Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0011 ✕ technique: T1071 ✕

Download CSV Show ATT&CK heatmap
  • A process connected to a rare external host Informational 6 variations

    A process connected to an external host name or directly to an IP address, which is rarely connected to from the organization.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Application Layer Protocol (T1071)
    Required data: XDR Agent
    Attacker's goals: Beacon to C2 server and/or exfiltrate data.
    Investigative actions: Check whether the process was injected or otherwise subverted for malicious use.

    Variations

    MSBuild process connected to a rare external host

    High overridden

    MSBuild normally does not make any network connections. This unusual activity may be malicious since attackers can leverage MSBuild for code execution. overridden

    MSBuild process connected to a rare external host

    Medium overridden

    MSBuild normally does not make any network connections. This unusual activity may be malicious since attackers can leverage MSBuild for code execution. overridden

    LOLBIN spawned by an Office executable connected to a rare external host

    High overridden

    A LOLBIN run by an Office process connected to an external IP address or host, which is rarely connected to from the organization. overridden

    A curl process connected to a rare external host

    Informational overridden

    A process connected to an external host name or directly to an IP address, which is rarely connected to from the organization. overridden

    VSCode extension process connected to a rare external host

    Low overridden

    A VSCode extension connected to an external IP address or host, which is rarely connected to from the organization. overridden

    UNIX LOLBIN process connected to a rare external host

    Low overridden

    A UNIX LOLBIN connected to an external IP address or host, which is rarely connected to from the organization. overridden