Analytics BIOC
Low
✕
Rare security product signed executable executed in the network
Attackers may attempt to install a security product with a known vulnerability to bypass security features.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Exploitation for Defense Evasion (T1211)
Attacker's goals:
Adversaries may exploit the application vulnerability to bypass security features.
Investigative actions:
Check if the security product was installed by a legitimate user and intentionally.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day