Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks.	Informational	Identity Threat Detection (ITDR)	XDR Agent	Defense Evasion
Analytics BIOC	A compressed file was exfiltrated over SSH Exfiltration of a compressed file over SSH.	Informational	Platform Analytics	XDR Agent	Exfiltration
Analytics	A compromised process accessed a rare cloud resource A compromised process accessed a rare cloud resource.	Informational	Platform Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Command and Control
Analytics BIOC	A disabled user attempted to log in A disabled user attempted to log in.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	A LOLBIN was copied to a different location To evade detection, attackers may copy a LOLBIN executable to a different location.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	A process connected to a rare cloud resource A process connected to a rare cloud resource.	Informational	Platform Analytics	XDR Agent	Command and Control, Exfiltration
Analytics BIOC	A process connected to a rare external host A process connected to an external host name or directly to an IP address, which is rarely connected to from the organization.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	A process connected to rare external host A process connected to a rare external host.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	A process is masquerading as a common Microsoft product An attacker might leverage common Microsoft software image names to run malicious processes without being caught.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	A rare local administrator login A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	A service was disabled A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.	Informational	Platform Analytics	XDR Agent	Impact
Analytics BIOC	A third-party utility was copied to a different location To evade detection, attackers may copy a third-party utility executable to a different location.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	A Torrent client was detected on a host The host produced traffic consistent with the BitTorrent protocol. Torrent usage may expose the organization to malware or enable attackers or malicious insiders to exfiltrate data.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration, Initial Access
Analytics BIOC	A user accessed an uncommon AppID A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization.	Informational	Identity Threat Detection (ITDR)	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics	A user accessed multiple time-consuming websites A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics	A user authenticated with weak NTLM to multiple hosts A user account authenticated to multiple hosts via NTLMv1 or LM authentication for the first time in the past 30 days.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics BIOC	A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.	Informational	Identity Analytics	XDR Agent	Credential Access, Resource Development
Analytics	A user logged on to multiple workstations via Schannel A user logged on to multiple workstations with a certificate via Schannel. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Persistence, Privilege Escalation, Credential Access
Analytics BIOC	Abnormal Communication to a Rare Domain An abnormal communication was seen from an internal entity to a rare domain.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics	Abnormal connections to a dormant host from a newly seen endpoint The endpoint has performed multiple connections to an endpoint that is relatively inactive on the network.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Discovery
Analytics BIOC	Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server to an external address.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Abnormal process connection to default Meterpreter port This process has probably been compromised by Meterpreter and is now used by it to run malicious commands.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics	Abnormal RDP connections to multiple hosts The endpoint attempted to initiate rare RDP connections to multiple hosts.	Informational	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Abnormal Recurring Communications to a Rare Domain Abnormal communications were seen from an internal entity to a rare external domain. This could be a case of beaconing to a C2 Server.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics	Abnormal SMB scanning activity to multiple hosts An endpoint performed a new, unfamiliar SMB scanning activity to multiple hosts on the network.	Informational	Platform Analytics	XDR Agent	Reconnaissance
Analytics BIOC	Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.	Informational	Identity Analytics	XDR Agent	Lateral Movement, Privilege Escalation
Analytics BIOC	Adding execution privileges A script was granted execution privileges using chmod before being run.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	An uncommon RDP session from a managed host An RDP session was established with uncommon parameters from a managed host.	Informational	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	An uncommon RDP session was established An RDP session was established with uncommon parameters.	Informational	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Analytics enhanced NGFW Threat Alert - Rare Internal Firewall Vulnerability Threat Alert An internal host triggered an NGFW (Next-Generation Firewall) vulnerability threat alert targeting another internal host. This activity is highly anomalous as it deviates from the source host's historical behavior and is rarely seen targeting this specific destination across the organization.	Informational	Platform Analytics	Palo Alto Networks Firewall threat Logs, XDR Agent	Reconnaissance
Analytics BIOC	AppleScript executed a shell script An uncommon shell script has been executed by the AppleScript interpreter process.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	AppleScript interpreter dynamic library loaded into a process The AppleScript interpreter dynamic library was loaded into a process.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	AppleScript process executed with a rare command line The AppleScript interpreter process was executed with an uncommon command line.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Authentication Attempt From a Dormant Account A dormant user account tried to authenticate to a service using a TGS after having been unused for a year or more. This may indicate the account is misused by an attacker.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Defense Evasion
Analytics	Brute-force attempt on a local account A local user account failed to log in multiple times in a short time period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	Command execution in a Kubernetes pod Container administration commands were executed within a Kubernetes pod.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Command execution via wmiexec Attackers may use WMI to execute commands on the target host.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Common third-party software name masquerading An attacker might leverage common third-party software image names to run malicious processes without being caught.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Commonly abused process launched as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Discovery of host users via WMIC Attackers may use wmic.exe to list the users of a host, and potentially its owner.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Download pattern that resembles Peer to Peer traffic A possible P2P protocol was spotted from an internal host.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Command and Control, Initial Access
Analytics BIOC	Executable moved to Windows system folder An attacker may be trying to avoid detection by moving an executable to a Windows system folder.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Execution of an uncommon process at an early startup stage Uncommon execution of an executable found in an early startup stage.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Execution of an uncommon process with a local/domain user SID at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage may be an indication of a persistent mechanism on boot that is being actively abused.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Execution of masqueraded third-party utility An attacker may be trying to avoid detection of third-party utility execution by renaming it.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Execution of renamed lolbin An attacker may be trying to avoid detection of lolbin's execution using a renamed lolbin.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	External Login Password Spray An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	Failed Login For a Long Username With Special Characters A long username containing special characters failed to log in to the domain.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access
Analytics BIOC	Failed Login For Locked-Out Account A locked-out user account (event ID 4725 or 4740) was used in a Kerberos TGT pre-authentication attempt.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Defense Evasion
Analytics BIOC	File transfer from unusual IP using known tools An adversary might use known tools to transfer tools/payloads into the compromised machine.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Globally uncommon high entropy module was loaded A module with high entropy and a globally uncommon hash was loaded.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Globally uncommon high entropy process was executed A process with high entropy and a globally uncommon hash was executed.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Globally uncommon image load from a signed process A signed process loaded a DLL that, on a global level, it usually doesn't load.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level.	Informational	Platform Analytics	XDR Agent	Defense Evasion, Persistence
Analytics BIOC	Globally uncommon IP address by a common process (sha256) A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Globally uncommon IP address connection from a signed process A signed process connected to an external IP address that, on a global level, it usually doesn't connect to.	Informational	Platform Analytics	XDR Agent	Defense Evasion, Command and Control
Analytics BIOC	Globally uncommon process execution from a signed process A signed process has executed a process that, on a global level, it usually doesn't execute.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Globally uncommon root-domain port combination by a common process (sha256) A process with a common sha256 connected to an external domain in a specific port that, on a global level, it usually doesn't connect to.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics BIOC	Indicator blocking Auditing or logging configuration changes on Linux host.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Injection into rundll32.exe A process injected into an instance of rundll32.exe.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Interactive login by a machine account A machine account performed an interactive or remote interactive login.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics	Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Kubelet server communication from a pod The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges.	Informational	Platform Analytics	XDR Agent	Privilege Escalation, Discovery
Analytics BIOC	Kubernetes API server communication from within a pod The Kubernetes API server was accessed from within a pod.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Kubernetes nsenter container escape The nsenter command was used to execute a process in the context of the initialization process.	Informational	Platform Analytics	XDR Agent	Privilege Escalation
Analytics BIOC	Kubernetes secret enumeration activity Kubectl secret enumeration command was executed.	Informational	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Kubernetes version disclosure The Kubernetes API server was inquired about the Kubernetes version by a process from within a pod.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	LDAP traffic from non-standard process LDAP traffic is usually performed by a standard set of processes. The endpoint had a non-standard process communicating over ports normally used by LDAP. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Linux local user account creation A user executed a process associated with user account creation.	Informational	Identity Analytics	XDR Agent	Persistence
Analytics BIOC	Linux network share discovery An adversary might use known tools to discover SMB shares within the compromised network.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Linux process execution with a rare GitHub URL A process was executed with an uncommon GitHub URL in its command line. This may have legitimate uses, but it might also be used by attackers to download malicious payloads.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Local account discovery One of several local account discovery commands were executed.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.	Informational	Identity Analytics	XDR Agent	Defense Evasion
Analytics BIOC	LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent	Exfiltration
Analytics	Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.	Informational	Identity Analytics	XDR Agent	Credential Access, Privilege Escalation
Analytics BIOC	Modification of PAM Modification of PAM configuration files.	Informational	Platform Analytics	XDR Agent	Persistence, Defense Evasion, Credential Access
Analytics BIOC	MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Execution
Analytics	Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics	NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.	Informational	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access, Lateral Movement
Analytics BIOC	Permission Groups discovery commands Permission group discovery command execution.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Discovery
Analytics BIOC	Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.	Informational	Platform Analytics	XDR Agent	Credential Access
Analytics	Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access, Lateral Movement

Analytics BIOC

A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks.

Informational

Identity Threat Detection (ITDR)

XDR Agent

Defense Evasion

Analytics BIOC

A compressed file was exfiltrated over SSH Exfiltration of a compressed file over SSH.

Informational

Platform Analytics

XDR Agent

Exfiltration

Analytics

A compromised process accessed a rare cloud resource A compromised process accessed a rare cloud resource.

Informational

Platform Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Command and Control

Analytics BIOC

A disabled user attempted to log in A disabled user attempted to log in.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

A LOLBIN was copied to a different location To evade detection, attackers may copy a LOLBIN executable to a different location.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

A process connected to a rare cloud resource A process connected to a rare cloud resource.

Informational

Platform Analytics

XDR Agent

Command and Control, Exfiltration

Analytics BIOC

A process connected to a rare external host A process connected to an external host name or directly to an IP address, which is rarely connected to from the organization.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

A process connected to rare external host A process connected to a rare external host.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

A process is masquerading as a common Microsoft product An attacker might leverage common Microsoft software image names to run malicious processes without being caught.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.

Informational

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

A rare local administrator login A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

A service was disabled A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.

Informational

Platform Analytics

XDR Agent

Impact

Analytics BIOC

A third-party utility was copied to a different location To evade detection, attackers may copy a third-party utility executable to a different location.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

A Torrent client was detected on a host The host produced traffic consistent with the BitTorrent protocol. Torrent usage may expose the organization to malware or enable attackers or malicious insiders to exfiltrate data.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration, Initial Access

Analytics BIOC

A user accessed an uncommon AppID A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization.

Informational

Identity Threat Detection (ITDR)

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics

A user accessed multiple time-consuming websites A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics

A user authenticated with weak NTLM to multiple hosts A user account authenticated to multiple hosts via NTLMv1 or LM authentication for the first time in the past 30 days.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics BIOC

A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.

Informational

Identity Analytics

XDR Agent

Credential Access, Resource Development

Analytics

A user logged on to multiple workstations via Schannel A user logged on to multiple workstations with a certificate via Schannel. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Persistence, Privilege Escalation, Credential Access

Analytics BIOC

Abnormal Communication to a Rare Domain An abnormal communication was seen from an internal entity to a rare domain.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics

Abnormal connections to a dormant host from a newly seen endpoint The endpoint has performed multiple connections to an endpoint that is relatively inactive on the network.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Discovery

Analytics BIOC

Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server to an external address.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Abnormal process connection to default Meterpreter port This process has probably been compromised by Meterpreter and is now used by it to run malicious commands.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics

Abnormal RDP connections to multiple hosts The endpoint attempted to initiate rare RDP connections to multiple hosts.

Informational

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Abnormal Recurring Communications to a Rare Domain Abnormal communications were seen from an internal entity to a rare external domain. This could be a case of beaconing to a C2 Server.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics

Abnormal SMB scanning activity to multiple hosts An endpoint performed a new, unfamiliar SMB scanning activity to multiple hosts on the network.

Informational

Platform Analytics

XDR Agent

Reconnaissance

Analytics BIOC

Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.

Informational

Identity Analytics

XDR Agent

Lateral Movement, Privilege Escalation

Analytics BIOC

Adding execution privileges A script was granted execution privileges using chmod before being run.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

An uncommon RDP session from a managed host An RDP session was established with uncommon parameters from a managed host.

Informational

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

An uncommon RDP session was established An RDP session was established with uncommon parameters.

Informational

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Analytics enhanced NGFW Threat Alert - Rare Internal Firewall Vulnerability Threat Alert An internal host triggered an NGFW (Next-Generation Firewall) vulnerability threat alert targeting another internal host. This activity is highly anomalous as it deviates from the source host's historical behavior and is rarely seen targeting this specific destination across the organization.

Informational

Platform Analytics

Palo Alto Networks Firewall threat Logs, XDR Agent

Reconnaissance

Analytics BIOC

AppleScript executed a shell script An uncommon shell script has been executed by the AppleScript interpreter process.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

AppleScript interpreter dynamic library loaded into a process The AppleScript interpreter dynamic library was loaded into a process.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

AppleScript process executed with a rare command line The AppleScript interpreter process was executed with an uncommon command line.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Authentication Attempt From a Dormant Account A dormant user account tried to authenticate to a service using a TGS after having been unused for a year or more. This may indicate the account is misused by an attacker.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Defense Evasion

Analytics

Brute-force attempt on a local account A local user account failed to log in multiple times in a short time period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

Command execution in a Kubernetes pod Container administration commands were executed within a Kubernetes pod.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Command execution via wmiexec Attackers may use WMI to execute commands on the target host.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Common third-party software name masquerading An attacker might leverage common third-party software image names to run malicious processes without being caught.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Commonly abused process launched as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Discovery of host users via WMIC Attackers may use wmic.exe to list the users of a host, and potentially its owner.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Download pattern that resembles Peer to Peer traffic A possible P2P protocol was spotted from an internal host.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Command and Control, Initial Access

Analytics BIOC

Executable moved to Windows system folder An attacker may be trying to avoid detection by moving an executable to a Windows system folder.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Execution of an uncommon process at an early startup stage Uncommon execution of an executable found in an early startup stage.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Execution of an uncommon process with a local/domain user SID at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage may be an indication of a persistent mechanism on boot that is being actively abused.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Execution of masqueraded third-party utility An attacker may be trying to avoid detection of third-party utility execution by renaming it.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Execution of renamed lolbin An attacker may be trying to avoid detection of lolbin's execution using a renamed lolbin.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

External Login Password Spray An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

Failed Login For a Long Username With Special Characters A long username containing special characters failed to log in to the domain.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access

Analytics BIOC

Failed Login For Locked-Out Account A locked-out user account (event ID 4725 or 4740) was used in a Kerberos TGT pre-authentication attempt.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Defense Evasion

Analytics BIOC

File transfer from unusual IP using known tools An adversary might use known tools to transfer tools/payloads into the compromised machine.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Globally uncommon high entropy module was loaded A module with high entropy and a globally uncommon hash was loaded.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Globally uncommon high entropy process was executed A process with high entropy and a globally uncommon hash was executed.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Globally uncommon image load from a signed process A signed process loaded a DLL that, on a global level, it usually doesn't load.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level.

Informational

Platform Analytics

XDR Agent

Defense Evasion, Persistence

Analytics BIOC

Globally uncommon IP address by a common process (sha256) A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Globally uncommon IP address connection from a signed process A signed process connected to an external IP address that, on a global level, it usually doesn't connect to.

Informational

Platform Analytics

XDR Agent

Defense Evasion, Command and Control

Analytics BIOC

Globally uncommon process execution from a signed process A signed process has executed a process that, on a global level, it usually doesn't execute.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Globally uncommon root-domain port combination by a common process (sha256) A process with a common sha256 connected to an external domain in a specific port that, on a global level, it usually doesn't connect to.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics BIOC

Indicator blocking Auditing or logging configuration changes on Linux host.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Injection into rundll32.exe A process injected into an instance of rundll32.exe.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Interactive login by a machine account A machine account performed an interactive or remote interactive login.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics

Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Kubelet server communication from a pod The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges.

Informational

Platform Analytics

XDR Agent

Privilege Escalation, Discovery

Analytics BIOC

Kubernetes API server communication from within a pod The Kubernetes API server was accessed from within a pod.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Kubernetes nsenter container escape The nsenter command was used to execute a process in the context of the initialization process.

Informational

Platform Analytics

XDR Agent

Privilege Escalation

Analytics BIOC

Kubernetes secret enumeration activity Kubectl secret enumeration command was executed.

Informational

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Kubernetes version disclosure The Kubernetes API server was inquired about the Kubernetes version by a process from within a pod.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

LDAP traffic from non-standard process LDAP traffic is usually performed by a standard set of processes. The endpoint had a non-standard process communicating over ports normally used by LDAP. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Linux local user account creation A user executed a process associated with user account creation.

Informational

Identity Analytics

XDR Agent

Persistence

Analytics BIOC

Linux network share discovery An adversary might use known tools to discover SMB shares within the compromised network.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Linux process execution with a rare GitHub URL A process was executed with an uncommon GitHub URL in its command line. This may have legitimate uses, but it might also be used by attackers to download malicious payloads.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Local account discovery One of several local account discovery commands were executed.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.

Informational

Identity Analytics

XDR Agent

Defense Evasion

Analytics BIOC

LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent

Exfiltration

Analytics

Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.

Informational

Identity Analytics

XDR Agent

Credential Access, Privilege Escalation

Analytics BIOC

Modification of PAM Modification of PAM configuration files.

Informational

Platform Analytics

XDR Agent

Persistence, Defense Evasion, Credential Access

Analytics BIOC

MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Execution

Analytics

Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics

NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.

Informational

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access, Lateral Movement

Analytics BIOC

Permission Groups discovery commands Permission group discovery command execution.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Discovery

Analytics BIOC

Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.

Informational

Platform Analytics

XDR Agent

Credential Access

Analytics

Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access, Lateral Movement