Analytics BIOC Low
✕

Rare binary connected to a rare cloud resource

Rare binary connected to a rare cloud resource.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Application Layer Protocol: Web Protocols (T1071.001)
Detector tags: EDR Windows C2 Analytics
Attacker's goals:

Communicate with the attacker's Command and Control (C2) infrastructure.

Investigative actions:

Check the binary file. Get further details about the uncommon external cloud resource.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • Software development tool connected to a rare cloud resource Informational (parent: Low)
  • Recently downloaded rare binary connected to a rare cloud resource Medium (parent: Low)