Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics	Suspicious access to cloud credential files A process accessed multiple cloud credential files, which may indicate a credential theft activity.	Informational	Cortex Cloud	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Suspicious access to Kubernetes API with kubelet credentials A combination of signals has been detected indicating that kubelet credentials were used inside a pod to access the Kubernetes API. This activity suggests an attempt to escalate privileges or move laterally within the cluster.	Low	Cortex Cloud	XDR Agent with eXtended Threat Hunting (XTH)	Exfiltration, Collection
Analytics BIOC	Suspicious access to shadow file An unpopular process accessed the shadow file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious account attribute modification that matches that of another account Suspicious account attribute modification that matches that of another account.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
Analytics BIOC	Suspicious active setup registered The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics	Suspicious activity indicating a potential abuse of a cloud-native email service A cloud identity performed a sequence of activities which might indicate an intent to abuse the email service to send phishing or spam.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log	Execution
Analytics BIOC	Suspicious activity on logging bucket An identity performed a suspicious activity on bucket used to store logs.	Informational	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	Suspicious AI Dataset Download A model dataset was accessed by an identity that typically doesn't interact with dataset files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics BIOC	Suspicious AI Dataset Label Modification AI Dataset labels were modified by an identity that typically doesn't interact with labels. MITRE ATLAS Technique: AML.T0020 - Poison Training Data. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics BIOC	Suspicious AI model usage from a Tor exit node A cloud identity invoked an AI model from a Tor exit node.	High	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Command and Control
Analytics BIOC	Suspicious AMSI decode attempt A script has executed commands that can be used to decode commands or files.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
BIOC	Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).	Low	Platform Analytics	Module	Defense Evasion
Analytics BIOC	Suspicious API call from a Tor exit node A cloud API was called from a Tor exit node.	High	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Command and Control, Initial Access
Analytics BIOC	Suspicious authentication package registered The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious authentication with Azure Password Hash Sync user Authentication to an unusual authentication target was performed by the Azure AD Password Hash Sync user.	Medium	Identity Analytics	AzureAD	Initial Access, Defense Evasion
Analytics	Suspicious AWS SSM parameters retrieval activity An identity dumped multiple AWS SSM parameters from the project. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.	Informational	Cortex Cloud	AWS Audit Log	Credential Access, Collection
Analytics BIOC	Suspicious Azure AD interactive sign-in using PowerShell A user interactively logged in to Azure AD via PowerShell.	Informational	Identity Analytics	AzureAD	Initial Access
Analytics	Suspicious Azure enumeration activity An Azure identity performed resource enumeration across multiple services using Microsoft Graph.	Medium	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics BIOC	Suspicious brand affiliation detected The sender's name or address suggests association with a recognized brand, but the email address doesn't match established patterns for that brand.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
Analytics BIOC	Suspicious certificate template modification A certificate template was updated with a possible misconfiguration. This may indicate the exploitation of misconfigured certificate template access control (ESC4).	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.	Low	Platform Analytics	XDR Agent	Discovery, Credential Access
Analytics BIOC	Suspicious certutil command line An attacker may use certutil to download malware.	Medium	Platform Analytics	XDR Agent	Command and Control, Defense Evasion
Analytics BIOC	Suspicious cloud compute instance SSH keys modification attempt An identity attempted to modify the SSH keys of a single compute instance. This may indicate an attacker's attempt to maintain persistence on the cloud instance.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Persistence, Lateral Movement
Analytics	Suspicious cloud user data modification attempt followed by VM restart Suspicious user data modification followed by VM restart, possibly an attempt to run altered startup scripts at boot.	Low	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Execution
Analytics BIOC	Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics	Suspicious container reconnaissance activity in a Kubernetes pod A process performed multiple consecutive container discovery commands from within a Kubernetes Pod.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Suspicious container runtime connection from within a Kubernetes Pod A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious curl user agent Suspicious user agent provided to curl command.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.	Low	Platform Analytics	XDR Agent	Impact, Defense Evasion
BIOC	Suspicious debug file created in a temporary folder SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin.	High	Platform Analytics	File	Credential Access
Analytics BIOC	Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Suspicious disablement of the Windows Firewall using PowerShell commands The Windows Firewall has been disabled using PowerShell. Malware may turn it off to exfiltrate data and communicate with C2 servers.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Suspicious DKIM Result The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
BIOC	Suspicious DLL load using Control.exe This execution mechanism is known to be used by malware to load malicious DLLs.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Suspicious DMARC result The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
Analytics	Suspicious DNS traffic 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Suspicious dNSHostName attribute change to DC name The dNSHostName attribute of a machine account was changed to a Domain Controller server name.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
Analytics BIOC	Suspicious docker image download from an unusual repository The agent has pulled a docker image from a repository for the first time.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious domain user account creation A user was observed creating a rare domain account.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin Attackers may attempt to dump the ntds.dit file, which stores all Active Directory account information, to later extract passwords and hashes from it.	High	Platform Analytics	XDR Agent	Credential Access
Analytics	Suspicious EBS snapshots deletion An identity deleted multiple EBS snapshots from the project, considerably more than usual.	Low	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	Suspicious Encrypting File System Remote call (EFSRPC) to domain controller An Encrypting File System Remote call (EFSRPC) was made to a domain controller.	Medium	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
BIOC	Suspicious executable created in a .NET directory Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe.	High	Platform Analytics	File	Defense Evasion
Analytics BIOC	Suspicious External RDP Login An unusual successful RDP connection by a user from an external IP. This may be indicative of using stolen credentials or malicious activity.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access
BIOC	Suspicious file created in AppData directory A suspicious executable file was created in the AppData directory.	Informational	Platform Analytics	File	Execution
Analytics BIOC	Suspicious heavy allocation of compute resources - possible mining activity An identity allocated an unusual heavy compute resource, suspected as mining activity. Heavy machines normally have a high amount of CPU cores or attached with GPU, which are targeted by adversaries to mine Cryptocurrency.	Medium	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact, Initial Access
Analytics BIOC	Suspicious hidden user created A user account was created with a name that mimics a machine account.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Defense Evasion
Analytics BIOC	Suspicious HTTP parameters detected The endpoint received suspicious HTTP parameters via an HTTP request, which may indicate attempts to exploit server components or web shell activity.	Medium	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access, Persistence
Analytics BIOC	Suspicious ICMP packet An ICMP router advertisement was sent by a host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control
Analytics	Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.	Low	Platform Analytics	XDR Agent	Impact
Analytics	Suspicious identity downloaded multiple objects from a bucket An identity downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection, Exfiltration
Analytics	Suspicious Kerberos Pre-Auth Failures by Host An endpoint failed unusual number of Kerberos pre-authentications (TGT requests) which may indicate a password-spraying attack.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious Kubernetes pod token access A Kubernetes pod has accessed the access token of another pod. This could indicate potential unauthorized access or a security breach within the cluster.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Suspicious LDAP queries followed by shared folder access The user executed suspicious LDAP queries shortly before accessing a shared folder. This behavior may be indicative of Rubeus activity involving Kerberos ticket forgery, such as Golden Ticket or Silver Ticket attacks.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious LDAP search query executed A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
BIOC	Suspicious lock screen image file written to disk Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.	Low	Platform Analytics	File	Command and Control
Analytics BIOC	Suspicious MFA request reported by user in Entra ID A user has flagged an MFA request as suspicious in Microsoft Entra ID. This could indicate a potential compromised user account or unauthorized access attempt.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Persistence, Initial Access
Analytics BIOC	Suspicious ML Model Download A model artifact was accessed from cloud storage by an identity that typically doesn't interact with model files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection
Analytics BIOC	Suspicious modification of the AdminSDHolder's ACL A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious Network Connection Originating from AWS SSM Agent A process spawned by the AWS SSM agent connected to an anonymous tunnel or TOR IP outside AWS. This may indicate the SSM agent was abused for command and control or data exfiltration.	Medium	Cortex Cloud	XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Suspicious NTLM authentication with machine account A suspicious NTLM authentication attempt was made by a machine account.	Informational	Identity Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Credential Access
Analytics	Suspicious objects encryption in an AWS bucket An AWS KMS key from a non-organization account was used to encrypt multiple objects in a bucket for the first time. This may indicate an attacker attempting to perform a ransomware attack against the organization's cloud environment.	High	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious PowerShell Enumeration of Running Processes Attackers often enumerate running processes to find and disable security tools.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Suspicious PowerSploit's recon module (PowerView) net function was executed An attacker may use PowerSploit to reconnaissance the network.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts An attacker may use PowerSploit to reconnaissance the network for exposed hosts to move laterally to.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	Suspicious print processor registered The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious Print System Remote Protocol usage by a process A host which is trusted for unconstrained delegation initiated an SMB connection to a DC using the Print System Remote Protocol. An attacker can abuse such sessions for relay attacks.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
BIOC	Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.	Low	Platform Analytics	Registry	Privilege Escalation, Persistence
BIOC	Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).	Medium	Platform Analytics	Registry	Privilege Escalation, Persistence
Analytics BIOC	Suspicious process accessed a site masquerading as Google A suspicious process accessed a site masquerading as Google.	Informational	Platform Analytics	XDR Agent	Command and Control, Defense Evasion
Analytics BIOC	Suspicious process accessed certificate files A suspicious process accessed certificate files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious process executed with a high integrity level A suspicious process was spawned with a High or System integrity level, which is higher than its parent process. This may indicate malicious privilege escalation.	Informational	Platform Analytics	XDR Agent	Privilege Escalation
Analytics BIOC	Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Suspicious process execution in a privileged container A process was executed in a privileged Kubernetes Pod for the first time in the past 30 days.	Informational	Platform Analytics	XDR Agent	Execution, Privilege Escalation
Analytics BIOC	Suspicious process loads a known PowerShell module A non-PowerShell process loaded a known PowerShell module. This image load may be an indication of PowerShell execution without directly invoking the PowerShell.exe binary.	Informational	Platform Analytics	XDR Agent	Execution
BIOC	Suspicious process loads AMSI DLL Amsi.dll is expected to be loaded from a few known processes (e.g. PowerShell). An image load from an unrelated LOLBIN may indicate PowerShell execution.	Informational	Platform Analytics	Module	Execution
Analytics BIOC	Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Suspicious Process Spawned by Adobe Reader Unusual process spawned by Adobe Reader with an uncommon command line.	Low	Platform Analytics	XDR Agent	Initial Access
Analytics BIOC	Suspicious Process Spawned by wininit.exe An unusual process was spawned by wininit.exe, possibly indicating malicious local or remote code execution.	Medium	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Suspicious process spawns MSBuild.exe The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Suspicious proxy environment variable setting Suspicious proxy environment variable change or definition with a rare command line.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics	Suspicious reconnaissance using LDAP A process executed multiple suspicious LDAP search queries. This may be indicative of LDAP enumeration.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious SaaS API call from a Tor exit node A SaaS API was called from a Tor exit node.	High	Identity Threat Detection (ITDR), SaaS Threat Detection	Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit	Command and Control
Analytics BIOC	Suspicious sAMAccountName change The name of a machine account was changed to a sAMAccountName with a missing trailing dollar sign.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
BIOC	Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.	Informational	Platform Analytics	File	Persistence
BIOC	Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.	Informational	Platform Analytics	File	Persistence
Analytics BIOC	Suspicious SearchProtocolHost.exe parent process SearchProtocolHost.exe has been launched from a process that is different from SearchIndexer.exe This may indicate malicious activity (such as malware later being injected to it, or it being used for phantom DLL hijacking).	Medium	Platform Analytics	XDR Agent	Execution, Defense Evasion
Analytics	Suspicious secrets dump activity An identity dumped multiple secrets from the project, considerably more than usual. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Credential Access, Collection
Analytics	Suspicious sender exhibiting automated sending patterns Multiple messages from a single sender were observed over a short period, all having the same subject and differing body content. This repetitive pattern may indicate automated or scripted behavior.	Informational	Email Security	Microsoft 365 Emails	Initial Access
Analytics	Suspicious sending domain with sender address randomization Multiple messages from a single sender domain were observed over a short period, each using a unique sender address. This per-message sender randomization is uncommon for legitimate senders and suggests automated behavior.	Informational	Email Security	Microsoft 365 Emails	Initial Access
Analytics BIOC	Suspicious setspn.exe execution A Service Principal Name (SPN) is a unique identifier for a service, mapped to a specific account. Setspn.exe can be used to retrieve SPN information, which may indicate an attacker's attempt to "Kerberoast".	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Suspicious SMB connection from domain controller A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Suspicious SPF Result The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion
Analytics BIOC	Suspicious SSH Downgrade The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Lateral Movement, Defense Evasion

Analytics

Suspicious access to cloud credential files A process accessed multiple cloud credential files, which may indicate a credential theft activity.

Informational

Cortex Cloud

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Suspicious access to Kubernetes API with kubelet credentials A combination of signals has been detected indicating that kubelet credentials were used inside a pod to access the Kubernetes API. This activity suggests an attempt to escalate privileges or move laterally within the cluster.

Low

Cortex Cloud

XDR Agent with eXtended Threat Hunting (XTH)

Exfiltration, Collection

Analytics BIOC

Suspicious access to shadow file An unpopular process accessed the shadow file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious account attribute modification that matches that of another account Suspicious account attribute modification that matches that of another account.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

Analytics BIOC

Suspicious active setup registered The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics

Suspicious activity indicating a potential abuse of a cloud-native email service A cloud identity performed a sequence of activities which might indicate an intent to abuse the email service to send phishing or spam.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log

Execution

Analytics BIOC

Suspicious activity on logging bucket An identity performed a suspicious activity on bucket used to store logs.

Informational

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

Suspicious AI Dataset Download A model dataset was accessed by an identity that typically doesn't interact with dataset files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics BIOC

Suspicious AI Dataset Label Modification AI Dataset labels were modified by an identity that typically doesn't interact with labels. MITRE ATLAS Technique: AML.T0020 - Poison Training Data. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics BIOC

Suspicious AI model usage from a Tor exit node A cloud identity invoked an AI model from a Tor exit node.

High

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Command and Control

Analytics BIOC

Suspicious AMSI decode attempt A script has executed commands that can be used to decode commands or files.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

BIOC

Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

Low

Platform Analytics

Module

Defense Evasion

Analytics BIOC

Suspicious API call from a Tor exit node A cloud API was called from a Tor exit node.

High

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Command and Control, Initial Access

Analytics BIOC

Suspicious authentication package registered The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious authentication with Azure Password Hash Sync user Authentication to an unusual authentication target was performed by the Azure AD Password Hash Sync user.

Medium

Identity Analytics

AzureAD

Initial Access, Defense Evasion

Analytics

Suspicious AWS SSM parameters retrieval activity An identity dumped multiple AWS SSM parameters from the project. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.

Informational

Cortex Cloud

AWS Audit Log

Credential Access, Collection

Analytics BIOC

Suspicious Azure AD interactive sign-in using PowerShell A user interactively logged in to Azure AD via PowerShell.

Informational

Identity Analytics

AzureAD

Initial Access

Analytics

Suspicious Azure enumeration activity An Azure identity performed resource enumeration across multiple services using Microsoft Graph.

Medium

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics BIOC

Suspicious brand affiliation detected The sender's name or address suggests association with a recognized brand, but the email address doesn't match established patterns for that brand.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

Analytics BIOC

Suspicious certificate template modification A certificate template was updated with a possible misconfiguration. This may indicate the exploitation of misconfigured certificate template access control (ESC4).

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.

Low

Platform Analytics

XDR Agent

Discovery, Credential Access

Analytics BIOC

Suspicious certutil command line An attacker may use certutil to download malware.

Medium

Platform Analytics

XDR Agent

Command and Control, Defense Evasion

Analytics BIOC

Suspicious cloud compute instance SSH keys modification attempt An identity attempted to modify the SSH keys of a single compute instance. This may indicate an attacker's attempt to maintain persistence on the cloud instance.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Persistence, Lateral Movement

Analytics

Suspicious cloud user data modification attempt followed by VM restart Suspicious user data modification followed by VM restart, possibly an attempt to run altered startup scripts at boot.

Low

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Execution

Analytics BIOC

Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics

Suspicious container reconnaissance activity in a Kubernetes pod A process performed multiple consecutive container discovery commands from within a Kubernetes Pod.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Suspicious container runtime connection from within a Kubernetes Pod A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious curl user agent Suspicious user agent provided to curl command.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.

Low

Platform Analytics

XDR Agent

Impact, Defense Evasion

BIOC

Suspicious debug file created in a temporary folder SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin.

High

Platform Analytics

File

Credential Access

Analytics BIOC

Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Suspicious disablement of the Windows Firewall using PowerShell commands The Windows Firewall has been disabled using PowerShell. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Suspicious DKIM Result The email contains a suspicious DKIM entry, showing either an unexpected verification result (none, fail, or policy) or a mismatched signing domain, which may indicate potential tampering or spoofing activity.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

BIOC

Suspicious DLL load using Control.exe This execution mechanism is known to be used by malware to load malicious DLLs.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Suspicious DMARC result The email has a suspicious DMARC result of either fail or none, which may indicate a potential domain misconfiguration or spoofing.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

Analytics

Suspicious DNS traffic 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Suspicious dNSHostName attribute change to DC name The dNSHostName attribute of a machine account was changed to a Domain Controller server name.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

Analytics BIOC

Suspicious docker image download from an unusual repository The agent has pulled a docker image from a repository for the first time.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious domain user account creation A user was observed creating a rare domain account.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin Attackers may attempt to dump the ntds.dit file, which stores all Active Directory account information, to later extract passwords and hashes from it.

High

Platform Analytics

XDR Agent

Credential Access

Analytics

Suspicious EBS snapshots deletion An identity deleted multiple EBS snapshots from the project, considerably more than usual.

Low

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

Suspicious Encrypting File System Remote call (EFSRPC) to domain controller An Encrypting File System Remote call (EFSRPC) was made to a domain controller.

Medium

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

BIOC

Suspicious executable created in a .NET directory Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe.

High

Platform Analytics

File

Defense Evasion

Analytics BIOC

Suspicious External RDP Login An unusual successful RDP connection by a user from an external IP. This may be indicative of using stolen credentials or malicious activity.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access

BIOC

Suspicious file created in AppData directory A suspicious executable file was created in the AppData directory.

Informational

Platform Analytics

File

Execution

Analytics BIOC

Suspicious heavy allocation of compute resources - possible mining activity An identity allocated an unusual heavy compute resource, suspected as mining activity. Heavy machines normally have a high amount of CPU cores or attached with GPU, which are targeted by adversaries to mine Cryptocurrency.

Medium

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact, Initial Access

Analytics BIOC

Suspicious hidden user created A user account was created with a name that mimics a machine account.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Defense Evasion

Analytics BIOC

Suspicious HTTP parameters detected The endpoint received suspicious HTTP parameters via an HTTP request, which may indicate attempts to exploit server components or web shell activity.

Medium

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access, Persistence

Analytics BIOC

Suspicious ICMP packet An ICMP router advertisement was sent by a host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control

Analytics

Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.

Low

Platform Analytics

XDR Agent

Impact

Analytics

Suspicious identity downloaded multiple objects from a bucket An identity downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Collection, Exfiltration

Analytics

Suspicious Kerberos Pre-Auth Failures by Host An endpoint failed unusual number of Kerberos pre-authentications (TGT requests) which may indicate a password-spraying attack.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious Kubernetes pod token access A Kubernetes pod has accessed the access token of another pod. This could indicate potential unauthorized access or a security breach within the cluster.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Suspicious LDAP queries followed by shared folder access The user executed suspicious LDAP queries shortly before accessing a shared folder. This behavior may be indicative of Rubeus activity involving Kerberos ticket forgery, such as Golden Ticket or Silver Ticket attacks.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious LDAP search query executed A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

BIOC

Suspicious lock screen image file written to disk Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.

Low

Platform Analytics

File

Command and Control

Analytics BIOC

Suspicious MFA request reported by user in Entra ID A user has flagged an MFA request as suspicious in Microsoft Entra ID. This could indicate a potential compromised user account or unauthorized access attempt.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Persistence, Initial Access

Analytics BIOC

Suspicious ML Model Download A model artifact was accessed from cloud storage by an identity that typically doesn't interact with model files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Collection

Analytics BIOC

Suspicious modification of the AdminSDHolder's ACL A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious Network Connection Originating from AWS SSM Agent A process spawned by the AWS SSM agent connected to an anonymous tunnel or TOR IP outside AWS. This may indicate the SSM agent was abused for command and control or data exfiltration.

Medium

Cortex Cloud

XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Suspicious NTLM authentication with machine account A suspicious NTLM authentication attempt was made by a machine account.

Informational

Identity Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Credential Access

Analytics

Suspicious objects encryption in an AWS bucket An AWS KMS key from a non-organization account was used to encrypt multiple objects in a bucket for the first time. This may indicate an attacker attempting to perform a ransomware attack against the organization's cloud environment.

High

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious PowerShell Enumeration of Running Processes Attackers often enumerate running processes to find and disable security tools.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Suspicious PowerSploit's recon module (PowerView) net function was executed An attacker may use PowerSploit to reconnaissance the network.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts An attacker may use PowerSploit to reconnaissance the network for exposed hosts to move laterally to.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

Suspicious print processor registered The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious Print System Remote Protocol usage by a process A host which is trusted for unconstrained delegation initiated an SMB connection to a DC using the Print System Remote Protocol. An attacker can abuse such sessions for relay attacks.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

BIOC

Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

Low

Platform Analytics

Registry

Privilege Escalation, Persistence

BIOC

Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

Medium

Platform Analytics

Registry

Privilege Escalation, Persistence

Analytics BIOC

Suspicious process accessed a site masquerading as Google A suspicious process accessed a site masquerading as Google.

Informational

Platform Analytics

XDR Agent

Command and Control, Defense Evasion

Analytics BIOC

Suspicious process accessed certificate files A suspicious process accessed certificate files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious process executed with a high integrity level A suspicious process was spawned with a High or System integrity level, which is higher than its parent process. This may indicate malicious privilege escalation.

Informational

Platform Analytics

XDR Agent

Privilege Escalation

Analytics BIOC

Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Suspicious process execution in a privileged container A process was executed in a privileged Kubernetes Pod for the first time in the past 30 days.

Informational

Platform Analytics

XDR Agent

Execution, Privilege Escalation

Analytics BIOC

Suspicious process loads a known PowerShell module A non-PowerShell process loaded a known PowerShell module. This image load may be an indication of PowerShell execution without directly invoking the PowerShell.exe binary.

Informational

Platform Analytics

XDR Agent

Execution

BIOC

Suspicious process loads AMSI DLL Amsi.dll is expected to be loaded from a few known processes (e.g. PowerShell). An image load from an unrelated LOLBIN may indicate PowerShell execution.

Informational

Platform Analytics

Module

Execution

Analytics BIOC

Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Suspicious Process Spawned by Adobe Reader Unusual process spawned by Adobe Reader with an uncommon command line.

Low

Platform Analytics

XDR Agent

Initial Access

Analytics BIOC

Suspicious Process Spawned by wininit.exe An unusual process was spawned by wininit.exe, possibly indicating malicious local or remote code execution.

Medium

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Suspicious process spawns MSBuild.exe The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Suspicious proxy environment variable setting Suspicious proxy environment variable change or definition with a rare command line.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics

Suspicious reconnaissance using LDAP A process executed multiple suspicious LDAP search queries. This may be indicative of LDAP enumeration.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious SaaS API call from a Tor exit node A SaaS API was called from a Tor exit node.

High

Identity Threat Detection (ITDR), SaaS Threat Detection

Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit

Command and Control

Analytics BIOC

Suspicious sAMAccountName change The name of a machine account was changed to a sAMAccountName with a missing trailing dollar sign.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

BIOC

Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.

Informational

Platform Analytics

File

Persistence

BIOC

Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.

Informational

Platform Analytics

File

Persistence

Analytics BIOC

Suspicious SearchProtocolHost.exe parent process SearchProtocolHost.exe has been launched from a process that is different from SearchIndexer.exe This may indicate malicious activity (such as malware later being injected to it, or it being used for phantom DLL hijacking).

Medium

Platform Analytics

XDR Agent

Execution, Defense Evasion

Analytics

Suspicious secrets dump activity An identity dumped multiple secrets from the project, considerably more than usual. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Credential Access, Collection

Analytics

Suspicious sender exhibiting automated sending patterns Multiple messages from a single sender were observed over a short period, all having the same subject and differing body content. This repetitive pattern may indicate automated or scripted behavior.

Informational

Email Security

Microsoft 365 Emails

Initial Access

Analytics

Suspicious sending domain with sender address randomization Multiple messages from a single sender domain were observed over a short period, each using a unique sender address. This per-message sender randomization is uncommon for legitimate senders and suggests automated behavior.

Informational

Email Security

Microsoft 365 Emails

Initial Access

Analytics BIOC

Suspicious setspn.exe execution A Service Principal Name (SPN) is a unique identifier for a service, mapped to a specific account. Setspn.exe can be used to retrieve SPN information, which may indicate an attacker's attempt to "Kerberoast".

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Suspicious SMB connection from domain controller A domain controller has initiated an SMB connection to another host. The domain controllers usually communicate over SMB only with other domain controllers. An attacker can abuse such sessions for relay attacks.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Suspicious SPF Result The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing.

Informational

Email Security

Microsoft 365 Emails

Defense Evasion

Analytics BIOC

Suspicious SSH Downgrade The endpoint asked for an ssh downgrade, ssh downgrade may enable attackers to perform attacks such as data decryption, man in the middle, session hijack, replay attack and more.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Lateral Movement, Defense Evasion