Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A user added a Windows firewall rule A user added a new Windows Firewall rule. Adding a firewall rule may indicate an attempt to bypass controls limiting network usage or to disrupt network communications.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	A user attempted to bypass Okta MFA A user may have attempted to bypass Okta MFA.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Credential Access
Analytics BIOC	A user certificate was issued with a mismatch A certificate was issued to a user who was not the requester, this may indicate a certificate manipulation.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation, Credential Access
Analytics BIOC	A user changed the Windows system time A user changed the Windows system time. This may be indicative of a malicious activity and may affect authentication from the source machine.	Informational	Identity Threat Detection (ITDR)	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	A user connected a new USB storage device to a host A user connected a new USB storage device that was not seen for this user and host in the last 30 days.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration
Analytics BIOC	A user connected a USB storage device for the first time A user connected a USB storage device for the first time in the past 30 days.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration
Analytics BIOC	A user connected from a new country A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics BIOC	A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Credential Access, Resource Development
Analytics BIOC	A user created a pfx file for the first time A user created a pfx file for the first time.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	A user created an abnormal password-protected archive A user created an abnormal password-protected archive using an archive program.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics BIOC	A user enabled a default local account A user enabled a default local account. Enabling a default account may pose a security risk, as they are often exploited by attackers.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access, Persistence
Analytics BIOC	A user logged in at an unusual time via SSO A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne	Defense Evasion
Analytics BIOC	A user logged in at an unusual time via VPN A user connected to a VPN on a day and hour, which is unusual for this user. This may indicate that the account was compromised.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Defense Evasion
Analytics BIOC	A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.	Informational	Identity Analytics	XDR Agent	Credential Access, Resource Development
Analytics BIOC	A user logged in to the AWS console for the first time A user logged in to the AWS console for the first time.	Informational	Cortex Cloud	AWS Audit Log	Initial Access, Persistence, Lateral Movement
Analytics BIOC	A user modified an Okta MFA factor An Okta MFA factor was modified by a user, suggesting a potential compromise of the account.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Credential Access, Persistence
Analytics BIOC	A user modified an Okta network zone An Okta network zone was modified by a user.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Defense Evasion
Analytics BIOC	A user modified an Okta policy rule An Okta policy rule was modified by a user, suggesting a potential compromise of the account.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Defense Evasion, Persistence
Analytics BIOC	A user modified the CA audit policy A user modified the CA audit policy. This may indicate that an attacker is attempting to cover their tracks before an AD CS attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	A user queried AD CS objects via LDAP A user queried AD CS objects via LDAP.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics BIOC	A user was added to a Windows security group A user was added to a Windows security group.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	A WMI subscriber was created A WMI subscriber was created.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Abnormal Communication to a Rare Domain An abnormal communication was seen from an internal entity to a rare domain.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Abnormal communication with a rare combination of TLS and HTTP User Agent Abnormal communication with a rare combination of TLS and HTTP User Agent to an external address.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Abnormal network communication through TOR using an uncommon port Suspicious connection from a known TOR IP to an uncommon port.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server to an external address.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Abnormal process connection to default Meterpreter port This process has probably been compromised by Meterpreter and is now used by it to run malicious commands.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Abnormal RDP session to a remote host from a rarely seen host The endpoint performed a rare RDP session to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Abnormal Recurring Communications to a Rare Domain Abnormal communications were seen from an internal entity to a rare external domain. This could be a case of beaconing to a C2 Server.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.	Informational	Identity Analytics	XDR Agent	Lateral Movement, Privilege Escalation
Analytics BIOC	Access to kubelet credentials file A process accessed a kubelet credentials file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Access to Kubernetes CA certificate file A process accessed a Kubernetes CA certificate file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Access to Kubernetes configuration file A process accessed a Kubernetes node configuration file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Access to sensitive host files from within a Kubernetes pod A process accessed sensitive host files inside a Kubernetes pod, indicating a potential container escape or privilege escalation attempt.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation
Analytics BIOC	Adding execution privileges A script was granted execution privileges using chmod before being run.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	ADFS DKM Key Access ADFS DKM key attribute (thumbnailphoto) access in AD container, potential Golden SAML token forging attempt.	Low	Identity Threat Detection (ITDR)	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Admin privileges were granted to a Google Workspace user Admin privileges were granted to a Google Workspace user. This user now has access to additional administrative functions and settings.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Privilege Escalation
Analytics BIOC	Administrator groups enumerated via LDAP An LDAP search query that collects information about administrators was executed. This may be indicative of Active Directory domain enumeration, which can be used to perform attacks against the organization.	Informational	Platform Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	AI safeguards deletion attempt A cloud identity deleted AI safeguards. MITRE ATLAS Technique: AML.T0015 - Evade ML Model.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log	Defense Evasion
Analytics BIOC	AI safeguards were modified A cloud identity modified AI safeguards. MITRE ATLAS Technique: AML.T0015 - Evade ML Model.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log	Defense Evasion
Analytics BIOC	An app was added to Google Marketplace An app was added to the Google Workspace Marketplace.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Command and Control
Analytics BIOC	An app was added to the Google Workspace trusted OAuth apps list An identity added an OAuth app to the Google Workspace trusted OAuth apps list.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Defense Evasion
Analytics BIOC	An app was removed from a blocked list in Google Workspace An identity removed an app from Google Workspace blocked OAuth or third-party apps list.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Defense Evasion
Analytics BIOC	An AWS database service master user password was changed An AWS database service master user password was changed.	Informational	Cortex Cloud	AWS Audit Log	Persistence
Analytics BIOC	An AWS EC2 instance containing sensitive data was exported A EC2 instance was exported to an S3 bucket. The instance was found to contain sensitive data.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An AWS EC2 instance was exported from a production account An EC2 instance was exported from a production account to an S3 bucket.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An AWS EC2 instance was exported into an unknown S3 bucket An EC2 instance was exported to an unknown S3 bucket.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An AWS EFS File-share mount was deleted An AWS EFS File-share mount was deleted.	Informational	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	An AWS EFS file-share was deleted An AWS EFS File-share has been deleted.	Informational	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	An AWS EKS cluster was created or deleted An AWS EKS cluster has been created or deleted.	Informational	Cortex Cloud	AWS Audit Log	Initial Access, Impact
Analytics BIOC	An AWS GuardDuty IP set was created An AWS GuardDuty IP set has been created.	Informational	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	An AWS Lambda Function was created An AWS Lambda Function was created.	Informational	Cortex Cloud	AWS Audit Log	Execution, Persistence
Analytics BIOC	An AWS Lambda function was modified An AWS Lambda function was modified.	Informational	Cortex Cloud	AWS Audit Log	Execution
Analytics BIOC	An AWS RDS Global Cluster Deletion An AWS RDS global cluster was deleted.	Informational	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	An AWS RDS instance was created from a snapshot A new AWS RDS instance was created from a publicly available RDS snapshot.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An AWS Route 53 domain was transferred to another AWS account An AWS Route 53 domain was transferred to another AWS account.	Informational	Cortex Cloud	AWS Audit Log	Resource Development
Analytics BIOC	An AWS S3 bucket configuration was modified An AWS S3 bucket configuration has been modified.	Informational	Cortex Cloud	AWS Audit Log	Defense Evasion, Impact
Analytics BIOC	An AWS SAML provider was modified An AWS SAML provider was modified.	Informational	Cortex Cloud	AWS Audit Log	Initial Access, Defense Evasion
Analytics BIOC	An AWS SES identity was deleted An AWS SES identity has been deleted.	Informational	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	An Azure application reached a throttling API rate An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics BIOC	An Azure DNS Zone was modified An Azure DNS zone has been changed or removed, which may indicate malicious activity or a misconfiguration.	Informational	Cortex Cloud	Azure Audit Log	Command and Control
Analytics BIOC	An Azure Firewall policy deletion An Azure Firewall policy was deleted. An attacker might use this technique to disable network defenses.	Low	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An Azure Firewall rule collection group was modified or deleted An Azure Firewall rule collection group was modified or deleted. This could indicate a malicious actor attempting to bypass security measures.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An Azure firewall rule group was modified An Azure firewall rule group was modified or deleted.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An Azure Firewall was modified An Azure Firewall was modified or deleted. This may indicate a security risk.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An Azure Key Vault key was modified An Azure Key Vault key was modified.	Informational	Cortex Cloud	Azure Audit Log	Credential Access
Analytics BIOC	An Azure Key Vault was modified Azure Key Vault has been modified or deleted by an Identity. This could be an indication of unauthorized access or malicious activity.	Informational	Cortex Cloud	Azure Audit Log	Credential Access
Analytics BIOC	An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Cluster was created or deleted.	Informational	Cortex Cloud	Azure Audit Log	Impact
Analytics BIOC	An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role or Cluster-Role was modified or deleted. This could indicate malicious activity and should be investigated.	Informational	Cortex Cloud	Azure Audit Log	Privilege Escalation
Analytics BIOC	An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted. This could indicate a security breach or malicious activity.	Informational	Cortex Cloud	Azure Audit Log	Privilege Escalation
Analytics BIOC	An Azure Kubernetes Service Account was modified or deleted An Azure Kubernetes Service Account was modified or deleted.	Informational	Cortex Cloud	Azure Audit Log	Impact
Analytics BIOC	An Azure Network Security Group was modified An Azure Network Security Group was modified or deleted. This could indicate malicious activity or a misconfiguration.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An Azure Point-to-Site VPN was modified An Azure Point-to-Site VPN was modified or deleted.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An Azure SQL database was exported from a production subscription An Azure SQL database export was initiated. The database was exported from a production subscription.	Informational	Cortex Cloud	Azure Audit Log	Exfiltration
Analytics BIOC	An Azure Suppression Rule was created An Azure Suppression Rule was created.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An Azure virtual network Device was modified An Azure virtual network Device was modified or deleted.	Informational	Cortex Cloud	Azure Audit Log	Impact
Analytics BIOC	An Azure virtual network was modified An Azure virtual network has been modified or deleted.	Informational	Cortex Cloud	Azure Audit Log	Impact
Analytics BIOC	An Azure VM snapshot SAS URL was generated An identity generated a SAS URL for an Azure VM snapshot. SAS URLs allow others to download or export the snapshot.	Informational	Cortex Cloud	Azure Audit Log	Exfiltration
Analytics BIOC	An Azure VM snapshot SAS URL was generated for export from a production subscription A SAS URL for an Azure VM snapshot was generated. The operation was performed within a production subscription. SAS URLs allow others to download or export the snapshot.	Informational	Cortex Cloud	Azure Audit Log	Exfiltration
Analytics BIOC	An Azure VPN Connection was modified Modification or removal of an Azure VPN connection was detected. This alert indicates a change to an existing VPN connection or the deletion of an existing connection.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	An EBS snapshot block was downloaded An EBS snapshot block was downloaded using the EBS direct API. This may indicate an attacker's attempt to exfiltrate data from a volume snapshot in the cloud environment.	Informational	Cortex Cloud	AWS Audit Log	Collection, Exfiltration
Analytics BIOC	An Email address was added to AWS SES An Email address was added to AWS SES.	Informational	Cortex Cloud	AWS Audit Log	Persistence
Analytics BIOC	An IAM group was created An IAM group was created.	Informational	Cortex Cloud	AWS Audit Log	Persistence
Analytics BIOC	An identity accessed a backup cloud storage An identity accessed a backup cloud storage.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection, Exfiltration
Analytics BIOC	An identity accessed a cloud storage for the first time An identity accessed a cloud storage resource for the first time.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection, Exfiltration
Analytics BIOC	An identity accessed Azure Kubernetes Secrets An identity has accessed or attempted to access Azure Kubernetes secrets or Config Objects.	Informational	Cortex Cloud	Azure Audit Log	Credential Access
Analytics BIOC	An identity attached an administrative policy to an IAM user or role An identity attached an administrative policy to an IAM user or role.	Informational	Cortex Cloud	AWS Audit Log	Privilege Escalation, Persistence
Analytics BIOC	An identity created or updated password for an IAM user An identity created or updated an AWS console password for an IAM user.	Informational	Cortex Cloud	AWS Audit Log	Privilege Escalation, Persistence
Analytics BIOC	An identity disabled bucket logging An identity disabled bucket logging.	Informational	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	An identity started an AWS SSM session An identity started an AWS SSM interactive session.	Informational	Cortex Cloud	AWS Audit Log	Lateral Movement
Analytics BIOC	An identity was granted permissions to manage user access to Azure resources An identity was granted the User Access Administrator permission at the tenant scope.	Informational	Cortex Cloud	Azure Audit Log	Privilege Escalation
Analytics BIOC	An inactive user attempted to authenticate A user with no activity in the past 30 days with the target, attempted to authenticate via universal authentication.	Informational	Identity Analytics		Initial Access
Analytics BIOC	An operation was performed by an identity from a domain that was not seen in the organization An operation was performed by an identity. This identity belongs to a domain that was not seen in the organization before.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Initial Access
Analytics BIOC	An RDS snapshot containing sensitive data was exported An RDS snapshot containing sensitive data was exported to an S3 bucket.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An RDS snapshot was exported from a production account An RDS snapshot was exported from a production account to an S3 bucket.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An RDS snapshot was exported to an unknown bucket An RDS snapshot was exported to an unknown S3 bucket. The destination bucket has not been seen in your tenant in the last 30 days.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An RDS snapshot was exported to an unknown S3 bucket An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.	Low	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An S3 replication policy to an unknown bucket was created An S3 replication policy was added to an S3 bucket. The referenced destination bucket was not seen in your tenant in the last 30 days.	Low	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An uncommon executable was remotely written over SMB to an uncommon destination An uncommon executable was remotely written over SMB to a destination, which was not involved in significant similar activity during last month.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics BIOC	An uncommon file added to startup-related Registry keys An attacker may add a file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence

Analytics BIOC

A user added a Windows firewall rule A user added a new Windows Firewall rule. Adding a firewall rule may indicate an attempt to bypass controls limiting network usage or to disrupt network communications.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

A user attempted to bypass Okta MFA A user may have attempted to bypass Okta MFA.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Credential Access

Analytics BIOC

A user certificate was issued with a mismatch A certificate was issued to a user who was not the requester, this may indicate a certificate manipulation.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation, Credential Access

Analytics BIOC

A user changed the Windows system time A user changed the Windows system time. This may be indicative of a malicious activity and may affect authentication from the source machine.

Informational

Identity Threat Detection (ITDR)

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

A user connected a new USB storage device to a host A user connected a new USB storage device that was not seen for this user and host in the last 30 days.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration

Analytics BIOC

A user connected a USB storage device for the first time A user connected a USB storage device for the first time in the past 30 days.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration

Analytics BIOC

A user connected from a new country A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics BIOC

A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Credential Access, Resource Development

Analytics BIOC

A user created a pfx file for the first time A user created a pfx file for the first time.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

A user created an abnormal password-protected archive A user created an abnormal password-protected archive using an archive program.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics BIOC

A user enabled a default local account A user enabled a default local account. Enabling a default account may pose a security risk, as they are often exploited by attackers.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access, Persistence

Analytics BIOC

A user logged in at an unusual time via SSO A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne

Defense Evasion

Analytics BIOC

A user logged in at an unusual time via VPN A user connected to a VPN on a day and hour, which is unusual for this user. This may indicate that the account was compromised.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Defense Evasion

Analytics BIOC

A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.

Informational

Identity Analytics

XDR Agent

Credential Access, Resource Development

Analytics BIOC

A user logged in to the AWS console for the first time A user logged in to the AWS console for the first time.

Informational

Cortex Cloud

AWS Audit Log

Initial Access, Persistence, Lateral Movement

Analytics BIOC

A user modified an Okta MFA factor An Okta MFA factor was modified by a user, suggesting a potential compromise of the account.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Credential Access, Persistence

Analytics BIOC

A user modified an Okta network zone An Okta network zone was modified by a user.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Defense Evasion

Analytics BIOC

A user modified an Okta policy rule An Okta policy rule was modified by a user, suggesting a potential compromise of the account.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Defense Evasion, Persistence

Analytics BIOC

A user modified the CA audit policy A user modified the CA audit policy. This may indicate that an attacker is attempting to cover their tracks before an AD CS attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

A user queried AD CS objects via LDAP A user queried AD CS objects via LDAP.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics BIOC

A user was added to a Windows security group A user was added to a Windows security group.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

A WMI subscriber was created A WMI subscriber was created.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Abnormal Communication to a Rare Domain An abnormal communication was seen from an internal entity to a rare domain.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Abnormal communication with a rare combination of TLS and HTTP User Agent Abnormal communication with a rare combination of TLS and HTTP User Agent to an external address.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Abnormal network communication through TOR using an uncommon port Suspicious connection from a known TOR IP to an uncommon port.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server to an external address.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Abnormal process connection to default Meterpreter port This process has probably been compromised by Meterpreter and is now used by it to run malicious commands.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Abnormal RDP session to a remote host from a rarely seen host The endpoint performed a rare RDP session to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Abnormal Recurring Communications to a Rare Domain Abnormal communications were seen from an internal entity to a rare external domain. This could be a case of beaconing to a C2 Server.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.

Informational

Identity Analytics

XDR Agent

Lateral Movement, Privilege Escalation

Analytics BIOC

Access to kubelet credentials file A process accessed a kubelet credentials file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Access to Kubernetes CA certificate file A process accessed a Kubernetes CA certificate file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Access to Kubernetes configuration file A process accessed a Kubernetes node configuration file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Access to sensitive host files from within a Kubernetes pod A process accessed sensitive host files inside a Kubernetes pod, indicating a potential container escape or privilege escalation attempt.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation

Analytics BIOC

Adding execution privileges A script was granted execution privileges using chmod before being run.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

ADFS DKM Key Access ADFS DKM key attribute (thumbnailphoto) access in AD container, potential Golden SAML token forging attempt.

Low

Identity Threat Detection (ITDR)

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Admin privileges were granted to a Google Workspace user Admin privileges were granted to a Google Workspace user. This user now has access to additional administrative functions and settings.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Privilege Escalation

Analytics BIOC

Administrator groups enumerated via LDAP An LDAP search query that collects information about administrators was executed. This may be indicative of Active Directory domain enumeration, which can be used to perform attacks against the organization.

Informational

Platform Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

AI safeguards deletion attempt A cloud identity deleted AI safeguards. MITRE ATLAS Technique: AML.T0015 - Evade ML Model.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log

Defense Evasion

Analytics BIOC

AI safeguards were modified A cloud identity modified AI safeguards. MITRE ATLAS Technique: AML.T0015 - Evade ML Model.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log

Defense Evasion

Analytics BIOC

An app was added to Google Marketplace An app was added to the Google Workspace Marketplace.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Command and Control

Analytics BIOC

An app was added to the Google Workspace trusted OAuth apps list An identity added an OAuth app to the Google Workspace trusted OAuth apps list.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Defense Evasion

Analytics BIOC

An app was removed from a blocked list in Google Workspace An identity removed an app from Google Workspace blocked OAuth or third-party apps list.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Defense Evasion

Analytics BIOC

An AWS database service master user password was changed An AWS database service master user password was changed.

Informational

Cortex Cloud

AWS Audit Log

Persistence

Analytics BIOC

An AWS EC2 instance containing sensitive data was exported A EC2 instance was exported to an S3 bucket. The instance was found to contain sensitive data.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An AWS EC2 instance was exported from a production account An EC2 instance was exported from a production account to an S3 bucket.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An AWS EC2 instance was exported into an unknown S3 bucket An EC2 instance was exported to an unknown S3 bucket.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An AWS EFS File-share mount was deleted An AWS EFS File-share mount was deleted.

Informational

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

An AWS EFS file-share was deleted An AWS EFS File-share has been deleted.

Informational

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

An AWS EKS cluster was created or deleted An AWS EKS cluster has been created or deleted.

Informational

Cortex Cloud

AWS Audit Log

Initial Access, Impact

Analytics BIOC

An AWS GuardDuty IP set was created An AWS GuardDuty IP set has been created.

Informational

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

An AWS Lambda Function was created An AWS Lambda Function was created.

Informational

Cortex Cloud

AWS Audit Log

Execution, Persistence

Analytics BIOC

An AWS Lambda function was modified An AWS Lambda function was modified.

Informational

Cortex Cloud

AWS Audit Log

Execution

Analytics BIOC

An AWS RDS Global Cluster Deletion An AWS RDS global cluster was deleted.

Informational

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

An AWS RDS instance was created from a snapshot A new AWS RDS instance was created from a publicly available RDS snapshot.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An AWS Route 53 domain was transferred to another AWS account An AWS Route 53 domain was transferred to another AWS account.

Informational

Cortex Cloud

AWS Audit Log

Resource Development

Analytics BIOC

An AWS S3 bucket configuration was modified An AWS S3 bucket configuration has been modified.

Informational

Cortex Cloud

AWS Audit Log

Defense Evasion, Impact

Analytics BIOC

An AWS SAML provider was modified An AWS SAML provider was modified.

Informational

Cortex Cloud

AWS Audit Log

Initial Access, Defense Evasion

Analytics BIOC

An AWS SES identity was deleted An AWS SES identity has been deleted.

Informational

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

An Azure application reached a throttling API rate An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics BIOC

An Azure DNS Zone was modified An Azure DNS zone has been changed or removed, which may indicate malicious activity or a misconfiguration.

Informational

Cortex Cloud

Azure Audit Log

Command and Control

Analytics BIOC

An Azure Firewall policy deletion An Azure Firewall policy was deleted. An attacker might use this technique to disable network defenses.

Low

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An Azure Firewall rule collection group was modified or deleted An Azure Firewall rule collection group was modified or deleted. This could indicate a malicious actor attempting to bypass security measures.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An Azure firewall rule group was modified An Azure firewall rule group was modified or deleted.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An Azure Firewall was modified An Azure Firewall was modified or deleted. This may indicate a security risk.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An Azure Key Vault key was modified An Azure Key Vault key was modified.

Informational

Cortex Cloud

Azure Audit Log

Credential Access

Analytics BIOC

An Azure Key Vault was modified Azure Key Vault has been modified or deleted by an Identity. This could be an indication of unauthorized access or malicious activity.

Informational

Cortex Cloud

Azure Audit Log

Credential Access

Analytics BIOC

An Azure Kubernetes Cluster was created or deleted An Azure Kubernetes Cluster was created or deleted.

Informational

Cortex Cloud

Azure Audit Log

Impact

Analytics BIOC

An Azure Kubernetes Role or Cluster-Role was modified An Azure Kubernetes Role or Cluster-Role was modified or deleted. This could indicate malicious activity and should be investigated.

Informational

Cortex Cloud

Azure Audit Log

Privilege Escalation

Analytics BIOC

An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted. This could indicate a security breach or malicious activity.

Informational

Cortex Cloud

Azure Audit Log

Privilege Escalation

Analytics BIOC

An Azure Kubernetes Service Account was modified or deleted An Azure Kubernetes Service Account was modified or deleted.

Informational

Cortex Cloud

Azure Audit Log

Impact

Analytics BIOC

An Azure Network Security Group was modified An Azure Network Security Group was modified or deleted. This could indicate malicious activity or a misconfiguration.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An Azure Point-to-Site VPN was modified An Azure Point-to-Site VPN was modified or deleted.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An Azure SQL database was exported from a production subscription An Azure SQL database export was initiated. The database was exported from a production subscription.

Informational

Cortex Cloud

Azure Audit Log

Exfiltration

Analytics BIOC

An Azure Suppression Rule was created An Azure Suppression Rule was created.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An Azure virtual network Device was modified An Azure virtual network Device was modified or deleted.

Informational

Cortex Cloud

Azure Audit Log

Impact

Analytics BIOC

An Azure virtual network was modified An Azure virtual network has been modified or deleted.

Informational

Cortex Cloud

Azure Audit Log

Impact

Analytics BIOC

An Azure VM snapshot SAS URL was generated An identity generated a SAS URL for an Azure VM snapshot. SAS URLs allow others to download or export the snapshot.

Informational

Cortex Cloud

Azure Audit Log

Exfiltration

Analytics BIOC

An Azure VM snapshot SAS URL was generated for export from a production subscription A SAS URL for an Azure VM snapshot was generated. The operation was performed within a production subscription. SAS URLs allow others to download or export the snapshot.

Informational

Cortex Cloud

Azure Audit Log

Exfiltration

Analytics BIOC

An Azure VPN Connection was modified Modification or removal of an Azure VPN connection was detected. This alert indicates a change to an existing VPN connection or the deletion of an existing connection.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

An EBS snapshot block was downloaded An EBS snapshot block was downloaded using the EBS direct API. This may indicate an attacker's attempt to exfiltrate data from a volume snapshot in the cloud environment.

Informational

Cortex Cloud

AWS Audit Log

Collection, Exfiltration

Analytics BIOC

An Email address was added to AWS SES An Email address was added to AWS SES.

Informational

Cortex Cloud

AWS Audit Log

Persistence

Analytics BIOC

An IAM group was created An IAM group was created.

Informational

Cortex Cloud

AWS Audit Log

Persistence

Analytics BIOC

An identity accessed a backup cloud storage An identity accessed a backup cloud storage.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Collection, Exfiltration

Analytics BIOC

An identity accessed a cloud storage for the first time An identity accessed a cloud storage resource for the first time.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Collection, Exfiltration

Analytics BIOC

An identity accessed Azure Kubernetes Secrets An identity has accessed or attempted to access Azure Kubernetes secrets or Config Objects.

Informational

Cortex Cloud

Azure Audit Log

Credential Access

Analytics BIOC

An identity attached an administrative policy to an IAM user or role An identity attached an administrative policy to an IAM user or role.

Informational

Cortex Cloud

AWS Audit Log

Privilege Escalation, Persistence

Analytics BIOC

An identity created or updated password for an IAM user An identity created or updated an AWS console password for an IAM user.

Informational

Cortex Cloud

AWS Audit Log

Privilege Escalation, Persistence

Analytics BIOC

An identity disabled bucket logging An identity disabled bucket logging.

Informational

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

An identity started an AWS SSM session An identity started an AWS SSM interactive session.

Informational

Cortex Cloud

AWS Audit Log

Lateral Movement

Analytics BIOC

An identity was granted permissions to manage user access to Azure resources An identity was granted the User Access Administrator permission at the tenant scope.

Informational

Cortex Cloud

Azure Audit Log

Privilege Escalation

Analytics BIOC

An inactive user attempted to authenticate A user with no activity in the past 30 days with the target, attempted to authenticate via universal authentication.

Informational

Identity Analytics

Initial Access

Analytics BIOC

An operation was performed by an identity from a domain that was not seen in the organization An operation was performed by an identity. This identity belongs to a domain that was not seen in the organization before.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Initial Access

Analytics BIOC

An RDS snapshot containing sensitive data was exported An RDS snapshot containing sensitive data was exported to an S3 bucket.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An RDS snapshot was exported from a production account An RDS snapshot was exported from a production account to an S3 bucket.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An RDS snapshot was exported to an unknown bucket An RDS snapshot was exported to an unknown S3 bucket. The destination bucket has not been seen in your tenant in the last 30 days.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An RDS snapshot was exported to an unknown S3 bucket An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.

Low

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An S3 replication policy to an unknown bucket was created An S3 replication policy was added to an S3 bucket. The referenced destination bucket was not seen in your tenant in the last 30 days.

Low

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An uncommon executable was remotely written over SMB to an uncommon destination An uncommon executable was remotely written over SMB to a destination, which was not involved in significant similar activity during last month.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics BIOC

An uncommon file added to startup-related Registry keys An attacker may add a file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence