Threat hunting in large datasets by clustering security events
Summary: Cisco Talos researcher Tiago Pereira described using Apache Spark with CountVectorizer, MinHash LSH and the Graphframes connectedComponents algorithm to cluster large volumes of security events, using 10 hashes and a maximum Jaccard distance of 0.2 to group similar events. The method reduced the search space for human analysts and surfaced clusters including an "--IsErik" adware artifact, an XMRig cryptocurrency miner written to C:\ProgramData\Microsoft\conhost.exe, and a BazarBackdoor campaign attributed to TA551.
What's compelling: The clustered events included a known cryptocurrency miner (XMRig, sha256 81A6DE094B78F7D2C21EB91CD0B04F2BED53C980D8999BF889B9A268E9EE364C) and a BazarBackdoor campaign tied to TA551, both found by grouping events rather than by any single alert - the detection depended on an analyst having the tooling and time to look.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026