Rare AppID usage to a rare destination

Analytics BIOC Informational

Rare AppID usage to a rare destination

Rare AppID with port usage to rare destination.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

ATT&CK tactics: Command and Control (TA0011)

ATT&CK techniques: Application Layer Protocol (T1071) Non-Standard Port (T1571)

Attacker's goals:

Attackers might use well-known ports with uncommon applications to avoid being detected by a non-application aware firewall or to bypass firewall rules based only on ports.

Investigative actions:

Investigate the endpoints participating in the session.

Test period:: N/A (single event)
Deduplication:: 14 Days

2 variations:

Rare AppID usage to a rare destination using an unsigned process Low (parent: Informational)
Rare AppID usage to a rare destination from an internet-facing server Low (parent: Informational)