Living-off-The-Land Reverse-Shell Detection by Informed Data Augmentation

arXiv:2402.18329v1 Announce Type: new
Abstract: The living-off-the-land (LOTL) offensive methodologies rely on the perpetration of malicious actions through chains of commands executed by legitimate applications, identifiable exclusively by analysis of system logs. LOTL techniques are well hidden inside the stream of events generated by common legitimate activities, moreover threat actors often camouflage activity through obfuscation, making them particularly difficult to detect without incurring in plenty of false alarms, even using machine learning. To improve the performance of models in such …

actions analysis applications arxiv augmentation cs.cr cs.lg data detection events generated hidden legitimate applications logs lotl malicious offensive reverse shell stream system techniques threat threat actors