Analytics BIOC
Informational
✕
Unique client computer model was detected via MS-Update protocol
A unique client computer model was detected via MS-Update protocol.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall EAL Logs
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Hardware Additions (T1200)
Attacker's goals:
The Windows Server Update Services enable machines to discover and download software updates from a dedicated update server while providing the necessary client characteristics to install the suitable client version and build. Characteristics may consist of computer model, BIOS version and architecture. A unique computer model in the network may indicate an unauthorized and unmanaged connection to the internal network.
Investigative actions:
Inspect the legitimacy of the host and its hardware components. Verify that this host is not a newly deployed end-point or virtual machine as part of a legitimate IT activity.
- Test period:
- N/A (single event)
- Deduplication:
- 7 Days