Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
BIOC	Process requests the deletion of Windows Shadowcopies Ransomware and wipers may use the wmic.exe or vssadmin.exe utilities to delete or modify Shadowcopies (a Windows backup mechanism).	High	Platform Analytics	Process execution	Impact
BIOC	Process runs from the recycle bin Process running from the recycle bin.	Low	Platform Analytics	Process execution	Defense Evasion
BIOC	Process runs with a double extension Look for executables with a common double extension. These are often used to disguise malware as some form of user content.	Medium	Platform Analytics	Process execution	Execution
BIOC	PsExec attempts to execute a command on a remote host PsExec is a SysInternals tool used to execute commands on remote hosts.	Informational	Platform Analytics	Network	Lateral Movement, Execution
BIOC	PsExec executed with plain-text credentials on the command line PsExec.exe is a Windows administrative tool, which may be used by adversaries to execute remote commands.	Informational	Platform Analytics	Process execution	Execution
BIOC	PsExec execution EulaAccepted flag added to the Registry PsExec is commonly used by malware for lateral movement, seeing this value in the Registry means that the user ran PsExec and approved the EULA either automatically or manually.	Informational	Platform Analytics	Registry	Lateral Movement, Execution
BIOC	PsExec runs with System privileges PsExec.exe is a Windows administrative tool, it can be used to elevate privileges and run other processes with NT/System privilege level.	Informational	Platform Analytics	Process execution	Privilege Escalation
Analytics BIOC	PsExec was executed with a suspicious command line PsExec.exe was executed.	Informational	Platform Analytics	XDR Agent	Execution, Privilege Escalation
BIOC	Psexesvc.exe executes a command from a remote host Psexesvc.exe executes to run a command received from a remote host via PsExec.	Informational	Platform Analytics	Process execution	Execution
BIOC	Pubprn.vbs signed script proxy execution Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.	High	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Python HTTP server started Python HTTP server started - possible exfiltration over HTTP.	Informational	Platform Analytics	XDR Agent	Exfiltration
BIOC	Python script connecting to network Python scripts may be used by attackers to connect to their command-and-control infrastructure.	Medium	Platform Analytics	Process execution	Execution
BIOC	Query startup programs using wmic.exe Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system.	Informational	Platform Analytics	Process execution	Discovery, Execution
Analytics	Random-Looking Domain Names The endpoint performed DNS lookups to an excessively large number of apparently random root domain names. This alert might be symptomatic of malware that is trying to connect to its command and control (C2) servers. The attacker's C2 server runs on one or more domains that can eventually be identified and blacklisted. To avoid this, malware will sometimes use Domain Generation Algorithms (DGA) that produce many unique, random-looking domain names every day. Because only a few of these domains are ever registered, the installed malware must blindly try to access each generated domain name in an effort to locate an active one, which may also trigger the Failed DNS alert.	Medium	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control
BIOC	Rar.exe execution with password protection parameters Rar.exe was executed with parameters indicating password protection of the output file.	Informational	Platform Analytics	Process execution	Collection
Analytics	Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Persistence
Analytics BIOC	Rare AppID usage to a rare destination Rare AppID with port usage to rare destination.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare binary connected to a rare external host Rare binary connected to a rare external host.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol A process made a connection to an external IP address or host that is rarely connected to by the organization.	Informational	Platform Analytics	Palo Alto Networks Url Logs	Command and Control
Analytics BIOC	Rare DCOM RPC activity The endpoint performed abnormal DCOM RPC activity to a remote host.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics BIOC	Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics	Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Discovery
Analytics BIOC	Rare MS-Update Server was detected The endpoint requested an MS-Update operation from a rare update server.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Initial Access
Analytics BIOC	Rare MS-Update traffic over HTTP The endpoint requested an MS-Update operation with abnormal HTTP traffic characteristics.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Lateral Movement
Analytics BIOC	Rare process accessed a Keychain file An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare process spawned by srvany.exe Unusual process spawned by srvany.exe, which allows applications to run as services with system privileges, this might be an indication of malicious local or remote code execution.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.	Low	Platform Analytics	XDR Agent	Command and Control, Lateral Movement
Analytics BIOC	Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare Remote Service (SVCCTL) RPC activity The endpoint performed abnormal RPC activity via Service Control Manager interface to a remote host.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics BIOC	Rare scheduled task created A new rare scheduled task was created with a rare path and a rare command line.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Rare Scheduled Task RPC activity The endpoint performed abnormal Scheduled Task RPC activity to a remote host.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Persistence
Analytics BIOC	Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Persistence
Analytics BIOC	Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Persistence
Analytics BIOC	Rare signature signed executable executed in the network Attackers may use signed executables by less known vendors to bypass security features.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare SMTP/S Session The Simple Mail Transfer Protocol (SMTP) and its SSL-secured variant SMTPS are used to send email. Attackers can use SMTP/S to exfiltrate data from your network.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration
Analytics BIOC	Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Rare Unix process divided files by size A file was divided into sub-files by size limit by a rare process.	Informational	Platform Analytics	XDR Agent	Exfiltration
Analytics BIOC	Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Lateral Movement
Analytics BIOC	Rare WinRM Session Windows Remote Management (WinRM) enables users to interact with remote systems in different ways, including running executables on the remote system. WinRM sessions can be established using WinRM/WinRS commands or programs such as PowerShell. Attackers can use WinRM to execute code and move laterally within a compromised network.	Informational	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	RDP Connection to localhost An RDP connection to localhost can be used for privilege escalation by leveraging Windows accessibility features.	Medium	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	RDP connections enabled remotely via Registry An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
BIOC	RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.	Low	Platform Analytics	Registry	Lateral Movement
BIOC	RDP connections enabled via Registry from a script host or rundll32.exe An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.	Informational	Platform Analytics	Registry	Lateral Movement
Analytics BIOC	RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Lateral Movement
BIOC	Reading .ssh files Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers.	Informational	Platform Analytics	Process execution	Credential Access
Analytics BIOC	Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.	Low	Platform Analytics	XDR Agent	Credential Access
BIOC	Reading the contents of /etc/mtab or /etc/fstab File read on /etc/mtab or /etc/fstab using the cat utility.	Informational	Platform Analytics	Process execution	Discovery
Analytics BIOC	Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Registration of Uncommon .NET Services and/or Assemblies Regasm.exe and regsvcs.exe are used to register .NET COM assemblies, which are typically located in specific paths, attackers might leverage that to execute code within a Microsoft signed binary.	Informational	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Registry credentials extraction Attackers may extract credentials from the Registry using system commands.	Informational	Platform Analytics	Process execution	Credential Access
BIOC	Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host.	High	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Remote code execution into Kubernetes Pod A container administration service was used to execute commands within a Kubernetes Pod.	Informational	Platform Analytics	XDR Agent	Execution
BIOC	Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.	Low	Platform Analytics	Process execution	Execution
Analytics BIOC	Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement
BIOC	Remote file copy Remote copy operation of a file using rsync or scp or sftp.	Informational	Platform Analytics	Process execution	Lateral Movement
Analytics BIOC	Remote PsExec-like command execution A remotely triggered service initiated a command execution in a PsExec-like manner by a host that rarely triggers services to other remote hosts.	Informational	Platform Analytics	XDR Agent	Lateral Movement, Execution
BIOC	Remote RDP session enumeration via query.exe Attackers may use the built-in query.exe tool to enumerate remote sessions, using the session flag.	Informational	Platform Analytics	Process execution	Lateral Movement
BIOC	Remote RDP session enumeration via qwinsta.exe Attackers may use the built-in qwinsta.exe tool to enumerate remote sessions.	Informational	Platform Analytics	Process execution	Lateral Movement
Analytics BIOC	Remote service command execution from an uncommon source A remotely triggered service initiated a command execution by a host that rarely triggers services to other remote hosts.	High	Platform Analytics	XDR Agent	Lateral Movement, Execution
Analytics BIOC	Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution
BIOC	Remote system discovery Remote system discovery using a system utility.	Informational	Platform Analytics	Process execution	Discovery
Analytics BIOC	Remote WMI process execution A host that rarely initiates WMI to other remote hosts triggered a remote process execution by using WMI RPC.	Medium	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Retrieval of kubelet credentials A process retrieved kubelet credentials.	Informational	Platform Analytics	XDR Agent	Credential Access
BIOC	Reverse shell one-liner using a scripting engine An attacker may use scripting engines to execute code from the command line to open a reverse shell.	Informational	Platform Analytics	Process execution	Execution
BIOC	Reverse shell using PowerShell PowerShell can start a reverse shell console for attackers using these commands and take control of the machine.	Informational	Platform Analytics	Process execution	Execution
BIOC	Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.	Informational	Platform Analytics	Registry	Defense Evasion
BIOC	Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Rubeus tool execution Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity.	High	Platform Analytics	Process execution	Execution
Analytics BIOC	Run downloaded script using pipe Downloading a script using wget or curl and executing it using a pipe to a shell.	Informational	Platform Analytics	XDR Agent	Execution
BIOC	Rundll32 loads a known abused DLL Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Rundll32.exe launches an executable using ordinal numbers argument Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Rundll32.exe running with no command-line arguments Rundll32.exe is meant to run with parameters, so the absence of them is extremely suspicious; this behavior is used in the default configuration of Cobalt Strike.	Medium	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rundll32.exe spawns conhost.exe This unusual parent-child process relationship may indicate that an attacker has abused rundll32.exe to run a console-based application such as PowerShell.	Medium	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Rundll32.exe was used to run JavaScript Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe.	Medium	Platform Analytics	Process execution	Defense Evasion
BIOC	Rundll32.exe with 'main' as EntryPoint Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs.	Medium	Platform Analytics	Process execution	Defense Evasion
BIOC	Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity.	Low	Platform Analytics	Process execution	Execution
Analytics BIOC	Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Scrcons.exe Rare Child Process The Windows Management Instrumentation (WMI) standard event consumer scrcons.exe executed a rare VBScript or PowerShell script. Executing a rare script can be an indication of local or remote code execution abuse by an attacker.	Informational	Platform Analytics	XDR Agent	Execution, Persistence
BIOC	Screen capture via command-line tool Attackers may use the window system screen capture tool to collect screenshots.	Informational	Platform Analytics	Process execution	Collection
Analytics BIOC	Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Script file added to startup-related Registry keys An attacker may add a script file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.	Low	Platform Analytics	XDR Agent	Command and Control, Execution
BIOC	Scripting engine creates a compressed file under a suspicious folder Attackers may compress data before exfiltrating it to reduce network bandwidth consumption; if a compressed file is placed in a suspicious folder, it may be due to malicious activity.	Informational	Platform Analytics	File	Collection
BIOC	Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file.	Informational	Platform Analytics	File	Defense Evasion
BIOC	Scripting engine makes connections over DNS ports Scripting engine makes connections over DNS ports should not happen, as DNS traffic is typically managed by svchost and sometimes the browsers. Attackers are known to use DNS traffic to exfiltrate data and avoid detection.	Informational	Platform Analytics	Network	Exfiltration
BIOC	Scripting process reads Outlook data files Attackers may try to retrieve email data and sensitive information from .ost and .pst files.	Informational	Platform Analytics	File	Collection

BIOC

Process requests the deletion of Windows Shadowcopies Ransomware and wipers may use the wmic.exe or vssadmin.exe utilities to delete or modify Shadowcopies (a Windows backup mechanism).

High

Platform Analytics

Process execution

Impact

BIOC

Process runs from the recycle bin Process running from the recycle bin.

Low

Platform Analytics

Process execution

Defense Evasion

BIOC

Process runs with a double extension Look for executables with a common double extension. These are often used to disguise malware as some form of user content.

Medium

Platform Analytics

Process execution

Execution

BIOC

PsExec attempts to execute a command on a remote host PsExec is a SysInternals tool used to execute commands on remote hosts.

Informational

Platform Analytics

Network

Lateral Movement, Execution

BIOC

PsExec executed with plain-text credentials on the command line PsExec.exe is a Windows administrative tool, which may be used by adversaries to execute remote commands.

Informational

Platform Analytics

Process execution

Execution

BIOC

PsExec execution EulaAccepted flag added to the Registry PsExec is commonly used by malware for lateral movement, seeing this value in the Registry means that the user ran PsExec and approved the EULA either automatically or manually.

Informational

Platform Analytics

Registry

Lateral Movement, Execution

BIOC

PsExec runs with System privileges PsExec.exe is a Windows administrative tool, it can be used to elevate privileges and run other processes with NT/System privilege level.

Informational

Platform Analytics

Process execution

Privilege Escalation

Analytics BIOC

PsExec was executed with a suspicious command line PsExec.exe was executed.

Informational

Platform Analytics

XDR Agent

Execution, Privilege Escalation

BIOC

Psexesvc.exe executes a command from a remote host Psexesvc.exe executes to run a command received from a remote host via PsExec.

Informational

Platform Analytics

Process execution

Execution

BIOC

Pubprn.vbs signed script proxy execution Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.

High

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Python HTTP server started Python HTTP server started - possible exfiltration over HTTP.

Informational

Platform Analytics

XDR Agent

Exfiltration

BIOC

Python script connecting to network Python scripts may be used by attackers to connect to their command-and-control infrastructure.

Medium

Platform Analytics

Process execution

Execution

BIOC

Query startup programs using wmic.exe Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system.

Informational

Platform Analytics

Process execution

Discovery, Execution

Analytics

Random-Looking Domain Names The endpoint performed DNS lookups to an excessively large number of apparently random root domain names. This alert might be symptomatic of malware that is trying to connect to its command and control (C2) servers. The attacker's C2 server runs on one or more domains that can eventually be identified and blacklisted. To avoid this, malware will sometimes use Domain Generation Algorithms (DGA) that produce many unique, random-looking domain names every day. Because only a few of these domains are ever registered, the installed malware must blindly try to access each generated domain name in an effort to locate an active one, which may also trigger the Failed DNS alert.

Medium

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control

BIOC

Rar.exe execution with password protection parameters Rar.exe was executed with parameters indicating password protection of the output file.

Informational

Platform Analytics

Process execution

Collection

Analytics

Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Persistence

Analytics BIOC

Rare AppID usage to a rare destination Rare AppID with port usage to rare destination.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare binary connected to a rare external host Rare binary connected to a rare external host.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol A process made a connection to an external IP address or host that is rarely connected to by the organization.

Informational

Platform Analytics

Palo Alto Networks Url Logs

Command and Control

Analytics BIOC

Rare DCOM RPC activity The endpoint performed abnormal DCOM RPC activity to a remote host.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics BIOC

Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics

Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Discovery

Analytics BIOC

Rare MS-Update Server was detected The endpoint requested an MS-Update operation from a rare update server.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Initial Access

Analytics BIOC

Rare MS-Update traffic over HTTP The endpoint requested an MS-Update operation with abnormal HTTP traffic characteristics.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Lateral Movement

Analytics BIOC

Rare process accessed a Keychain file An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare process spawned by srvany.exe Unusual process spawned by srvany.exe, which allows applications to run as services with system privileges, this might be an indication of malicious local or remote code execution.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.

Low

Platform Analytics

XDR Agent

Command and Control, Lateral Movement

Analytics BIOC

Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare Remote Service (SVCCTL) RPC activity The endpoint performed abnormal RPC activity via Service Control Manager interface to a remote host.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics BIOC

Rare scheduled task created A new rare scheduled task was created with a rare path and a rare command line.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Rare Scheduled Task RPC activity The endpoint performed abnormal Scheduled Task RPC activity to a remote host.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Persistence

Analytics BIOC

Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Persistence

Analytics BIOC

Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Persistence

Analytics BIOC

Rare signature signed executable executed in the network Attackers may use signed executables by less known vendors to bypass security features.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare SMTP/S Session The Simple Mail Transfer Protocol (SMTP) and its SSL-secured variant SMTPS are used to send email. Attackers can use SMTP/S to exfiltrate data from your network.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration

Analytics BIOC

Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Rare Unix process divided files by size A file was divided into sub-files by size limit by a rare process.

Informational

Platform Analytics

XDR Agent

Exfiltration

Analytics BIOC

Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Lateral Movement

Analytics BIOC

Rare WinRM Session Windows Remote Management (WinRM) enables users to interact with remote systems in different ways, including running executables on the remote system. WinRM sessions can be established using WinRM/WinRS commands or programs such as PowerShell. Attackers can use WinRM to execute code and move laterally within a compromised network.

Informational

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

RDP Connection to localhost An RDP connection to localhost can be used for privilege escalation by leveraging Windows accessibility features.

Medium

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

RDP connections enabled remotely via Registry An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

BIOC

RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Low

Platform Analytics

Registry

Lateral Movement

BIOC

RDP connections enabled via Registry from a script host or rundll32.exe An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Informational

Platform Analytics

Registry

Lateral Movement

Analytics BIOC

RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Lateral Movement

BIOC

Reading .ssh files Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers.

Informational

Platform Analytics

Process execution

Credential Access

Analytics BIOC

Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.

Low

Platform Analytics

XDR Agent

Credential Access

BIOC

Reading the contents of /etc/mtab or /etc/fstab File read on /etc/mtab or /etc/fstab using the cat utility.

Informational

Platform Analytics

Process execution

Discovery

Analytics BIOC

Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Registration of Uncommon .NET Services and/or Assemblies Regasm.exe and regsvcs.exe are used to register .NET COM assemblies, which are typically located in specific paths, attackers might leverage that to execute code within a Microsoft signed binary.

Informational

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Registry credentials extraction Attackers may extract credentials from the Registry using system commands.

Informational

Platform Analytics

Process execution

Credential Access

BIOC

Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host.

High

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Remote code execution into Kubernetes Pod A container administration service was used to execute commands within a Kubernetes Pod.

Informational

Platform Analytics

XDR Agent

Execution

BIOC

Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.

Low

Platform Analytics

Process execution

Execution

Analytics BIOC

Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement

BIOC

Remote file copy Remote copy operation of a file using rsync or scp or sftp.

Informational

Platform Analytics

Process execution

Lateral Movement

Analytics BIOC

Remote PsExec-like command execution A remotely triggered service initiated a command execution in a PsExec-like manner by a host that rarely triggers services to other remote hosts.

Informational

Platform Analytics

XDR Agent

Lateral Movement, Execution

BIOC

Remote RDP session enumeration via query.exe Attackers may use the built-in query.exe tool to enumerate remote sessions, using the session flag.

Informational

Platform Analytics

Process execution

Lateral Movement

BIOC

Remote RDP session enumeration via qwinsta.exe Attackers may use the built-in qwinsta.exe tool to enumerate remote sessions.

Informational

Platform Analytics

Process execution

Lateral Movement

Analytics BIOC

Remote service command execution from an uncommon source A remotely triggered service initiated a command execution by a host that rarely triggers services to other remote hosts.

High

Platform Analytics

XDR Agent

Lateral Movement, Execution

Analytics BIOC

Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution

BIOC

Remote system discovery Remote system discovery using a system utility.

Informational

Platform Analytics

Process execution

Discovery

Analytics BIOC

Remote WMI process execution A host that rarely initiates WMI to other remote hosts triggered a remote process execution by using WMI RPC.

Medium

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Retrieval of kubelet credentials A process retrieved kubelet credentials.

Informational

Platform Analytics

XDR Agent

Credential Access

BIOC

Reverse shell one-liner using a scripting engine An attacker may use scripting engines to execute code from the command line to open a reverse shell.

Informational

Platform Analytics

Process execution

Execution

BIOC

Reverse shell using PowerShell PowerShell can start a reverse shell console for attackers using these commands and take control of the machine.

Informational

Platform Analytics

Process execution

Execution

BIOC

Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

Informational

Platform Analytics

Registry

Defense Evasion

BIOC

Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Rubeus tool execution Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity.

High

Platform Analytics

Process execution

Execution

Analytics BIOC

Run downloaded script using pipe Downloading a script using wget or curl and executing it using a pipe to a shell.

Informational

Platform Analytics

XDR Agent

Execution

BIOC

Rundll32 loads a known abused DLL Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Rundll32.exe launches an executable using ordinal numbers argument Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Rundll32.exe running with no command-line arguments Rundll32.exe is meant to run with parameters, so the absence of them is extremely suspicious; this behavior is used in the default configuration of Cobalt Strike.

Medium

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rundll32.exe spawns conhost.exe This unusual parent-child process relationship may indicate that an attacker has abused rundll32.exe to run a console-based application such as PowerShell.

Medium

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Rundll32.exe was used to run JavaScript Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe.

Medium

Platform Analytics

Process execution

Defense Evasion

BIOC

Rundll32.exe with 'main' as EntryPoint Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs.

Medium

Platform Analytics

Process execution

Defense Evasion

BIOC

Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity.

Low

Platform Analytics

Process execution

Execution

Analytics BIOC

Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Scrcons.exe Rare Child Process The Windows Management Instrumentation (WMI) standard event consumer scrcons.exe executed a rare VBScript or PowerShell script. Executing a rare script can be an indication of local or remote code execution abuse by an attacker.

Informational

Platform Analytics

XDR Agent

Execution, Persistence

BIOC

Screen capture via command-line tool Attackers may use the window system screen capture tool to collect screenshots.

Informational

Platform Analytics

Process execution

Collection

Analytics BIOC

Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Script file added to startup-related Registry keys An attacker may add a script file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.

Low

Platform Analytics

XDR Agent

Command and Control, Execution

BIOC

Scripting engine creates a compressed file under a suspicious folder Attackers may compress data before exfiltrating it to reduce network bandwidth consumption; if a compressed file is placed in a suspicious folder, it may be due to malicious activity.

Informational

Platform Analytics

File

Collection

BIOC

Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file.

Informational

Platform Analytics

File

Defense Evasion

BIOC

Scripting engine makes connections over DNS ports Scripting engine makes connections over DNS ports should not happen, as DNS traffic is typically managed by svchost and sometimes the browsers. Attackers are known to use DNS traffic to exfiltrate data and avoid detection.

Informational

Platform Analytics

Network

Exfiltration

BIOC

Scripting process reads Outlook data files Attackers may try to retrieve email data and sensitive information from .ost and .pst files.

Informational

Platform Analytics

File

Collection