Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A commonly abused process connected to a rare cloud resource A commonly abused process connected to a rare cloud resource.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	A commonly abused process connected to a rare external host A commonly abused process connected to a rare external host.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics	A compromised process accessed a rare external host A compromised process accessed a rare external host.	Low	Platform Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Command and Control
Analytics BIOC	A suspicious process enrolled for a certificate A suspicious process enrolled for a certificate.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Abnormal communication with a rare combination of TLS and HTTP User Agent Abnormal communication with a rare combination of TLS and HTTP User Agent to an external address.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics	Abnormal ICMP echo (PING) to multiple hosts An endpoint performed an abnormal ICMP echo (PING) to multiple hosts on the network.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Abnormal network communication through TOR using an uncommon port Suspicious connection from a known TOR IP to an uncommon port.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics	Abnormal RDP connections to multiple hosts from a rarely seen host The endpoint attempted to initiate rare RDP connections to multiple hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Abnormal RDP session to a remote host from a rarely seen host The endpoint performed a rare RDP session to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics	Abnormal SMB activity to multiple hosts An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics	Account probing A user failed to log in to multiple hosts it never accessed before in a short amount of time. This may indicate the account is compromised and an attacker is probing for a host it can access with those credentials.	Low	Identity Analytics	XDR Agent	Initial Access, Credential Access
Analytics BIOC	An uncommon service was started An uncommon service was started using systemctl or service processes.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation
Analytics BIOC	Attempt to execute a command on a remote host using PsExec.exe There was an attempt to run a command on a remote host using PsExec.exe.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution
Analytics BIOC	Cached credentials discovery with cmdkey Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list.	Low	Platform Analytics	XDR Agent	Credential Access, Discovery
Analytics BIOC	Certutil pfx parsing Certutil was used to parse a pfx certificate file.	Low	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Command running with COMSPEC in the command line argument COMSPEC is an environmental variable that points to cmd.exe. Attackers may use this command to obfuscate their command and avoid detection.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Compressing data using python Usage of a Python module to compress files.	Low	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Conhost.exe spawned a suspicious cmd process Attackers may abuse the conhost process to execute malicious files and evade detection.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Contained process execution with a rare GitHub URL A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Copy a user's GnuPG directory with rsync Copy a user's GnuPG (.gnupg) directory on to a staging folder using the 'find' and 'rsync' commands.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Delayed Deletion of Files A command line deleting files used the time-out or ping commands to delay the file deletion. This is suspicious, as malware sometimes uses these techniques to cover their tracks.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics	DNS Tunneling 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. The endpoint may be remotely controlled by an attacker, and/or an attacker may have exfiltrated data from it. This detector is not supported when networking events arrive solely from Cortex XDR Linux agents.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Download a script using the python requests module Download a shell script from a remote location using the Python requests module.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Execution of an uncommon process at an early startup stage by Windows system binary Uncommon execution of an executable found in an early startup stage by Windows system binary.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Execution of command from within a Kubernetes pod using kubelet credentials A command was executed from within a Kubernetes pod using Kubelet credentials. This activity allows an attacker to impersonate the node and perform privileged operations against the cluster API.	Low	Platform Analytics	XDR Agent	Privilege Escalation
Analytics BIOC	Execution of dllhost.exe with an empty command line The process dllhost.exe was executed with an empty command line. This behavior is suspicious, and may be caused by a malicious actor using 'Image File Execution Options' in the registry to evade detection.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Extracting credentials from Unix files Suspicious Unix files containing insecurely stored credentials were accessed.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics	Failed Connections The endpoint has failed connections to other endpoints that have been inactive for more than 24 hours, or that Cortex XDR Analytics has never seen on the network. The endpoint has made an abnormally large number of these failed connections and/or is attempting to connect to an abnormal mixture of missing or inactive endpoints. Your network might contain legitimate scanners that could cause a false positive for this alert. Cortex XDR Analytics attempts to filter these out by checking if a scanner has been active for a long consecutive period of time. Consequently, if this alert is seen, it represents new activity on your network. An attacker may be trying to move laterally, or to scan different parts of the network to look for other endpoints that expose a specific service. Worms also perform a similar activity to automatically infect additional hosts in the network.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Discovery
Analytics	Failed DNS The endpoint is performing DNS lookups that are failing at an excessively high rate when compared to its peer group. This alert might be symptomatic of malware that is trying to connect to its command and control (C2) servers. The attacker's C2 server runs on one or more domains that can eventually be identified and blacklisted. To avoid this, malware will sometimes use Domain Generation Algorithms (DGA) that produce many domain names every day. Because only a few of these domains are ever registered, the installed malware must blindly try to access each generated domain name in an effort to locate an active one.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control
Analytics BIOC	Globally uncommon root domain from a signed process A signed process connected to an external domain that, on a global level, it usually doesn't connect to.	Low	Platform Analytics	XDR Agent	Defense Evasion, Command and Control
Analytics BIOC	Globally uncommon root-domain port combination from a signed process A signed process connected to an external domain on a specific port that, on a global level, it usually doesn't connect to.	Low	Platform Analytics	XDR Agent	Defense Evasion, Command and Control
Analytics	HTTP with suspicious characteristics Uncommon HTTP communication was performed by the host that might indicate its attempt to hide malicious activities.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Installation of a new System-V service Installation of a new System-V service.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation
Analytics BIOC	Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation.	Low	Platform Analytics	XDR Agent	Execution, Privilege Escalation
Analytics	Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.	Low	Identity Analytics	XDR Agent	Discovery, Credential Access
Analytics BIOC	Interactive login by a service account A service account performed an interactive or remote interactive login.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics	Kerberos Pre-Auth Failures by Host The endpoint failed an unusual number of Kerberos pre-authentications (TGT requests) from at least three users when compared to its baseline. This can indicate a password-spraying attack.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Keylogging using system commands Usage of a Linux system utility to capture input.	Low	Platform Analytics	XDR Agent	Credential Access, Collection
Analytics	Large Upload (FTP) The endpoint transferred an excessively large amounts of data to a single destination over FTP. Cortex XDR Analytics assumes endpoint traffic towards a specific destination should be about the same over long periods of time. For that reason, Cortex XDR detected this abnormal behavior of a large data upload. An attacker may be exfiltrating data directly to the internet using this protocol.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics	Large Upload (Generic) The endpoint transferred large amounts of data to an external site using a different protocol from HTTP/s, FTP, or SMTP. (A specific detector is used for each of those protocols.) Cortex XDR Analytics assumes that data transfers out of your network are ordinarily performed using one of those three services, so it expects that data transfers over all other ports to be low. For the same reason, Cortex XDR Analytics also assumes endpoint traffic towards a specific destination should be about the same over long periods of time. An attacker may be exfiltrating data directly to the internet.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics	Large Upload (HTTPS) The endpoint transferred an excessive amount of data to an external site over HTTPS. The destination is not a popular upload site for endpoints on your network, and the endpoint performing the upload has not previously downloaded a large amount of data from the site. The upload is considered excessive based on comparison to baseline measurements of HTTPS data transfers on your network. An attacker may be exfiltrating data directly to the internet.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration
Analytics	Large Upload (SMTP) The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration
Analytics BIOC	Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	LOLBIN process executed with a high integrity level A process spawned a suspicious LOLBIN process with a higher/system integrity level. The LOLBIN process spawned with an uncommon command line. This may be an indication of malicious code execution to gain privileges.	Low	Platform Analytics	XDR Agent	Privilege Escalation
Analytics	Machine Account NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that machine account NTLM authentication data has been relayed.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access, Lateral Movement
Analytics BIOC	Masquerading as the Linux crond process Copies a file and renames it as crond.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Microsoft Office injects code into a process An attacker may inject payloads into processes via Microsoft Office. While legitimate in certain cases, code injection can also be used in malicious ways.	Low	Platform Analytics	XDR Agent	Initial Access, Defense Evasion
Analytics BIOC	Microsoft Office Process Spawning a Suspicious One-Liner A Microsoft Office process spawned a commonly abused process with a full command (not a script), this is a typically malicious behavior.	Low	Platform Analytics	XDR Agent	Execution, Initial Access
Analytics BIOC	Microsoft Office process spawns a commonly abused process Microsoft Office process spawns a commonly abused process with an uncommon command.	Low	Platform Analytics	XDR Agent	Execution, Initial Access
Analytics BIOC	Microsoft Office process spawns conhost.exe This unusual parent-child relationship may indicate that a Microsoft Office application executed a console-based application.	Low	Platform Analytics	XDR Agent	Execution, Initial Access
Analytics BIOC	Mount command was executed from within a Kubernetes pod to list all the attached filesystems The mount command was executed inside a Kubernetes pod to list all the attached filesystems, which may serve as a precursor to container escape and host filesystem access.	Low	Platform Analytics	XDR Agent	Privilege Escalation
Analytics BIOC	MpCmdRun.exe was used to download files into the system Attackers might be using legitimate Windows Defender executables to download malicious code onto the system.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Mshta.exe launched with suspicious arguments Microsoft HTML application host process has been launched with suspicious arguments, which may indicate malicious intent.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Mshta.exe spawns from a browser process Mshta is the Microsoft HTML Application Host. It executes HTML applications on Windows. Detected when a browser process has spawned mshta, which can be a potential attack vector.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics	Multiple discovery commands The alerted causality performed multiple discovery commands in a short timeframe.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery commands on a Windows host by the same process The alerted process performed multiple discovery commands in a short timeframe.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.	Low	Identity Analytics	XDR Agent	Execution
Analytics BIOC	Multiple uncommon SSH Servers with the same Server host key Multiple uncommon SSH servers were observed using the same host key.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Credential Access
Analytics	Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	New FTP Server A new FTP server has been detected.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Initial Access, Collection
Analytics	New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics	NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics BIOC	Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Okta FastPass reported phishing attack suspected Okta FastPass authentication reported a phishing attack suspected.	Low	Identity Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent, Palo Alto Networks Firewall threat Logs	Initial Access
Analytics BIOC	Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics	Possible external RDP Brute-Force Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	Possible Insider Threat Activity A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain.	Low	Identity Threat Detection (ITDR)	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Impact
Analytics BIOC	Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Possible Kerberos relay attack A suspicious local network login was observed, which might indicate on Kerberos relay attack. This attack can lead to privilege escalation by obtaining system privileges on the target.	Low	Platform Analytics	Windows Event Collector, XDR Agent	Privilege Escalation
Analytics BIOC	Possible network service discovery via command-line tool An attacker may use command-line utilities to discover open ports and services on a remote host.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Possible network sniffing attempt via tcpdump or tshark Attackers may monitor network traffic for cleartext credentials or to learn the network's configuration.	Low	Platform Analytics	XDR Agent	Credential Access, Discovery
Analytics BIOC	Possible Pass-the-Hash An account was successfully logged on to with new credentials. This login type is rare and may be an attacker's attempt to pass-the-hash and move laterally within a network.	Low	Identity Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Possible path traversal via HTTP request The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Discovery
Analytics	Possible phishing attack via Microsoft Teams An external tenant is possibly attempting a phishing attack via Microsoft Teams.	Low	Identity Threat Detection (ITDR)	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access
Analytics	Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.	Low	Identity Analytics	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Defense Evasion
Analytics BIOC	PowerShell runs suspicious base64-encoded commands Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare binary connected to a rare external host Rare binary connected to a rare external host.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.	Low	Platform Analytics	XDR Agent	Command and Control, Lateral Movement
Analytics BIOC	Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Lateral Movement
Analytics BIOC	RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Lateral Movement
Analytics BIOC	Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control

Analytics BIOC

A commonly abused process connected to a rare cloud resource A commonly abused process connected to a rare cloud resource.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

A commonly abused process connected to a rare external host A commonly abused process connected to a rare external host.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics

A compromised process accessed a rare external host A compromised process accessed a rare external host.

Low

Platform Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Command and Control

Analytics BIOC

A suspicious process enrolled for a certificate A suspicious process enrolled for a certificate.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Abnormal communication with a rare combination of TLS and HTTP User Agent Abnormal communication with a rare combination of TLS and HTTP User Agent to an external address.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics

Abnormal ICMP echo (PING) to multiple hosts An endpoint performed an abnormal ICMP echo (PING) to multiple hosts on the network.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Abnormal network communication through TOR using an uncommon port Suspicious connection from a known TOR IP to an uncommon port.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics

Abnormal RDP connections to multiple hosts from a rarely seen host The endpoint attempted to initiate rare RDP connections to multiple hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Abnormal RDP session to a remote host from a rarely seen host The endpoint performed a rare RDP session to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics

Abnormal SMB activity to multiple hosts An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics

Account probing A user failed to log in to multiple hosts it never accessed before in a short amount of time. This may indicate the account is compromised and an attacker is probing for a host it can access with those credentials.

Low

Identity Analytics

XDR Agent

Initial Access, Credential Access

Analytics BIOC

An uncommon service was started An uncommon service was started using systemctl or service processes.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation

Analytics BIOC

Attempt to execute a command on a remote host using PsExec.exe There was an attempt to run a command on a remote host using PsExec.exe.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution

Analytics BIOC

Cached credentials discovery with cmdkey Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list.

Low

Platform Analytics

XDR Agent

Credential Access, Discovery

Analytics BIOC

Certutil pfx parsing Certutil was used to parse a pfx certificate file.

Low

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Command running with COMSPEC in the command line argument COMSPEC is an environmental variable that points to cmd.exe. Attackers may use this command to obfuscate their command and avoid detection.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Compressing data using python Usage of a Python module to compress files.

Low

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Conhost.exe spawned a suspicious cmd process Attackers may abuse the conhost process to execute malicious files and evade detection.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Contained process execution with a rare GitHub URL A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Copy a user's GnuPG directory with rsync Copy a user's GnuPG (.gnupg) directory on to a staging folder using the 'find' and 'rsync' commands.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Delayed Deletion of Files A command line deleting files used the time-out or ping commands to delay the file deletion. This is suspicious, as malware sometimes uses these techniques to cover their tracks.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics

DNS Tunneling 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. The endpoint may be remotely controlled by an attacker, and/or an attacker may have exfiltrated data from it. This detector is not supported when networking events arrive solely from Cortex XDR Linux agents.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Download a script using the python requests module Download a shell script from a remote location using the Python requests module.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Execution of an uncommon process at an early startup stage by Windows system binary Uncommon execution of an executable found in an early startup stage by Windows system binary.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Execution of command from within a Kubernetes pod using kubelet credentials A command was executed from within a Kubernetes pod using Kubelet credentials. This activity allows an attacker to impersonate the node and perform privileged operations against the cluster API.

Low

Platform Analytics

XDR Agent

Privilege Escalation

Analytics BIOC

Execution of dllhost.exe with an empty command line The process dllhost.exe was executed with an empty command line. This behavior is suspicious, and may be caused by a malicious actor using 'Image File Execution Options' in the registry to evade detection.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Extracting credentials from Unix files Suspicious Unix files containing insecurely stored credentials were accessed.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics

Failed Connections The endpoint has failed connections to other endpoints that have been inactive for more than 24 hours, or that Cortex XDR Analytics has never seen on the network. The endpoint has made an abnormally large number of these failed connections and/or is attempting to connect to an abnormal mixture of missing or inactive endpoints. Your network might contain legitimate scanners that could cause a false positive for this alert. Cortex XDR Analytics attempts to filter these out by checking if a scanner has been active for a long consecutive period of time. Consequently, if this alert is seen, it represents new activity on your network. An attacker may be trying to move laterally, or to scan different parts of the network to look for other endpoints that expose a specific service. Worms also perform a similar activity to automatically infect additional hosts in the network.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Discovery

Analytics

Failed DNS The endpoint is performing DNS lookups that are failing at an excessively high rate when compared to its peer group. This alert might be symptomatic of malware that is trying to connect to its command and control (C2) servers. The attacker's C2 server runs on one or more domains that can eventually be identified and blacklisted. To avoid this, malware will sometimes use Domain Generation Algorithms (DGA) that produce many domain names every day. Because only a few of these domains are ever registered, the installed malware must blindly try to access each generated domain name in an effort to locate an active one.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control

Analytics BIOC

Globally uncommon root domain from a signed process A signed process connected to an external domain that, on a global level, it usually doesn't connect to.

Low

Platform Analytics

XDR Agent

Defense Evasion, Command and Control

Analytics BIOC

Globally uncommon root-domain port combination from a signed process A signed process connected to an external domain on a specific port that, on a global level, it usually doesn't connect to.

Low

Platform Analytics

XDR Agent

Defense Evasion, Command and Control

Analytics

HTTP with suspicious characteristics Uncommon HTTP communication was performed by the host that might indicate its attempt to hide malicious activities.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Installation of a new System-V service Installation of a new System-V service.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation

Analytics BIOC

Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation.

Low

Platform Analytics

XDR Agent

Execution, Privilege Escalation

Analytics

Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.

Low

Identity Analytics

XDR Agent

Discovery, Credential Access

Analytics BIOC

Interactive login by a service account A service account performed an interactive or remote interactive login.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics

Kerberos Pre-Auth Failures by Host The endpoint failed an unusual number of Kerberos pre-authentications (TGT requests) from at least three users when compared to its baseline. This can indicate a password-spraying attack.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Keylogging using system commands Usage of a Linux system utility to capture input.

Low

Platform Analytics

XDR Agent

Credential Access, Collection

Analytics

Large Upload (FTP) The endpoint transferred an excessively large amounts of data to a single destination over FTP. Cortex XDR Analytics assumes endpoint traffic towards a specific destination should be about the same over long periods of time. For that reason, Cortex XDR detected this abnormal behavior of a large data upload. An attacker may be exfiltrating data directly to the internet using this protocol.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics

Large Upload (Generic) The endpoint transferred large amounts of data to an external site using a different protocol from HTTP/s, FTP, or SMTP. (A specific detector is used for each of those protocols.) Cortex XDR Analytics assumes that data transfers out of your network are ordinarily performed using one of those three services, so it expects that data transfers over all other ports to be low. For the same reason, Cortex XDR Analytics also assumes endpoint traffic towards a specific destination should be about the same over long periods of time. An attacker may be exfiltrating data directly to the internet.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics

Large Upload (HTTPS) The endpoint transferred an excessive amount of data to an external site over HTTPS. The destination is not a popular upload site for endpoints on your network, and the endpoint performing the upload has not previously downloaded a large amount of data from the site. The upload is considered excessive based on comparison to baseline measurements of HTTPS data transfers on your network. An attacker may be exfiltrating data directly to the internet.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration

Analytics

Large Upload (SMTP) The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration

Analytics BIOC

Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

LOLBIN process executed with a high integrity level A process spawned a suspicious LOLBIN process with a higher/system integrity level. The LOLBIN process spawned with an uncommon command line. This may be an indication of malicious code execution to gain privileges.

Low

Platform Analytics

XDR Agent

Privilege Escalation

Analytics

Machine Account NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that machine account NTLM authentication data has been relayed.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access, Lateral Movement

Analytics BIOC

Masquerading as the Linux crond process Copies a file and renames it as crond.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Microsoft Office injects code into a process An attacker may inject payloads into processes via Microsoft Office. While legitimate in certain cases, code injection can also be used in malicious ways.

Low

Platform Analytics

XDR Agent

Initial Access, Defense Evasion

Analytics BIOC

Microsoft Office Process Spawning a Suspicious One-Liner A Microsoft Office process spawned a commonly abused process with a full command (not a script), this is a typically malicious behavior.

Low

Platform Analytics

XDR Agent

Execution, Initial Access

Analytics BIOC

Microsoft Office process spawns a commonly abused process Microsoft Office process spawns a commonly abused process with an uncommon command.

Low

Platform Analytics

XDR Agent

Execution, Initial Access

Analytics BIOC

Microsoft Office process spawns conhost.exe This unusual parent-child relationship may indicate that a Microsoft Office application executed a console-based application.

Low

Platform Analytics

XDR Agent

Execution, Initial Access

Analytics BIOC

Mount command was executed from within a Kubernetes pod to list all the attached filesystems The mount command was executed inside a Kubernetes pod to list all the attached filesystems, which may serve as a precursor to container escape and host filesystem access.

Low

Platform Analytics

XDR Agent

Privilege Escalation

Analytics BIOC

MpCmdRun.exe was used to download files into the system Attackers might be using legitimate Windows Defender executables to download malicious code onto the system.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Mshta.exe launched with suspicious arguments Microsoft HTML application host process has been launched with suspicious arguments, which may indicate malicious intent.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Mshta.exe spawns from a browser process Mshta is the Microsoft HTML Application Host. It executes HTML applications on Windows. Detected when a browser process has spawned mshta, which can be a potential attack vector.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics

Multiple discovery commands The alerted causality performed multiple discovery commands in a short timeframe.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery commands on a Windows host by the same process The alerted process performed multiple discovery commands in a short timeframe.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.

Low

Identity Analytics

XDR Agent

Execution

Analytics BIOC

Multiple uncommon SSH Servers with the same Server host key Multiple uncommon SSH servers were observed using the same host key.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Credential Access

Analytics

Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

New FTP Server A new FTP server has been detected.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Initial Access, Collection

Analytics

New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics

NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics BIOC

Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Okta FastPass reported phishing attack suspected Okta FastPass authentication reported a phishing attack suspected.

Low

Identity Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent, Palo Alto Networks Firewall threat Logs

Initial Access

Analytics BIOC

Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics

Possible external RDP Brute-Force Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

Possible Insider Threat Activity A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain.

Low

Identity Threat Detection (ITDR)

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Impact

Analytics BIOC

Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Possible Kerberos relay attack A suspicious local network login was observed, which might indicate on Kerberos relay attack. This attack can lead to privilege escalation by obtaining system privileges on the target.

Low

Platform Analytics

Windows Event Collector, XDR Agent

Privilege Escalation

Analytics BIOC

Possible network service discovery via command-line tool An attacker may use command-line utilities to discover open ports and services on a remote host.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Possible network sniffing attempt via tcpdump or tshark Attackers may monitor network traffic for cleartext credentials or to learn the network's configuration.

Low

Platform Analytics

XDR Agent

Credential Access, Discovery

Analytics BIOC

Possible Pass-the-Hash An account was successfully logged on to with new credentials. This login type is rare and may be an attacker's attempt to pass-the-hash and move laterally within a network.

Low

Identity Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Possible path traversal via HTTP request The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Discovery

Analytics

Possible phishing attack via Microsoft Teams An external tenant is possibly attempting a phishing attack via Microsoft Teams.

Low

Identity Threat Detection (ITDR)

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access

Analytics

Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.

Low

Identity Analytics

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Defense Evasion

Analytics BIOC

PowerShell runs suspicious base64-encoded commands Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare binary connected to a rare external host Rare binary connected to a rare external host.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.

Low

Platform Analytics

XDR Agent

Command and Control, Lateral Movement

Analytics BIOC

Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Lateral Movement

Analytics BIOC

RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Lateral Movement

Analytics BIOC

Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control