Analytics BIOC
Informational
✕
A Torrent client was detected on a host
The host produced traffic consistent with the BitTorrent protocol. Torrent usage may expose the organization to malware or enable attackers or malicious insiders to exfiltrate data.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls
ATT&CK tactics: Exfiltration (TA0010) Initial Access (TA0001)
ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048) Phishing (T1566)
Attacker's goals:
Exfiltrate data or as a phishing entry point.
Investigative actions:
Check the host for torrent client software. Look at the download's folder for foreign files or Torrent files. Examine the client's network traffic for uploaded or downloaded file hashes.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- A Torrent client was detected on a host Informational