Skip to main content

Rare Process / Service

Atlas home · Research path · Operational families · Anomaly models · Visual index

Consolidated 27 September 2026 from the revised publication. Source-reported incidents, proposed models, functional tests, and synthetic results remain separate evidence classes. Provenance and review scope.

Low observed prevalence of a process or service in a stated population.

Telemetry contract: Process/service creation, software inventory, signer/hash and collection coverage.

Candidate method [unvalidated until tested]: Measure prevalence within a role and time period; distinguish new telemetry from a genuinely new binary.

Benign alternatives and limits: Deployment, troubleshooting and rare authorized tools can all be legitimate.

Rare process / service anomaly. A utility appears on 1 of 20 monitored database hosts over seven days: 5% observed host prevalence. That is not a 5% attack probability, detector precision or enterprise-wide prevalence estimate. New software, diagnostics and newly enabled telemetry can all look rare.
Figure 15. Rare process / service anomaly. A utility appears on 1 of 20 monitored database hosts over seven days: 5% observed host prevalence. That is not a 5% attack probability, detector precision or enterprise-wide prevalence estimate.SYNTHETIC ILLUSTRATION · USER-SUPPLIEDSources: NIST SP 800-94.
Text equivalent and full-size diagram

New software, diagnostics and newly enabled telemetry can all look rare.

Defined example population: 20 monitored database hosts over seven days. The utility is observed on host 20 only: 1/20 = 5%.

Check hash, signer, owner and deployment history. Newly enabled logging can make familiar software look new.

Rare means uncommon in the observations, not malicious.

Open original full-size asset

Evidence tags: Endpoint telemetry · Network telemetry. Statistical forms: point, contextual.

Browse articles and guides: Rare Process / Service.

Reported incidents and detection interpretations

BazarCall to Conti intrusion​

Period: 2021 case reported on 1 August. Evidence: incident reported by the cited source.

Observed [source-reported]: The investigators recorded AdFind deployment and execution for domain enumeration on compromised hosts. The DFIR Report: BazarCall to Conti Ransomware via Trickbot and Cobalt Strike.

Anomaly interpretation [inferred]: Measure first-seen execution within the host role and inspect the associated account and discovery output. Tool presence alone cannot distinguish administration from intrusion.

Telemetry to validate: Process image, hash, command line, account and host-class software history.

Boundary / competing explanation: The report documents execution, not a measured enterprise prevalence distribution or a guaranteed rarity alert.

ATT&CK [author-mapped behavior, not actor attribution]: T1087.002 — Account Discovery: Domain Account

MESSAGETAP on telecommunications SMS servers​

Period: 2019. Evidence: campaign reported by the cited source.

Observed [source-reported]: Mandiant found MESSAGETAP on Linux SMS-center servers, capturing network traffic with libpcap and selecting SMS data. Mandiant: MESSAGETAP: Who's Reading Your Text Messages?.

Anomaly interpretation [inferred]: Compare capture-capable executables with the approved SMS-server software inventory and investigate unknown binaries in that role.

Telemetry to validate: Executable inventory, process execution, package integrity and packet-capture capability use.

Boundary / competing explanation: libpcap also supports legitimate monitoring; the proposed rarity baseline is not a result published by the investigators.

ATT&CK [author-mapped behavior, not actor attribution]: T1040 — Network Sniffing

Crosslinks: Parent-Child Execution · Peer-Group. Statistical foundation in the Anomaly Detection Atlas. Related research: Newest Detection Engineering Techniques: From Rules to Validated Security Telemetry.

Illustrative scenarios (not additional incidents):

  • A domain controller suddenly executes 7z.exe, a binary never before seen on that host class, shortly before large archive creation.

  • A Linux web server launches socat for the first time, despite no prior history of that tool in its software baseline.

  • A workstation starts a newly dropped unsigned binary from %AppData%, and that file has zero prevalence across the enterprise.

  • A Windows server that normally runs only approved business services suddenly installs and starts a new service with a random-looking name and no trusted signature.

  • A production database host executes rclone, a utility not previously observed on similar servers, followed by outbound network activity.

Apply this analytical view​

These are curated conceptual links, not claims that a specific model detected the cited incidents.

Models: Command or scripting interpreter execution · New or modified system service · Object renamed to resemble trusted object · Protected credential memory or stores accessed.

Collection references: Process Creation · Service Creation · Process Metadata. These describe data components, not equivalent connectors or guaranteed fields.

Technique workspaces​

Follow the exact technique ID to source rules, associated tools, collection references, and documented lab candidates. A navigation association is not live validation.