Rare access to known advertising domains

Analytics Informational

Rare access to known advertising domains

The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall EAL Logs, XDR Agent

ATT&CK tactics: Command and Control (TA0011) Persistence (TA0003)

ATT&CK techniques: Application Layer Protocol (T1071) Software Extensions: Browser Extensions (T1176.001)

Attacker's goals:

Causing the user to view excessive advertising content.

Investigative actions:

Investigate the infected machine and search for suspicious browser extensions, see if changes were made to the homepage or if the browser is slower than usual, check whether sites that do not have ads usually, display ads when accessed from the possibly infected endpoint. Search for suspicious redirections or proxy configuration on the infected machine. Search for a C&C communication.

Test period:: 1 Day
Deduplication:: 1 Day

2 variations:

Rare access to known advertising domains from a Rare User Agent Informational
Suspicious Rare access to known advertising domains Low (parent: Informational)