Analytics BIOC Informational

Unique client computer model was detected via MS-Update protocol

A unique client computer model was detected via MS-Update protocol.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall EAL Logs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Hardware Additions (T1200)
Attacker's goals:

The Windows Server Update Services enable machines to discover and download software updates from a dedicated update server while providing the necessary client characteristics to install the suitable client version and build. Characteristics may consist of computer model, BIOS version and architecture. A unique computer model in the network may indicate an unauthorized and unmanaged connection to the internal network.

Investigative actions:

Inspect the legitimacy of the host and its hardware components. Verify that this host is not a newly deployed end-point or virtual machine as part of a legitimate IT activity.

Test period:
N/A (single event)
Deduplication:
7 Days