Analytics BIOC
Informational
✕
Uncommon communication to an instant messaging server
A rare communication between a process to a known instant messaging server.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Web Service (T1102)
Attacker's goals:
Data exfiltration or attack tool staging through a trusted service.
Investigative actions:
Examine the legitimacy of the application that made the communication with the provider's server. Examine the parent process of this application. Check for anomalies regarding the time frame where the communication occurred.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- Uncommon communication to an instant messaging server by a suspicious process Low (parent: Informational)
- Uncommon communication to an instant messaging server by an uncommon scripting engine execution Low (parent: Informational)