Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level.	Informational	Platform Analytics	XDR Agent	Defense Evasion, Persistence
Analytics BIOC	Globally uncommon IP address by a common process (sha256) A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Globally uncommon IP address connection from a signed process A signed process connected to an external IP address that, on a global level, it usually doesn't connect to.	Informational	Platform Analytics	XDR Agent	Defense Evasion, Command and Control
Analytics BIOC	Globally uncommon process execution from a signed process A signed process has executed a process that, on a global level, it usually doesn't execute.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Globally uncommon root domain from a signed process A signed process connected to an external domain that, on a global level, it usually doesn't connect to.	Low	Platform Analytics	XDR Agent	Defense Evasion, Command and Control
Analytics BIOC	Globally uncommon root-domain port combination by a common process (sha256) A process with a common sha256 connected to an external domain in a specific port that, on a global level, it usually doesn't connect to.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Globally uncommon root-domain port combination from a signed process A signed process connected to an external domain on a specific port that, on a global level, it usually doesn't connect to.	Low	Platform Analytics	XDR Agent	Defense Evasion, Command and Control
Analytics BIOC	Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	HTTP with suspicious characteristics Uncommon HTTP communication was performed by the host that might indicate its attempt to hide malicious activities.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Hydra Password Brute-Force Tool Execution Attackers may use brute-force techniques to gain access to accounts when usernames and/or passwords are unknown.	High	Platform Analytics	XDR Agent	Credential Access
Analytics	Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics BIOC	Indicator blocking Auditing or logging configuration changes on Linux host.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Indirect command execution using the Program Compatibility Assistant Pcalua.exe (Program Compatibility Assistant) is used for running old programs that have compatibility issues. Attackers can use pcalua.exe to indirectly execute their malicious programs.	Medium	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Injection into rundll32.exe A process injected into an instance of rundll32.exe.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Installation of a new System-V service Installation of a new System-V service.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation
Analytics BIOC	Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation.	Low	Platform Analytics	XDR Agent	Execution, Privilege Escalation
Analytics	Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.	Low	Identity Analytics	XDR Agent	Discovery, Credential Access
Analytics BIOC	Interactive login by a machine account A machine account performed an interactive or remote interactive login.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Interactive login by a service account A service account performed an interactive or remote interactive login.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics	Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Kerberos Pre-Auth Failures by Host The endpoint failed an unusual number of Kerberos pre-authentications (TGT requests) from at least three users when compared to its baseline. This can indicate a password-spraying attack.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Kerberos Traffic from Non-Standard Process The endpoint had a non-standard process communicating over ports normally used by Kerberos. An attacker might be using malicious tools to move laterally.	Medium	Platform Analytics	XDR Agent	Discovery
Analytics	Kerberos User Enumeration A high amount of Kerberos principal unknown errors were generated on users in the last hour. This may be indicative of Kerberos user enumeration.	Medium	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Discovery
Analytics BIOC	Keylogging using system commands Usage of a Linux system utility to capture input.	Low	Platform Analytics	XDR Agent	Credential Access, Collection
Analytics BIOC	Kubelet server communication from a pod The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges.	Informational	Platform Analytics	XDR Agent	Privilege Escalation, Discovery
Analytics BIOC	Kubernetes API server communication from within a pod The Kubernetes API server was accessed from within a pod.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Kubernetes nsenter container escape The nsenter command was used to execute a process in the context of the initialization process.	Informational	Platform Analytics	XDR Agent	Privilege Escalation
Analytics BIOC	Kubernetes secret enumeration activity Kubectl secret enumeration command was executed.	Informational	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Kubernetes version disclosure The Kubernetes API server was inquired about the Kubernetes version by a process from within a pod.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Kubernetes vulnerability scanner activity A Kubernetes cluster was scanned by a known vulnerability scanner.	Medium	Platform Analytics	XDR Agent	Execution, Discovery
Analytics	Large Upload (FTP) The endpoint transferred an excessively large amounts of data to a single destination over FTP. Cortex XDR Analytics assumes endpoint traffic towards a specific destination should be about the same over long periods of time. For that reason, Cortex XDR detected this abnormal behavior of a large data upload. An attacker may be exfiltrating data directly to the internet using this protocol.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics	Large Upload (Generic) The endpoint transferred large amounts of data to an external site using a different protocol from HTTP/s, FTP, or SMTP. (A specific detector is used for each of those protocols.) Cortex XDR Analytics assumes that data transfers out of your network are ordinarily performed using one of those three services, so it expects that data transfers over all other ports to be low. For the same reason, Cortex XDR Analytics also assumes endpoint traffic towards a specific destination should be about the same over long periods of time. An attacker may be exfiltrating data directly to the internet.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics	Large Upload (HTTPS) The endpoint transferred an excessive amount of data to an external site over HTTPS. The destination is not a popular upload site for endpoints on your network, and the endpoint performing the upload has not previously downloaded a large amount of data from the site. The upload is considered excessive based on comparison to baseline measurements of HTTPS data transfers on your network. An attacker may be exfiltrating data directly to the internet.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration
Analytics	Large Upload (SMTP) The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration
Analytics BIOC	LDAP traffic from non-standard process LDAP traffic is usually performed by a standard set of processes. The endpoint had a non-standard process communicating over ports normally used by LDAP. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Linux local user account creation A user executed a process associated with user account creation.	Informational	Identity Analytics	XDR Agent	Persistence
Analytics BIOC	Linux network share discovery An adversary might use known tools to discover SMB shares within the compromised network.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Linux process execution with a rare GitHub URL A process was executed with an uncommon GitHub URL in its command line. This may have legitimate uses, but it might also be used by attackers to download malicious payloads.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Local account discovery One of several local account discovery commands were executed.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.	Informational	Identity Analytics	XDR Agent	Defense Evasion
Analytics BIOC	LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	LOLBIN process executed with a high integrity level A process spawned a suspicious LOLBIN process with a higher/system integrity level. The LOLBIN process spawned with an uncommon command line. This may be an indication of malicious code execution to gain privileges.	Low	Platform Analytics	XDR Agent	Privilege Escalation
Analytics	Machine Account NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that machine account NTLM authentication data has been relayed.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access, Lateral Movement
Analytics BIOC	Manipulation of netsh helper DLLs Registry keys Registering netsh helper DLLs is uncommon, and could be used by malware for persistence.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Masquerading as the Linux crond process Copies a file and renames it as crond.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent	Exfiltration
Analytics BIOC	Memory dumping with comsvcs.dll A process memory dump was performed using comsvcs.dll MiniDump. This method is commonly used by attackers to dump Lsass.exe (Local Security Authority Subsystem Service) process memory to a file, so they could later extract credentials from the memory dump.	High	Platform Analytics	XDR Agent	Credential Access
Analytics	Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.	Informational	Identity Analytics	XDR Agent	Credential Access, Privilege Escalation
Analytics BIOC	Microsoft Office injects code into a process An attacker may inject payloads into processes via Microsoft Office. While legitimate in certain cases, code injection can also be used in malicious ways.	Low	Platform Analytics	XDR Agent	Initial Access, Defense Evasion
Analytics BIOC	Microsoft Office Process Spawning a Suspicious One-Liner A Microsoft Office process spawned a commonly abused process with a full command (not a script), this is a typically malicious behavior.	Low	Platform Analytics	XDR Agent	Execution, Initial Access
Analytics BIOC	Microsoft Office process spawns a commonly abused process Microsoft Office process spawns a commonly abused process with an uncommon command.	Low	Platform Analytics	XDR Agent	Execution, Initial Access
Analytics BIOC	Microsoft Office process spawns conhost.exe This unusual parent-child relationship may indicate that a Microsoft Office application executed a console-based application.	Low	Platform Analytics	XDR Agent	Execution, Initial Access
Analytics BIOC	Mimikatz command-line arguments These command-line arguments are often used by Mimikatz to dump and harvest credentials.	High	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Modification of PAM Modification of PAM configuration files.	Informational	Platform Analytics	XDR Agent	Persistence, Defense Evasion, Credential Access
Analytics BIOC	Mount command was executed from within a Kubernetes pod to list all the attached filesystems The mount command was executed inside a Kubernetes pod to list all the attached filesystems, which may serve as a precursor to container escape and host filesystem access.	Low	Platform Analytics	XDR Agent	Privilege Escalation
Analytics BIOC	MpCmdRun.exe was used to download files into the system Attackers might be using legitimate Windows Defender executables to download malicious code onto the system.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Mshta.exe launched with suspicious arguments Microsoft HTML application host process has been launched with suspicious arguments, which may indicate malicious intent.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Mshta.exe spawns from a browser process Mshta is the Microsoft HTML Application Host. It executes HTML applications on Windows. Detected when a browser process has spawned mshta, which can be a potential attack vector.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Multiple discovery commands The alerted causality performed multiple discovery commands in a short timeframe.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery commands on a Windows host by the same process The alerted process performed multiple discovery commands in a short timeframe.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.	Low	Identity Analytics	XDR Agent	Execution
Analytics	Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Execution
Analytics BIOC	Multiple uncommon SSH Servers with the same Server host key Multiple uncommon SSH servers were observed using the same host key.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Credential Access
Analytics	Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics	Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Netcat makes or gets connections Malicious actors can use Netcat for privilege escalation, remote code execution, data exfiltration and protocol tunneling to evade detection.	High	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics	New Administrative Behavior The endpoint performed new administrative actions, relative to its previously profiled behavior. It is possible that an endpoint will infrequently be used for administrative activities, so analytics is performed using logs collected over a long period of time, also comparing the activity to that of other endpoints. That is, if many endpoints are contacting the same destination with the same administrative activity, then this network activity is less likely to result in this alert. An attacker may be operating on the host, probing other computers and moving laterally inside the network using a trusted computer and credentials. Attackers typically exhibit administrative behaviors when performing reconnaissance and lateral movement.	Medium	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	New FTP Server A new FTP server has been detected.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Initial Access, Collection
Analytics	New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics	NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Hash Harvesting An unusual number of users has sent NTLM to a target in the last hour. This may be indicative of poisoning and NTLM hash harvesting.	Medium	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.	Informational	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access, Lateral Movement
Analytics BIOC	Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Okta FastPass reported phishing attack suspected Okta FastPass authentication reported a phishing attack suspected.	Low	Identity Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent, Palo Alto Networks Firewall threat Logs	Initial Access
Analytics BIOC	Permission Groups discovery commands Permission group discovery command execution.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Phantom DLL Loading An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Discovery
Analytics	Possible AS-REP Roasting Attack A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.	Medium	Identity Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.	Informational	Platform Analytics	XDR Agent	Credential Access
Analytics	Possible brute force or configuration change attempt on cytool An unusual amount of cytool commands were executed in a short period from a user who doesn't usually run these commands. This may indicate an attempt to guess the Administrator password.	High	Platform Analytics	XDR Agent	Credential Access
Analytics	Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access, Lateral Movement
Analytics BIOC	Possible code downloading from a remote host by Regsvr32 Regsvr32 may be used to fetch arbitrary code from a remote host and execute it without dropping the payload onto the disk. Known to be used for malicious purposes.	Medium	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Possible collection of screen captures with Windows Problem Steps Recorder Windows Problem Steps Recorder (psr.exe), can record screen and clicks. Adversaries may abuse psr.exe to create screen captures and collect them afterward.	Medium	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Possible compromised machine account A Kerberos TGT for machine account has been used and does not match the hostname.	Medium	Platform Analytics	XDR Agent	Execution

Analytics BIOC

Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level.

Informational

Platform Analytics

XDR Agent

Defense Evasion, Persistence

Analytics BIOC

Globally uncommon IP address by a common process (sha256) A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Globally uncommon IP address connection from a signed process A signed process connected to an external IP address that, on a global level, it usually doesn't connect to.

Informational

Platform Analytics

XDR Agent

Defense Evasion, Command and Control

Analytics BIOC

Globally uncommon process execution from a signed process A signed process has executed a process that, on a global level, it usually doesn't execute.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Globally uncommon root domain from a signed process A signed process connected to an external domain that, on a global level, it usually doesn't connect to.

Low

Platform Analytics

XDR Agent

Defense Evasion, Command and Control

Analytics BIOC

Globally uncommon root-domain port combination by a common process (sha256) A process with a common sha256 connected to an external domain in a specific port that, on a global level, it usually doesn't connect to.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Globally uncommon root-domain port combination from a signed process A signed process connected to an external domain on a specific port that, on a global level, it usually doesn't connect to.

Low

Platform Analytics

XDR Agent

Defense Evasion, Command and Control

Analytics BIOC

Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

HTTP with suspicious characteristics Uncommon HTTP communication was performed by the host that might indicate its attempt to hide malicious activities.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Hydra Password Brute-Force Tool Execution Attackers may use brute-force techniques to gain access to accounts when usernames and/or passwords are unknown.

High

Platform Analytics

XDR Agent

Credential Access

Analytics

Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics BIOC

Indicator blocking Auditing or logging configuration changes on Linux host.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Indirect command execution using the Program Compatibility Assistant Pcalua.exe (Program Compatibility Assistant) is used for running old programs that have compatibility issues. Attackers can use pcalua.exe to indirectly execute their malicious programs.

Medium

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Injection into rundll32.exe A process injected into an instance of rundll32.exe.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Installation of a new System-V service Installation of a new System-V service.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation

Analytics BIOC

Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation.

Low

Platform Analytics

XDR Agent

Execution, Privilege Escalation

Analytics

Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.

Low

Identity Analytics

XDR Agent

Discovery, Credential Access

Analytics BIOC

Interactive login by a machine account A machine account performed an interactive or remote interactive login.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Interactive login by a service account A service account performed an interactive or remote interactive login.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics

Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Kerberos Pre-Auth Failures by Host The endpoint failed an unusual number of Kerberos pre-authentications (TGT requests) from at least three users when compared to its baseline. This can indicate a password-spraying attack.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Kerberos Traffic from Non-Standard Process The endpoint had a non-standard process communicating over ports normally used by Kerberos. An attacker might be using malicious tools to move laterally.

Medium

Platform Analytics

XDR Agent

Discovery

Analytics

Kerberos User Enumeration A high amount of Kerberos principal unknown errors were generated on users in the last hour. This may be indicative of Kerberos user enumeration.

Medium

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Discovery

Analytics BIOC

Keylogging using system commands Usage of a Linux system utility to capture input.

Low

Platform Analytics

XDR Agent

Credential Access, Collection

Analytics BIOC

Kubelet server communication from a pod The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges.

Informational

Platform Analytics

XDR Agent

Privilege Escalation, Discovery

Analytics BIOC

Kubernetes API server communication from within a pod The Kubernetes API server was accessed from within a pod.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Kubernetes nsenter container escape The nsenter command was used to execute a process in the context of the initialization process.

Informational

Platform Analytics

XDR Agent

Privilege Escalation

Analytics BIOC

Kubernetes secret enumeration activity Kubectl secret enumeration command was executed.

Informational

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Kubernetes version disclosure The Kubernetes API server was inquired about the Kubernetes version by a process from within a pod.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Kubernetes vulnerability scanner activity A Kubernetes cluster was scanned by a known vulnerability scanner.

Medium

Platform Analytics

XDR Agent

Execution, Discovery

Analytics

Large Upload (FTP) The endpoint transferred an excessively large amounts of data to a single destination over FTP. Cortex XDR Analytics assumes endpoint traffic towards a specific destination should be about the same over long periods of time. For that reason, Cortex XDR detected this abnormal behavior of a large data upload. An attacker may be exfiltrating data directly to the internet using this protocol.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics

Large Upload (Generic) The endpoint transferred large amounts of data to an external site using a different protocol from HTTP/s, FTP, or SMTP. (A specific detector is used for each of those protocols.) Cortex XDR Analytics assumes that data transfers out of your network are ordinarily performed using one of those three services, so it expects that data transfers over all other ports to be low. For the same reason, Cortex XDR Analytics also assumes endpoint traffic towards a specific destination should be about the same over long periods of time. An attacker may be exfiltrating data directly to the internet.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics

Large Upload (HTTPS) The endpoint transferred an excessive amount of data to an external site over HTTPS. The destination is not a popular upload site for endpoints on your network, and the endpoint performing the upload has not previously downloaded a large amount of data from the site. The upload is considered excessive based on comparison to baseline measurements of HTTPS data transfers on your network. An attacker may be exfiltrating data directly to the internet.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration

Analytics

Large Upload (SMTP) The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration

Analytics BIOC

LDAP traffic from non-standard process LDAP traffic is usually performed by a standard set of processes. The endpoint had a non-standard process communicating over ports normally used by LDAP. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Linux local user account creation A user executed a process associated with user account creation.

Informational

Identity Analytics

XDR Agent

Persistence

Analytics BIOC

Linux network share discovery An adversary might use known tools to discover SMB shares within the compromised network.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Linux process execution with a rare GitHub URL A process was executed with an uncommon GitHub URL in its command line. This may have legitimate uses, but it might also be used by attackers to download malicious payloads.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Local account discovery One of several local account discovery commands were executed.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.

Informational

Identity Analytics

XDR Agent

Defense Evasion

Analytics BIOC

LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

LOLBIN process executed with a high integrity level A process spawned a suspicious LOLBIN process with a higher/system integrity level. The LOLBIN process spawned with an uncommon command line. This may be an indication of malicious code execution to gain privileges.

Low

Platform Analytics

XDR Agent

Privilege Escalation

Analytics

Machine Account NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that machine account NTLM authentication data has been relayed.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access, Lateral Movement

Analytics BIOC

Manipulation of netsh helper DLLs Registry keys Registering netsh helper DLLs is uncommon, and could be used by malware for persistence.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Masquerading as the Linux crond process Copies a file and renames it as crond.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent

Exfiltration

Analytics BIOC

Memory dumping with comsvcs.dll A process memory dump was performed using comsvcs.dll MiniDump. This method is commonly used by attackers to dump Lsass.exe (Local Security Authority Subsystem Service) process memory to a file, so they could later extract credentials from the memory dump.

High

Platform Analytics

XDR Agent

Credential Access

Analytics

Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.

Informational

Identity Analytics

XDR Agent

Credential Access, Privilege Escalation

Analytics BIOC

Microsoft Office injects code into a process An attacker may inject payloads into processes via Microsoft Office. While legitimate in certain cases, code injection can also be used in malicious ways.

Low

Platform Analytics

XDR Agent

Initial Access, Defense Evasion

Analytics BIOC

Microsoft Office Process Spawning a Suspicious One-Liner A Microsoft Office process spawned a commonly abused process with a full command (not a script), this is a typically malicious behavior.

Low

Platform Analytics

XDR Agent

Execution, Initial Access

Analytics BIOC

Microsoft Office process spawns a commonly abused process Microsoft Office process spawns a commonly abused process with an uncommon command.

Low

Platform Analytics

XDR Agent

Execution, Initial Access

Analytics BIOC

Microsoft Office process spawns conhost.exe This unusual parent-child relationship may indicate that a Microsoft Office application executed a console-based application.

Low

Platform Analytics

XDR Agent

Execution, Initial Access

Analytics BIOC

Mimikatz command-line arguments These command-line arguments are often used by Mimikatz to dump and harvest credentials.

High

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Modification of PAM Modification of PAM configuration files.

Informational

Platform Analytics

XDR Agent

Persistence, Defense Evasion, Credential Access

Analytics BIOC

Mount command was executed from within a Kubernetes pod to list all the attached filesystems The mount command was executed inside a Kubernetes pod to list all the attached filesystems, which may serve as a precursor to container escape and host filesystem access.

Low

Platform Analytics

XDR Agent

Privilege Escalation

Analytics BIOC

MpCmdRun.exe was used to download files into the system Attackers might be using legitimate Windows Defender executables to download malicious code onto the system.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Mshta.exe launched with suspicious arguments Microsoft HTML application host process has been launched with suspicious arguments, which may indicate malicious intent.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Mshta.exe spawns from a browser process Mshta is the Microsoft HTML Application Host. It executes HTML applications on Windows. Detected when a browser process has spawned mshta, which can be a potential attack vector.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Multiple discovery commands The alerted causality performed multiple discovery commands in a short timeframe.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery commands on a Windows host by the same process The alerted process performed multiple discovery commands in a short timeframe.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.

Low

Identity Analytics

XDR Agent

Execution

Analytics

Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Execution

Analytics BIOC

Multiple uncommon SSH Servers with the same Server host key Multiple uncommon SSH servers were observed using the same host key.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Credential Access

Analytics

Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics

Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Netcat makes or gets connections Malicious actors can use Netcat for privilege escalation, remote code execution, data exfiltration and protocol tunneling to evade detection.

High

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics

New Administrative Behavior The endpoint performed new administrative actions, relative to its previously profiled behavior. It is possible that an endpoint will infrequently be used for administrative activities, so analytics is performed using logs collected over a long period of time, also comparing the activity to that of other endpoints. That is, if many endpoints are contacting the same destination with the same administrative activity, then this network activity is less likely to result in this alert. An attacker may be operating on the host, probing other computers and moving laterally inside the network using a trusted computer and credentials. Attackers typically exhibit administrative behaviors when performing reconnaissance and lateral movement.

Medium

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

New FTP Server A new FTP server has been detected.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Initial Access, Collection

Analytics

New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics

NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Hash Harvesting An unusual number of users has sent NTLM to a target in the last hour. This may be indicative of poisoning and NTLM hash harvesting.

Medium

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.

Informational

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access, Lateral Movement

Analytics BIOC

Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Okta FastPass reported phishing attack suspected Okta FastPass authentication reported a phishing attack suspected.

Low

Identity Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent, Palo Alto Networks Firewall threat Logs

Initial Access

Analytics BIOC

Permission Groups discovery commands Permission group discovery command execution.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Phantom DLL Loading An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Discovery

Analytics

Possible AS-REP Roasting Attack A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.

Medium

Identity Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.

Informational

Platform Analytics

XDR Agent

Credential Access

Analytics

Possible brute force or configuration change attempt on cytool An unusual amount of cytool commands were executed in a short period from a user who doesn't usually run these commands. This may indicate an attempt to guess the Administrator password.

High

Platform Analytics

XDR Agent

Credential Access

Analytics

Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access, Lateral Movement

Analytics BIOC

Possible code downloading from a remote host by Regsvr32 Regsvr32 may be used to fetch arbitrary code from a remote host and execute it without dropping the payload onto the disk. Known to be used for malicious purposes.

Medium

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Possible collection of screen captures with Windows Problem Steps Recorder Windows Problem Steps Recorder (psr.exe), can record screen and clicks. Adversaries may abuse psr.exe to create screen captures and collect them afterward.

Medium

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Possible compromised machine account A Kerberos TGT for machine account has been used and does not match the hostname.

Medium

Platform Analytics

XDR Agent

Execution