Microsoft Research: AI Can Generate Realistic Command-Line and Process Telemetry

A new approach showing how artificial intelligence can generate highly realistic command-line data and process telemetry potentially transforming how security teams build and test threat detection systems.

Logs and telemetry form modern cybersecurity risk, powering threat detection, incident response, and forensic investigations across endpoints and cloud environments.

However, collecting high-quality attack telemetry remains a persistent challenge. Real-world datasets are dominated by benign activity, while malicious events are rare, difficult to capture, and expensive to reproduce in controlled environments.

Security teams rely on detailed logs to detect attacker behavior, but building these datasets is complex. Organizations must simulate attacks, label malicious activity, and reconstruct entire attack chains an effort that is both time-consuming and costly.

As a result, detection engineering often slows down, and both rule-based and AI-driven detection systems suffer from limited training data.

Microsoft researchers propose a different path: using AI to generate synthetic yet realistic security logs based on attacker behaviors.

Instead of relying solely on real-world telemetry, the system translates adversary tactics, techniques, and procedures (TTPs) into structured log data.

AI Can Generate Realistic Command-Line

At the core of the research is a simple idea convert attacker intent into machine-readable logs.

The system takes input from frameworks like MITRE ATT&CK and combines it with specific attacker actions. For example, a stealth technique such as indirect command execution (T1202) might involve tools like “forfiles.exe” with obfuscated commands.

The AI then generates corresponding telemetry, including command-line arguments, process names, and parent-child relationships.

The goal is not to copy real logs exactly, but to create semantically accurate entries that behave like real attack data and can trigger detection systems effectively.

Microsoft evaluated three methods to generate synthetic logs:

• Prompt-engineered generation uses structured prompts to guide AI models through attack scenarios, followed by evaluation using another model acting as a judge.
• Agentic workflows introduce multiple AI agents a generator, evaluator, and improver that iteratively refine logs, significantly improving accuracy in complex attack chains.
• Reinforcement learning with verifiable rewards (RLVR) further enhances realism by comparing generated logs with ground truth and assigning partial rewards based on similarity and correctness.

Among these, agentic workflows delivered the most consistent improvements, especially when paired with reasoning-capable models.

Synthetic telemetry offers several advantages over traditional lab simulations:

• Eliminates exposure of sensitive data.
• Enables simulation of rare or emerging threats.
• Speeds up detection development and testing.
• Supports reproducible experiments across environments.

While not a full replacement for lab testing, synthetic logs can accelerate early-stage detection design and expand coverage without the operational burden of executing real attacks.

• An LLM‑as‑a‑Judge as follows to compare the synthesized data against ground‑truth logs.
• The model only awards partial rewards based on semantic alignment and imposes a penalty if the generated string is not an exact match of the ground-truth logs, producing a more context-aware and flexible reward signal to guide the learning process.

The research evaluated these approaches using multiple datasets, including controlled attack simulations, open-source security datasets, and multi-stage attack environments like ATLASv2.

Performance was measured using recall, focusing on how well generated logs matched expected attack behavior.

Results show that prompt-based methods provide a baseline but lack consistency. In contrast, agentic workflows significantly improve recall and fidelity, producing logs that closely resemble real telemetry, including accurate command lines and process relationships.

Reinforcement learning approaches show promise but require large volumes of labeled data to reach production-level accuracy.

For Microsoft Defender customers, this innovation could streamline detection engineering and improve response capabilities.

By generating realistic attack telemetry on demand, organizations can test defenses against a wider range of threats without relying on costly lab environments.

Ultimately, AI-driven synthetic logs may help security teams stay ahead of evolving threats by enabling faster, safer, and more scalable detection development marking a significant shift in how cybersecurity data is created and used.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.