Skip to content

Change description and name of problemchild ML detection-rules #4545

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sodhikirti07 merged 3 commits into from
Mar 20, 2025
Merged

Change description and name of problemchild ML detection-rules #4545

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
597c41e
Changed description and name of problemchild ML detection-rules
sodhikirti07 Mar 19, 2025
b4ad9d9
Merge branch 'main' into update_problemchild_rules_description
shashank-elastic Mar 20, 2025
3771407
updated rule name in investigation guide
sodhikirti07 Mar 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions ...rations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@
creation_date = "2023/10/16"
integration = ["problemchild", "endpoint", "windows"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/03/19"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high
scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es)
A machine learning job combination has identified a host with one or more suspicious Windows processes that exhibit
unusually high malicious probability scores.These process(es) have been classified as malicious in several ways. The process(es)
were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious
processes, each process has the same host name, and the aggregate score of the event cluster was calculated to be
unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly
Expand All @@ -21,7 +21,7 @@ from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "problem_child_high_sum_by_host"
name = "Suspicious Windows Process Cluster Spawned by a Host"
name = "Host Detected with Suspicious Windows Process(es)"
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/problemchild",
Expand Down
8 changes: 4 additions & 4 deletions ...oblemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@
creation_date = "2023/10/16"
integration = ["problemchild", "endpoint", "windows"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/03/19"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high
scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es)
A machine learning job combination has identified a parent process with one or more suspicious Windows processes that exhibit
unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The process(es)
were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious
processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to
be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly
Expand All @@ -21,7 +21,7 @@ from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "problem_child_high_sum_by_parent"
name = "Suspicious Windows Process Cluster Spawned by a Parent Process"
name = "Parent Process Detected with Suspicious Windows Process(es)"
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/problemchild",
Expand Down
8 changes: 4 additions & 4 deletions ...rations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@
creation_date = "2023/10/16"
integration = ["problemchild", "endpoint", "windows"]
maturity = "production"
updated_date = "2025/01/15"
updated_date = "2025/03/19"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

[rule]
anomaly_threshold = 75
author = ["Elastic"]
description = """
A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high
scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es)
A machine learning job combination has identified a user with one or more suspicious Windows processes that exhibit
unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The process(es)
were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious
processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be
unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly
Expand All @@ -21,7 +21,7 @@ from = "now-45m"
interval = "15m"
license = "Elastic License v2"
machine_learning_job_id = "problem_child_high_sum_by_user"
name = "Suspicious Windows Process Cluster Spawned by a User"
name = "User Detected with Suspicious Windows Process(es)"
references = [
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
"https://docs.elastic.co/en/integrations/problemchild",
Expand Down