Analytics BIOC
Informational
✕
Windows CGO, actor and action processes with anomalous characteristics
Windows CGO, actor and action processes with anomalous characteristics.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution (T1204)
Detector tags: Process Anomaly Analytics
Attacker's goals:
Processes anomalous characteristics which commonly appear in malicious activities.
Investigative actions:
Investigate the executed process image and check if it is malicious. Investigate the CGO and actor processes that executed the process and check if they are malicious.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Windows CGO, actor and action processes with highly anomalous characteristics Low (parent: Informational)