  Endpoint Detection and Remediation (EDR) platforms are essential for
identifying and responding to cyber threats. This study presents a novel
approach using Large Language Models (LLMs) to detect Hands-on-Keyboard (HOK)
cyberattacks. Our method involves converting endpoint activity data into
narrative forms that LLMs can analyze to distinguish between normal operations
and potential HOK attacks. We address the challenges of interpreting endpoint
data by segmenting narratives into windows and employing a dual training
strategy. The results demonstrate that LLM-based models have the potential to
outperform traditional machine learning methods, offering a promising direction
for enhancing EDR capabilities and apply LLMs in cybersecurity.
