Analytics BIOC
Informational
✕
Suspicious proxy environment variable setting
Suspicious proxy environment variable change or definition with a rare command line.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Proxy: Internal Proxy (T1090.001)
Attacker's goals:
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.
Investigative actions:
Investigate the process activities and try to understand the network impact os the new proxy setting.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Hour