Analytics Alerts

Suspicious Azure enumeration activity Medium Cloud

An Azure identity performed resource enumeration across multiple services using Microsoft Graph.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Cloud Service Discovery (T1526)

Required data: Azure Audit Log Microsoft Graph Logs

Detector tags: Microsoft Graph Activity Logs

Attacker's goals: Map the Azure tenant and detect potential resources to abuse.

Investigative actions: Check the identity's role designation in the organization. Identify which resources were discovered. Investigate if the discovered resources were used to extract sensitive information or perform other attacks in the cloud environment.

Suspicious Certutil AD CS contact Low 1 variation

A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)

ATT&CK techniques: System Service Discovery (T1007) Steal or Forge Authentication Certificates (T1649)

Required data: XDR Agent

Detector tags: Active Directory Certificate Services Analytics

Attacker's goals: An attacker might look for AD CS servers, certificate templates or request certificates. With the wrong setting or loose vulnerable templates or enabled enrollment, the attacker will be able to authenticate as users on the network.

Investigative actions: Look at further action done by the user. Investigate whether other non-standard operations were done regarding the AD CS.

Variations

Suspicious Certutil AD CS Admin Interface contact

Medium overridden

A suspicious occurrence of Certutil attempted to contact the AD CS Admin Interface. overridden

Suspicious DKIM Result Informational Email 4 variations

The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impersonation (T1656)

Required data: Microsoft 365 Emails

Detector tags: Spoofing

Attacker's goals: Impersonate internal users or familiar individuals and trick them into clicking on malicious links or attachments.

Investigative actions: Check the email address for any unusual spellings, missing letters, or unknown domains. Examine the sender's IP address and reputation, and check why DKIM didn't pass. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

Known domain DKIM deviation

Informational overridden

An email was sent from a commonly seen domain in the organization, that has historically passed DKIM checks, but returned a suspicious DKIM result of fail This deviation may indicate an attempt to spoof or impersonate a legitimate external sender. Such sudden DKIM outcome from a previously trusted external domain warrants further investigation. overridden

Lack DKIM signature from typically signing domains

Informational overridden

An email was sent from a domain that has historically passed DKIM checks, but returned a suspicious DKIM result of none A none DKIM result implies on an unsigned email, which is atypical for domains with previous signed messages. This deviation may indicate an attempt to spoof or impersonate a legitimate external sender. Such sudden DKIM outcome from a previously trusted external domain warrants further investigation. overridden

DKIM results lacking sender correlation

Informational overridden

The email's authentication results have no indication of proper signing from the email's sender This deviation may indicate an attempt to spoof or impersonate a legitimate external sender. overridden

Known domain suspicious DKIM result

Informational overridden

An email was sent from a commonly seen domain that had no other suspicious DKIM outcomes for the past 30 days. This may indicate an attempt to spoof or impersonate a legitimate external sender. overridden

Suspicious DMARC result Informational Email 3 variations

The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impersonation (T1656)

Required data: Microsoft 365 Emails

Detector tags: Spoofing

Attacker's goals: Impersonate internal users or familiar individuals. Trick users into clicking on malicious links or attachments.

Investigative actions: Check the email address for any unusual spellings. Check the email address for any missing letters. Check the reason DMARC didn't pass and the action. Check if the email was delivered to the recipients based on the action taken, even though DMARC did not pass. Verify whether the sender's IP address has appeared in different log sources before and its reputation. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

DMARC deviation from historically compliant domain

Informational overridden

An email was sent from a domain that has historically passed DMARC checks but returned a suspicious DMARC result of either fail or none for the first time in the past 30 days. This deviation may indicate an attempt to spoof or impersonate a legitimate external sender. Such sudden DMARC outcome from a previously trusted external domain warrants further investigation. overridden

DMARC failure bypassed domain policy

Informational overridden

An email with a DMARC result of fail was delivered to a user's Inbox, despite the sender domain having a DMARC policy of reject. This indicates the message should have been rejected according to the domain owner policy, but was instead accepted and delivered, potentially exposing the user to email spoofing or phishing. This suggests a potential policy bypass or misconfiguration in mail filtering. overridden

DMARC failed with non-enforcing policy

Informational overridden

An email was received with DMARC=fail and policy=none, meaning the message failed both SPF and DKIM identifier alignment checks, but no enforcement action (quarantine or reject) was requested by the sending domain. This may indicate an overly permissive DMARC configuration on the sender side and could allow unauthenticated messages to reach users' inboxes. Such configurations are often exploited in phishing or spoofing campaigns, and should be treated with caution. overridden

Suspicious DNS traffic Informational 2 variations

10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 1 Hour

ATT&CK tactics: Command and Control (TA0011) Exfiltration (TA0010)

ATT&CK techniques: Application Layer Protocol (T1071) Exfiltration Over Alternative Protocol (T1048)

Required data: Palo Alto Networks Firewall traffic Logs XDR Agent

Attacker's goals: DNS tunneling, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. An attacker may also use this protocol to exfiltrated data from the compromised endpoint outside the network.

Investigative actions: Verify that the source device or process is not an approved security solution. Verify if the DNS query types are non-standard. DNS tunnels use uncommon query types that enable encoding of more data. Examples include: INIT, PRIVATE, NULL, SRV, KEY, and TXT. If the affected endpoint is operating Windows, verify that the DNS traffic is coming from svchost.exe and search for other processes that ran when the alert triggered. On Windows, the DNS requests go through svchost.exe. Verify the responses per DNS query. Many responses per query may indicate a tool being downloaded. Verify the destination domain details and compare the number of endpoints in your network that access the domain over time to see if this is an uncommonly contacted domain. Verify the source web-browser traffic to determine if the process was generated by user action, if the user did not initiate the traffic it can be indicative of malicious activity. Verify non-DNS traffic to the domain. Any traffic except DNS queries to the destination domain may indicate a legitimate domain and not used solely for command-and-control or data exfiltration.

Variations

Suspicious DNS traffic with a rarely seen domain

Low overridden

10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. This domain was rarely seen in this tenant. overridden

Suspicious DNS traffic with a globally rare DNS query length

Low overridden

10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. The combination of the DNS queries along with this root domain is globally rare. overridden

Suspicious DotNet log file created Low 3 variations

Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Reflective Code Loading (T1620) Process Injection (T1055)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Run/Inject DotNet code in the context of a signed process.

Investigative actions: Verify if the actor process is using DotNet in a valid way.* Check if a new application was recently installed on the host at the time of the alert.

Variations

DotNet log file created by svchost from 'Absolute software Corp' causality

Informational overridden

Causality 'Absolute software Corp' loads/injects into svchost and creates DotNet log files. overridden

Suspicious DotNet log file created from an injected thread

Low overridden

Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files. overridden

Suspicious DotNet log file created

Low overridden

Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files. overridden

Suspicious EBS snapshots deletion Low Cloud 1 variation

An identity deleted multiple EBS snapshots from the project, considerably more than usual.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 5 Days

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: Inhibit System Recovery (T1490)

Required data: AWS Audit Log

Attacker's goals: Adversaries may delete data to prevent the recovery of a corrupted system.

Investigative actions: Identify the deleted snapshots and their associated resources. Investigate the identity that performed the deletion and review recent related activity.

Variations

A non administrative identity successfully deleted multiple snapshots from a project

Medium overridden

An identity deleted multiple EBS snapshots from the project, considerably more than usual. overridden

Suspicious Encrypting File System Remote call (EFSRPC) to domain controller Medium

An Encrypting File System Remote call (EFSRPC) was made to a domain controller.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Lateral Movement (TA0008)

ATT&CK techniques: Use Alternate Authentication Material: Pass the Hash (T1550.002)

Required data: Palo Alto Networks Firewall EAL Logs XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: An attacker is attempting to steal credentials and move laterally within a network.

Investigative actions: Check for suspicious processes on the host. Check if the source host is a vulnerability scanner. Look for following suspicious connections using the DC machine account.

Suspicious External RDP Login Informational Identity Analytics

An unusual successful RDP connection by a user from an external IP. This may be indicative of using stolen credentials or malicious activity.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: External Remote Services (T1133)

Required data: XDR Agent

Attacker's goals: The attacker attempts to gain access to the accounts through RDP from an external source.

Investigative actions: Identify the user performing RDP and check that it is authorized. Check whether this IP has a malicious reputation. Reset the user's password. Follow further actions done by the user.

Suspicious HTTP parameters detected Medium

The endpoint received suspicious HTTP parameters via an HTTP request, which may indicate attempts to exploit server components or web shell activity.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001) Persistence (TA0003)

ATT&CK techniques: External Remote Services (T1133) Server Software Component: Web Shell (T1505.003)

Required data: Palo Alto Networks Firewall EAL Logs XDR Agent

Detector tags: Webshell Analytics

Attacker's goals: Attackers may exploit server components or misconfigurations to access arbitrary sensitive files on the web server.

Investigative actions: Inspect the legitimacy of the URI path and the parameters values sent to the server. Ensure that the rare URI is not a legitimate result of routine development actions on the web server.

Suspicious ICMP packet Low 1 variation

An ICMP router advertisement was sent by a host.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Command and Control (TA0011)

ATT&CK techniques: Protocol Tunneling (T1572)

Required data: Palo Alto Networks Firewall EAL Logs XDR Agent

Attacker's goals: Make the victim change his routing table.

Investigative actions: Investigate why the source host sent an ICMP router advertisement and if it changed the destination target routing table.

Variations

Suspicious ICMP packet that resemble an ICMP redirect attack

Informational overridden

ICMP redirect was sent by a user. overridden

Suspicious ICMP traffic that resembles smurf attack Low

ICMP smurf attack was used.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 1 Day

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: Endpoint Denial of Service: Service Exhaustion Flood (T1499.002) Network Denial of Service (T1498)

Required data: XDR Agent

Attacker's goals: Attempt to perform a denial-of-service attack by network exhaustion.

Investigative actions: Check if the ICMP message to broadcast was used for a legitimate reason. If not, check for denial-of-service impact on the subnet.

Suspicious Kerberos Pre-Auth Failures by Host Low Identity Analytics

An endpoint failed unusual number of Kerberos pre-authentications (TGT requests) which may indicate a password-spraying attack.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Brute Force: Password Spraying (T1110.003)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: The attacker is attempting to gain an initial foothold in the domain using a list of valid users and a guessed password.

Investigative actions: Identify the source host from which the failed logons originated, by making sure the IP is not a shared address. Review source host activity to detect any additional suspicious or lateral movement behavior. Correlate successful logons from the source host to identify potential account compromises following the failed attempts.

Suspicious Kubernetes pod token access Medium 3 variations

A Kubernetes pod has accessed the access token of another pod. This could indicate potential unauthorized access or a security breach within the cluster.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Kubernetes - AGENT, Kubernetes Credentials Theft Analytics

Attacker's goals: Gain access to the Kubernetes environment.

Investigative actions: Look for additional suspicious activities. Verify if the exposed credentials were used to access the API server. Investigate which operations were used against the Kubernetes cluster with the exposed credentials.

Variations

Suspicious Kubernetes pod token access via remote access

High overridden

A Kubernetes pod has accessed the access token of another pod. This could indicate potential unauthorized access or a security breach within the cluster. overridden

Suspicious Kubernetes pod token access by an unusual pod

High overridden

A Kubernetes pod has accessed the access token of another pod. This could indicate potential unauthorized access or a security breach within the cluster. overridden

Suspicious Kubernetes pod token access by an unusual process

Medium overridden

A Kubernetes pod has accessed the access token of another pod. This could indicate potential unauthorized access or a security breach within the cluster. overridden

Suspicious LDAP queries followed by shared folder access Low

The user executed suspicious LDAP queries shortly before accessing a shared folder. This behavior may be indicative of Rubeus activity involving Kerberos ticket forgery, such as Golden Ticket or Silver Ticket attacks.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Steal or Forge Kerberos Tickets (T1558)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: An attacker may use LDAP based account discovery and a forged Kerberos ticket (e.g. Silver Ticket) to access shared resources and collect sensitive data.

Investigative actions: Review the LDAP query content to determine if it targets privileged groups (e.g., Domain Admins) or sensitive objects. Correlate the shared folder path with sensitive file shares (e.g., SYSVOL, NETLOGON, backup shares). Check if the IP address {ip_address} is associated with known administrative systems or unusual user behavior. Determine if Rubeus or other Kerberos abuse tools were used based on timing, patterns, or command line artifacts. Inspect for potential Silver Ticket or Golden Ticket activity by reviewing Kerberos ticket logs and security events. Verify if the user account had prior suspicious authentication events or privilege escalation.

Suspicious LDAP search query executed Low 2 variations

A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Account Discovery (T1087)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: LDAP Analytics (Client)

Attacker's goals: An attacker is attempting to enumerate Active Directory.

Investigative actions: Check if the process executes LDAP search queries as part of its normal behavior. Investigate the LDAP search query for any suspicious indicators. Determine whether the search query is generic. Wide search queries (often using wildcards) tend to be more suspicious. In our case, we are looking for targeted search queries.

Variations

Suspicious LDAP search query executed

High overridden

A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization. overridden

Suspicious LDAP search query executed

Low overridden

A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization. overridden

Suspicious MFA request reported by user in Entra ID Informational Identity Threat Module, SaaS Threat Detection 1 variation

A user has flagged an MFA request as suspicious in Microsoft Entra ID. This could indicate a potential compromised user account or unauthorized access attempt.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003) Initial Access (TA0001)

ATT&CK techniques: Valid Accounts (T1078)

Required data: AzureAD Audit Log

Attacker's goals: An attacker may attempt to gain unauthorized access to the account.

Investigative actions: Check if the authentication attempt was legitimate. Investigate any recent unusual login behavior or IP addresses associated with the account. Verify whether the user has recently changed their authentication methods or account settings. Follow the account for possible suspicious or unusual logins.

Variations

Suspicious MFA request reported by a sensitive user in Entra ID

Low overridden

A user has flagged an MFA request as suspicious in Microsoft Entra ID. This could indicate a potential compromised user account or unauthorized access attempt. overridden

Suspicious ML Model Download Informational Cloud 1 variation

A model artifact was accessed from cloud storage by an identity that typically doesn't interact with model files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 5 Days

ATT&CK tactics: Collection (TA0009)

ATT&CK techniques: Data from Cloud Storage (T1530)

Required data: AWS Audit Log Azure Audit Log Gcp Audit Log

Detector tags: Cloud AI Infrastructure Analytics

Attacker's goals: Adversaries may collect ML artifacts for exfiltration or for use in ML Attack Staging.

Investigative actions: Examine the bucket to determine which model was accessed. Verify that this command was executed by a trusted source.

Variations

Suspicious First-Time AI Model Download by Identity

Medium overridden

A model artifact was accessed from cloud storage by an identity that did not interact with model files recently. overridden

Suspicious NTLM authentication with machine account Informational Identity Analytics 1 variation

A suspicious NTLM authentication attempt was made by a machine account.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Forced Authentication (T1187)

Required data: Palo Alto Networks Firewall EAL Logs XDR Agent

Attacker's goals: An attacker aims to exploit authentication protocols to steal credentials and enable lateral movement within the network.

Investigative actions: Identify the source and target users and hosts involved in the NTLM authentication attempt. Monitor the users associated with the authentication for any further suspicious activities or unauthorized actions. Look for earlier connections to the source which may cause it to initiate the session. Investigate the root cause of the behavior and determine if it can be mitigated or blocked in the future.

Variations

Rare and sensitive NTLM authentication with machine account

Low overridden

A rare and sensitive NTLM authentication attempt was made by a machine account. overridden

Suspicious Network Connection Originating from AWS SSM Agent Medium Cloud

A process spawned by the AWS SSM agent connected to an anonymous tunnel or TOR IP outside AWS. This may indicate the SSM agent was abused for command and control or data exfiltration.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Command and Control (TA0011) Exfiltration (TA0010)

ATT&CK techniques: Application Layer Protocol (T1071) Exfiltration Over C2 Channel (T1041)

Required data: XDR Agent

Detector tags: SSM Remote Management Analytics

Attacker's goals: Abuse the Amazon SSM agent to establish a covert command and control channel or exfiltrate data outside the cloud environment.

Investigative actions: Verify the process spawned by SSM agent and validate its legitimacy. Inspect the destination IP and ASN in threat intelligence feeds. Review recent SSM document executions on the affected host.

Suspicious PowerShell Command Line Low

Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)

Required data: XDR Agent

Attacker's goals: Gain code execution on the host.

Investigative actions: Check whether the command line executed is benign or normal for the host and/or user performing it. For example, the command line may be an administrative script.

Suspicious PowerShell Enumeration of Running Processes Informational

Attackers often enumerate running processes to find and disable security tools.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Process Discovery (T1057)

Required data: XDR Agent

Attacker's goals: Understand the type of host according to the processes running on it; find and disable security tools.

Investigative actions: Verify whether the command that was executed is benign or normal for the host and/or user performing it (for example, it may be an IT script).

Suspicious PowerSploit's recon module (PowerView) net function was executed Medium

An attacker may use PowerSploit to reconnaissance the network.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Remote System Discovery (T1018)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Collect information about the host, network and user configuration for lateral movement and privilege escalation.

Investigative actions: Verify that the relevant function was indeed run by PowerSploit (https://powersploit.readthedocs.io/#recon). Understand what information the attacker had gathered from the command and investigate relevant assets.

Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts Medium

An attacker may use PowerSploit to reconnaissance the network for exposed hosts to move laterally to.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Remote System Discovery (T1018)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Collect information about the host, network and user configuration for lateral movement and privilege escalation.

Investigative actions: Verify that the relevant function was indeed run by PowerSploit (https://powersploit.readthedocs.io/#recon). Understand what information the attacker had gathered from the command and investigate relevant assets.

Suspicious Print System Remote Protocol usage by a process Low Identity Analytics

A host which is trusted for unconstrained delegation initiated an SMB connection to a DC using the Print System Remote Protocol. An attacker can abuse such sessions for relay attacks.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Forced Authentication (T1187)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Elevate privileges from standard domain user to domain admin.

Investigative actions: Check if the domain controller is patched or vulnerable to the attack. Check if the suspected account is compromised. Check if the source machine is trusted for unconstrained delegation and verify that the machine's configuration should stay that way. Follow actions by the account and if it performed a DCSync.

Suspicious Process Spawned by Adobe Reader Low

Unusual process spawned by Adobe Reader with an uncommon command line.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)

Required data: XDR Agent

Attacker's goals: An attacker attempts to gain code execution via a phishing document.

Investigative actions: Check the source of the document (received by mail or loaded locally). Investigate the child processes for malicious activity and network connections to an external host.

Suspicious Process Spawned by wininit.exe Medium

An unusual process was spawned by wininit.exe, possibly indicating malicious local or remote code execution.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Masquerading (T1036)

Required data: XDR Agent

Attacker's goals: Gain code execution on the host.

Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Suspicious RunOnce Parent Process Low

Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)

Required data: XDR Agent

Attacker's goals: An attacker is trying to perform an action on the system at a later point, achieving persistence.

Investigative actions: Investigate the endpoint to determine if it's a legitimate process that is supposed to use RunOnce in its operation.

Suspicious SMB connection from domain controller Low

A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 7 Days

ATT&CK tactics: Lateral Movement (TA0008)

ATT&CK techniques: Use Alternate Authentication Material: Pass the Hash (T1550.002)

Required data: Palo Alto Networks Firewall traffic Logs XDR Agent Third-Party Firewalls

Attacker's goals: An attacker is attempting to steal credentials and move laterally within a network.

Investigative actions: Check if the destination is domain controller, if it is, exclude it. Look for earlier connections to the DC, which may cause it to initiate the session.

Suspicious SPF Result Informational Email 2 variations

The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impersonation (T1656)

Required data: Microsoft 365 Emails

Detector tags: Spoofing

Attacker's goals: Impersonate internal users or familiar individuals. Trick users into clicking on malicious links or attachments.

Investigative actions: Check the email address for any unusual spellings. Check the email address for any missing letters. Verify the sender's domain to confirm its legitimacy. Examine the sender's IP address and reputation. Verify the domain's connection to the IP address and investigate the reason SPF didn't pass. Verify whether the sender's IP address has appeared in different log sources before. Verify if the sender's IP address is identifiable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

Internal domain SPF deviation

Informational overridden

An email was sent from an internal root domain that has historically passed SPF checks, but returned a suspicious SPF result of fail, soft fail, or policy for the first time in the past 30 days. This deviation may indicate an attempt to spoof or impersonate a trusted internal sender, a tactic commonly associated with BEC and internal phishing. Such a sudden SPF outcome from a typically trusted domain warrants further investigation. overridden

Known domain SPF deviation

Informational overridden

An email was sent from a domain that has historically passed SPF checks, but returned a suspicious SPF result of fail, soft fail, or policy for the first time in the past 30 days. This deviation may indicate an attempt to spoof or impersonate a legitimate external sender. Such a sudden SPF outcome from a previously trusted external domain warrants further investigation. overridden

Suspicious SSH Downgrade Low 2 variations

The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Lateral Movement (TA0008) Defense Evasion (TA0005)

ATT&CK techniques: Remote Services (T1021) Impair Defenses: Downgrade Attack (T1562.010)

Required data: Palo Alto Networks Firewall EAL Logs

Detector tags: NDR Lateral Movement Analytics

Attacker's goals: Attackers may attempt to move laterally over the network by exploiting problems in a lower version of SSH.

Investigative actions: Audit the authentication attempts in the SSH server from the alerted host. If the source host authenticated to the SSH server, it may indicate that the attacker managed to connect to the remote host maliciously.

Variations

A Host Performed an SSH Downgrade For The First Time In The Last 30 Days

Low overridden

The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more. With a lower version than the source host used in the past. overridden

A Target Server Performed an SSH Downgrade For The First Time In The Last 30 Days

Low overridden

The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more. With a lower version than the remote host used in the past. overridden

Suspicious SSO access from ASN Informational Identity Analytics 2 variations

A suspicious SSO authentication was made by a user.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Valid Accounts: Domain Accounts (T1078.002)

Required data: AzureAD Azure SignIn Log Idira Duo Google Workspace Authentication Okta OneLogin PingOne

Attacker's goals: Use an account that was possibly compromised to gain access to the network.

Investigative actions: Confirm that the activity is benign (e.g. the user has switched locations and providers). Verify if the ASN is an approved ASN to authenticate from. Follow further actions done by the user.

Variations

Suspicious SSO access from ASN via a suspicious IP

Low overridden

A suspicious SSO authentication was made by a user. overridden

Google Workspace - Suspicious SSO access from ASN

Informational overridden

A suspicious SSO authentication was made by a user. overridden

Suspicious SSO authentication Informational Identity Analytics 2 variations

A suspicious SSO authentication was made by a user.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Valid Accounts (T1078)

Required data: Okta

Attacker's goals: Achieve initial access to a company's resources.

Investigative actions: See whether this was a legitimate action. Review the external IP/domain involved in the alert. Contact the user whose account is being accessed and verify that they are actually attempting to log in. Check if the login attempt is coming from an unfamiliar location or device. Look for unusual login patterns, such as login attempts at odd hours. Monitor the user's account for further unusual activity.

Variations

Successful SSO authentication with suspicious characteristics

Medium overridden

A user successfully accessed SSO with some suspicious characteristics that flagged this login attempt as a suspicious login. overridden

SSO authentication attempt with suspicious characteristics

Low overridden

A user accessed SSO with some suspicious characteristics that flagged this login attempt as a suspicious login. overridden

Suspicious SaaS API call from a Tor exit node High Identity Threat Module, SaaS Threat Detection 2 variations

A SaaS API was called from a Tor exit node.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Command and Control (TA0011)

ATT&CK techniques: Proxy: Multi-hop Proxy (T1090.003)

Required data: Box Audit Log DropBox Google Workspace Audit Logs Office 365 Audit

Attacker's goals: Conceal information about malicious activities, such as location and network usage.

Investigative actions: Block all web traffic to and from public Tor entry and exit nodes.

Variations

A Failed API call from a Tor exit node

Informational overridden

A SaaS API was called from a Tor exit node. overridden

Suspicious SaaS API call from a Tor exit node via Mobile Device

Medium overridden

A SaaS API was called from a Tor exit node. overridden

Suspicious SearchProtocolHost.exe parent process Medium

SearchProtocolHost.exe has been launched from a process that is different from SearchIndexer.exe This may indicate malicious activity (such as malware later being injected to it, or it being used for phantom DLL hijacking).

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 6 Hours

ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)

ATT&CK techniques: User Execution (T1204) System Binary Proxy Execution (T1218)

Required data: XDR Agent

Attacker's goals: Gain code execution on the host and evade security controls.

Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Suspicious Udev driver rule execution manipulation Low 1 variation

Udev driver rule was modified with unusual pattern, might be used by adversaries to backdoor existing drivers.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)

ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Adversaries can use this technique to execute arbitrary commands once the machine boots.

Investigative actions: Check if the action was done using an automation service. Check the rule modification content and look for any suspicious payloads. Check if there are any other suspicious activities originated from the same machine/executing user.

Variations

Unusual Udev driver rule execution manipulation

Low overridden

Udev driver rule was modified with unusual pattern, might be used by adversaries to backdoor existing drivers. overridden

Suspicious Unicode character detected in email Informational Email 3 variations

Unicode characters can be used for obfuscation, allowing malicious actors to disguise harmful intent, URLs or attachments By embedding non-printing Unicode characters, attackers can bypass security filters and evade detection mechanisms Such characters may also be used for phishing attempts that appear legitimate to both users and security systems.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Masquerading (T1036) Impersonation (T1656)

Required data: Microsoft 365 Emails

Detector tags: Evasion, Phishing

Attacker's goals: Embedding suspicious Unicode characters in the email to appear legitimate, evade security filters and bypass detection mechanisms.

Investigative actions: Check the email address for any unusual spellings, missing letters, or unknown domains. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

Phishing terms obfuscation using Unicode characters detected in email

Low overridden

Unicode characters can be used for obfuscation, allowing malicious actors to disguise harmful intent, URLs or attachments By embedding non-printing Unicode characters, attackers can bypass security filters and evade detection mechanisms Such characters may also be used for phishing attempts that appear legitimate to both users and security systems. overridden

Words obfuscation using Unicode characters detected in email

Informational overridden

Unicode characters can be used for obfuscation, allowing malicious actors to disguise harmful intent, URLs or attachments By embedding non-printing Unicode characters, attackers can bypass security filters and evade detection mechanisms Such characters may also be used for phishing attempts that appear legitimate to both users and security systems. overridden

Multiple suspicious Unicode characters detected in email

Informational overridden

Unicode characters can be used for obfuscation, allowing malicious actors to disguise harmful intent, URLs or attachments By embedding non-printing Unicode characters, attackers can bypass security filters and evade detection mechanisms Such characters may also be used for phishing attempts that appear legitimate to both users and security systems. overridden

Suspicious access of the System Management Container Low Identity Analytics

A user accessed the System Management container, which may be an indication of a reconnaissance for site servers.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Reconnaissance (TA0043)

ATT&CK techniques: Gather Victim Network Information (T1590)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Microsoft SCCM Analytics

Attacker's goals: An attacker is attempting to enumerate Microsoft Configuration Manager and identify accessible site servers.

Investigative actions: Look for the suspicious LDAP query that may trigger this event. Check if the process executes LDAP search queries as part of its normal behavior. Investigate any other potentially suspicious behavior from the compromised user. Looking for suspicious activity or logins to the Microsoft Configuration Manager site server.

Suspicious access to Kubernetes API with kubelet credentials Low Cloud 1 variation

A combination of signals has been detected indicating that kubelet credentials were used inside a pod to access the Kubernetes API. This activity suggests an attempt to escalate privileges or move laterally within the cluster.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Exfiltration (TA0010) Collection (TA0009)

ATT&CK techniques: Data from Cloud Storage (T1530) Automated Exfiltration (T1020)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Cloud Data Asset Exfiltration, Data Detection & Response

Attacker's goals: Usage of the Kubernetes API server to perform operations inside the cluster.

Investigative actions: Check if there is an active attack against the Kubernetes cluster.

Variations

Suspicious access to Kubernetes API with kubelet credentials from unusual pod

Medium overridden

A combination of signals has been detected indicating that kubelet credentials were used inside a pod to access the Kubernetes API. This activity suggests an attempt to escalate privileges or move laterally within the cluster. overridden

Suspicious access to cloud credential files Informational Cloud 6 variations

A process accessed multiple cloud credential files, which may indicate a credential theft activity.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Cloud Lateral Movement Analytics

Attacker's goals: Gain initial access to the cloud environment.

Investigative actions: Verify if the executing process is doing more suspicious activities. Verify if the exposed credential files were used to access to the cloud environment. Verify which operations were used against the cloud environment with the exposed credentials.

Variations

Suspicious access to cloud credential files of various cloud providers within a cloud instance

Low overridden

A process accessed multiple cloud credential files, which may indicate a credential theft activity. overridden

Suspicious access to cloud credential files within a cloud instance

Informational overridden

A process accessed multiple cloud credential files, which may indicate a credential theft activity. overridden

Suspicious access to Windows cloud credential files of various cloud providers

Medium overridden

A process accessed multiple cloud credential files, which may indicate a credential theft activity. overridden

Suspicious access to Windows cloud credential files by an unusual process

Low overridden

A process accessed multiple cloud credential files, which may indicate a credential theft activity. overridden

Suspicious access to cloud credential files of various cloud providers

Medium overridden

A process accessed multiple cloud credential files, which may indicate a credential theft activity. overridden

Suspicious access to cloud credential files by an unusual process

Low overridden

A process accessed multiple cloud credential files, which may indicate a credential theft activity. overridden

Suspicious access to shadow file Informational 4 variations

An unpopular process accessed the shadow file.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 7 Days

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: OS Credential Dumping (T1003)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Attackers may attempt to dump the contents of these sensitive files to perform offline password cracking.

Investigative actions: Check the process for more suspicious activity. Check whether this was a legitimate action.

Variations

Suspicious access to shadow file in a Kubernetes Pod using a known text editor

Medium overridden

An unpopular process accessed the shadow file in a Kubernetes Pod. overridden

Suspicious access to shadow file using a known text editor

Medium overridden

An unpopular process accessed the shadow file. overridden

Suspicious access to shadow file in a Kubernetes Pod

Low overridden

An unpopular process accessed the shadow file. overridden

Suspicious access to shadow file

Low overridden

An unpopular process accessed the shadow file. overridden

Suspicious account attribute modification that matches that of another account Low Identity Analytics 1 variation

Suspicious account attribute modification that matches that of another account.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)

ATT&CK techniques: Account Manipulation (T1098) Valid Accounts: Domain Accounts (T1078.002)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Active Directory Certificate Services Analytics

Attacker's goals: An attacker might modify account attributes to elevate privileges and get access to strong accounts in the domain.

Investigative actions: Check if any associated certificates were granted. Check if any login attempts were made by the impersonated accounts using certificates. Check if any Kerberos TGT tickets were generated by the impersonated accounts using certificates.

Variations

Suspicious account attribute modification that matches that of a sensitive machine account

Medium overridden

Suspicious account attribute modification that matches that of another account. overridden

Suspicious active setup registered Informational

The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Active Setup (T1547.014)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Gain persistence using the legitimate windows active setup mechanism, which executes binary on system startup.

Investigative actions: Verify if the registered binary is malicious. Check if the installing software is a malicious binary.

Suspicious activity indicating a potential abuse of a cloud-native email service Low Cloud 2 variations

A cloud identity performed a sequence of activities which might indicate an intent to abuse the email service to send phishing or spam.

Activation:: 14 Days
Training:: 30 Days
Test:: 3 Hours
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: User Execution (T1204)

Required data: AWS Audit Log Azure Audit Log

Attacker's goals: Adversaries may use cloud-based email services to send phishing or spread malware, abusing legitimate email domains.

Investigative actions: Check if the identity intended to preform these actions or look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).

Variations

Suspicious activity indicating a potential abuse of a cloud-native email service involving discovery, weaponization, and impact

High overridden

A cloud identity performed a sequence of activities which might indicate an intent to abuse the email service to send phishing or spam. The behavior that was observed included discovery operations, attack preparation and actual email sending. These activities might indicate an intent to abuse the email service to send phishing or spam. overridden

Suspicious activity indicating a potential abuse of a cloud-native email service involving discovery and weaponization

Medium overridden

A cloud identity performed a sequence of activities which might indicate an intent to abuse the email service to send phishing or spam. The behavior that was observed included discovery operations and attack weaponization. These activities might indicate an intent to abuse the email service to send phishing or spam. overridden

Suspicious activity on logging bucket Informational Cloud 2 variations

An identity performed a suspicious activity on bucket used to store logs.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impair Defenses (T1562) Impair Defenses: Disable or Modify Cloud Logs (T1562.008)

Required data: AWS Audit Log

Detector tags: Cloud Log Tampering Analytics

Attacker's goals: Evade detection by tampering the logs.

Investigative actions: Verify whether the identity attempted to access the bucket. Verify no logs were modified in the bucket.

Variations

Suspicious deletion on CloudTrail logging bucket

Medium overridden

An identity performed a suspicious activity on bucket used to store CloudTrail logs. overridden

Suspicious deletion on S3 access logs bucket

Medium overridden

An identity performed a suspicious activity on an S3 bucket used to store access logs. overridden

Suspicious authentication package registered Medium

The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 14 Days

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Authentication Package (T1547.002)

Required data: XDR Agent

Attacker's goals: Gain persistence using the legitimate Windows authentication package mechanism, which loads libraries into Windows services.

Investigative actions: Verify if the registered library is malicious. Check if the installing software is a malicious binary. Check for any suspicious network activity from "lsass.exe".

Suspicious authentication with Azure Password Hash Sync user Medium Identity Analytics

Authentication to an unusual authentication target was performed by the Azure AD Password Hash Sync user.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001) Defense Evasion (TA0005)

ATT&CK techniques: Valid Accounts (T1078) Modify Authentication Process: Hybrid Identity (T1556.007)

Required data: AzureAD

Attacker's goals: The attacker may be attempting to exploit a PHS user, the attacker wants to escalate and abuse this user, to get access to all the user's hashes.

Investigative actions: Follow further actions done by the account.

Suspicious brand affiliation detected Informational Email

The sender's name or address suggests association with a recognized brand, but the email address doesn't match established patterns for that brand.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Hour 30 Minutes

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impersonation (T1656)

Required data: Microsoft 365 Emails

Detector tags: Brand Impersonation

Attacker's goals: Trick the user on clicking the link, while avoiding detection.

Investigative actions: Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Suspicious certificate template modification Informational Identity Analytics 2 variations

A certificate template was updated with a possible misconfiguration. This may indicate the exploitation of misconfigured certificate template access control (ESC4).

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Hour

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Steal or Forge Authentication Certificates (T1649)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Active Directory Certificate Services Analytics

Attacker's goals: An attacker is attempting to exploit AD CS misconfigurations to obtain certificates that can be used for credential theft and privilege escalation.

Investigative actions: Review the AD CS configuration for vulnerable templates and EKU settings.* Review AD CS logs to identify any unauthorized certificate issuances, modifications, or template changes.

Variations

Certificate template was updated to be vulnerable to AD CS ESC attack

Medium overridden

A certificate template was updated, making it vulnerable to an AD CS ESC attack. This may indicate the potential abuse of AD CS ESC4. overridden

Certificate template was updated with a misconfiguration configuration

Low overridden

A certificate template was updated with new misconfiguration. This may indicate a potential AD CS ESC4 attack. overridden

Suspicious certutil command line Medium

An attacker may use certutil to download malware.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Command and Control (TA0011) Defense Evasion (TA0005)

ATT&CK techniques: System Binary Proxy Execution (T1218) Ingress Tool Transfer (T1105)

Required data: XDR Agent

Detector tags: LOLBIN Execution Analytics

Attacker's goals: An attacker may use certutil to download malware.

Investigative actions: Check whether the URL is benign and if this was a desired behavior as part of its normal execution flow. Check whether the downloaded file is malicious.

Suspicious cloud compute instance SSH keys modification attempt Informational Cloud 7 variations

An identity attempted to modify the SSH keys of a single compute instance. This may indicate an attacker's attempt to maintain persistence on the cloud instance.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 5 Days

ATT&CK tactics: Persistence (TA0003) Lateral Movement (TA0008)

ATT&CK techniques: Account Manipulation: SSH Authorized Keys (T1098.004) Remote Services: Cloud Services (T1021.007) Remote Services: Direct Cloud VM Connections (T1021.008)

Required data: AWS Audit Log Azure Audit Log Gcp Audit Log

Detector tags: Cloud Lateral Movement Analytics

Attacker's goals: Maintain persistence on a compromised compute instance. Escalate local privileges to gain root on compute instance.

Investigative actions: Investigate if SSH keys were modified or added at the instance or project level. Investigate which permissions were obtained as a result of the SSH keys modification.

Variations

Suspicious cloud compute instance SSH keys modification attempt by an identity with high administrative activity

Informational overridden

An identity attempted to modify the SSH keys of a single compute instance. The identity has high administrative activity This may indicate an attacker's attempt to maintain persistence on the cloud instance. overridden

Instance SSH keys were modified for the first time in the cloud provider

High overridden

An identity has modified the SSH keys of an instance for the first time in the cloud provider. This may indicate an attacker's attempt to maintain persistence on the cloud instance. overridden

Suspicious cloud compute instance SSH keys modification by a service account

Medium overridden

A service account has modified the SSH keys of a single compute instance. This may indicate an attacker's attempt to maintain persistence on the cloud instance. overridden

Suspicious cloud compute instance SSH keys modification

Informational overridden

An identity has modified the SSH keys of a single compute instance. This may indicate an attacker's attempt to maintain persistence on the cloud instance. overridden

Suspicious GCP project level metadata modification by a service account

Low overridden

A service account has modified the metadata of the entire instances in the project. This may indicate an attacker's attempt to perform lateral movement within the project. overridden

Suspicious GCP project level metadata modification

Informational overridden

An identity account has modified the metadata of the entire instances in the project. This may indicate an attacker's attempt to perform lateral movement within the project. overridden

Suspicious GCP project level metadata modification attempt

Informational overridden

An identity account has modified the metadata of the entire instances in the project. This may indicate an attacker's attempt to perform lateral movement within the project. overridden

Suspicious cloud user data modification attempt followed by VM restart Low Cloud

Suspicious user data modification followed by VM restart, possibly an attempt to run altered startup scripts at boot.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Cloud Administration Command (T1651)

Required data: AWS Audit Log Gcp Audit Log

Attacker's goals: Execute arbitrary code, establish persistence, or alter instance startup behavior through modified user data.

Investigative actions: Review the identity who modified the instance user data. Inspect the user data script for malicious content.

Suspicious container orchestration job Low

A suspicious orchestration job ran with a rare command line.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 10 Minutes

ATT&CK tactics: Execution (TA0002) Persistence (TA0003) Privilege Escalation (TA0004)

ATT&CK techniques: Scheduled Task/Job: Container Orchestration Job (T1053.007)

Required data: XDR Agent

Attacker's goals: Adversaries may abuse task scheduling functionality provided by container orchestration tools The adversaries do that to schedule deployment of containers configured to execute malicious code.

Investigative actions: Investigate The process activities and impact on the relevant container.

Suspicious container reconnaissance activity in a Kubernetes pod Informational 2 variations

A process performed multiple consecutive container discovery commands from within a Kubernetes Pod.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Remote System Discovery (T1018) System Information Discovery (T1082) System Network Configuration Discovery (T1016) System Service Discovery (T1007) Container and Resource Discovery (T1613)

Required data: XDR Agent

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Collect information about the host, network and user configuration for lateral movement and privilege escalation.

Investigative actions: Verify if the script or process initiating the discovery commands is benign. Verify that this isn't sanctioned IT activity. Look for other hosts executing similar commands.

Variations

Suspicious container reconnaissance activity in a Kubernetes pod

Medium overridden

A process performed multiple consecutive container discovery commands from within a Kubernetes Pod. overridden

Suspicious container reconnaissance activity in a Kubernetes pod

Low overridden

A process performed multiple consecutive container discovery commands from within a Kubernetes Pod. overridden

Suspicious container runtime connection from within a Kubernetes Pod Informational 2 variations

A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 5 Days

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Container Administration Command (T1609) Deploy Container (T1610)

Required data: XDR Agent

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Escape from a container to the host machine and expand the foothold in the network.

Investigative actions: Change the container socket configuration. Check if the default Docker daemon binding to TCP changed. If so, non-root users may gain access to the container.

Variations

Suspicious container runtime connection from within a Kubernetes Pod using the curl client

Low overridden

A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host. overridden

Suspicious container runtime connection from within a Kubernetes Pod using the docker client

Medium overridden

A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host. overridden

Suspicious curl user agent Informational 1 variation

Suspicious user agent provided to curl command.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Command and Control (TA0011)

ATT&CK techniques: Application Layer Protocol: Web Protocols (T1071.001)

Required data: XDR Agent

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Impairing host defenses.

Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Variations

Suspicious curl user agent from within a Kubernetes Pod

Low overridden

Suspicious user agent provided to curl command. overridden

Suspicious dNSHostName attribute change to DC name Medium Identity Analytics

The dNSHostName attribute of a machine account was changed to a Domain Controller server name.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)

ATT&CK techniques: Account Manipulation (T1098) Valid Accounts: Domain Accounts (T1078.002)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Elevate privileges from standard domain user to domain admin.

Investigative actions: Check if the domain controller is patched or vulnerable to the attack. Check if any associated TGTs or service tickets were granted. Follow actions by the account and if it performed a DCSync.

Suspicious data encryption Low

Known applications were used to encrypt data within a machine's local file system.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Impact (TA0040) Defense Evasion (TA0005)

ATT&CK techniques: Data Encrypted for Impact (T1486) Obfuscated Files or Information: Encrypted/Encoded File (T1027.013)

Required data: XDR Agent

Attacker's goals: Damage or hide data on the local file system.

Investigative actions: Check if the action was done using an automation service. Check if there are any other suspicious activities originated from the same machine/executing user.

Suspicious disablement of the Windows Firewall Low

The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 7 Days

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)

Required data: XDR Agent

Attacker's goals: An attacker may turn the firewall off to exfiltrate data and communicate with C2 servers.

Investigative actions: Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if the process is legitimately disabling the firewall.

Suspicious disablement of the Windows Firewall using PowerShell commands Medium

The Windows Firewall has been disabled using PowerShell. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: An attacker may turn the firewall off to exfiltrate data and communicate with C2 servers.

Investigative actions: Check Windows event logs to see the PowerShell command or script that was executed. Check whether the PowerShell command is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if it's a legitimate process that disabled the firewall.

Suspicious docker image download from an unusual repository Informational 2 variations

The agent has pulled a docker image from a repository for the first time.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: User Execution: Malicious Image (T1204.003)

Required data: XDR Agent

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Adversaries may rely on a user running a malicious image to facilitate execution.

Investigative actions: Scan the docker image that was pulled. Check the repository designation. Check on which other agents the docker image is being used.

Variations

Suspicious docker image download from an unrecognized registry

Low overridden

The agent has pulled a docker image from a registry that has never been used in the organization. overridden

Suspicious docker image download from an unrecognized repository

Low overridden

The agent has pulled a docker image from a repository that has never been used in the organization. overridden

Suspicious domain user account creation Informational Identity Analytics

A user was observed creating a rare domain account.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Create Account: Domain Account (T1136.002)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Persistence using a valid account.

Investigative actions: Check the user who created the account and verify its activity.

Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin High

Attackers may attempt to dump the ntds.dit file, which stores all Active Directory account information, to later extract passwords and hashes from it.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: OS Credential Dumping: NTDS (T1003.003)

Required data: XDR Agent

Attacker's goals: Retrieve Active Directory data, to perform malicious activities such as lateral movement.

Investigative actions: Check the initiator process for additional suspicious activity.

Suspicious failed HTTP request - potential Spring4Shell exploit Low 1 variation

A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Exploit Public-Facing Application (T1190)

Required data: Palo Alto Networks Firewall EAL Logs XDR Agent

Attacker's goals: Gain the ability to execute code remotely or drop malware.

Investigative actions: Check if suspicious process executions occurred after the request. Consider limiting access to the vulnerable server.

Variations

Suspicious HTTP request - potential Spring4Shell exploit

Medium overridden

A potentially malicious HTTP request was received, possibly as part of a Spring4Shell exploitation attempt. overridden

Suspicious heavy allocation of compute resources - possible mining activity Medium Cloud 3 variations

An identity allocated an unusual heavy compute resource, suspected as mining activity. Heavy machines normally have a high amount of CPU cores or attached with GPU, which are targeted by adversaries to mine Cryptocurrency.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 5 Days

ATT&CK tactics: Impact (TA0040) Initial Access (TA0001)

ATT&CK techniques: Resource Hijacking (T1496) Valid Accounts (T1078)

Required data: AWS Audit Log Azure Audit Log Gcp Audit Log

Attacker's goals: Leverage cloud compute resources to earn virtual currency.

Investigative actions: Check the identity created resources and its legitimacy. Look for any unusual behavior originated from the suspected identity, and check if they're compromised, e.g. access key, service account, etc.

Variations

Suspicious heavy allocation of compute resources - possible mining activity

Low overridden

An identity allocated an unusual heavy compute resource, suspected as mining activity. Heavy machines normally have a high amount of CPU cores or attached with GPU, which are targeted by adversaries to mine Cryptocurrency. overridden

Suspicious heavy allocation of compute resources - possible mining activity

High overridden

An identity allocated an unusual heavy compute resource, suspected as mining activity. Heavy machines normally have a high amount of CPU cores or attached with GPU, which are targeted by adversaries to mine Cryptocurrency. overridden

Suspicious heavy allocation of compute resources - possible mining activity

Medium overridden

An identity allocated an unusual heavy compute resource, suspected as mining activity. Heavy machines normally have a high amount of CPU cores or attached with GPU, which are targeted by adversaries to mine Cryptocurrency. overridden

Suspicious hidden user created Medium Identity Analytics

A user account was created with a name that mimics a machine account.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003) Defense Evasion (TA0005)

ATT&CK techniques: Create Account (T1136) Hide Artifacts: Hidden Users (T1564.002)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Evasion using a valid account.

Investigative actions: Check the user account created and verify its activity.

Suspicious identity downloaded multiple objects from a bucket Low Cloud 3 variations

An identity downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 5 Days

ATT&CK tactics: Collection (TA0009) Exfiltration (TA0010)

ATT&CK techniques: Data from Cloud Storage (T1530) Automated Exfiltration (T1020)

Required data: AWS Audit Log Azure Audit Log Gcp Audit Log

Detector tags: Cloud Data Asset Exfiltration, Data Detection & Response

Attacker's goals: Exfiltrate sensitive data from the cloud environment.

Investigative actions: Check the accessed bucket and objects designation. Verify that the identity did not download any sensitive information that it shouldn't.

Variations

Suspicious identity with DevOps behavior downloaded multiple objects from a bucket

Informational overridden

An identity with DevOps behavior downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment. overridden

Suspicious identity downloaded multiple objects from a bucket that contains sensitive files

Medium overridden

An identity downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment. The bucket contains sensitive files. overridden

Suspicious identity downloaded multiple objects from a backup storage bucket

Medium overridden

An identity downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment. overridden

Suspicious modification of the AdminSDHolder's ACL Low Identity Analytics

A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Account Manipulation (T1098)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Attackers attempt to obtain full control privileges and then move laterally.

Investigative actions: Check if a new user was added to the AdminSDHolder object. Check if a suspicious user account was recently created. Check if a user was added to a privileged group (e.g. Domain Admins). Investigate any other potentially suspicious behavior from the compromised user. Search for actions that may trigger SDProp, such as modifying the registry or executing an LDAP query.

Suspicious module load using direct syscall Low 1 variation

A module was loaded to a process using a direct syscall.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Native API (T1106)

Required data: XDR Agent

Detector tags: Direct Syscall Analytics

Attacker's goals: An attacker might try to use direct syscalls to evade detection and load a malicious module to a legitimate program.

Investigative actions: Investigate the direct syscall mapped image to verify if it is malicious. Investigate the loaded module to verify if it is malicious.

Variations

A module was loaded to an unsigned process by using a direct syscall

Medium overridden

A module was loaded to an unsigned process using a direct syscall. overridden

Suspicious objects encryption in an AWS bucket High Cloud

An AWS KMS key from a non-organization account was used to encrypt multiple objects in a bucket for the first time. This may indicate an attacker attempting to perform a ransomware attack against the organization's cloud environment.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 1 Day

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: Data Encrypted for Impact (T1486)

Required data: AWS Audit Log

Detector tags: Cloud Data Asset Protection Tampering, Data Detection & Response

Attacker's goals: Gain monetary compensation in exchange for decryption or the decryption key. Permanently deny access to important storage objects.

Investigative actions: Check if the external KMS service is a legit encryption service. Check if the identity performed enumeration activity to detect insecure S3 buckets, which are configured without the versioning and MFA Delete mechanisms. Detect additional buckets that were encrypted using the same external KMS service. Disable the identity from which the external service was configured. Enable versioning on every critical bucket. Enable MFA Delete on every critical bucket.

Suspicious print processor registered Medium

The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Print Processors (T1547.012)

Required data: XDR Agent

Attacker's goals: Gain persistence using the legitimate windows print processor mechanism, which loads libraries into Windows services.

Investigative actions: Verify if the registered library is malicious. Check if the installing software is a malicious binary. Check for any suspicious network activity from svchost.exe or spoolsv.exe.

Suspicious process accessed a site masquerading as Google Informational 1 variation

A suspicious process accessed a site masquerading as Google.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Command and Control (TA0011) Defense Evasion (TA0005)

ATT&CK techniques: Web Service: Bidirectional Communication (T1102.002) Masquerading (T1036)

Required data: XDR Agent

Attacker's goals: Masquerade legitimate looking Google services for defense evasion and C&C.

Investigative actions: See whether this site has a malicious reputation. Follow process activities. Monitor traffic to the site.

Variations

Suspicious process resolved the DNS name of a site masquerading as Google

Informational overridden

A suspicious process resolved the DNS name of a site masquerading as Google. overridden

Suspicious process accessed certificate files Low

A suspicious process accessed certificate files.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Unsecured Credentials (T1552) Steal or Forge Authentication Certificates (T1649)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Attackers may search for local certificate files for authentication, persistence or NTLM extraction.

Investigative actions: See whether this was a legitimate action. Follow process/user activities.

Suspicious process executed with a high integrity level Informational 1 variation

A suspicious process was spawned with a High or System integrity level, which is higher than its parent process. This may indicate malicious privilege escalation.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 7 Days

ATT&CK tactics: Privilege Escalation (TA0004)

ATT&CK techniques: Abuse Elevation Control Mechanism (T1548)

Required data: XDR Agent

Attacker's goals: An attacker may attempt to gain higher privileges.

Investigative actions: Check whether the command line executed is benign or normal for the host and/or user performing it. Investigate the endpoint to determine if it's a legitimate process that is supposed to run with privileges.

Variations

Suspicious process executed with a high integrity level

Low overridden

A suspicious process was spawned with a High or System integrity level, which is higher than its parent process. This may indicate malicious privilege escalation. overridden

Suspicious process execution from tmp folder Informational 4 variations

An unpopular process was executed from the tmp folder.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)

Required data: XDR Agent

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Attackers may try to run the executable application from a folder that is writable to all users and use it to avoid detection.

Investigative actions: Verify that this isn't IT activity. Look for other hosts executing similar commands.

Variations

A web server process executed an unpopular application from the tmp folder

Medium overridden

An executable application ran from the tmp folder by a web server process. overridden

Suspicious cron job task execution of a binary from the tmp folder

Medium overridden

An unpopular process was executed from the tmp folder. overridden

Suspicious interactive execution of a binary from the tmp folder

Medium overridden

An unpopular process was executed from the tmp folder. overridden

Suspicious process execution from tmp folder in a Kubernetes pod

Informational overridden

An unpopular process was executed from the tmp folder. overridden

Suspicious process execution in a privileged container Informational 1 variation

A process was executed in a privileged Kubernetes Pod for the first time in the past 30 days.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002) Privilege Escalation (TA0004)

ATT&CK techniques: Container Administration Command (T1609) Escape to Host (T1611)

Required data: XDR Agent

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Perform lateral movement to new hosts to expand the foothold within a network and gain higher privileges.

Investigative actions: Investigate the processes being spawned on the host for malicious activities. Correlate the command run from the host and understand which software initiated it.

Variations

Suspicious process execution in a new privileged container

Informational overridden

A process was executed in a privileged Kubernetes Pod for the first time in the past 30 days. overridden

Suspicious process loads a known PowerShell module Informational 2 variations

A non-PowerShell process loaded a known PowerShell module. This image load may be an indication of PowerShell execution without directly invoking the PowerShell.exe binary.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 8 Hours

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)

Required data: XDR Agent

Attacker's goals: An attacker is attempting to run PowerShell without PowerShell.exe to evade detection.

Investigative actions: Investigate the process and command line executed and whether it's benign or normal for this host.

Variations

Suspicious unsigned process loads a known PowerShell module

Low overridden

A non-PowerShell process loaded a known PowerShell module. This image load may be an indication of PowerShell execution without directly invoking the PowerShell.exe binary. overridden

Office process loads a known PowerShell DLL

High overridden

A Microsoft Office process loaded a known PowerShell module. This image load may be a sign of PowerShell execution without directly invoking the PowerShell.exe binary. overridden

Suspicious process modified RC script file Low 1 variation

A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)

ATT&CK techniques: Boot or Logon Initialization Scripts: RC Scripts (T1037.004)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system's startup.

Investigative actions: Check the modified RC script file and try to understand the impact of the file modification.

Variations

Suspicious process modified RC script file in a Kubernetes pod

Low overridden

A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence. overridden

Suspicious proxy environment variable setting Informational

Suspicious proxy environment variable change or definition with a rare command line.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Hour

ATT&CK tactics: Command and Control (TA0011)

ATT&CK techniques: Proxy: Internal Proxy (T1090.001)

Required data: XDR Agent

Attacker's goals: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

Investigative actions: Investigate the process activities and try to understand the network impact os the new proxy setting.

Suspicious reconnaissance using LDAP Informational 1 variation

A process executed multiple suspicious LDAP search queries. This may be indicative of LDAP enumeration.

Activation:: 14 Days
Training:: 30 Days
Test:: 10 Minutes
Deduplication:: 7 Days

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Account Discovery (T1087)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Detector tags: LDAP Analytics (Client)

Attacker's goals: An attacker is attempting to enumerate Active Directory.

Investigative actions: Check if the process executes LDAP search queries as part of its normal behavior. Investigate the LDAP search query for any suspicious indicators. Determine whether the search query is generic. Generic search queries (often using wildcards) tend to be more suspicious.

Variations

Suspicious reconnaissance using LDAP from untrusted process

Low overridden

A process executed multiple suspicious LDAP search queries. This may be indicative of LDAP enumeration. overridden

Suspicious runonce.exe parent process Low

Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 6 Hours

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)

Required data: XDR Agent

Attacker's goals: Command execution and persistence on the host.

Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Suspicious sAMAccountName change Low Identity Analytics 1 variation

The name of a machine account was changed to a sAMAccountName with a missing trailing dollar sign.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)

ATT&CK techniques: Account Manipulation (T1098) Valid Accounts (T1078)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Elevate privileges from standard domain user to domain admin.

Investigative actions: Check if the domain controller is patched or vulnerable to the attack. Check if any associated TGTs or service tickets were granted. Follow actions by the account and if it performed a DCSync.

Variations

Suspicious sAMAccountName change to DC hostname

Medium overridden

The name of a machine account was changed to a sAMAccountName with a missing trailing dollar sign. overridden

Suspicious secrets dump activity Informational Cloud 2 variations

An identity dumped multiple secrets from the project, considerably more than usual. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 5 Days

ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)

ATT&CK techniques: Unsecured Credentials (T1552) Data from Cloud Storage (T1530) Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006)

Required data: AWS Audit Log Azure Audit Log Gcp Audit Log

Attacker's goals: Collect secrets from the cloud environment.

Investigative actions: Check the accessed secrets' designation. Verify that the identity did not dump any sensitive information that it shouldn't.

Variations

An identity extracted every secret within the organization across multiple regions

Medium overridden

An identity dumped multiple secrets from the project, considerably more than usual. This may indicate an attacker's attempt to dump sensitive information from the cloud environment. overridden

An identity extracted multiple secrets within the organization across multiple regions

Low overridden

An identity dumped multiple secrets from the project, considerably more than usual. This may indicate an attacker's attempt to dump sensitive information from the cloud environment. overridden

Suspicious sender exhibiting automated sending patterns Informational Email 1 variation

Multiple messages from a single sender were observed over a short period, all having the same subject and differing body content. This repetitive pattern may indicate automated or scripted behavior.

Activation:: 14 Days
Training:: 30 Days
Test:: 30 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Phishing (T1566)

Required data: Microsoft 365 Emails

Detector tags: Phishing

Attacker's goals: Trick the user into clicking a link, while avoiding detection.

Investigative actions: Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

Suspicious sender with high-volume automated sending patterns

Informational overridden

A high volume of messages was observed from a single sender address within a short time period, all sharing the same subject line but containing different body content. This elevated and repetitive pattern may indicate automated or scripted behavior at scale. overridden

Suspicious sending domain with sender address randomization Informational Email 1 variation

Multiple messages from a single sender domain were observed over a short period, each using a unique sender address. This per-message sender randomization is uncommon for legitimate senders and suggests automated behavior.

Activation:: 14 Days
Training:: 30 Days
Test:: 30 Minutes
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Phishing (T1566)

Required data: Microsoft 365 Emails

Detector tags: Phishing

Attacker's goals: Trick the user into clicking a link, while avoiding detection.

Investigative actions: Examine the sender's IP address and reputation. Verify whether the sender's IP address has appeared in different log sources before, and if it is recognizable. If the message contains attachments or links, scrutinize them for any suspicious indications. Monitor further actions taken, such as file downloads or access to potentially malicious links.

Variations

High-volume sender domain with per-message sender randomization

Informational overridden

A high volume of emails was observed from a single sending domain over a short time period, each using a unique sender address. This high volume per-message sender randomization is uncommon for legitimate senders and suggests automated behavior. overridden

Suspicious setspn.exe execution Low

A Service Principal Name (SPN) is a unique identifier for a service, mapped to a specific account. Setspn.exe can be used to retrieve SPN information, which may indicate an attacker's attempt to "Kerberoast".

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Steal or Forge Kerberos Tickets (T1558)

Required data: XDR Agent

Attacker's goals: Retrieving SPN information to perform related attacks like 'Kerberoast'.

Investigative actions: Investigate the user who executed setspn.exe and find out if the act was malicious.

Suspicious sshpass command execution Low 1 variation

The sshpass command was executed, This could be an attempt to check for credential stuffing.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Brute Force: Credential Stuffing (T1110.004)

Required data: XDR Agent

Detector tags: Kubernetes - AGENT, Containers

Attacker's goals: Attackers may try to check and reuse credentials on the host.

Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.

Variations

Suspicious sshpass command execution in a Kubernetes pod

Low overridden

The sshpass command was executed, This could be an attempt to check for credential stuffing. overridden

Suspicious successful RDP connection to localhost Informational Identity Analytics 2 variations

An unusual process created a successful RDP connection to localhost. This may indicate the use of a tunnel to bypass a firewall.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: External Remote Services (T1133)

Required data: XDR Agent

Detector tags: Enhanced RDP Analytics

Attacker's goals: The attacker attempts to gain access to the accounts through RDP from an external source.

Investigative actions: Investigate the actor process to determine if it was used for legitimate purposes or malicious activity. Identify the user performing RDP and check that it is authorized. Follow further actions done by the user.

Variations

Suspicious successful RDP connection to localhost via reverse SSH tunnel

Low overridden

An unusual process created a successful RDP connection to localhost. The command line indicates the usage of SSH tunnel to bypass the firewall. overridden

Suspicious successful RDP connection to localhost on DC server

Low overridden

An unusual process created a successful RDP connection to localhost on a DC server. This may indicate the use of a tunnel to bypass a firewall. overridden

Suspicious systemd timer activity Low

Suspicious systemd timer activity, which may indicate an attempt to establish persistence.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002) Persistence (TA0003) Privilege Escalation (TA0004)

ATT&CK techniques: Scheduled Task/Job: Systemd Timers (T1053.006)

Required data: XDR Agent

Attacker's goals: An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.

Investigative actions: Check the systemd timer file change and try to understand the impact of the systemd timers change.

Suspicious theme and sentiment in email Informational Email

The email's body has a theme and sentiment that may indicate a malicious attempt.

Activation:: 14 Days
Training:: 30 Days
Test:: 1 Hour
Deduplication:: 1 Hour 30 Minutes

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: Financial Theft (T1657)

Required data: Box Audit Log DropBox Google Workspace Audit Logs Microsoft 365 Emails Office 365 Audit Okta Audit Log

Detector tags: Phishing

Attacker's goals: Trick recipients into revealing sensitive information, hijack the organization, or obtain money through deception.

Investigative actions: Review the email headers and metadata of to identify potential spoofing techniques or unusual routing patterns. Analyze any URLs or attachments in a secure sandbox environment to detect possible malware or phishing attempts. Correlate findings with recent alerts in the SIEM to assess whether similar accumulation patterns are forming. Engage potentially affected users to understand if any actions were taken in response to this email, which could increase the overall risk. Document and escalate findings if the accumulation of warnings suggests a broader phishing campaign.

Suspicious time provider registered Medium 2 variations

The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Time Providers (T1547.003)

Required data: XDR Agent

Attacker's goals: Gain persistence using the legitimate Windows time provider mechanism, which loads libraries into Windows services.

Investigative actions: Verify if the registered library is malicious. Check if the software performing the installation is a malicious binary. Check for any network activity from a "svchost.exe -k LocalService" process that seems suspicious.

Variations

Suspicious time provider registered manually by reg.exe

High overridden

The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service. overridden

Suspicious time provider registered using an uncommon provider name

High overridden

The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service. overridden

Suspicious usage of EC2 token Low Cloud 1 variation

An AWS EC2 STS token was used externally from an EC2 instance.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 5 Days

ATT&CK tactics: Credential Access (TA0006) Initial Access (TA0001)

ATT&CK techniques: Steal Application Access Token (T1528) Unsecured Credentials (T1552) Valid Accounts: Cloud Accounts (T1078.004)

Required data: AWS Audit Log

Attacker's goals: Exfiltrate token and abuse it remotely.

Investigative actions: Check if the access key was generated by the attached instance. Check what actions were executed by the access key. Check if the relevant instance is compromised.

Variations

Suspicious usage of EC2 token

Medium overridden

An AWS EC2 STS token was used externally from an EC2 instance. overridden

Suspicious usage of File Server Remote VSS Protocol (FSRVP) High

A suspicious usage of File Server Remote VSS Protocol (FSRVP) was done.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Lateral Movement (TA0008)

ATT&CK techniques: Use Alternate Authentication Material: Pass the Hash (T1550.002)

Required data: XDR Agent

Attacker's goals: An attacker is attempting to steal credentials and move laterally within a network.

Investigative actions: Check for suspicious processes on the source host. Check if the source host is a vulnerability scanner. Look for additional suspicious activities by users.

Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet Informational

An attacker may use one of Microsoft's Active Directory PowerShell module remote discovery cmdlet to reconnaissance the network.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Remote System Discovery (T1018)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Collect information about the host, network and user configuration for lateral movement and privilege escalation.

Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow. Understand what information the attacker had gathered from the command and investigate relevant assets.

Svchost.exe loads a rare unsigned module Low

Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Defense Evasion (TA0005) Persistence (TA0003)

ATT&CK techniques: Masquerading: Masquerade Task or Service (T1036.004) Create or Modify System Process: Windows Service (T1543.003)

Required data: XDR Agent

Detector tags: Malicious Service Analytics

Attacker's goals: Evading detections by running code from a signed Microsoft executable.

Investigative actions: Check whether the loaded module with the corresponding hash is benign and if this was a desired behavior as part of its normal execution flow. Go to the 'Services' registry key and investigate its sub keys to find the service associated with the loaded dll.

System information discovery via psinfo.exe Low

Using psinfo.exe, the attacker can gather information about the network, and gain an in-depth understanding of which devices are relevant to attack.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 6 Hours

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: System Information Discovery (T1082)

Required data: XDR Agent

Attacker's goals: Collect information about the host, network and user configuration for lateral movement and privilege escalation.

Investigative actions: Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow. Verify that this isn't sanctioned IT activity. Look for other hosts executing similar commands.

System profiling WMI query execution Informational

Attackers or malware may use WMI queries to identify the system and evade execution in sandbox environments.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Execution (TA0002) Discovery (TA0007)

ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)

Required data: XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Attacker or malware can use WMI queries to identify system components and prevent execution in sandbox \ virtualized environments to evade detection.

Investigative actions: Examine the process that executed the WMI query and verify that the process is from a trusted source. Inspect the system for suspicious activity that is related to that process.

System shutdown or reboot Informational

System shutdown or reboot using shutdown, reboot, halt or poweroff.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 1 Day

ATT&CK tactics: Impact (TA0040)

ATT&CK techniques: System Shutdown/Reboot (T1529)

Required data: XDR Agent

Attacker's goals: Attackers may shut down or reboot hosts to disturb access to those hosts.

Investigative actions: Verify that this isn't IT activity.

TGT request with a spoofed sAMAccountName - Event log Medium Identity Analytics

A Kerberos authentication ticket (TGT) was requested for an account with a spoofed sAMAccountName.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 3 Hours

ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)

ATT&CK techniques: Account Manipulation (T1098) Valid Accounts (T1078)

Required data: Windows Event Collector XDR Agent with eXtended Threat Hunting (XTH)

Attacker's goals: Elevate privileges from standard domain user to domain admin.

Investigative actions: Check if the domain controller is patched or vulnerable to the attack. Look for associated sAMAccountName rename events. Check if any associated service tickets were granted. Follow actions by the account and if it performed a DCSync.

TGT request with a spoofed sAMAccountName - Network Medium Identity Analytics

A Kerberos authentication ticket (TGT) was requested for an account with a spoofed sAMAccountName.

Activation:: 14 Days
Training:: 30 Days
Test:: N/A (single event)
Deduplication:: 3 Hours

ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)

ATT&CK techniques: Account Manipulation (T1098) Valid Accounts (T1078)

Required data: XDR Agent

Attacker's goals: Elevate privileges from standard domain user to domain admin.

Investigative actions: Check if the domain controller is patched or vulnerable to the attack. Look for associated sAMAccountName rename events. Check if any associated service tickets were granted. Follow actions by the account and if it performed a DCSync.