Analytics
Low
✕
Multiple network-related alerts of different MITRE tactics on the same host
Multiple alerts of different MITRE tactics were seen on the same host.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Platform Alerts, Third-Party Alerts
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution (T1204)
Detector tags: NDR Insights Analytics
Attacker's goals:
Execute multiple covert actions to circumvent detection.
Investigative actions:
Investigate the source of all the linked alerts. Asses whether it looks like a threat actor executing multiple tactics.
- Test period:
- 1 Day
- Deduplication:
- 1 Day