A commonly abused process connected to a rare cloud resource

Analytics BIOC Low

A commonly abused process connected to a rare cloud resource

A commonly abused process connected to a rare cloud resource.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Command and Control (TA0011)

ATT&CK techniques: Application Layer Protocol: Web Protocols (T1071.001)

Detector tags: EDR Windows C2 Analytics

Attacker's goals:

Communicate with the attacker's Command and Control (C2) infrastructure.

Investigative actions:

Investigate the actor process connected to the cloud resource. Is this use case usually takes place within the org? Determine if the cloud resource is owned by your organization or a known external entity. Assess whether this communication pattern is expected or not.

Test period:: N/A (single event)
Deduplication:: 1 Day

3 variations:

A commonly abused software develop tool connected to a rare cloud resource Informational (parent: Low)
A commonly abused rare process connected to a rare cloud resource Low
A commonly abused renamed process connected to a rare cloud resource Medium (parent: Low) Adds Masquerading (T1036)