Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. technique: T1003 ✕

Download CSV Show ATT&CK heatmap
  • Unusual Azure AD sync module load Low Identity Threat Module 1 variation

    A process that does not usually load the Azure AD Sync mcrypt.dll loaded the module.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Required data: XDR Agent
    Attacker's goals: Attackers can abuse the Azure AD Connect database files to get access to the AD Sync account. The AD Sync account is a highly privileged account that can perform a DCSync and get access to on-premise password hashes.
    Investigative actions: See whether this was a legitimate action. Follow process/user/host activities. Follow unusual actions of the AD Sync user. Check for unusual Azure AD authentications. Check for a possible DCSync.

    Variations

    Unusual Azure AD sync module load by suspicious process

    Medium overridden

    A suspicious process that does not usually load the Azure AD Sync mcrypt.dll loaded the module. overridden