Analytics BIOC Informational
✕

A non-browser process accessed a website UI

An uncommon network communication between a non-browser process and a website UI.

Module:
Platform Analytics
Data source:
Palo Alto Networks Url Logs
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Web Service (T1102)
Attacker's goals:

Data exfiltration or attack tool staging.

Investigative actions:

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization. Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Suspicious content upload to a known text share website by Non browser process High (parent: Informational)
  • Uncommon data upload to a website through a Non-browser process Low (parent: Informational)
  • Uncommon data download from a known text share website through a Non-browser process Medium (parent: Informational)