Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution
Analytics BIOC	Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.	Low	Platform Analytics	XDR Agent	Command and Control, Execution
Analytics BIOC	Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.	Low	Platform Analytics	XDR Agent	Privilege Escalation, Defense Evasion
Analytics BIOC	SMB Traffic from Non-Standard Process SMB traffic is usually performed by a standard set of privileged processes through designated ports. The endpoint had a non-standard process communicating over ports normally used by SMB. An attacker might be moving laterally by using tools that implement a custom version of the SMB protocol.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Impact
Analytics BIOC	Stored credentials exported using credwiz.exe Attackers may abuse the credwiz tool to export stored accounts.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics	Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics BIOC	SUID/GUID permission discovery Attackers may search for potential to elevate permissions using binaries that have the SUID or GUID bit enabled.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.	Low	Platform Analytics	XDR Agent	Discovery, Credential Access
Analytics BIOC	Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics BIOC	Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.	Low	Platform Analytics	XDR Agent	Impact, Defense Evasion
Analytics BIOC	Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access
Analytics BIOC	Suspicious ICMP packet An ICMP router advertisement was sent by a host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control
Analytics	Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.	Low	Platform Analytics	XDR Agent	Impact
Analytics BIOC	Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious Process Spawned by Adobe Reader Unusual process spawned by Adobe Reader with an uncommon command line.	Low	Platform Analytics	XDR Agent	Initial Access
Analytics BIOC	Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious setspn.exe execution A Service Principal Name (SPN) is a unique identifier for a service, mapped to a specific account. Setspn.exe can be used to retrieve SPN information, which may indicate an attacker's attempt to "Kerberoast".	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Suspicious SMB connection from domain controller A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Suspicious sshpass command execution The sshpass command was executed, This could be an attempt to check for credential stuffing.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Suspicious systemd timer activity Suspicious systemd timer activity, which may indicate an attempt to establish persistence.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics BIOC	Svchost.exe loads a rare unsigned module Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution.	Low	Platform Analytics	XDR Agent	Defense Evasion, Persistence
Analytics BIOC	System information discovery via psinfo.exe Using psinfo.exe, the attacker can gather information about the network, and gain an in-depth understanding of which devices are relevant to attack.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	The Linux system firewall was disabled The system firewall was disabled.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Uncommon AppleScript containing a potential obfuscation technique was executed The AppleScript interpreter process was executed with an obfuscation technique in the command line.	Low	Platform Analytics	XDR Agent	Execution, Defense Evasion
Analytics BIOC	Uncommon AppleScript containing a potential persistence command was executed via the command line The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.	Low	Platform Analytics	XDR Agent	Execution, Persistence
Analytics BIOC	Uncommon AppleScript designed to capture screen or clipboard data was executed via the command line The AppleScript interpreter was executed with a script designed to capture screen content or clipboard data.	Low	Platform Analytics	XDR Agent	Execution, Collection
Analytics BIOC	Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords.	Low	Platform Analytics	XDR Agent	Execution, Credential Access
Analytics BIOC	Uncommon AppleScript was executed via the command line to contact an external server The AppleScript interpreter executed a script designed to contact an external server.	Low	Platform Analytics	XDR Agent	Execution, Exfiltration
Analytics BIOC	Uncommon ARP cache listing via arp.exe The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache. Adversaries may attempt to use the command to discover remote systems they could compromise.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Uncommon attempt to clear shell history An attempt to clear or manipulate shell history files was detected.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Uncommon driver loaded An uncommon driver loaded which may be an attempt to kill the EDR or install rootkit.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Uncommon execution of ODBCConf Attackers may abuse the Odbcconf.exe Windows utility to proxy the execution of malicious DLL files.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Uncommon IP Configuration Listing via ipconfig.exe The 'ipconfig' command is used to display TCP/IP network configuration information and refresh the Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Adversaries may use the command to discover network configuration details.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Uncommon msiexec execution of an arbitrary file from a remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Uncommon remote monitoring and management tool An uncommon Remote Monitoring and Management (RMM) product was observed.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Uncommon remote scheduled task creation The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to execute programs or persist malware on remote machines.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Uncommon remote service start via sc.exe The Service Control command (sc.exe) is used to create, start, stop, query, or delete Windows services. Adversaries may attempt to use the command to execute and persist a binary, command, or script.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Uncommon reverse SSH tunnel to external domain/ip An uncommon reverse SSH tunnel might have been created.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Uncommon routing table listing via route.exe The route.exe command is used to display and modify entries in the local IP routing table. Adversaries may attempt to use the command to discover remote systems they could compromise.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Uncommon SSH session was established An uncommon SSH session was established.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Uncommon VNC server communication Uncommon VNC server network traffic was observed.	Low	Platform Analytics	XDR Agent	Command and Control, Lateral Movement
Analytics BIOC	Unprivileged process opened a registry hive An unprivileged process opened a registry hive directly.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Unsigned and unpopular process performed a DLL injection An unsigned process with low popularity injected a dll into another process.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Unsigned and unpopular process performed an injection An unsigned process with low popularity injected code to another process.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Unsigned process creates a scheduled task via file access A scheduled task was created via file access from an unsigned process. This is uncommon and may indicate malicious activity.	Low	Platform Analytics	XDR Agent	Execution, Persistence
Analytics BIOC	Unusual ADFS Remote Synchronization network connections from non-ADFS server Detected an unauthorized configuration sync request to the ADFS Policy Store from a non-ADFS server, step for forging SAML tokens in a Golden SAML attack.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Credential Access, Lateral Movement
Analytics BIOC	Unusual AWS credentials creation AWS utility was used to create an access key and a secret key.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Unusual AWS user added to group AWS user added to AWS group, possibly to elevate privileges and gain more access to resources.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Unusual Azure AD sync module load A process that does not usually load the Azure AD Sync mcrypt.dll loaded the module.	Low	Identity Threat Detection (ITDR)	XDR Agent	Credential Access
Analytics BIOC	Unusual compressed file password protection An adversary might compress sensitive files with password protection to bypass security mitigations when attempting to exfiltrate them.	Low	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Unusual Kubernetes dashboard communication from a pod The Kubernetes dashboard was accessed by an unusual pod within the environment.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Unusual Lolbins Process Spawned by InstallUtil.exe An unusual process was spawned by InstallUtil.exe, possibly indicating malicious local or remote code execution.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Unusual Process Spawned by Nginx in Ingress-Nginx pod Unusual Process Spawned by Nginx in Ingress-Nginx pod.	Low	Platform Analytics	XDR Agent	Execution, Initial Access
Analytics BIOC	Weakly-Encrypted Kerberos Ticket Requested A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes and is typically a sign of a Kerberoasting attack.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Windows Event Log was cleared using wevtutil.exe A command-line utility was used to clear the Windows Event Log. It may be used to delete logs to cover the tracks of the malicious activity, making it harder to perform analysis.	Low	Platform Analytics	XDR Agent	Impact
Analytics BIOC	WmiPrvSe.exe Rare Child Command Line A remote WMI command executed a binary proxy, the Windows Management Instrumentation (WMI) Provider Host wmiprvse.exe, which executed a rare child command line. Executing a rare child process can be an indication of remote code execution abuse by an attacker.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution
Analytics BIOC	Wscript/Cscript loads .NET DLLs An unusual script loads .NET DLLs, possibly indicating JScriptToDotnet execution.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Wsmprovhost.exe Rare Child Process The PowerShell host wsmprovhost.exe is a proxy process executed remotely through PowerShell when using Windows Remote Management (WinRM). It has executed a rare child process, which may indicate remote code execution abuse by an attacker.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution

Analytics BIOC

Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution

Analytics BIOC

Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.

Low

Platform Analytics

XDR Agent

Command and Control, Execution

Analytics BIOC

Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.

Low

Platform Analytics

XDR Agent

Privilege Escalation, Defense Evasion

Analytics BIOC

SMB Traffic from Non-Standard Process SMB traffic is usually performed by a standard set of privileged processes through designated ports. The endpoint had a non-standard process communicating over ports normally used by SMB. An attacker might be moving laterally by using tools that implement a custom version of the SMB protocol.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Impact

Analytics BIOC

Stored credentials exported using credwiz.exe Attackers may abuse the credwiz tool to export stored accounts.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics

Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics BIOC

SUID/GUID permission discovery Attackers may search for potential to elevate permissions using binaries that have the SUID or GUID bit enabled.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.

Low

Platform Analytics

XDR Agent

Discovery, Credential Access

Analytics BIOC

Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics BIOC

Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.

Low

Platform Analytics

XDR Agent

Impact, Defense Evasion

Analytics BIOC

Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access

Analytics BIOC

Suspicious ICMP packet An ICMP router advertisement was sent by a host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control

Analytics

Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.

Low

Platform Analytics

XDR Agent

Impact

Analytics BIOC

Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious Process Spawned by Adobe Reader Unusual process spawned by Adobe Reader with an uncommon command line.

Low

Platform Analytics

XDR Agent

Initial Access

Analytics BIOC

Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious setspn.exe execution A Service Principal Name (SPN) is a unique identifier for a service, mapped to a specific account. Setspn.exe can be used to retrieve SPN information, which may indicate an attacker's attempt to "Kerberoast".

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Suspicious SMB connection from domain controller A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Suspicious sshpass command execution The sshpass command was executed, This could be an attempt to check for credential stuffing.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Suspicious systemd timer activity Suspicious systemd timer activity, which may indicate an attempt to establish persistence.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics BIOC

Svchost.exe loads a rare unsigned module Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution.

Low

Platform Analytics

XDR Agent

Defense Evasion, Persistence

Analytics BIOC

System information discovery via psinfo.exe Using psinfo.exe, the attacker can gather information about the network, and gain an in-depth understanding of which devices are relevant to attack.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

The Linux system firewall was disabled The system firewall was disabled.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Uncommon AppleScript containing a potential obfuscation technique was executed The AppleScript interpreter process was executed with an obfuscation technique in the command line.

Low

Platform Analytics

XDR Agent

Execution, Defense Evasion

Analytics BIOC

Uncommon AppleScript containing a potential persistence command was executed via the command line The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.

Low

Platform Analytics

XDR Agent

Execution, Persistence

Analytics BIOC

Uncommon AppleScript designed to capture screen or clipboard data was executed via the command line The AppleScript interpreter was executed with a script designed to capture screen content or clipboard data.

Low

Platform Analytics

XDR Agent

Execution, Collection

Analytics BIOC

Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords.

Low

Platform Analytics

XDR Agent

Execution, Credential Access

Analytics BIOC

Uncommon AppleScript was executed via the command line to contact an external server The AppleScript interpreter executed a script designed to contact an external server.

Low

Platform Analytics

XDR Agent

Execution, Exfiltration

Analytics BIOC

Uncommon ARP cache listing via arp.exe The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache. Adversaries may attempt to use the command to discover remote systems they could compromise.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Uncommon attempt to clear shell history An attempt to clear or manipulate shell history files was detected.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Uncommon driver loaded An uncommon driver loaded which may be an attempt to kill the EDR or install rootkit.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Uncommon execution of ODBCConf Attackers may abuse the Odbcconf.exe Windows utility to proxy the execution of malicious DLL files.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Uncommon IP Configuration Listing via ipconfig.exe The 'ipconfig' command is used to display TCP/IP network configuration information and refresh the Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Adversaries may use the command to discover network configuration details.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Uncommon msiexec execution of an arbitrary file from a remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Uncommon remote monitoring and management tool An uncommon Remote Monitoring and Management (RMM) product was observed.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Uncommon remote scheduled task creation The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to execute programs or persist malware on remote machines.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Uncommon remote service start via sc.exe The Service Control command (sc.exe) is used to create, start, stop, query, or delete Windows services. Adversaries may attempt to use the command to execute and persist a binary, command, or script.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Uncommon reverse SSH tunnel to external domain/ip An uncommon reverse SSH tunnel might have been created.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Uncommon routing table listing via route.exe The route.exe command is used to display and modify entries in the local IP routing table. Adversaries may attempt to use the command to discover remote systems they could compromise.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Uncommon SSH session was established An uncommon SSH session was established.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Uncommon VNC server communication Uncommon VNC server network traffic was observed.

Low

Platform Analytics

XDR Agent

Command and Control, Lateral Movement

Analytics BIOC

Unprivileged process opened a registry hive An unprivileged process opened a registry hive directly.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Unsigned and unpopular process performed a DLL injection An unsigned process with low popularity injected a dll into another process.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Unsigned and unpopular process performed an injection An unsigned process with low popularity injected code to another process.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Unsigned process creates a scheduled task via file access A scheduled task was created via file access from an unsigned process. This is uncommon and may indicate malicious activity.

Low

Platform Analytics

XDR Agent

Execution, Persistence

Analytics BIOC

Unusual ADFS Remote Synchronization network connections from non-ADFS server Detected an unauthorized configuration sync request to the ADFS Policy Store from a non-ADFS server, step for forging SAML tokens in a Golden SAML attack.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Credential Access, Lateral Movement

Analytics BIOC

Unusual AWS credentials creation AWS utility was used to create an access key and a secret key.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Unusual AWS user added to group AWS user added to AWS group, possibly to elevate privileges and gain more access to resources.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Unusual Azure AD sync module load A process that does not usually load the Azure AD Sync mcrypt.dll loaded the module.

Low

Identity Threat Detection (ITDR)

XDR Agent

Credential Access

Analytics BIOC

Unusual compressed file password protection An adversary might compress sensitive files with password protection to bypass security mitigations when attempting to exfiltrate them.

Low

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Unusual Kubernetes dashboard communication from a pod The Kubernetes dashboard was accessed by an unusual pod within the environment.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Unusual Lolbins Process Spawned by InstallUtil.exe An unusual process was spawned by InstallUtil.exe, possibly indicating malicious local or remote code execution.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Unusual Process Spawned by Nginx in Ingress-Nginx pod Unusual Process Spawned by Nginx in Ingress-Nginx pod.

Low

Platform Analytics

XDR Agent

Execution, Initial Access

Analytics BIOC

Weakly-Encrypted Kerberos Ticket Requested A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes and is typically a sign of a Kerberoasting attack.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Windows Event Log was cleared using wevtutil.exe A command-line utility was used to clear the Windows Event Log. It may be used to delete logs to cover the tracks of the malicious activity, making it harder to perform analysis.

Low

Platform Analytics

XDR Agent

Impact

Analytics BIOC

WmiPrvSe.exe Rare Child Command Line A remote WMI command executed a binary proxy, the Windows Management Instrumentation (WMI) Provider Host wmiprvse.exe, which executed a rare child command line. Executing a rare child process can be an indication of remote code execution abuse by an attacker.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution

Analytics BIOC

Wscript/Cscript loads .NET DLLs An unusual script loads .NET DLLs, possibly indicating JScriptToDotnet execution.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Wsmprovhost.exe Rare Child Process The PowerShell host wsmprovhost.exe is a proxy process executed remotely through PowerShell when using Windows Remote Management (WinRM). It has executed a rare child process, which may indicate remote code execution abuse by an attacker.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution