Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

3 alerts match the current filters. tactic: TA0006 ✕ technique: T1059 ✕

Download CSV Show ATT&CK heatmap
  • A Command Line Interface (CLI) command was executed from an AWS serverless compute service Low Cloud 2 variations

    AWS serverless compute service token was used to execute a Command Line Interface (CLI) command. This may indicate token theft due to the nature of serverless compute.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Initial Access (TA0001) Credential Access (TA0006) Execution (TA0002)
    ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004) Steal Application Access Token (T1528) Unsecured Credentials (T1552) Command and Scripting Interpreter: Cloud API (T1059.009)
    Required data: AWS Audit Log
    Detector tags: Cloud Serverless Function Credentials Theft Analytics
    Attacker's goals: Exfiltrate serverless token and abuse it.
    Investigative actions: Verify whether the serverless-attached identity's credentials were intentionally used in CLI. Check what CLI commands were executed using the serverless attached token. Check if the suspected serverless function is compromised.

    Variations

    A Command Line Interface (AWS-CLI) command was executed from an AWS serverless compute service

    Informational overridden

    AWS serverless compute service token was used to execute a Command Line Interface (CLI) command. This may indicate token theft due to the nature of serverless compute. overridden

    Unusual Command Line Interface (CLI) command was executed from an AWS serverless compute service

    Low overridden

    AWS serverless compute service token was used to execute a Command Line Interface (CLI) command. This may indicate token theft due to the nature of serverless compute. overridden

  • Uncommon AppleScript designed to access credential files was executed via the command line Medium

    The AppleScript interpreter was executed with a script designed to access credential files such as keychains or SSH keys.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
    ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Credentials from Password Stores (T1555)
    Required data: XDR Agent
    Detector tags: AppleScript Analytics, Sensitive Information Stealing Analytics
    Attacker's goals: Access stored credentials such as keychains and SSH keys for lateral movement or unauthorized access.
    Investigative actions: Identify which credential files were targeted (keychain, SSH authorized_keys, etc.). Check if credentials or authentication tokens were extracted. Verify the legitimacy of the file access attempt and whether it aligns with the user's normal activity. Examine child processes for signs of data exfiltration.
  • Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords Low 1 variation

    The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
    ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Credentials from Password Stores (T1555)
    Required data: XDR Agent
    Detector tags: AppleScript Analytics, Credentials Grabbing Analytics
    Attacker's goals: Harvest user credentials and passwords from sensitive locations such as the macOS Keychain or directory services to enable unauthorized access, lateral movement, or privilege escalation.
    Investigative actions: Analyze the command line and determine whether it performs any malicious or suspicious actions. Check the events generated by the process or its children for potential malicious behavior. Check whether the process was executed in an unusual way.

    Variations

    Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords leveraging the 'dscl -authonly' command to covertly verify the captured password

    High overridden

    The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords. overridden