Analytics BIOC Informational
✕

Globally uncommon high entropy module was loaded

A module with high entropy and a globally uncommon hash was loaded.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Obfuscated Files or Information (T1027)
Attacker's goals:

Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.

Investigative actions:

Check if the module is either compressed, encrypted, obfuscated or packed.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Globally uncommon high entropy module was loaded by process which was executed by a scheduled task Low (parent: Informational)