Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0008 ✕ technique: T1190 ✕

Show ATT&CK heatmap
  • Unusual DB process spawning a shell Informational 3 variations

    A DB related process abnormally spawned a shell. This might indicate an exploitation attempt.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Initial Access (TA0001) Lateral Movement (TA0008)
    ATT&CK techniques: Exploit Public-Facing Application (T1190) Exploitation of Remote Services (T1210)
    Required data: XDR Agent
    Detector tags: Shell Analytics
    Attacker's goals: Obtain access to either the database or its hosting machine for various purposes like privilege escalation, lateral movement, and data theft.
    Investigative actions: Review the commands/processes executed by the shell for malicious actions. Check if and what else the DB process has executed. Check for any additional alerts raised in the context of the DB process. Audit the query/access logs of the DB for suspicious actions (Such as SQL injection or similar).

    Variations

    Unusual DB process spawning a shell with a possible reconnaissance command

    Low overridden

    A DB related process abnormally spawned a shell. This might indicate an exploitation attempt. overridden

    Unusual DB process spawning a shell with a possible web download/access command

    Low overridden

    A DB related process abnormally spawned a shell. This might indicate an exploitation attempt. overridden

    Unusual DB process spawning a shell with an unusual command line

    Low overridden

    A DB related process abnormally spawned a shell. This might indicate an exploitation attempt. overridden