Bias Analysis
Detected Bias Types
powershell_heavy
windows_tools
windows_first
Summary
The documentation page demonstrates a Windows bias by referencing Windows-specific tools and technologies (such as PowerShell, Windows events, and Windows malware families) without providing equivalent Linux examples or mentioning Linux-specific attack patterns. PowerShell is highlighted in multiple detection scenarios, and Windows alerts are used as illustrative examples. There is no mention of Linux-based threats, tools, or detection patterns, nor are Linux command-line or log sources referenced.
Recommendations
- Include detection scenarios and examples that reference Linux-based attacks, such as suspicious Bash or shell activity, Linux-specific malware, or Linux log sources (e.g., syslog, auditd).
- Provide examples of multistage attacks that involve Linux endpoints or mixed-OS environments.
- Balance the use of Windows-specific tools (like PowerShell and Windows Event Logs) with Linux equivalents (such as Bash, systemd, or Linux audit logs).
- Add references to Linux security solutions (e.g., Microsoft Defender for Endpoint on Linux, or integration with Linux EDR tools) where appropriate.
- Ensure that tables and illustrative examples include both Windows and Linux alerts/incidents to demonstrate parity.
Create Pull Request