Analytics BIOC
Informational
✕
Globally uncommon high entropy process was executed
A process with high entropy and a globally uncommon hash was executed.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Obfuscated Files or Information (T1027)
Attacker's goals:
Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.
Investigative actions:
Check if the process' file is either compressed, encrypted, obfuscated or packed.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
3 variations:
- Globally uncommon high entropy process was executed by a web server process or CGO Low (parent: Informational) Adds External Remote Services (T1133) Server Software Component: Web Shell (T1505.003)
- Globally uncommon high entropy process was extracted from an internet-downloaded archive and executed Low (parent: Informational)
- Globally uncommon high entropy process was downloaded from an uncommon source and executed Low (parent: Informational)