Anomalous Process Execution Activity identifies processes whose behaviour differs significantly from what is baseline for an environment, then enriches the alert with the domains, network activity, reputation data, and AI command line analysis an analyst needs to reach a verdict quickly and confidently.

Why Process Behaviour Matters for Security

Process telemetry is one of the richest sources of attacker evidence available, and one of the hardest to use well:

• Legitimate binaries are routinely abused to run malicious payloads
• Command lines are frequently obfuscated, encoded, or chained
• Static allow lists and blocklists cannot keep pace with living off the land techniques
• The same process can be entirely normal on one host and highly suspicious on another

What Anomalous Process Execution Activity Does

The detection uses machine learning to identify unusual process execution patterns, then expands the picture around them. Rather than alerting on a process in isolation, it correlates the network behaviour of the process and its parent, evaluates whether the observed indicators are novel for the environment, and applies AI analysis to the command line itself.

It is designed to surface behaviours associated with:

• Cryptomining and resource hijacking
• Credential theft
• Malicious and obfuscated scripting
• Suspicious outbound communication from unexpected processes
• Abuse of legitimate binaries to execute untrusted code

Event timelines make it straightforward to identify repeated execution attempts, additional affected systems, the user activity behind the process, and the relationships between related events.

How It Works

• Detect with Machine Learning. Flags process behaviour that deviates from what is normal for the environment.
• Extract indicators. Telemetry is collected from Windows critical event logs.
• Correlation. Network events for the process and its parent are correlated into one view.
• Assess Baseline. Indicators are checked against environmental baselines to see if they are uncommon.
• Enrichment and Scoring. Contextual data is applied and risk is scored.

Real World Security Value

Anomalous Process Execution Activity provides organisations with:

• Detection of malicious behaviour that uses legitimate, signed, or native binaries
• Endpoint and network evidence correlated into a single detection
• Decoded command lines and plain language AI reasoning, reducing time to verdict
• Reduced alert fatigue through environment aware baselining and novelty scoring
• Explainable risk scoring that stands up to analyst scrutiny

Conclusion

Attackers have moved away from obviously malicious files and towards ordinary tools used in unusual ways. Anomalous Process Execution Activity meets that shift by learning what normal execution looks like in each environment, expanding every anomaly with the network and reputation context around it, and using AI to explain exactly what a command line is doing.