Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. technique: T1090 ✕

Download CSV Show ATT&CK heatmap
  • Suspicious proxy environment variable setting Informational

    Suspicious proxy environment variable change or definition with a rare command line.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Hour
    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Proxy: Internal Proxy (T1090.001)
    Required data: XDR Agent
    Attacker's goals: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.
    Investigative actions: Investigate the process activities and try to understand the network impact os the new proxy setting.