Analytics BIOC Informational
✕

Uncommon network tunnel creation

An uncommon network tunnel was established.

Module:
Platform Analytics
Data source:
Palo Alto Networks Url Logs
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Protocol Tunneling (T1572)
Attacker's goals:

Attackers may use SSH or any similar utility to create a network tunnel to allow an attacker to covertly connect to an internal host.

Investigative actions:

Review the external IP/domain using known intelligence tools. Investigate the causality of the process and its user ID to find uncommon behaviors. Search for processes or files that were created by this SSH instance.

Test period:
N/A (single event)
Deduplication:
12 Hours
3 variations:
  • Uncommon network tunnel creation Informational
  • Uncommon SSH tunnel to unpopular IP address Low (parent: Informational)
  • An uncommon network tunnel was established over the default SSH port Low (parent: Informational)