Detecting Living-off-the-land attacks with new Elastic Integration

This post introduces Elastic’s ProblemChild package for detecting Living-off-the-Land (LotL) activity on Windows using an integrated pipeline of ML inference on process lineage, anomaly detection for rare parent-child processes, and prebuilt detection rules. It provides step-by-step setup in Kibana (install assets, enrich data via ingest pipelines, run preconfigured anomaly detection jobs, and enable rules), highlights how anomaly detection reduces false positives, and offers options to trial and get support via Elastic Cloud and community resources.