Learn
active
ML System Detects Security Platform Product Abuse at Scale
- Engineer — Learn: Academic research on detecting sophisticated LOTL-based abuse of security platforms using multi-modal ML. No immediate patch or config action — worth understanding as a design pattern for abuse-resistant SaaS instrumentation.
- SOC/IR — Learn: The multi-modal approach to cold-start LOTL detection and the framing of security tools themselves as an abuse surface is worth absorbing for detection strategy, but the paper yields no ready-to-deploy rules or IOCs.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.