Analytics
High
✕
Possible brute force or configuration change attempt on cytool
An unusual amount of cytool commands were executed in a short period from a user who doesn't usually run these commands. This may indicate an attempt to guess the Administrator password.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Brute Force: Password Guessing (T1110.001)
Attacker's goals:
The attacker may disable the agent to perform malicious activities.
Investigative actions:
Verify which user ran these commands and if it is a legitimate behavior on this host.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day