Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0003 ✕

Download CSV Show ATT&CK heatmap
  • Suspicious time provider registered Medium 2 variations

    The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Time Providers (T1547.003)
    Required data: XDR Agent
    Attacker's goals: Gain persistence using the legitimate Windows time provider mechanism, which loads libraries into Windows services.
    Investigative actions: Verify if the registered library is malicious. Check if the software performing the installation is a malicious binary. Check for any network activity from a "svchost.exe -k LocalService" process that seems suspicious.

    Variations

    Suspicious time provider registered manually by reg.exe

    High overridden

    The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service. overridden

    Suspicious time provider registered using an uncommon provider name

    High overridden

    The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service. overridden