Analytics BIOC Informational
✕

Execution of an uncommon process at an early startup stage

Uncommon execution of an executable found in an early startup stage.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Autostart Execution (T1547)
Detector tags: Generic Persistence Analytics
Attacker's goals:

Adversaries continuously find and develop new undetectable, novel methods of launching malware during startup. Attackers aim to get persistence to continue operating even after a reboot.

Investigative actions:

Check if the CGO (causality group owner) is familiar and if one of it configuration/parameters/registry keys has been modified.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Execution of an uncommon process at an early startup stage with suspicious characteristics Low (parent: Informational)
  • Execution of an uncommon process at an early startup stage with uncommon characteristics Low (parent: Informational)