tag: Lotl · 1 items
- Engineer — Learn: Academic research on detecting sophisticated LOTL-based abuse of security platforms using multi-modal ML. No immediate patch or config action — worth understanding as a design pattern for abuse-resistant SaaS instrumentation.
- SOC/IR — Learn: The multi-modal approach to cold-start LOTL detection and the framing of security tools themselves as an abuse surface is worth absorbing for detection strategy, but the paper yields no ready-to-deploy rules or IOCs.
- Leader — Skip