9004 Problems of information security. Computer systems Проблемы информационной безопасности. Компьютерные системы 2071-8217 3 Approach to detecting malicious actions of attacker based on autoregression model in investigation of cyber incident Подход к обнаружению вредоносных действий злоумышленника на основе модели авторегрессии при расследовании киберинцидента Smirnov S. 0000-0002-5511-4000 Eremeev Mihail Pribylov I. MIREA – Russian Technological University 03 06 2021 2 41 47

The paper presents an approach to detecting malicious actions of an attacker based on the analysis of the Security.evtx event logs of the Windows operating system when investigating an information security incident. The authors experimentally tested the use of the autoregression model (the Change Finder algorithm), on the basis of which malicious activity of domain users in the corporate network was detected

 information security incident APT attack lateral movement security log security.evtx change finder algorithm