Detection Alert on a Process Exhibiting CPU Spike
Description
This rule correlates security alerts with processes exhibiting unusually high CPU utilization on the same host and process ID within a short time window. This behavior may indicate malicious activity such as malware execution, cryptomining, exploit payload execution, or abuse of system resources following initial compromise.
Query · esql
FROM metrics-*, .alerts-security.* METADATA _index
| where not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """)
| eval
// processes with more than 70% total CPU use
cpu_metrics_pids = CASE(_index like ".ds-metrics-system.process-*" and system.process.cpu.total.norm.pct >= 0.7, process.pid, null),
// any security alert with process.name and ID populated excluding low severity ones
alerts_pids = CASE(_index like ".internal.alerts-security.*" and kibana.alert.rule.name is not null and process.name is not null and process.pid is not null and host.id is not null and kibana.alert.risk_score > 21, process.pid, null)
| stats pid_with_cpu_spike = COUNT_DISTINCT(cpu_metrics_pids), pid_with_alerts = COUNT_DISTINCT(alerts_pids),
Esql.max_cpu_pct = MAX(system.process.cpu.total.norm.pct),
Esql.alerts = VALUES(kibana.alert.rule.name),
Esql.process_hash_sha256 = VALUES(process.hash.sha256),
process_path = VALUES(process.executable),
parent_process_path = VALUES(process.parent.executable),
user_name = VALUES(user.name),
host_name = VALUES(host.name),
cmdline = VALUES(process.command_line) by process.pid, process.name, host.id
| where pid_with_cpu_spike > 0 and pid_with_alerts > 0
// populate fields to use in rule exceptions
| eval process.hash.sha256 = MV_FIRST(Esql.process_hash_sha256),
process.executable = MV_FIRST(process_path),
process.parent.executable = MV_FIRST(parent_process_path),
process.command_line = MV_FIRST(cmdline),
user.name = MV_FIRST(user_name),
host.name = MV_FIRST(host_name)
| KEEP user.name, host.id, host.name, process.*, Esql.*
| where `process.executable` != "C:\\Program Files\\ESET\\ESET Security\\ekrn.exe" and
`process.executable` != "C:\\Windows\\System32\\CompatTelRunner.exe" and
`process.executable` != "C:\\Program Files\\UiPath\\Studio\\UiPath.ActivityCompiler.CommandLine.exe"
Rule dependencies
Depends on
-
correlates · Elastic alerts index
Correlates over any alert. No specific upstream rule.
Excludes
Rule Type: Higher-Order Rule— excluded, not a dependency
Implementation guide
This rule requires host CPU metrics collected via the Elastic Agent System integration.
System Metrics Integration Setup
The System integration collects host-level metrics such as CPU usage, load, memory, and process statistics and sends them to Elasticsearch using Elastic Agent.
Prerequisite Requirements:
- Elastic Agent managed by Fleet
- A Fleet Server configured and reachable Refer to the Fleet Server setup guide: https://www.elastic.co/guide/en/fleet/current/fleet-server.html
The following steps should be executed in order to enable CPU metrics collection:
- Go to the Kibana home page and click Add integrations.
- In the search bar, enter System and select the System integration.
- Click Add System.
- Configure an integration name and optionally add a description.
- Under Metrics, ensure the following datasets are enabled:
system.cpusystem.load(optional but recommended)system.process(optional, if process-level CPU is required)- Review optional and advanced settings as needed.
- Add the integration to an existing agent policy or create a new agent policy.
- Deploy the Elastic Agent to the hosts from which CPU metrics should be collected.
- Click Save and Continue to finalize the setup.
Validation
After deployment, verify CPU metrics ingestion by confirming the presence of documents in:
- metrics-system.cpu-*
- metrics-system.load-* (if enabled)
For more details on the System integration and available metrics, refer to the documentation: https://docs.elastic.co/integrations/system
Analyst notes
Investigating Detection Alert on a Process Exhibiting CPU Spike
This rule identifies processes that both triggered a security alert and exhibited unusually high CPU utilization on the same host and process ID within a short time window. This combination may indicate malicious execution, resource abuse, or post-compromise activity.
Possible investigation steps
- Review the correlated alert(s) to understand why the process was flagged by Elastic Defend.
- Examine the process name, command line, and SHA-256 hash to determine whether the process is expected or known to be malicious.
- Validate the observed CPU usage and duration to determine whether the spike is abnormal for this process and host.
- Check for related process activity such as parent/child processes, suspicious process spawning, or privilege escalation attempts.
- Review additional host telemetry including:
- Network connections initiated by the process
- File creation or modification events
- Persistence mechanisms (services, scheduled tasks, registry keys)
- Determine whether similar activity is observed on other hosts, which may indicate a broader compromise.
False positive analysis
- Legitimate high-CPU processes such as software updates, backup agents, security scans, or system maintenance tasks.
- Resource-intensive but benign applications (e.g., compilers, video encoding, data processing jobs).
- Security tools or monitoring agents temporarily consuming high CPU.
Response and remediation
- If malicious activity is confirmed, isolate the affected host to prevent further impact.
- Terminate the offending process if safe to do so.
- Remove any identified malicious binaries or artifacts and eliminate persistence mechanisms.
- Apply relevant patches or configuration changes to remediate the root cause.
- Monitor the environment for recurrence of similar high-CPU processes combined with security alerts.
- Escalate the incident if multiple hosts or indicators suggest coordinated or widespread activity.