Analytics
Informational
✕
A compromised process accessed a rare cloud resource
A compromised process accessed a rare cloud resource.
- Module:
- Platform Analytics
- Data source:
- XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Application Layer Protocol (T1071)
Detector tags: EDR Windows C2 Analytics
Attacker's goals:
Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.
Investigative actions:
Investigate the compromised process. Identify the rare cloud resource accessed, is it managed by your organization?
- Test period:
- 2 Hours
- Deduplication:
- 1 Day
3 variations:
- A process compromised by DLL sideloading accessed a rare cloud resource and demonstrated abnormal communication patters Medium (parent: Informational)
- A process compromised by DLL sideloading accessed a rare cloud resource Informational
- An injected process accessed a rare cloud resource Informational