Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics BIOC	Possible Kerberos relay attack A suspicious local network login was observed, which might indicate on Kerberos relay attack. This attack can lead to privilege escalation by obtaining system privileges on the target.	Low	Platform Analytics	Windows Event Collector, XDR Agent	Privilege Escalation
Analytics	Possible multistage attack in Microsoft Teams Possible multistage attack in Microsoft Teams.	Low	Identity Threat Detection (ITDR)	Office 365 Audit	Initial Access
Analytics BIOC	Possible network service discovery via command-line tool An attacker may use command-line utilities to discover open ports and services on a remote host.	Low	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Possible network sniffing attempt via tcpdump or tshark Attackers may monitor network traffic for cleartext credentials or to learn the network's configuration.	Low	Platform Analytics	XDR Agent	Credential Access, Discovery
BIOC	Possible Oracle enumeration via Oscanner The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.	Low	Platform Analytics	Process execution	Discovery
BIOC	Possible Oracle enumeration via tnscmd10g The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs.	Low	Platform Analytics	Process execution	Discovery
Analytics BIOC	Possible Pass-the-Hash An account was successfully logged on to with new credentials. This login type is rare and may be an attacker's attempt to pass-the-hash and move laterally within a network.	Low	Identity Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Possible path traversal via HTTP request The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Discovery
Analytics	Possible phishing attack via Microsoft Teams An external tenant is possibly attempting a phishing attack via Microsoft Teams.	Low	Identity Threat Detection (ITDR)	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access
Analytics BIOC	Possible webshell file written by a web server process An uncommon file with a web file extension was created, written or renamed by a web server process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Initial Access, Persistence
Analytics	Potential denial of wallet abusing AI services An ML model experienced a sudden spike in requests in a short time. MITRE ATLAS Techniques: AML.T0029 - Denial of ML Service, AML.T0034 - Cost Harvesting. OWASP Top 10 LLM Technique: LLM10 - Unbounded Consumption.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics	Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.	Low	Identity Analytics	AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Defense Evasion
Analytics	Potential kubelet impersonation attempt A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Potential SCCM credential harvesting using WMI detected Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Credential Access
BIOC	PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.	Low	Platform Analytics	Process execution	Persistence
Analytics BIOC	PowerShell Initiates a Network Connection to GitHub PowerShell initiates a Network Connection to GitHub with an uncommon command line. This may have legitimate uses, but this technique is frequently used by attackers to serve malicious payloads.	Low	Platform Analytics	Palo Alto Networks Url Logs	Execution
Analytics BIOC	PowerShell runs suspicious base64-encoded commands Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.	Low	Platform Analytics	XDR Agent	Execution
BIOC	Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.	Low	Platform Analytics	Registry	Persistence
Analytics BIOC	Privileged role used by Azure application An Azure application with high-level API permissions invoked a request to the Microsoft Graph API.	Low	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Privilege Escalation
BIOC	Process runs from the recycle bin Process running from the recycle bin.	Low	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare binary connected to a rare external host Rare binary connected to a rare external host.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics	Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Discovery
Analytics BIOC	Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.	Low	Platform Analytics	XDR Agent	Command and Control, Lateral Movement
Analytics BIOC	Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Persistence
Analytics BIOC	Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Persistence
Analytics BIOC	Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics BIOC	Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Lateral Movement
Analytics BIOC	RDP connections enabled remotely via Registry An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
BIOC	RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.	Low	Platform Analytics	Registry	Lateral Movement
Analytics BIOC	RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Lateral Movement
Analytics BIOC	Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
BIOC	Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.	Low	Platform Analytics	Process execution	Execution
Analytics BIOC	Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution
Analytics BIOC	Remote usage of an AWS service token An AWS service token was used externally of the cloud environment.	Low	Cortex Cloud	AWS Audit Log	Credential Access, Lateral Movement, Initial Access
Analytics BIOC	Remote usage of an Azure Managed Identity token An Azure Managed Identity token, which is attached to a compute service, was used externally of the cloud environment.	Low	Cortex Cloud	Azure Audit Log	Credential Access
Analytics BIOC	Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity.	Low	Platform Analytics	Process execution	Execution
Analytics BIOC	Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.	Low	Platform Analytics	XDR Agent	Command and Control, Execution
Analytics BIOC	SecureBoot was disabled SecureBoot was disabled, this might be indicative of someone trying to install an alternate non-UEFI supported OS.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Sending unusual file(s) to an external address Unusual files sent to an external address.	Low	Email Security	Microsoft 365 Emails	Initial Access, Exfiltration
Analytics BIOC	Setting Windows Auto Logon by uncommon process Setting Windows Auto Logon by uncommon process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.	Low	Platform Analytics	XDR Agent	Privilege Escalation, Defense Evasion
Analytics	Short-lived user account A user was created and deleted within a short period of time.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	SMB Traffic from Non-Standard Process SMB traffic is usually performed by a standard set of privileged processes through designated ports. The endpoint had a non-standard process communicating over ports normally used by SMB. An attacker might be moving laterally by using tools that implement a custom version of the SMB protocol.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Impact
Analytics BIOC	SPNs cleared from a machine account Service principal names were cleared from a machine account.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
Analytics BIOC	SSO authentication attempt by a honey user An SSO authentication attempt was made by a honey user, a decoy account created specifically to detect unauthorized access. This may indicate potential attacker activity.	Low	Identity Analytics	AzureAD, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	SSO authentication by a machine account A machine account successfully authenticated via SSO.	Low	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	SSO authentication by a service account A service account successfully authenticated via SSO.	Low	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	Stored credentials exported using credwiz.exe Attackers may abuse the credwiz tool to export stored accounts.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics	Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics BIOC	SUID/GUID permission discovery Attackers may search for potential to elevate permissions using binaries that have the SUID or GUID bit enabled.	Low	Platform Analytics	XDR Agent	Discovery
BIOC	Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).	Low	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Suspicious access of the System Management Container A user accessed the System Management container, which may be an indication of a reconnaissance for site servers.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Reconnaissance
Analytics	Suspicious access to Kubernetes API with kubelet credentials A combination of signals has been detected indicating that kubelet credentials were used inside a pod to access the Kubernetes API. This activity suggests an attempt to escalate privileges or move laterally within the cluster.	Low	Cortex Cloud	XDR Agent with eXtended Threat Hunting (XTH)	Exfiltration, Collection
Analytics BIOC	Suspicious account attribute modification that matches that of another account Suspicious account attribute modification that matches that of another account.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
Analytics	Suspicious activity indicating a potential abuse of a cloud-native email service A cloud identity performed a sequence of activities which might indicate an intent to abuse the email service to send phishing or spam.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log	Execution
Analytics BIOC	Suspicious AI Dataset Download A model dataset was accessed by an identity that typically doesn't interact with dataset files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics BIOC	Suspicious AI Dataset Label Modification AI Dataset labels were modified by an identity that typically doesn't interact with labels. MITRE ATLAS Technique: AML.T0020 - Poison Training Data. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
BIOC	Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).	Low	Platform Analytics	Module	Defense Evasion
Analytics BIOC	Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.	Low	Platform Analytics	XDR Agent	Discovery, Credential Access
Analytics	Suspicious cloud user data modification attempt followed by VM restart Suspicious user data modification followed by VM restart, possibly an attempt to run altered startup scripts at boot.	Low	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Execution
Analytics BIOC	Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics BIOC	Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.	Low	Platform Analytics	XDR Agent	Impact, Defense Evasion
Analytics BIOC	Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics	Suspicious EBS snapshots deletion An identity deleted multiple EBS snapshots from the project, considerably more than usual.	Low	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access
Analytics BIOC	Suspicious ICMP packet An ICMP router advertisement was sent by a host.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control
Analytics	Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.	Low	Platform Analytics	XDR Agent	Impact
Analytics	Suspicious identity downloaded multiple objects from a bucket An identity downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection, Exfiltration
Analytics	Suspicious Kerberos Pre-Auth Failures by Host An endpoint failed unusual number of Kerberos pre-authentications (TGT requests) which may indicate a password-spraying attack.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Suspicious LDAP queries followed by shared folder access The user executed suspicious LDAP queries shortly before accessing a shared folder. This behavior may be indicative of Rubeus activity involving Kerberos ticket forgery, such as Golden Ticket or Silver Ticket attacks.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Suspicious LDAP search query executed A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
BIOC	Suspicious lock screen image file written to disk Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.	Low	Platform Analytics	File	Command and Control
Analytics BIOC	Suspicious modification of the AdminSDHolder's ACL A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Suspicious Print System Remote Protocol usage by a process A host which is trusted for unconstrained delegation initiated an SMB connection to a DC using the Print System Remote Protocol. An attacker can abuse such sessions for relay attacks.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
BIOC	Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.	Low	Platform Analytics	Registry	Privilege Escalation, Persistence

Analytics BIOC

Possible Kerberoasting without SPNs A user specifically requested weak and deprecated encryption in a Kerberos TGS request. This provides easy-to-crack hashes, and is typically a sign of a Kerberoasting attack. The requested service was specified by using a suspicious SPN type, which is often used by Kerberoasting tools to request by SAN instead of SPN.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics BIOC

Possible Kerberos relay attack A suspicious local network login was observed, which might indicate on Kerberos relay attack. This attack can lead to privilege escalation by obtaining system privileges on the target.

Low

Platform Analytics

Windows Event Collector, XDR Agent

Privilege Escalation

Analytics

Possible multistage attack in Microsoft Teams Possible multistage attack in Microsoft Teams.

Low

Identity Threat Detection (ITDR)

Office 365 Audit

Initial Access

Analytics BIOC

Possible network service discovery via command-line tool An attacker may use command-line utilities to discover open ports and services on a remote host.

Low

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Possible network sniffing attempt via tcpdump or tshark Attackers may monitor network traffic for cleartext credentials or to learn the network's configuration.

Low

Platform Analytics

XDR Agent

Credential Access, Discovery

BIOC

Possible Oracle enumeration via Oscanner The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.

Low

Platform Analytics

Process execution

Discovery

BIOC

Possible Oracle enumeration via tnscmd10g The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs.

Low

Platform Analytics

Process execution

Discovery

Analytics BIOC

Possible Pass-the-Hash An account was successfully logged on to with new credentials. This login type is rare and may be an attacker's attempt to pass-the-hash and move laterally within a network.

Low

Identity Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Possible path traversal via HTTP request The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Discovery

Analytics

Possible phishing attack via Microsoft Teams An external tenant is possibly attempting a phishing attack via Microsoft Teams.

Low

Identity Threat Detection (ITDR)

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access

Analytics BIOC

Possible webshell file written by a web server process An uncommon file with a web file extension was created, written or renamed by a web server process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Initial Access, Persistence

Analytics

Potential denial of wallet abusing AI services An ML model experienced a sudden spike in requests in a short time. MITRE ATLAS Techniques: AML.T0029 - Denial of ML Service, AML.T0034 - Cost Harvesting. OWASP Top 10 LLM Technique: LLM10 - Unbounded Consumption.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics

Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.

Low

Identity Analytics

AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Defense Evasion

Analytics

Potential kubelet impersonation attempt A process accessed both the Kubelet credentials and the Kubernetes CA certificate, indicating an attempt to impersonate the node agent and communicate with the API server.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Potential SCCM credential harvesting using WMI detected Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Credential Access

BIOC

PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.

Low

Platform Analytics

Process execution

Persistence

Analytics BIOC

PowerShell Initiates a Network Connection to GitHub PowerShell initiates a Network Connection to GitHub with an uncommon command line. This may have legitimate uses, but this technique is frequently used by attackers to serve malicious payloads.

Low

Platform Analytics

Palo Alto Networks Url Logs

Execution

Analytics BIOC

PowerShell runs suspicious base64-encoded commands Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.

Low

Platform Analytics

XDR Agent

Execution

BIOC

Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.

Low

Platform Analytics

Registry

Persistence

Analytics BIOC

Privileged role used by Azure application An Azure application with high-level API permissions invoked a request to the Microsoft Graph API.

Low

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Privilege Escalation

BIOC

Process runs from the recycle bin Process running from the recycle bin.

Low

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare binary connected to a rare external host Rare binary connected to a rare external host.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Rare file transfer over SMB protocol The endpoint performed an abnormal file transfer over SMB to a remote host.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics

Rare LDAP enumeration Possible LDAP enumeration with a rare combination of queries.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Discovery

Analytics BIOC

Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Rare process executed by an AppleScript An uncommon process has been executed by the AppleScript interpreter process.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare process with VNC server capabilities started A rare process with VNC server capabilities was started.

Low

Platform Analytics

XDR Agent

Command and Control, Lateral Movement

Analytics BIOC

Rare RDP session to a remote host The endpoint performed a rare RDP session to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare Scheduled Task RPC activity from a rarely seen host The endpoint performed abnormal Scheduled Task RPC activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Persistence

Analytics BIOC

Rare security product signed executable executed in the network Attackers may attempt to install a security product with a known vulnerability to bypass security features.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Persistence

Analytics BIOC

Rare SMB session to a remote host The endpoint performed a rare SMB activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics BIOC

Rare SSH Session Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Rare unsigned process execution by scheduled task Rare and unsigned process was executed by a scheduled task.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Rare Windows Remote Management (WinRM) HTTP Activity The endpoint performed unfamiliar WinRM HTTP activity to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Lateral Movement

Analytics BIOC

RDP connections enabled remotely via Registry An attacker may remotely enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

BIOC

RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

Low

Platform Analytics

Registry

Lateral Movement

Analytics BIOC

RDP from an unmanaged endpoint in a typically managed subnet An RDP connection was established from an unmanaged endpoint in a typically managed subnet, indicating a possible lateral movement.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Lateral Movement

Analytics BIOC

Reading bash command history file Attackers may access the bash history file to glean cleartext usernames and passwords that were entered on the command line.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Recurring access to rare domain The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring access to rare IP The endpoint is periodically accessing an external fixed-IP address that its peers rarely use. Access to this external IP address has occurred repeatedly over many days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Recurring rare domain access from an unsigned process An unsigned process is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Recurring rare domain access to dynamic DNS domain The endpoint is periodically connecting to an external domain that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

BIOC

Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.

Low

Platform Analytics

Process execution

Execution

Analytics BIOC

Remote command execution via wmic.exe Remote command execution using the Windows Management Instrumentation command-line tool.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Remote DCOM command execution A remotely triggered DCOM initiated a command execution by a host that rarely executes processes using DCOM to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Remote service start from an uncommon source A remotely triggered service initiated by a host that rarely triggers services to other remote hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution

Analytics BIOC

Remote usage of an AWS service token An AWS service token was used externally of the cloud environment.

Low

Cortex Cloud

AWS Audit Log

Credential Access, Lateral Movement, Initial Access

Analytics BIOC

Remote usage of an Azure Managed Identity token An Azure Managed Identity token, which is attached to a compute service, was used externally of the cloud environment.

Low

Cortex Cloud

Azure Audit Log

Credential Access

Analytics BIOC

Rundll32.exe executes a rare unsigned module Rundll32.exe executes a rare unsigned module, which can indicate an attacker's malicious execution.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity.

Low

Platform Analytics

Process execution

Execution

Analytics BIOC

Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Screensaver process executed from Users or temporary folder An executable file with a screensaver extension was executed from the Users or temp folder. This is not a common behavior for screensavers and may indicate a malicious file disguised as a screensaver in the Users or temp folder. It is recommended to further investigate the execution flow for malicious indicators.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity.

Low

Platform Analytics

XDR Agent

Command and Control, Execution

Analytics BIOC

SecureBoot was disabled SecureBoot was disabled, this might be indicative of someone trying to install an alternate non-UEFI supported OS.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Sending unusual file(s) to an external address Unusual files sent to an external address.

Low

Email Security

Microsoft 365 Emails

Initial Access, Exfiltration

Analytics BIOC

Setting Windows Auto Logon by uncommon process Setting Windows Auto Logon by uncommon process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Setuid and Setgid file bit manipulation The setuid or setgid bits were set on a file.

Low

Platform Analytics

XDR Agent

Privilege Escalation, Defense Evasion

Analytics

Short-lived user account A user was created and deleted within a short period of time.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

SMB Traffic from Non-Standard Process SMB traffic is usually performed by a standard set of privileged processes through designated ports. The endpoint had a non-standard process communicating over ports normally used by SMB. An attacker might be moving laterally by using tools that implement a custom version of the SMB protocol.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Impact

Analytics BIOC

SPNs cleared from a machine account Service principal names were cleared from a machine account.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

Analytics BIOC

SSO authentication attempt by a honey user An SSO authentication attempt was made by a honey user, a decoy account created specifically to detect unauthorized access. This may indicate potential attacker activity.

Low

Identity Analytics

AzureAD, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

SSO authentication by a machine account A machine account successfully authenticated via SSO.

Low

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

SSO authentication by a service account A service account successfully authenticated via SSO.

Low

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

Stored credentials exported using credwiz.exe Attackers may abuse the credwiz tool to export stored accounts.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics

Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics BIOC

SUID/GUID permission discovery Attackers may search for potential to elevate permissions using binaries that have the SUID or GUID bit enabled.

Low

Platform Analytics

XDR Agent

Discovery

BIOC

Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).

Low

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Suspicious access of the System Management Container A user accessed the System Management container, which may be an indication of a reconnaissance for site servers.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Reconnaissance

Analytics

Suspicious access to Kubernetes API with kubelet credentials A combination of signals has been detected indicating that kubelet credentials were used inside a pod to access the Kubernetes API. This activity suggests an attempt to escalate privileges or move laterally within the cluster.

Low

Cortex Cloud

XDR Agent with eXtended Threat Hunting (XTH)

Exfiltration, Collection

Analytics BIOC

Suspicious account attribute modification that matches that of another account Suspicious account attribute modification that matches that of another account.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

Analytics

Suspicious activity indicating a potential abuse of a cloud-native email service A cloud identity performed a sequence of activities which might indicate an intent to abuse the email service to send phishing or spam.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log

Execution

Analytics BIOC

Suspicious AI Dataset Download A model dataset was accessed by an identity that typically doesn't interact with dataset files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics BIOC

Suspicious AI Dataset Label Modification AI Dataset labels were modified by an identity that typically doesn't interact with labels. MITRE ATLAS Technique: AML.T0020 - Poison Training Data. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

BIOC

Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

Low

Platform Analytics

Module

Defense Evasion

Analytics BIOC

Suspicious Certutil AD CS contact A suspicious occurrence of Certutil attempted to contact the AD CS Request Interface.

Low

Platform Analytics

XDR Agent

Discovery, Credential Access

Analytics

Suspicious cloud user data modification attempt followed by VM restart Suspicious user data modification followed by VM restart, possibly an attempt to run altered startup scripts at boot.

Low

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Execution

Analytics BIOC

Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics BIOC

Suspicious data encryption Known applications were used to encrypt data within a machine's local file system.

Low

Platform Analytics

XDR Agent

Impact, Defense Evasion

Analytics BIOC

Suspicious disablement of the Windows Firewall The Windows Firewall has been disabled. Malware may turn it off to exfiltrate data and communicate with C2 servers.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Suspicious DotNet log file created Payloads that use the DotNet framework may generate suspicious Microsoft DotNet log files.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics

Suspicious EBS snapshots deletion An identity deleted multiple EBS snapshots from the project, considerably more than usual.

Low

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access

Analytics BIOC

Suspicious ICMP packet An ICMP router advertisement was sent by a host.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control

Analytics

Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used.

Low

Platform Analytics

XDR Agent

Impact

Analytics

Suspicious identity downloaded multiple objects from a bucket An identity downloaded multiple objects from a bucket, considerably more than usual. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Collection, Exfiltration

Analytics

Suspicious Kerberos Pre-Auth Failures by Host An endpoint failed unusual number of Kerberos pre-authentications (TGT requests) which may indicate a password-spraying attack.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Suspicious LDAP queries followed by shared folder access The user executed suspicious LDAP queries shortly before accessing a shared folder. This behavior may be indicative of Rubeus activity involving Kerberos ticket forgery, such as Golden Ticket or Silver Ticket attacks.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Suspicious LDAP search query executed A suspicious and unpopular LDAP search query was executed. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

BIOC

Suspicious lock screen image file written to disk Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.

Low

Platform Analytics

File

Command and Control

Analytics BIOC

Suspicious modification of the AdminSDHolder's ACL A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Suspicious module load using direct syscall A module was loaded to a process using a direct syscall.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious PowerShell Command Line Attackers often leverage PowerShell one-liners, in which PowerShell is executed with suspicious options on the command line.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Suspicious Print System Remote Protocol usage by a process A host which is trusted for unconstrained delegation initiated an SMB connection to a DC using the Print System Remote Protocol. An attacker can abuse such sessions for relay attacks.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

BIOC

Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

Low

Platform Analytics

Registry

Privilege Escalation, Persistence