Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics	Machine Account NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that machine account NTLM authentication data has been relayed.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access, Lateral Movement
Analytics	Mailbox enumeration activity by Azure application Microsoft Graph API was used to enumerate mailboxes in Azure tenant.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Massive file activity abnormal to process A user generated massive file activity by size or distinct file count.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	Massive file compression by user Multiple archive files were created by a user. This might indicate an attempt to stage data before exfiltration.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	Massive file downloads from SaaS service A user downloaded a large volume of files from an organizational SaaS service, either exceeding the normal file count or size for the user's typical behavior.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit	Collection
Analytics	Massive files deletion in Box A user deleted a large amount of data in Box. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	Box Audit Log	Impact
Analytics	Massive files deletion in Dropbox A user deleted a large amount of data in Dropbox. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	DropBox	Impact
Analytics	Massive files deletion in Google Drive A user deleted a large amount of data in Google Drive. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	Google Workspace Audit Logs	Impact
Analytics	Massive files deletion in Microsoft SharePoint or OneDrive A user deleted a large amount of data in Microsoft SharePoint or OneDrive. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	Office 365 Audit	Impact
Analytics	Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent	Exfiltration
Analytics	Massive upload to SaaS service A user uploaded a large amount of data to an organizational cloud storage. This behavior may indicate that the data is being exfiltrated or staged.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit	Exfiltration, Collection
Analytics	Microsoft 365 storage services exfiltration activity The Microsoft Graph API was used to download Microsoft OneDrive and SharePoint files.	Low	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Collection
Analytics	Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.	Informational	Identity Analytics	XDR Agent	Credential Access, Privilege Escalation
Analytics	Microsoft OneDrive enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneDrive items.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Microsoft OneNote enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneNote items.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Microsoft SharePoint enumeration activity The Microsoft Graph API was used to enumerate Microsoft SharePoint sites in an Azure tenant.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Microsoft Teams enumeration activity The Microsoft Graph API was used to enumerate Microsoft Teams channels in an Azure tenant.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	ML artifacts destruction An identity deleted multiple ML artifacts.	Low	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Impact
Analytics	Multi region enumeration activity An internal identity performed an operation on multiple regions, considerably more than usual. This may indicate an attacker's attempt to identify all available resources in the cloud environment.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Discovery, Defense Evasion
Analytics	Multiple alerts associated with a single RDP connection Multiple alerts associated with a single RDP connection were triggered.	Informational	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Lateral Movement
Analytics	Multiple alerts of different MITRE tactics were seen Multiple alerts of different MITRE tactics were seen on the same host under the same causality.	Low	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Execution
Analytics	Multiple Azure AD admin role removals An Azure AD identity removed multiple administrators from their roles.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Impact
Analytics	Multiple cloud snapshots export A cloud identity has downloaded multiple virtual machines or DB snapshots locally.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Exfiltration
Analytics	Multiple discovery commands The alerted causality performed multiple discovery commands in a short timeframe.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery commands on a Windows host by the same process The alerted process performed multiple discovery commands in a short timeframe.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple failed AWS assume role attempts An AWS identity performed an unusual high number of failed assume role attempts.	Informational	Cortex Cloud	AWS Audit Log	Discovery, Privilege Escalation
Analytics	Multiple failed logins from a single IP Multiple failed logins were observed in a short period of time from a single external IP. The IP is not a known identity provider.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Initial Access
Analytics	Multiple network-related alerts of different MITRE tactics on the same host Multiple alerts of different MITRE tactics were seen on the same host.	Low	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Execution
Analytics	Multiple network-related alerts produced by different detectors on the same host Multiple alerts produced by different detectors were seen on the same host.	Low	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Execution
Analytics	Multiple Okta MFA requests sent to a user Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.	Informational	Identity Analytics	Okta	Credential Access, Resource Development
Analytics	Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.	Low	Identity Analytics	XDR Agent	Execution
Analytics	Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Execution
Analytics	Multiple risk indicators for a cloud identity Multiple risk indicators detected for a cloud identity, combining unusual activity with activity from unusual geolocation or high-risk IP.	High	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Initial Access
Analytics	Multiple Suspicious FTP Login Attempts Multiple suspicious FTP sessions were detected, which may indicate a brute-force attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Initial Access, Credential Access
Analytics	Multiple suspicious user accounts were created A user was observed creating multiple rare user accounts.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics	Multiple TGT requests for users without Kerberos pre-authentication Multiple TGT requests for users that do not require Kerberos pre-authentication were observed. This is typically a sign of an AS-REP attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	Multiple user accounts were deleted A user deleted multiple user accounts.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Impact
Analytics	Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics	Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	New Administrative Behavior The endpoint performed new administrative actions, relative to its previously profiled behavior. It is possible that an endpoint will infrequently be used for administrative activities, so analytics is performed using logs collected over a long period of time, also comparing the activity to that of other endpoints. That is, if many endpoints are contacting the same destination with the same administrative activity, then this network activity is less likely to result in this alert. An attacker may be operating on the host, probing other computers and moving laterally inside the network using a trusted computer and credentials. Attackers typically exhibit administrative behaviors when performing reconnaissance and lateral movement.	Medium	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics	New cloud identity created with administrative policy New cloud identity was created and assigned administrative policy.	Low	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Persistence
Analytics	New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics	NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Hash Harvesting An unusual number of users has sent NTLM to a target in the last hour. This may be indicative of poisoning and NTLM hash harvesting.	Medium	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.	Informational	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access, Lateral Movement
Analytics	Numerous emails sent by a single sender to multiple internal recipients Numerous emails were sent to multiple internal recipients. This may indicate spam or any other malicious attempt.	Informational	Email Security	Microsoft 365 Emails	Initial Access
Analytics	Okta account reset password attempt A user used a weak factor to reset their Okta password.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access
Analytics	Okta account unlock Okta user account was unlocked.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access
Analytics	Okta device assignment A device was assigned as an Okta MFA device to a user.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access, Persistence
Analytics	Okta Reported Threat Detected Okta Threat Insight Reported Threat Detected.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access
Analytics	Outlook files accessed by an unsigned process An attacker may use an uncommon and unsigned process to access Outlook data files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	Port Scan The endpoint connected, or attempted to connect, to multiple privileged ports, which are infrequently used by other endpoints (i.e. destination ports that are normally used by many endpoints will not raise this alert). Attackers perform port scans for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port scans using data arriving solely from Cortex agents is incomplete.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, Third-Party Firewalls	Discovery
Analytics	Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Discovery
Analytics	Possible AS-REP Roasting Attack A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.	Medium	Identity Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Possible Brute Force in universal authentication An abnormally high amount of authentication attempts via universal authentication were seen within a short period of time. This may indicate a brute-force attack.	Informational	Identity Analytics		Credential Access, Resource Development
Analytics	Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.	Informational	Platform Analytics	XDR Agent	Credential Access
Analytics	Possible brute force or configuration change attempt on cytool An unusual amount of cytool commands were executed in a short period from a user who doesn't usually run these commands. This may indicate an attempt to guess the Administrator password.	High	Platform Analytics	XDR Agent	Credential Access
Analytics	Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access, Lateral Movement
Analytics	Possible ConsentFix - OAuth Token Theft Detected Detection of potential OAuth token theft via a forced 'localhost' redirect and first-party app abuse. This indicates an attacker has likely bypassed MFA to hijack a user's cloud session.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD	Initial Access, Credential Access, Execution
Analytics	Possible data exfiltration over a USB storage device A process generated massive file creation, renaming and write activity to a USB storage device.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration
Analytics	Possible external RDP Brute-Force Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.	Low	Identity Analytics	XDR Agent	Credential Access
Analytics	Possible Impossible Travel Pattern - SSO A user logged in from several countries in a short period, including at least one location that is rare for the user or organization. This suspicious activity may be a sign of credential theft.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access, Resource Development
Analytics	Possible Insider Threat Activity A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain.	Low	Identity Threat Detection (ITDR)	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Impact
Analytics	Possible internal data exfiltration over a USB storage device A user generated abnormal massive file activity to a connected USB storage device.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration
Analytics	Possible Kerberoasting attack A user enumerated all service principals in the organization and specifically requested weak and deprecated encryption in a ticket request. This is typically a sign of a Kerberoasting attack.	Medium	Identity Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Possible Kerberos User Enumeration Multiple Kerberos TGT requests with KDC_ERR_C_PRINCIPAL_UNKNOWN errors were generated on different users in the last 10 minutes which may indicate Kerberos user enumeration.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics	Possible LDAP enumeration by unsigned process An unsigned process performed multiple different LDAP search queries. This may be indicative of LDAP enumeration.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics	Possible multistage attack in Microsoft Teams Possible multistage attack in Microsoft Teams.	Low	Identity Threat Detection (ITDR)	Office 365 Audit	Initial Access
Analytics	Possible Password Spray in universal authentication An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack.	Informational	Identity Analytics		Credential Access, Resource Development
Analytics	Possible phishing attack via Microsoft Teams An external tenant is possibly attempting a phishing attack via Microsoft Teams.	Low	Identity Threat Detection (ITDR)	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access
Analytics	Possible Privilege Escalation using Delegated MSA account An attacker might abuse dMSA account to escalate its privileges.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation
Analytics	Possible TGT reuse from different hosts (pass the ticket) We observed two different hosts sending TGS using the same TGT. This may indicate a TGT was stolen and passed to another host.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics	Potential denial of wallet abusing AI services An ML model experienced a sudden spike in requests in a short time. MITRE ATLAS Techniques: AML.T0029 - Denial of ML Service, AML.T0034 - Cost Harvesting. OWASP Top 10 LLM Technique: LLM10 - Unbounded Consumption.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics	Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.	Low	Identity Analytics	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Defense Evasion
Analytics	Potential kubelet impersonation attempt A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Potential NTLM Relay Attack Multiple NTLM authentications were made to the same workstation and user from different IPs. This might indicate a potential NTLM Relay attack.	Informational	Identity Analytics	XDR Agent	Credential Access, Lateral Movement
Analytics	Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs in a short period of time. This might indicate a potential NTLM Relay attack.	Informational	Identity Analytics	XDR Agent	Credential Access, Lateral Movement
Analytics	Potential Phishing has been detected This email contains multiple indicators consistent with a phishing attack. The message likely attempts to steal credentials, distribute malware, or trick recipients into performing actions that compromise security through deceptive content or suspicious technical characteristics.	Medium	Email Security	Box Audit Log, DropBox, Google Workspace Audit Logs, Microsoft 365 Emails, Office 365 Audit, Okta Audit Log	Initial Access
Analytics	Random-Looking Domain Names The endpoint performed DNS lookups to an excessively large number of apparently random root domain names. This alert might be symptomatic of malware that is trying to connect to its command and control (C2) servers. The attacker's C2 server runs on one or more domains that can eventually be identified and blacklisted. To avoid this, malware will sometimes use Domain Generation Algorithms (DGA) that produce many unique, random-looking domain names every day. Because only a few of these domains are ever registered, the installed malware must blindly try to access each generated domain name in an effort to locate an active one, which may also trigger the Failed DNS alert.	Medium	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control
Analytics	Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Persistence
Analytics	Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Discovery
Analytics	Remote account enumeration Multiple non-existing accounts failed to remotely log in to a host in a short period of time. This may indicate an attacker is trying to remotely enumerate accounts.	Informational	Identity Analytics	XDR Agent	Discovery, Credential Access
Analytics	SCCM log files enumeration Multiple local SCCM logs were accessed within a short period of time.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics	Sensitive Exchange mail sent to external users A user sent sensitive email messages to external users.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Collection, Exfiltration
Analytics	Short-lived Azure AD user account An Azure AD user was created and deleted within a short period of time.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Defense Evasion
Analytics	Short-lived user account A user was created and deleted within a short period of time.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics	Single account excessively locked out A user has been locked out an unusually high number of times within a short timeframe. This could indicate an attempt to gain unauthorized access to the user's account.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Impact
Analytics	SSH authentication brute force attempts A user attempted to authenticate via SSH an excessive number of times in a short period. This may indicate a brute force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	SSO Brute Force An abnormally high amount of SSO authentication attempts were seen within a short period of time. This may have resulted from a brute-force attack.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics	SSO Password Spray An abnormally high amount of SSO authentication attempts were seen within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics	Storage enumeration activity An identity attempted to discover cloud objects within storage buckets. This might be an attempt by an adversary to find sensitive data stored in cloud storage, which could lead to data theft.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Discovery
Analytics	Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics	Sudden spike in outbound email volume Unusual amount of emails sent by an internal sender to one or more external recipients within a short timeframe.	Informational	Email Security	Microsoft 365 Emails	Execution, Credential Access

Analytics

Machine Account NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that machine account NTLM authentication data has been relayed.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access, Lateral Movement

Analytics

Mailbox enumeration activity by Azure application Microsoft Graph API was used to enumerate mailboxes in Azure tenant.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Massive file activity abnormal to process A user generated massive file activity by size or distinct file count.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

Massive file compression by user Multiple archive files were created by a user. This might indicate an attempt to stage data before exfiltration.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

Massive file downloads from SaaS service A user downloaded a large volume of files from an organizational SaaS service, either exceeding the normal file count or size for the user's typical behavior.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit

Collection

Analytics

Massive files deletion in Box A user deleted a large amount of data in Box. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

Box Audit Log

Impact

Analytics

Massive files deletion in Dropbox A user deleted a large amount of data in Dropbox. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

DropBox

Impact

Analytics

Massive files deletion in Google Drive A user deleted a large amount of data in Google Drive. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

Google Workspace Audit Logs

Impact

Analytics

Massive files deletion in Microsoft SharePoint or OneDrive A user deleted a large amount of data in Microsoft SharePoint or OneDrive. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

Office 365 Audit

Impact

Analytics

Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent

Exfiltration

Analytics

Massive upload to SaaS service A user uploaded a large amount of data to an organizational cloud storage. This behavior may indicate that the data is being exfiltrated or staged.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit

Exfiltration, Collection

Analytics

Microsoft 365 storage services exfiltration activity The Microsoft Graph API was used to download Microsoft OneDrive and SharePoint files.

Low

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Collection

Analytics

Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.

Informational

Identity Analytics

XDR Agent

Credential Access, Privilege Escalation

Analytics

Microsoft OneDrive enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneDrive items.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Microsoft OneNote enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneNote items.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Microsoft SharePoint enumeration activity The Microsoft Graph API was used to enumerate Microsoft SharePoint sites in an Azure tenant.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Microsoft Teams enumeration activity The Microsoft Graph API was used to enumerate Microsoft Teams channels in an Azure tenant.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

ML artifacts destruction An identity deleted multiple ML artifacts.

Low

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Impact

Analytics

Multi region enumeration activity An internal identity performed an operation on multiple regions, considerably more than usual. This may indicate an attacker's attempt to identify all available resources in the cloud environment.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Discovery, Defense Evasion

Analytics

Multiple alerts associated with a single RDP connection Multiple alerts associated with a single RDP connection were triggered.

Informational

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Lateral Movement

Analytics

Multiple alerts of different MITRE tactics were seen Multiple alerts of different MITRE tactics were seen on the same host under the same causality.

Low

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Execution

Analytics

Multiple Azure AD admin role removals An Azure AD identity removed multiple administrators from their roles.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Impact

Analytics

Multiple cloud snapshots export A cloud identity has downloaded multiple virtual machines or DB snapshots locally.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Exfiltration

Analytics

Multiple discovery commands The alerted causality performed multiple discovery commands in a short timeframe.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery commands on a Windows host by the same process The alerted process performed multiple discovery commands in a short timeframe.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple failed AWS assume role attempts An AWS identity performed an unusual high number of failed assume role attempts.

Informational

Cortex Cloud

AWS Audit Log

Discovery, Privilege Escalation

Analytics

Multiple failed logins from a single IP Multiple failed logins were observed in a short period of time from a single external IP. The IP is not a known identity provider.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Initial Access

Analytics

Multiple network-related alerts of different MITRE tactics on the same host Multiple alerts of different MITRE tactics were seen on the same host.

Low

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Execution

Analytics

Multiple network-related alerts produced by different detectors on the same host Multiple alerts produced by different detectors were seen on the same host.

Low

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Execution

Analytics

Multiple Okta MFA requests sent to a user Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.

Informational

Identity Analytics

Okta

Credential Access, Resource Development

Analytics

Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account.

Low

Identity Analytics

XDR Agent

Execution

Analytics

Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Execution

Analytics

Multiple risk indicators for a cloud identity Multiple risk indicators detected for a cloud identity, combining unusual activity with activity from unusual geolocation or high-risk IP.

High

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Initial Access

Analytics

Multiple Suspicious FTP Login Attempts Multiple suspicious FTP sessions were detected, which may indicate a brute-force attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Initial Access, Credential Access

Analytics

Multiple suspicious user accounts were created A user was observed creating multiple rare user accounts.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics

Multiple TGT requests for users without Kerberos pre-authentication Multiple TGT requests for users that do not require Kerberos pre-authentication were observed. This is typically a sign of an AS-REP attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Multiple user accounts failed login due to account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

Multiple user accounts were deleted A user deleted multiple user accounts.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Impact

Analytics

Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics

Multiple Weakly-Encrypted Kerberos Tickets Received A user accessed a number of services associated with user accounts in the 10 minutes leading to the alert, generating a number of weakly encrypted Kerberos TGS (ticket granting service) tickets that is significantly larger than the number of weakly encrypted TGS tickets received by that user in the 30 days leading to the alert. Services associated with user accounts are a common target for Kerberoasting due to default weak encryption.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

New Administrative Behavior The endpoint performed new administrative actions, relative to its previously profiled behavior. It is possible that an endpoint will infrequently be used for administrative activities, so analytics is performed using logs collected over a long period of time, also comparing the activity to that of other endpoints. That is, if many endpoints are contacting the same destination with the same administrative activity, then this network activity is less likely to result in this alert. An attacker may be operating on the host, probing other computers and moving laterally inside the network using a trusted computer and credentials. Attackers typically exhibit administrative behaviors when performing reconnaissance and lateral movement.

Medium

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics

New cloud identity created with administrative policy New cloud identity was created and assigned administrative policy.

Low

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Persistence

Analytics

New Shared User Account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics

NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Brute Force on a Service Account A service account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate a NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Brute Force on an Administrator Account An administrator account attempted to authenticate using NTLM to a target an excessive number of times in a short period. This may indicate an NTLM brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Hash Harvesting An unusual number of users has sent NTLM to a target in the last hour. This may be indicative of poisoning and NTLM hash harvesting.

Medium

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.

Informational

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access, Lateral Movement

Analytics

Numerous emails sent by a single sender to multiple internal recipients Numerous emails were sent to multiple internal recipients. This may indicate spam or any other malicious attempt.

Informational

Email Security

Microsoft 365 Emails

Initial Access

Analytics

Okta account reset password attempt A user used a weak factor to reset their Okta password.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access

Analytics

Okta account unlock Okta user account was unlocked.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access

Analytics

Okta device assignment A device was assigned as an Okta MFA device to a user.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access, Persistence

Analytics

Okta Reported Threat Detected Okta Threat Insight Reported Threat Detected.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access

Analytics

Outlook files accessed by an unsigned process An attacker may use an uncommon and unsigned process to access Outlook data files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

Port Scan The endpoint connected, or attempted to connect, to multiple privileged ports, which are infrequently used by other endpoints (i.e. destination ports that are normally used by many endpoints will not raise this alert). Attackers perform port scans for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port scans using data arriving solely from Cortex agents is incomplete.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, Third-Party Firewalls

Discovery

Analytics

Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Discovery

Analytics

Possible AS-REP Roasting Attack A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.

Medium

Identity Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Possible Brute Force in universal authentication An abnormally high amount of authentication attempts via universal authentication were seen within a short period of time. This may indicate a brute-force attack.

Informational

Identity Analytics

Credential Access, Resource Development

Analytics

Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.

Informational

Platform Analytics

XDR Agent

Credential Access

Analytics

Possible brute force or configuration change attempt on cytool An unusual amount of cytool commands were executed in a short period from a user who doesn't usually run these commands. This may indicate an attempt to guess the Administrator password.

High

Platform Analytics

XDR Agent

Credential Access

Analytics

Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access, Lateral Movement

Analytics

Possible ConsentFix - OAuth Token Theft Detected Detection of potential OAuth token theft via a forced 'localhost' redirect and first-party app abuse. This indicates an attacker has likely bypassed MFA to hijack a user's cloud session.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD

Initial Access, Credential Access, Execution

Analytics

Possible data exfiltration over a USB storage device A process generated massive file creation, renaming and write activity to a USB storage device.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration

Analytics

Possible external RDP Brute-Force Multiple failed remote logins originated from an external IP with at least one successful login. This may indicate a successful brute-force attack.

Low

Identity Analytics

XDR Agent

Credential Access

Analytics

Possible Impossible Travel Pattern - SSO A user logged in from several countries in a short period, including at least one location that is rare for the user or organization. This suspicious activity may be a sign of credential theft.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access, Resource Development

Analytics

Possible Insider Threat Activity A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain.

Low

Identity Threat Detection (ITDR)

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Impact

Analytics

Possible internal data exfiltration over a USB storage device A user generated abnormal massive file activity to a connected USB storage device.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration

Analytics

Possible Kerberoasting attack A user enumerated all service principals in the organization and specifically requested weak and deprecated encryption in a ticket request. This is typically a sign of a Kerberoasting attack.

Medium

Identity Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Possible Kerberos User Enumeration Multiple Kerberos TGT requests with KDC_ERR_C_PRINCIPAL_UNKNOWN errors were generated on different users in the last 10 minutes which may indicate Kerberos user enumeration.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics

Possible LDAP enumeration by unsigned process An unsigned process performed multiple different LDAP search queries. This may be indicative of LDAP enumeration.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics

Possible multistage attack in Microsoft Teams Possible multistage attack in Microsoft Teams.

Low

Identity Threat Detection (ITDR)

Office 365 Audit

Initial Access

Analytics

Possible Password Spray in universal authentication An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack.

Informational

Identity Analytics

Credential Access, Resource Development

Analytics

Possible phishing attack via Microsoft Teams An external tenant is possibly attempting a phishing attack via Microsoft Teams.

Low

Identity Threat Detection (ITDR)

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access

Analytics

Possible Privilege Escalation using Delegated MSA account An attacker might abuse dMSA account to escalate its privileges.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation

Analytics

Possible TGT reuse from different hosts (pass the ticket) We observed two different hosts sending TGS using the same TGT. This may indicate a TGT was stolen and passed to another host.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics

Potential denial of wallet abusing AI services An ML model experienced a sudden spike in requests in a short time. MITRE ATLAS Techniques: AML.T0029 - Denial of ML Service, AML.T0034 - Cost Harvesting. OWASP Top 10 LLM Technique: LLM10 - Unbounded Consumption.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics

Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.

Low

Identity Analytics

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Defense Evasion

Analytics

Potential kubelet impersonation attempt A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Potential NTLM Relay Attack Multiple NTLM authentications were made to the same workstation and user from different IPs. This might indicate a potential NTLM Relay attack.

Informational

Identity Analytics

XDR Agent

Credential Access, Lateral Movement

Analytics

Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server Multiple NTLM authentications were made to the same Microsoft Configuration Manager site server and user from different IPs in a short period of time. This might indicate a potential NTLM Relay attack.

Informational

Identity Analytics

XDR Agent

Credential Access, Lateral Movement

Analytics

Potential Phishing has been detected This email contains multiple indicators consistent with a phishing attack. The message likely attempts to steal credentials, distribute malware, or trick recipients into performing actions that compromise security through deceptive content or suspicious technical characteristics.

Medium

Email Security

Box Audit Log, DropBox, Google Workspace Audit Logs, Microsoft 365 Emails, Office 365 Audit, Okta Audit Log

Initial Access

Analytics

Random-Looking Domain Names The endpoint performed DNS lookups to an excessively large number of apparently random root domain names. This alert might be symptomatic of malware that is trying to connect to its command and control (C2) servers. The attacker's C2 server runs on one or more domains that can eventually be identified and blacklisted. To avoid this, malware will sometimes use Domain Generation Algorithms (DGA) that produce many unique, random-looking domain names every day. Because only a few of these domains are ever registered, the installed malware must blindly try to access each generated domain name in an effort to locate an active one, which may also trigger the Failed DNS alert.

Medium

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control

Analytics

Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Persistence

Analytics

Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Discovery

Analytics

Remote account enumeration Multiple non-existing accounts failed to remotely log in to a host in a short period of time. This may indicate an attacker is trying to remotely enumerate accounts.

Informational

Identity Analytics

XDR Agent

Discovery, Credential Access

Analytics

SCCM log files enumeration Multiple local SCCM logs were accessed within a short period of time.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics

Sensitive Exchange mail sent to external users A user sent sensitive email messages to external users.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Collection, Exfiltration

Analytics

Short-lived Azure AD user account An Azure AD user was created and deleted within a short period of time.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Defense Evasion

Analytics

Short-lived user account A user was created and deleted within a short period of time.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics

Single account excessively locked out A user has been locked out an unusually high number of times within a short timeframe. This could indicate an attempt to gain unauthorized access to the user's account.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Impact

Analytics

SSH authentication brute force attempts A user attempted to authenticate via SSH an excessive number of times in a short period. This may indicate a brute force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

SSO Brute Force An abnormally high amount of SSO authentication attempts were seen within a short period of time. This may have resulted from a brute-force attack.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics

SSO Password Spray An abnormally high amount of SSO authentication attempts were seen within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics

Storage enumeration activity An identity attempted to discover cloud objects within storage buckets. This might be an attempt by an adversary to find sensitive data stored in cloud storage, which could lead to data theft.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Discovery

Analytics

Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics

Sudden spike in outbound email volume Unusual amount of emails sent by an internal sender to one or more external recipients within a short timeframe.

Informational

Email Security

Microsoft 365 Emails

Execution, Credential Access