Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0008 ✕ technique: T1550 ✕

Download CSV Show ATT&CK heatmap
  • Possible TGT reuse from different hosts (pass the ticket) Informational Identity Analytics 1 variation

    We observed two different hosts sending TGS using the same TGT. This may indicate a TGT was stolen and passed to another host.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    10 Hours
    Deduplication:
    1 Day
    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Use Alternate Authentication Material: Pass the Ticket (T1550.003)
    Required data: XDR Agent
    Attacker's goals: Lateral movement using stolen user-account credentials.
    Investigative actions: Check if the mentioned hosts are not the same, and investigate if the ticket was stolen from one of them.

    Variations

    TGT reuse from different hosts (pass the ticket)

    Low overridden

    We observed two different hosts sending TGS using the same TGT. This may indicate a TGT was stolen and passed to another host. overridden