ConceptsProcess Anomaly Detection

Process Anomaly Detection

Detecting unusual process behavior on endpoints, rare process names, unexpected parents, anomalous command lines, or atypical execution patterns, on the premise that abnormal processes often indicate malicious activity.

Glossary definition

7 direct links1 lesson

Concept Neighborhood

Explore this concept’s connections in the groups below.

PrerequisiteRelated

Start here

Baseline Analysis

The foundation Process Anomaly Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Baseline AnalysisStart here

Establishing what normal activity looks like in an environment so that deviations stand out as worth investigating. In detection and SIEM work, the baseline is the reference against which anomalies are measured.

lessons

Relatedsorted by lesson coverage

Parent Process

lessons

Process Tree

lessons

LOLBin Detection

lessons

Anomaly Detection

lesson

Macro Restriction

lesson

Privilege Escalation Hunts

lesson

Related Lessons

1 lesson covers this concept

Common Detection Patterns

SOC Analyst