Detect Potential Data Poisoning Attacks on ML Models
This rule detects potential data poisoning attacks targeting machine learning models by monitoring Windows Security Event ID 4688 (a process was created) for command-line activity containing keywords indicative of model training or dataset modification, combined with terms suggesting malicious intent like 'corrupted', 'poison', or 'injection'. It aims to identify attempts to manipulate or compromise ML models through their training data.
Microsoft Sentinel (KQL)
