Data anomaly detection in Log360

Unusual privilege escalation or the abnormal use of elevated accounts is flagged immediately. If a user suddenly gains admin rights or accesses systems outside their role, Log360 highlights the deviation and prioritizes it with entity risk scoring. This includes unauthorized group or GPO deletions, off-hours GPO changes, and suspicious registry access in Windows. It also covers conditional access policy changes in Microsoft 365 and unapproved rule changes across firewalls and SaaS platforms from providers such as Sophos, Fortinet, and SonicWall.

Adversaries often abuse system tools. Log360’s rules detect rare or obfuscated command usage and suspicious child process activity, such as PowerShell spawning unusual processes or Regsvr32 running with uncommon flags. It also monitors privileged command execution on Unix, IIS FTP, Microsoft SQL Server, and Check Point devices, and failed attempts or scheduled tasks created outside of working hours are treated as signs of persistence or reconnaissance..

Spikes in downloads, file transfers, or uploads to unapproved cloud apps are detected by comparing them against established baselines. Analysts get alerts with risk scoring to judge whether the behavior is routine or a potential breach. Other signals include excessive file changes or deletions on Windows, abnormal surges in Microsoft 365 file deletions, bulk data transfers in Salesforce, and unusual email activity such as large volumes of emails sent to a single recipient.

Slow-moving threats are uncovered by linking anomalies across time, such as unusual login patterns combined with rare process execution and abnormal file access. This correlation reveals campaigns that would otherwise be missed. Examples include Salesforce user setting changes, app integrations after hours, unauthorized firewall or policy modifications, and unusual mailbox access in Microsoft 365—all of which point to insider misuse or persistent attack activity.