Prioritizing suspicious PowerShell activity with machine learning

Expel describes building and deploying a LightGBM machine-learning model to evaluate PowerShell process arguments and predict the likelihood an alert is malicious, integrating the model into an automated triage robot that can reprioritize (but not suppress) alerts in their SOC workflow; the post outlines model features (e.g., entropy, special character counts, indicators like "-enc"), operationalization details, and key lessons on production monitoring, human oversight, and analyst feedback.