Analytics High

Possible brute force or configuration change attempt on cytool

An unusual amount of cytool commands were executed in a short period from a user who doesn't usually run these commands. This may indicate an attempt to guess the Administrator password.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Brute Force: Password Guessing (T1110.001)
Attacker's goals:

The attacker may disable the agent to perform malicious activities.

Investigative actions:

Verify which user ran these commands and if it is a legitimate behavior on this host.

Test period:
1 Hour
Deduplication:
1 Day