Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

3 alerts match the current filters. tactic: TA0005 ✕ technique: T1059 ✕

Download CSV Show ATT&CK heatmap
  • Azure Monitor alert rule deleted Informational Cloud 2 variations

    An Azure Monitor alert rule was deleted. Azure Monitor alert rules watch telemetry from cloud resources and fire when suspicious or anomalous activity occurs. Adversaries may delete these rules to blind defenders and avoid detection of follow-on malicious activity.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
    ATT&CK techniques: Impair Defenses (T1562) Impair Defenses: Disable or Modify Tools (T1562.001) Command and Scripting Interpreter: Cloud API (T1059.009)
    Required data: Azure Audit Log
    Detector tags: Cloud Log Tampering Analytics
    Attacker's goals: Blind defenders by removing alerts that watch for suspicious cloud activity. Avoid detection of subsequent operations such as data exfiltration, lateral movement, or persistence.
    Investigative actions: Identify which alert rule was deleted (metric, scheduled query, or activity-log alert) and what it was watching. Verify whether the identity that performed the deletion is authorized to manage Azure Monitor alert rules. Check the Azure Activity Log for the caller's other recent operations in the subscription / resource group. Look for correlated suspicious activity such as resource modifications, role assignments, or diagnostic-settings changes that would normally have been alerted on. Re-create the alert rule (or restore from infrastructure-as-code) to re-establish monitoring coverage.

    Variations

    Unusual Azure Monitor alert rule deletion

    Low overridden

    An Azure Monitor alert rule was deleted. Azure Monitor alert rules watch telemetry from cloud resources and fire when suspicious or anomalous activity occurs. Adversaries may delete these rules to blind defenders and avoid detection of follow-on malicious activity. overridden

    Azure Monitor alert rule deleted by compute workload

    Low overridden

    An Azure Monitor alert rule was deleted. Azure Monitor alert rules watch telemetry from cloud resources and fire when suspicious or anomalous activity occurs. Adversaries may delete these rules to blind defenders and avoid detection of follow-on malicious activity. overridden

  • Azure VM extension abuse attempt Informational Cloud 1 variation

    A suspicious Azure VM extension operation was detected. Attackers can use CustomScriptExtension to execute arbitrary scripts on VMs, VMAccessExtension to reset local passwords for persistence, or delete the IaaSAntimalware extension to disable antimalware protection and evade detection.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002) Persistence (TA0003) Defense Evasion (TA0005)
    ATT&CK techniques: Cloud Administration Command (T1651) Command and Scripting Interpreter: Cloud API (T1059.009) Account Manipulation (T1098) Impair Defenses: Disable or Modify Tools (T1562.001)
    Required data: Azure Audit Log
    Attacker's goals: Execute arbitrary code on VMs without network access (CustomScriptExtension). Gain persistent access by resetting local admin passwords (VMAccessExtension). Disable antimalware to deploy malware undetected (IaaSAntimalware deletion).
    Investigative actions: Identify the extension type involved (CustomScriptExtension, VMAccessExtension, IaaSAntimalware). For CustomScriptExtension: review the script payload executed on the VM. For VMAccessExtension: check if local admin credentials were reset and audit subsequent logins. For IaaSAntimalware deletion: verify the virtual machine audit log after the extension was removed. Verify whether the identity performing the operation is authorized to manage VM extensions. Check for correlated suspicious activity such as new role assignments or lateral movement.

    Variations

    Unusual azure VM extension abuse

    Low overridden

    A suspicious Azure VM extension operation was detected. Attackers can use CustomScriptExtension to execute arbitrary scripts on VMs, VMAccessExtension to reset local passwords for persistence, or delete the IaaSAntimalware extension to disable antimalware protection and evade detection. overridden

  • Uncommon AppleScript containing a potential obfuscation technique was executed Low 2 variations

    The AppleScript interpreter process was executed with an obfuscation technique in the command line.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)
    ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Obfuscated Files or Information: Command Obfuscation (T1027.010)
    Required data: XDR Agent
    Detector tags: AppleScript Analytics, Evasion Analytics
    Attacker's goals: Evade defenses and impede forensics by encrypting, encoding, or obfuscating payloads at rest or in transit.
    Investigative actions: Analyze the command line and determine whether it performs any malicious or suspicious actions. Check the events generated by the process or its children for potential malicious behavior. Verify the legitimacy of the persistence mechanism being created or modified.

    Variations

    Uncommon AppleScript containing a potential obfuscation technique was executed subsequently running a shell command

    Medium overridden

    The AppleScript interpreter process was executed with an obfuscation technique in the command line. overridden

    Uncommon AppleScript containing a potential obfuscation technique was executed by an uncommon parent process

    High overridden

    The AppleScript interpreter process was executed with an obfuscation technique in the command line. overridden