Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0008 ✕ technique: T1021 ✕

Download CSV Show ATT&CK heatmap
  • Abnormal SMB activity to multiple hosts Low 4 variations

    An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    5 Hours
    Deduplication:
    1 Day
    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services (T1021)
    Required data: XDR Agent
    Detector tags: NDR Lateral Movement Analytics
    Attacker's goals: An adversary may use different protocols to enumerate and plan its lateral movement over the network.
    Investigative actions: Verify if the host is a newly deployed server that consists of SMB services to multiple hosts. Verify the legitimacy of the actor process (and its causality) that initiated this SMB traffic.

    Variations

    Highly rare SMB activity to multiple hosts

    Low overridden

    An endpoint performed a new, and highly rare, SMB activity to multiple hosts on the network. overridden

    Highly rare SMB activity to multiple hosts

    Medium overridden

    An endpoint performed a new, and highly rare SMB activity to multiple hosts on the network. overridden

    Abnormal SMB activity to multiple hosts

    Medium overridden

    An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network. overridden

    Abnormal SMB activity to multiple hosts

    Low overridden

    An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network. overridden