Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Multiple uncommon SSH Servers with the same Server host key Multiple uncommon SSH servers were observed using the same host key.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Credential Access
Analytics	Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
BIOC	Nagios enumeration A Nagios XI database may be enumerated for the credentials of the hosts monitored.	Low	Platform Analytics	Process execution	Credential Access
BIOC	Network share discovery via command-line tool Attackers may use command-line tools to discover mapped shares on the host.	Low	Platform Analytics	Process execution	Discovery
Analytics BIOC	New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	New FTP Server A new FTP server has been detected.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Initial Access, Collection
Analytics BIOC	Non-browser access to a pastebin-like site Non-browser access to a pastebin-like site.	Low	Platform Analytics	Palo Alto Networks Url Logs	Command and Control
BIOC	Notepad process makes a network connection Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.	Low	Platform Analytics	Network	Defense Evasion
Analytics BIOC	NTDS.dit file written by an uncommon executable The Active Directory database file was written by an uncommon process to a non-default location.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Office process accessed an unusual .LNK file An attacker may embed a .LNK file in an Office document to execute malicious code.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Persistence
Analytics BIOC	Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Out of band testing domain connection Connection from web service process to out-of-band-testing domain.	Low	Platform Analytics	Network	Initial Access
Analytics	Outlook files accessed by an unsigned process An attacker may use an uncommon and unsigned process to access Outlook data files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Collection
BIOC	Plink/SSH reverse tunnel PuTTY link (Plink) / SSH can be used to create encrypted tunnels to communicate back to an attacker's C2 server.	Low	Platform Analytics	Process execution	Command and Control
BIOC	Port Monitor added in Registry Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.	Low	Platform Analytics	Registry	Persistence
Analytics BIOC	Possible DCSync from a non domain controller Attackers may pose a compromised host as a DC to replicate data to it (DCSync).	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Defense Evasion
Analytics BIOC	Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Possible Kerberos relay attack A suspicious local network login was observed, which might indicate on Kerberos relay attack. This attack can lead to privilege escalation by obtaining system privileges on the target.	Low	Platform Analytics	Windows Event Collector, XDR Agent	Privilege Escalation
Analytics BIOC	Possible network service discovery via command-line tool An attacker may use command-line utilities to discover open ports and services on a remote host.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Possible network sniffing attempt via tcpdump or tshark Attackers may monitor network traffic for cleartext credentials or to learn the network's configuration.	Low	Platform Analytics	XDR Agent	Credential Access, Discovery
BIOC	Possible Oracle enumeration via Oscanner The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.	Low	Platform Analytics	Process execution	Discovery
BIOC	Possible Oracle enumeration via tnscmd10g The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs.	Low	Platform Analytics	Process execution	Discovery
Analytics BIOC	Possible path traversal via HTTP request The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Discovery
Analytics BIOC	Possible webshell file written by a web server process An uncommon file with a web file extension was created, written or renamed by a web server process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Initial Access, Persistence
Analytics	Potential kubelet impersonation attempt A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Potential SCCM credential harvesting using WMI detected Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Credential Access
BIOC	PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.	Low	Platform Analytics	Process execution	Persistence
Analytics BIOC	PowerShell Initiates a Network Connection to GitHub PowerShell initiates a Network Connection to GitHub with an uncommon command line. This may have legitimate uses, but this technique is frequently used by attackers to serve malicious payloads.	Low	Platform Analytics	Palo Alto Networks Url Logs	Execution
Analytics BIOC	PowerShell runs suspicious base64-encoded commands Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.	Low	Platform Analytics	XDR Agent	Execution
BIOC	Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.	Low	Platform Analytics	Registry	Persistence
BIOC	Process runs from the recycle bin Process running from the recycle bin.	Low	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare binary connected to a rare external host Rare binary connected to a rare external host.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics	Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Discovery
Analytics BIOC	Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.	Low	Platform Analytics	XDR Agent	Command and Control, Lateral Movement
Analytics BIOC	Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Persistence
Analytics BIOC	Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Persistence
Analytics BIOC	Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Lateral Movement
Analytics BIOC	RDP connections enabled remotely via Registry An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
BIOC	RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.	Low	Platform Analytics	Registry	Lateral Movement
Analytics BIOC	RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Lateral Movement
Analytics BIOC	Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
BIOC	Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.	Low	Platform Analytics	Process execution	Execution
Analytics BIOC	Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution
Analytics BIOC	Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity.	Low	Platform Analytics	Process execution	Execution
Analytics BIOC	Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.	Low	Platform Analytics	XDR Agent	Command and Control, Execution
Analytics BIOC	SecureBoot was disabled SecureBoot was disabled, this might be indicative of someone trying to install an alternate non-UEFI supported OS.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Setting Windows Auto Logon by uncommon process Setting Windows Auto Logon by uncommon process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.	Low	Platform Analytics	XDR Agent	Privilege Escalation, Defense Evasion
Analytics BIOC	SMB Traffic from Non-Standard Process SMB traffic is usually performed by a standard set of privileged processes through designated ports. The endpoint had a non-standard process communicating over ports normally used by SMB. An attacker might be moving laterally by using tools that implement a custom version of the SMB protocol.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Impact
Analytics BIOC	Stored credentials exported using credwiz.exe Attackers may abuse the credwiz tool to export stored accounts.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics	Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics BIOC	SUID/GUID permission discovery Attackers may search for potential to elevate permissions using binaries that have the SUID or GUID bit enabled.	Low	Platform Analytics	XDR Agent	Discovery
BIOC	Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).	Low	Platform Analytics	Process execution	Defense Evasion
BIOC	Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).	Low	Platform Analytics	Module	Defense Evasion
Analytics BIOC	Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.	Low	Platform Analytics	XDR Agent	Discovery, Credential Access
Analytics BIOC	Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics BIOC	Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.	Low	Platform Analytics	XDR Agent	Impact, Defense Evasion
Analytics BIOC	Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access
Analytics BIOC	Suspicious ICMP packet An ICMP router advertisement was sent by a host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control
Analytics	Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.	Low	Platform Analytics	XDR Agent	Impact
Analytics	Suspicious LDAP queries followed by shared folder access The user executed suspicious LDAP queries shortly before accessing a shared folder. This behavior may be indicative of Rubeus activity involving Kerberos ticket forgery, such as Golden Ticket or Silver Ticket attacks.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious LDAP search query executed A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
BIOC	Suspicious lock screen image file written to disk Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.	Low	Platform Analytics	File	Command and Control
Analytics BIOC	Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.	Low	Platform Analytics	XDR Agent	Execution
BIOC	Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.	Low	Platform Analytics	Registry	Privilege Escalation, Persistence
Analytics BIOC	Suspicious process accessed certificate files A suspicious process accessed certificate files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Suspicious Process Spawned by Adobe Reader Unusual process spawned by Adobe Reader with an uncommon command line.	Low	Platform Analytics	XDR Agent	Initial Access
Analytics BIOC	Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious setspn.exe execution A Service Principal Name (SPN) is a unique identifier for a service, mapped to a specific account. Setspn.exe can be used to retrieve SPN information, which may indicate an attacker's attempt to "Kerberoast".	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Suspicious SMB connection from domain controller A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Suspicious SSH Downgrade The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Lateral Movement, Defense Evasion
Analytics BIOC	Suspicious sshpass command execution The sshpass command was executed, This could be an attempt to check for credential stuffing.	Low	Platform Analytics	XDR Agent	Credential Access

Analytics BIOC

Multiple uncommon SSH Servers with the same Server host key Multiple uncommon SSH servers were observed using the same host key.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Credential Access

Analytics

Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

BIOC

Nagios enumeration A Nagios XI database may be enumerated for the credentials of the hosts monitored.

Low

Platform Analytics

Process execution

Credential Access

BIOC

Network share discovery via command-line tool Attackers may use command-line tools to discover mapped shares on the host.

Low

Platform Analytics

Process execution

Discovery

Analytics BIOC

New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

New FTP Server A new FTP server has been detected.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Initial Access, Collection

Analytics BIOC

Non-browser access to a pastebin-like site Non-browser access to a pastebin-like site.

Low

Platform Analytics

Palo Alto Networks Url Logs

Command and Control

BIOC

Notepad process makes a network connection Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.

Low

Platform Analytics

Network

Defense Evasion

Analytics BIOC

NTDS.dit file written by an uncommon executable The Active Directory database file was written by an uncommon process to a non-default location.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Office process accessed an unusual .LNK file An attacker may embed a .LNK file in an Office document to execute malicious code.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Persistence

Analytics BIOC

Office process spawned with suspicious command-line arguments An Office process was executed with LOLBIN-like command-line arguments. This behavior is exhibited in the VBA-RunPE tool that executes executables from the memory of Word/Excel/PowerPoint.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Out of band testing domain connection Connection from web service process to out-of-band-testing domain.

Low

Platform Analytics

Network

Initial Access

Analytics

Outlook files accessed by an unsigned process An attacker may use an uncommon and unsigned process to access Outlook data files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Collection

BIOC

Plink/SSH reverse tunnel PuTTY link (Plink) / SSH can be used to create encrypted tunnels to communicate back to an attacker's C2 server.

Low

Platform Analytics

Process execution

Command and Control

BIOC

Port Monitor added in Registry Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.

Low

Platform Analytics

Registry

Persistence

Analytics BIOC

Possible DCSync from a non domain controller Attackers may pose a compromised host as a DC to replicate data to it (DCSync).

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Defense Evasion

Analytics BIOC

Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Possible Kerberos relay attack A suspicious local network login was observed, which might indicate on Kerberos relay attack. This attack can lead to privilege escalation by obtaining system privileges on the target.

Low

Platform Analytics

Windows Event Collector, XDR Agent

Privilege Escalation

Analytics BIOC

Possible network service discovery via command-line tool An attacker may use command-line utilities to discover open ports and services on a remote host.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Possible network sniffing attempt via tcpdump or tshark Attackers may monitor network traffic for cleartext credentials or to learn the network's configuration.

Low

Platform Analytics

XDR Agent

Credential Access, Discovery

BIOC

Possible Oracle enumeration via Oscanner The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.

Low

Platform Analytics

Process execution

Discovery

BIOC

Possible Oracle enumeration via tnscmd10g The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs.

Low

Platform Analytics

Process execution

Discovery

Analytics BIOC

Possible path traversal via HTTP request The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Discovery

Analytics BIOC

Possible webshell file written by a web server process An uncommon file with a web file extension was created, written or renamed by a web server process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Initial Access, Persistence

Analytics

Potential kubelet impersonation attempt A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Potential SCCM credential harvesting using WMI detected Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Credential Access

BIOC

PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.

Low

Platform Analytics

Process execution

Persistence

Analytics BIOC

PowerShell Initiates a Network Connection to GitHub PowerShell initiates a Network Connection to GitHub with an uncommon command line. This may have legitimate uses, but this technique is frequently used by attackers to serve malicious payloads.

Low

Platform Analytics

Palo Alto Networks Url Logs

Execution

Analytics BIOC

PowerShell runs suspicious base64-encoded commands Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.

Low

Platform Analytics

XDR Agent

Execution

BIOC

Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.

Low

Platform Analytics

Registry

Persistence

BIOC

Process runs from the recycle bin Process running from the recycle bin.

Low

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare binary connected to a rare external host Rare binary connected to a rare external host.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics

Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Discovery

Analytics BIOC

Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.

Low

Platform Analytics

XDR Agent

Command and Control, Lateral Movement

Analytics BIOC

Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Persistence

Analytics BIOC

Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Persistence

Analytics BIOC

Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Lateral Movement

Analytics BIOC

RDP connections enabled remotely via Registry An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

BIOC

RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Low

Platform Analytics

Registry

Lateral Movement

Analytics BIOC

RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Lateral Movement

Analytics BIOC

Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

BIOC

Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.

Low

Platform Analytics

Process execution

Execution

Analytics BIOC

Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution

Analytics BIOC

Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity.

Low

Platform Analytics

Process execution

Execution

Analytics BIOC

Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.

Low

Platform Analytics

XDR Agent

Command and Control, Execution

Analytics BIOC

SecureBoot was disabled SecureBoot was disabled, this might be indicative of someone trying to install an alternate non-UEFI supported OS.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Setting Windows Auto Logon by uncommon process Setting Windows Auto Logon by uncommon process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.

Low

Platform Analytics

XDR Agent

Privilege Escalation, Defense Evasion

Analytics BIOC

SMB Traffic from Non-Standard Process SMB traffic is usually performed by a standard set of privileged processes through designated ports. The endpoint had a non-standard process communicating over ports normally used by SMB. An attacker might be moving laterally by using tools that implement a custom version of the SMB protocol.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Impact

Analytics BIOC

Stored credentials exported using credwiz.exe Attackers may abuse the credwiz tool to export stored accounts.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics

Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics BIOC

SUID/GUID permission discovery Attackers may search for potential to elevate permissions using binaries that have the SUID or GUID bit enabled.

Low

Platform Analytics

XDR Agent

Discovery

BIOC

Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).

Low

Platform Analytics

Process execution

Defense Evasion

BIOC

Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

Low

Platform Analytics

Module

Defense Evasion

Analytics BIOC

Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.

Low

Platform Analytics

XDR Agent

Discovery, Credential Access

Analytics BIOC

Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics BIOC

Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.

Low

Platform Analytics

XDR Agent

Impact, Defense Evasion

Analytics BIOC

Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access

Analytics BIOC

Suspicious ICMP packet An ICMP router advertisement was sent by a host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control

Analytics

Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.

Low

Platform Analytics

XDR Agent

Impact

Analytics

Suspicious LDAP queries followed by shared folder access The user executed suspicious LDAP queries shortly before accessing a shared folder. This behavior may be indicative of Rubeus activity involving Kerberos ticket forgery, such as Golden Ticket or Silver Ticket attacks.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious LDAP search query executed A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

BIOC

Suspicious lock screen image file written to disk Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.

Low

Platform Analytics

File

Command and Control

Analytics BIOC

Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.

Low

Platform Analytics

XDR Agent

Execution

BIOC

Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

Low

Platform Analytics

Registry

Privilege Escalation, Persistence

Analytics BIOC

Suspicious process accessed certificate files A suspicious process accessed certificate files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Suspicious Process Spawned by Adobe Reader Unusual process spawned by Adobe Reader with an uncommon command line.

Low

Platform Analytics

XDR Agent

Initial Access

Analytics BIOC

Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious setspn.exe execution A Service Principal Name (SPN) is a unique identifier for a service, mapped to a specific account. Setspn.exe can be used to retrieve SPN information, which may indicate an attacker's attempt to "Kerberoast".

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Suspicious SMB connection from domain controller A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Suspicious SSH Downgrade The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Lateral Movement, Defense Evasion

Analytics BIOC

Suspicious sshpass command execution The sshpass command was executed, This could be an attempt to check for credential stuffing.

Low

Platform Analytics

XDR Agent

Credential Access