Results for “abnormal-security”

Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.

"Anomaly" covers three distinct problems, and a detector built for one is close to

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

Deploys anomaly detection for industrial control environments using machine learning models trained on OT network baselines, physics-based process models, and behavioral analysis of industrial protocol communications.

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Detect sophisticated cyber-physical attacks that modify PLC logic while spoofing sensor readings, covering PLC integrity monitoring, process anomaly detection, and multi-stage attack chain detection.

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

Detects unusual options activity and classifies smart money signals to help follow institutional positioning, including volume/OI ratio spikes, block trades, sweep orders, and net premium flow.

Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.

Use to scan support conversations for a harm nobody has categorised yet — a new failure mode, a scam pattern, or a product change hurting a group of customers before it shows in any metric. Trigger for "is anything new going wrong", "scan for emerging issues", "early warning from support", horizon scanning, a new scam pattern, or preparing for a question about what you might be missing.

Exploit path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve authenticated content.