Detecting suspicious child processes using ee-outliers and Elasticsearch

In this post, we will illustrate how ee-outliers can be used to detect suspicious child processes. This can be a very helpful way of spotting malicious endpoint activity during our Threat Hunting activities. A few examples where detecting suspicious child processes could help us: Detection of a malicious Microsoft Word file spawning cmd.exe Detection of … Continue reading Detecting suspicious child processes using ee-outliers and Elasticsearch

TLS beaconing detection using ee-outliers and Elasticsearch

Earlier today, we open-source ee-outliers, our in-house developed framework to detect outliers in events stored in Elasticsearch. This blog post is the first of several in which we want to dive a bit deeper in how we use ee-outliers ourselves in our own security monitoring activities. Today we will look at how ee-outliers can be … Continue reading TLS beaconing detection using ee-outliers and Elasticsearch

Announcement: open-sourcing ee-outliers

Today, we are excited to announce we are open-sourcing ee-outliers, our in-house developed framework to detect outliers in events stored in Elasticsearch! The framework was developed for the purpose of detecting anomalies in security events, however it could just as well be used for the detection of outliers in other types of data. We have … Continue reading Announcement: open-sourcing ee-outliers