Machine learning can help against hands-on-keyboard attacks, where a person operates inside your network using legitimate accounts and built-in tools, because there is often no malware file to match. But it is a force multiplier for good telemetry, tight identity controls and a fast human response, not a replacement for them.
What is a hands-on-keyboard attack?
It is an intrusion driven live by a person, not a script that runs and finishes. After an initial foothold, the operator explores, escalates privileges, moves between machines and stages data or ransomware. They adapt to what they see.
MITRE ATT&CK describes this behavior as chains of techniques across tactics such as credential access, discovery and lateral movement. Technique T1078, Valid Accounts, notes that adversaries may use legitimate credentials to gain access and persist, which is why this kind of activity blends into normal traffic.
Why do signatures struggle?
A signature matches a known file or string. A human using remote desktop with a stolen administrator login, listing groups with a built-in command, then copying files, leaves little to match. Each action is a normal one. What is abnormal is the sequence, the time, the account and the place.
Where does machine learning actually help?
In spotting unusual behavior at a scale no analyst can read. Examples:
- Baseline deviation. An account that normally signs in from one city on weekdays suddenly signs in at 3 a.m. from a server it never used, and then queries many hosts.
- Sequence detection. Discovery commands followed by credential access followed by a large internal copy, within an hour.
- Alert grouping. Collapsing forty related alerts into one incident so an analyst sees the story.
NIST's AI Risk Management Framework is a useful reminder that these models need measuring and governing like any component that shapes decisions: check false positive rates, review what the model treats as normal, and keep a human able to override.
Where does it not help?
Models learn from your data. If an attacker is already inside and quiet, their behavior can become part of the baseline. If your logs are incomplete, there is nothing to learn from. And a high-confidence alert is useless if nobody acts for two days.
CISA's ransomware guide, which covers prevention and response, spends most of its length on basics: patching, limiting access, multi-factor authentication, backups and a response plan. Those steps constrain what a live operator can do whether or not a model notices.
What does a good setup look like?
A constructed example: an attacker phishes a help desk employee and obtains a session. They try to reach file servers. Three controls stack. Privileged access requires a separate admin account with multi-factor authentication, so the help desk credential cannot browse servers. Logging captures sign-ins and remote service use centrally. A behavior model flags the help desk account starting remote sessions to servers it never touched. An analyst reads a short summary within minutes, disables the account and revokes sessions. The model contributed the alert; identity design limited the damage; the analyst closed it.
What should you measure?
Time from first malicious action to detection, time from detection to containment, and share of alerts that were real. A model that improves the first number without flooding analysts is paying for itself. One that raises alert volume without improving either is not.
How to check or apply this
- Confirm you log sign-ins, privileged actions and remote access centrally, with enough retention to investigate.
- Separate admin accounts from everyday ones and require multi-factor authentication for admin.
- Pick two behaviors to detect first, such as new remote sessions from help desk accounts and unusual internal data copies.
- Evaluate any ML detection against past incidents or a purple team exercise before relying on it.
- Write the containment steps: who disables accounts, who isolates hosts, who decides.
- Rehearse with a tabletop that starts from a stolen session.
Quick check
Is machine learning required to detect these attacks?
No. Good logging, rules for known techniques and identity controls catch many. Machine learning adds scale for anomaly spotting and alert grouping.
Why not rely on antivirus?
Because an operator using valid accounts and built-in tools may drop no malware file for antivirus to scan.
Sources
Last reviewed: 18 October 2026.
