Piotr Kaliszuk

Methods For Identifying Living-Off-The-Land Attacks Using Sysmon Telemetry Analysis And Machine Learning Models

A proprietary methodology for identifying LOLBin abuse in Windows environments, based on telemetry collected by Sysmon and machine learning models is presented, which indicates that incorporating the context of natural user behavior significantly reduces the number of false alarms and increases the effectiveness of det...