Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0008 ✕ technique: T1021 ✕

Download CSV Show ATT&CK heatmap
  • A user established an SMB connection to multiple hosts Informational Identity Analytics 2 variations

    A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    10 Minutes
    Deduplication:
    1 Day
    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services (T1021)
    Required data: XDR Agent with eXtended Threat Hunting (XTH)
    Attacker's goals: Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.
    Investigative actions: Verify if the host is a newly deployed server that consists of SMB services to multiple hosts. Look for the process that initiated this activity on the remote host. Check if the user is authorized to perform such activity.

    Variations

    A user established an SMB connection to multiple hosts for the first time

    Medium overridden

    A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account. overridden

    A user performed an abnormal SMB activity to multiple hosts

    Low overridden

    A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account. overridden