Exclusions Added via PowerShell
     * Windows Event Logs Cleared
     * Windows Firewall Disabled via PowerShell
     * Windows Network Enumeration
     * Windows Script Executing PowerShell
     * Windows Script Interpreter Executing Process via WMI
     * Windows Service Installed via an Unusual Client
     * Zoom Meeting with no Passcode
     * macOS Installer Spawns Network Event
   * Downloadable rule updates
     * Update v0.13.1
     * Update v0.13.2
     * Update v0.13.3
     * Update v0.14.1
     * Update v0.14.2
     * Update v0.14.3
 * Investigate
   * Investigate events in Timeline
   * About Timeline templates
   * Cases
   * Configure external connections
 * Manage
   * Endpoints
     * Host isolation
   * Trusted applications
   * Event filters
   * Host isolation exceptions
 * Elastic Security APIs
   * Detections API
     * Create rule
     * Get rule
     * Find rules
     * Update rule
     * Delete rule
     * Bulk rule actions
     * Index endpoint
     * Tags endpoint
     * Import rules
     * Export rules
     * Privileges endpoint
     * Signals endpoint
     * Prebuilt rules
   * Exceptions API
     * Create exception container
     * Create exception item
     * Find exception containers
     * Find exception items
     * Get exception container
     * Get exception item
     * Update exception container
     * Summary exception container
     * Update exception item
     * Delete exception container
     * Delete exception item
     * Lists index endpoint
   * Lists API
     * Create list container
     * Create list item
     * Import list items
     * Find list containers
     * Find list items
     * Get list container
     * Get list item
     * Update list container
     * Update list item
     * Export list items
     * Delete list container
     * Delete list item
   * Detection Alerts Migration API
   * Timeline API
     * Get Timelines or Timeline templates
     * Get Timeline / Timeline template by savedObjectId
     * Get Timeline template by templateTimelineId
     * Create Timeline or Timeline template
     * Add a note to an existing Timeline
     * Pin an event to an existing Timeline
     * Delete Timelines or Timeline templates
     * Import timelines and timeline templates
   * Cases API
     * Create case
     * Add comment
     * Update case
     * Update comment
     * Find cases
     * Get case
     * Get all case comments
     * Get comment
     * Get all case activity
     * Get tags
     * Get reporters
     * Get status
     * Delete comment
     * Delete all comments
     * Delete case
     * Set default Elastic Security UI connector
     * Update case configurations
     * Get current connector
     * Find connectors
     * Push case
     * Find cases by alert
     * Find All Alerts Attached to a Case
   * Actions API (for pushing cases to external systems)
     * Create connector
     * Update connector
     * Create or update an external incident
   * Endpoint management API
     * Get endpoint
     * List endpoints
     * Isolate a host
     * Release an isolated host
     * Trusted applications
     * Event filters
     * Host isolation exceptions
 * Elastic Security fields and object schemas
   * Elastic Security ECS field reference
   * Timeline schema
   * Alert schema
 * Troubleshooting
   * Detection rules
   * Management tools
 * Technical preview
   * Host risk score
   * Network Beaconing
 * Release notes
   * 8.1
   * 8.0

SUBSCRIBE TO OUR NEWSLETTER

MarketoFEForm

*






 




Sign up

Follow us
 * 
 * 
 * 
 * 


PRODUCTS & SOLUTIONS

 * Enterprise Search
 * Observability
 * Security
 * Elastic Stack
 * Elasticsearch
 * Kibana
 * Integrations
 * Subscriptions
 * Pricing


COMPANY

 * Careers
   
   
   WE'RE HIRING

 * Board of Directors
 * Contact


RESOURCES

 * Documentation
 * What is the ELK Stack?
 * What is Elasticsearch?
 * Migrating from Splunk
 * Compare AWS Elasticsearch
 * Public Sector

Follow us
 * 
 * 
 * 
 * 

Language

DeutschEnglishEspañolFrançais日本語한국어简体中文PortuguêsEnglish

 * Trademarks
 * Terms of Use
 * Privacy
 * Sitemap

© 2022. Elasticsearch B.V. All Rights Reserved

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and
in other countries.

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo
are trademarks of the Apache Software Foundation in the United States and/or
other countries.

© 2022. Elasticsearch B.V. All Rights Reserved


Press again to continue 0/1
Notice

We and selected third parties use cookies or similar technologies for technical
purposes and, with your consent, for other purposes as specified in the cookie
policy.

Learn more and customize
RejectAccept