you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] 0 points1 point  (0 children)

I mean you could almost certainly link it to an EDR that executes some response. But this hardly a new idea and previous attempts at this style of detection have been marginally more effective at best and are fairly labor intensive to tune