Sentinel detects hidden Windows attacks using multiple analysis methods
SENTINEL: A Multi-Pathway Architecture for Detecting Living-Off-the-Land APT Attacks on Windows Command Lines
Cryptography and SecurityArtificial Intelligence
Summary
Hackers often hide malicious actions by using normal Windows tools instead of custom malware, making their attacks hard to spot. The authors created SENTINEL, a system that combines different smart techniques to better identify these hidden attacks, even when commands are scrambled or happen in steps. SENTINEL was tested on real examples from a long-running spying campaign and caught attacks much more accurately than previous methods. This approach helps spot threats that use normal computer tools in sneaky ways.
What this means in practice
- •For security engineers: Improve detection of hidden malicious Windows command line activities used by state-sponsored attackers through enhanced multi-method analysis.
- •For enterprise security teams: Integrate SENTINEL's techniques to strengthen defenses against persistent threats that avoid detection by using legitimate system tools.
Authors
Ahad Bin Islam Shoeb, Kamrul Hasan, Jamal Uddin Tanvin, Liang Hong, Imtiaz Ahmed, Md Arif Billah, Al Amin
Abstract
Living-Off-the-Land (LOTL) is the dominant evasion technique of Advanced Persistent Threat (APT) actors, exploiting legitimate Windows utilities to conduct malicious operations without deploying custom malware and enabling state-sponsored campaigns to maintain persistent access within military and critical defense infrastructure for extended periods. Existing detection methods fail against obfuscated commands and multi-stage attack sequences, as demonstrated by the Volt Typhoon APT campaign, which maintained undetected access to U.S. critical infrastructure for over 18 months using exclusively signed Windows utilities. We present SENTINEL, a multi-pathway architecture integrating BERT-based semantic encoding, character-level CNN for obfuscation invariance, inter-command attention for multi-stage pattern recognition, and autoencoder-based anomaly scoring. Evaluated on a balanced Volt Typhoon benchmark derived from Microsoft and CISA threat intelligence advisories, SENTINEL achieves 92.0% accuracy on documented state-sponsored attack commands and 91.2% on obfuscated variants, compared to 74.0% and 72.0% for standalone BERT. Per-class analysis reveals that models achieving over 98% overall validation accuracy on imbalanced data exhibit only 44-58% malicious recall on balanced adversarial sets. Character-level processing contributes 5.6 percentage points of obfuscation invariance, and the 8.0 percentage point gap over augmentation-only baselines confirms structural architectural value beyond data-driven robustness alone.