Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Suspicious active setup registered The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Suspicious authentication package registered The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious cloud compute instance SSH keys modification attempt An identity attempted to modify the SSH keys of a single compute instance. This may indicate an attacker's attempt to maintain persistence on the cloud instance.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Persistence, Lateral Movement
Analytics BIOC	Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics BIOC	Suspicious dNSHostName attribute change to DC name The dNSHostName attribute of a machine account was changed to a Domain Controller server name.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
Analytics BIOC	Suspicious domain user account creation A user was observed creating a rare domain account.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Suspicious hidden user created A user account was created with a name that mimics a machine account.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Defense Evasion
Analytics BIOC	Suspicious HTTP parameters detected The endpoint received suspicious HTTP parameters via an HTTP request, which may indicate attempts to exploit server components or web shell activity.	Medium	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Initial Access, Persistence
Analytics BIOC	Suspicious MFA request reported by user in Entra ID A user has flagged an MFA request as suspicious in Microsoft Entra ID. This could indicate a potential compromised user account or unauthorized access attempt.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Persistence, Initial Access
Analytics BIOC	Suspicious modification of the AdminSDHolder's ACL A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Suspicious print processor registered The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service.	Medium	Platform Analytics	XDR Agent	Persistence
BIOC	Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.	Low	Platform Analytics	Registry	Privilege Escalation, Persistence
BIOC	Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).	Medium	Platform Analytics	Registry	Privilege Escalation, Persistence
Analytics BIOC	Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious sAMAccountName change The name of a machine account was changed to a sAMAccountName with a missing trailing dollar sign.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
BIOC	Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.	Informational	Platform Analytics	File	Persistence
BIOC	Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.	Informational	Platform Analytics	File	Persistence
Analytics BIOC	Suspicious systemd timer activity Suspicious systemd timer activity, which may indicate an attempt to establish persistence.	Low	Platform Analytics	XDR Agent	Execution, Persistence, Privilege Escalation
Analytics BIOC	Suspicious time provider registered The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service.	Medium	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Suspicious Udev driver rule execution manipulation Udev driver rule was modified with unusual pattern, might be used by adversaries to backdoor existing drivers.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Svchost.exe loads a rare unsigned module Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution.	Low	Platform Analytics	XDR Agent	Defense Evasion, Persistence
BIOC	Tampering with Windows Security Support Provider DLLs Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002.	Informational	Platform Analytics	Registry	Persistence
BIOC	Task scheduled by commonly abused host process Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use.	Informational	Platform Analytics	Process execution	Persistence
Analytics BIOC	TGT request with a spoofed sAMAccountName - Event log A Kerberos authentication ticket (TGT) was requested for an account with a spoofed sAMAccountName.	Medium	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
Analytics BIOC	TGT request with a spoofed sAMAccountName - Network A Kerberos authentication ticket (TGT) was requested for an account with a spoofed sAMAccountName.	Medium	Identity Analytics	XDR Agent	Privilege Escalation, Persistence
Analytics BIOC	Uncommon AppleScript containing a potential persistence command was executed via the command line The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.	Low	Platform Analytics	XDR Agent	Execution, Persistence
Analytics BIOC	Uncommon AT task-job creation by user An unpopular AT task-job was created by a user.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Uncommon browser extension loaded An uncommon browser extension was loaded by a Chromium-based browser.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Uncommon jsp file write by a Java process An uncommon jsp file was written by a Java process.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Uncommon Launch Agent persistency was registered or modified An uncommon Launch Agent persistence mechanism was registered/modified on the system.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Uncommon Launch Daemon persistency was registered or modified An uncommon Launch Daemon persistence mechanism was registered/modified on the system.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Uncommon local scheduled task creation via schtasks.exe The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Uncommon login item persistency was registered or modified An uncommon login item persistence mechanism was registered/modified on the system.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Uncommon Managed Object Format (MOF) compiler usage The mofcomp.exe WMI MOF compiled is used to compile code into the WMI repository that in turn may enable attackers to run scheduled or triggered code from the context of a Microsoft-signed binary.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Uncommon net group command execution Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.	Informational	Platform Analytics	XDR Agent	Discovery, Persistence
Analytics BIOC	Uncommon net localgroup command execution Uncommon net localgroup command execution which may be used for group and user enumeration and unauthorized user creation.	Informational	Platform Analytics	XDR Agent	Discovery, Persistence
Analytics BIOC	Uncommon PowerShell commands used to create or alter scheduled task parameters Attackers may create or alter scheduled task parameters to gain higher privileges or persistence on the system.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Uncommon signed process execution by scheduled task An uncommon process was executed by a scheduled task.	Informational	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Uncommon user management via net.exe The net.exe command is used to add, delete, and otherwise manage the users on a computer. Adversaries may attempt to use the command to discover or add local and domain user accounts.	Informational	Platform Analytics	XDR Agent	Discovery, Persistence
Analytics BIOC	Unknown DLL was added to the AD FS Global Assembly Cache path A new and unknown DLL was created within the Active Directory Federation Services (AD FS) Global Assembly Cache (GAC). Attackers may manipulate IdentityServer adapters to achieve persistence or execute malicious code within the AD FS environment.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Unsigned process creates a scheduled task via file access A scheduled task was created via file access from an unsigned process. This is uncommon and may indicate malicious activity.	Low	Platform Analytics	XDR Agent	Execution, Persistence
Analytics BIOC	Unusual AWS credentials creation AWS utility was used to create an access key and a secret key.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Unusual AWS user added to group AWS user added to AWS group, possibly to elevate privileges and gain more access to resources.	Low	Platform Analytics	XDR Agent	Persistence
Analytics BIOC	Unusual Identity and Access Management (IAM) activity A cloud identity performed an unusual IAM operation.	Informational	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Persistence, Privilege Escalation
Analytics BIOC	Unusual process access to ld.so.preload file Attackers can modify ld.so.preload to inject malicious code into every dynamically linked process, enabling persistence and code execution. This detected operation is considered atypical in terms of access.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Unusual resource modification by newly seen IAM user A cloud resource was modified by a newly seen IAM user.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Persistence, Privilege Escalation, Impact
Analytics BIOC	Unusual user account enablement A user enabled an account. This user does not usually enable user accounts.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Unusual user-agent for a cloud identity A cloud identity has executed an API call with an unusual user-agent.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Initial Access, Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Unverified domain added to Azure AD A new unverified domain was added to Azure AD.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Persistence
Analytics BIOC	User account delegation change A user account was modified with delegation to a service.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	User added a new device to Okta Verify instance The user has successfully registered a new device with the Okta Verify application.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Persistence
Analytics	User added to a group and removed A user was added to an Active Directory group and removed within a short period of time, which may be a sign of compromise.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
BIOC	User added to local administrator group using a PowerShell command Adding a new user to the local admin group may or may not be malicious, but it is an outstanding action worth considering, as it shouldn't happen too often. A malware may add a new malicious user to the administrators group as a way of maintaining high privileges after the system was compromised.	Medium	Platform Analytics	Process execution	Persistence
Analytics	User added to the SMS Admins local group A user was added to the SMS Admins local group. This may indicate a potential attack targeting the Microsoft Configuration Manager infrastructure.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
BIOC	User creation or modification via /etc file Attackers may create new users or modify existing users by directly modifying /etc/passwd and /etc/shadow.	Informational	Platform Analytics	File	Persistence
Analytics BIOC	User installed an application in Microsoft Teams via Graph API A user who rarely uses the Graph API to install Microsoft Teams applications has installed one using it.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Microsoft Graph Logs	Persistence
Analytics BIOC	Weakly-Encrypted Kerberos TGT Response A weakly encrypted Kerberos TGT was issued by a domain controller. The encryption type is abnormal for this DC and results in a TGT that is easier to crack. This behavior may indicate a Skeleton Key attack.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Credential Access, Defense Evasion, Persistence
Analytics	Web server CGO executed a process following a potential Webshell dropped A process was executed by a web server CGO following a potential drop of a webshell file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Web server CGO executed an uncommon process An uncommon process was executed by a web server CGO, which might indicate a Webshell activity or a web server exploit.	Informational	Platform Analytics	XDR Agent	Initial Access, Persistence
BIOC	Write to .bash_profile Commands in ~/.bash_profile are executed on every user shell login with a username and password.	Informational	Platform Analytics	File	Persistence

Analytics BIOC

Suspicious active setup registered The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Suspicious authentication package registered The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious cloud compute instance SSH keys modification attempt An identity attempted to modify the SSH keys of a single compute instance. This may indicate an attacker's attempt to maintain persistence on the cloud instance.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Persistence, Lateral Movement

Analytics BIOC

Suspicious container orchestration job A suspicious orchestration job ran with a rare command line.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics BIOC

Suspicious dNSHostName attribute change to DC name The dNSHostName attribute of a machine account was changed to a Domain Controller server name.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

Analytics BIOC

Suspicious domain user account creation A user was observed creating a rare domain account.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Suspicious hidden user created A user account was created with a name that mimics a machine account.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Defense Evasion

Analytics BIOC

Suspicious HTTP parameters detected The endpoint received suspicious HTTP parameters via an HTTP request, which may indicate attempts to exploit server components or web shell activity.

Medium

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Initial Access, Persistence

Analytics BIOC

Suspicious MFA request reported by user in Entra ID A user has flagged an MFA request as suspicious in Microsoft Entra ID. This could indicate a potential compromised user account or unauthorized access attempt.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Persistence, Initial Access

Analytics BIOC

Suspicious modification of the AdminSDHolder's ACL A user modified the AdminSDHolder ACL, which may be an indication of a privilege escalation attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Suspicious print processor registered The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service.

Medium

Platform Analytics

XDR Agent

Persistence

BIOC

Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

Low

Platform Analytics

Registry

Privilege Escalation, Persistence

BIOC

Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

Medium

Platform Analytics

Registry

Privilege Escalation, Persistence

Analytics BIOC

Suspicious process modified RC script file A suspicious process modified an RC script file. These files allow system administrators to map and start custom services at startup for different run levels. This may be done to establish persistence.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Suspicious RunOnce Parent Process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user login events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious runonce.exe parent process Runonce.exe executes commands under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, typically on computer boot and user logon events.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious sAMAccountName change The name of a machine account was changed to a sAMAccountName with a missing trailing dollar sign.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

BIOC

Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.

Informational

Platform Analytics

File

Persistence

BIOC

Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.

Informational

Platform Analytics

File

Persistence

Analytics BIOC

Suspicious systemd timer activity Suspicious systemd timer activity, which may indicate an attempt to establish persistence.

Low

Platform Analytics

XDR Agent

Execution, Persistence, Privilege Escalation

Analytics BIOC

Suspicious time provider registered The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service.

Medium

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Suspicious Udev driver rule execution manipulation Udev driver rule was modified with unusual pattern, might be used by adversaries to backdoor existing drivers.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Svchost.exe loads a rare unsigned module Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution.

Low

Platform Analytics

XDR Agent

Defense Evasion, Persistence

BIOC

Tampering with Windows Security Support Provider DLLs Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002.

Informational

Platform Analytics

Registry

Persistence

BIOC

Task scheduled by commonly abused host process Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use.

Informational

Platform Analytics

Process execution

Persistence

Analytics BIOC

TGT request with a spoofed sAMAccountName - Event log A Kerberos authentication ticket (TGT) was requested for an account with a spoofed sAMAccountName.

Medium

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

Analytics BIOC

TGT request with a spoofed sAMAccountName - Network A Kerberos authentication ticket (TGT) was requested for an account with a spoofed sAMAccountName.

Medium

Identity Analytics

XDR Agent

Privilege Escalation, Persistence

Analytics BIOC

Uncommon AppleScript containing a potential persistence command was executed via the command line The AppleScript interpreter executed an uncommon command potentially used for persistence to maintain system access.

Low

Platform Analytics

XDR Agent

Execution, Persistence

Analytics BIOC

Uncommon AT task-job creation by user An unpopular AT task-job was created by a user.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Uncommon browser extension loaded An uncommon browser extension was loaded by a Chromium-based browser.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Uncommon jsp file write by a Java process An uncommon jsp file was written by a Java process.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Uncommon Launch Agent persistency was registered or modified An uncommon Launch Agent persistence mechanism was registered/modified on the system.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Uncommon Launch Daemon persistency was registered or modified An uncommon Launch Daemon persistence mechanism was registered/modified on the system.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Uncommon local scheduled task creation via schtasks.exe The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Uncommon login item persistency was registered or modified An uncommon login item persistence mechanism was registered/modified on the system.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Uncommon Managed Object Format (MOF) compiler usage The mofcomp.exe WMI MOF compiled is used to compile code into the WMI repository that in turn may enable attackers to run scheduled or triggered code from the context of a Microsoft-signed binary.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Uncommon net group command execution Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation.

Informational

Platform Analytics

XDR Agent

Discovery, Persistence

Analytics BIOC

Uncommon net localgroup command execution Uncommon net localgroup command execution which may be used for group and user enumeration and unauthorized user creation.

Informational

Platform Analytics

XDR Agent

Discovery, Persistence

Analytics BIOC

Uncommon PowerShell commands used to create or alter scheduled task parameters Attackers may create or alter scheduled task parameters to gain higher privileges or persistence on the system.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Uncommon signed process execution by scheduled task An uncommon process was executed by a scheduled task.

Informational

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Uncommon user management via net.exe The net.exe command is used to add, delete, and otherwise manage the users on a computer. Adversaries may attempt to use the command to discover or add local and domain user accounts.

Informational

Platform Analytics

XDR Agent

Discovery, Persistence

Analytics BIOC

Unknown DLL was added to the AD FS Global Assembly Cache path A new and unknown DLL was created within the Active Directory Federation Services (AD FS) Global Assembly Cache (GAC). Attackers may manipulate IdentityServer adapters to achieve persistence or execute malicious code within the AD FS environment.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking.

Informational

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder.

Informational

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

Unsigned process creates a scheduled task via file access A scheduled task was created via file access from an unsigned process. This is uncommon and may indicate malicious activity.

Low

Platform Analytics

XDR Agent

Execution, Persistence

Analytics BIOC

Unusual AWS credentials creation AWS utility was used to create an access key and a secret key.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Unusual AWS user added to group AWS user added to AWS group, possibly to elevate privileges and gain more access to resources.

Low

Platform Analytics

XDR Agent

Persistence

Analytics BIOC

Unusual Identity and Access Management (IAM) activity A cloud identity performed an unusual IAM operation.

Informational

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Persistence, Privilege Escalation

Analytics BIOC

Unusual process access to ld.so.preload file Attackers can modify ld.so.preload to inject malicious code into every dynamically linked process, enabling persistence and code execution. This detected operation is considered atypical in terms of access.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Unusual resource modification by newly seen IAM user A cloud resource was modified by a newly seen IAM user.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Persistence, Privilege Escalation, Impact

Analytics BIOC

Unusual user account enablement A user enabled an account. This user does not usually enable user accounts.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Unusual user-agent for a cloud identity A cloud identity has executed an API call with an unusual user-agent.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Initial Access, Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

Unverified domain added to Azure AD A new unverified domain was added to Azure AD.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Persistence

Analytics BIOC

User account delegation change A user account was modified with delegation to a service.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

User added a new device to Okta Verify instance The user has successfully registered a new device with the Okta Verify application.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Persistence

Analytics

User added to a group and removed A user was added to an Active Directory group and removed within a short period of time, which may be a sign of compromise.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

BIOC

User added to local administrator group using a PowerShell command Adding a new user to the local admin group may or may not be malicious, but it is an outstanding action worth considering, as it shouldn't happen too often. A malware may add a new malicious user to the administrators group as a way of maintaining high privileges after the system was compromised.

Medium

Platform Analytics

Process execution

Persistence

Analytics

User added to the SMS Admins local group A user was added to the SMS Admins local group. This may indicate a potential attack targeting the Microsoft Configuration Manager infrastructure.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

BIOC

User creation or modification via /etc file Attackers may create new users or modify existing users by directly modifying /etc/passwd and /etc/shadow.

Informational

Platform Analytics

File

Persistence

Analytics BIOC

User installed an application in Microsoft Teams via Graph API A user who rarely uses the Graph API to install Microsoft Teams applications has installed one using it.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Microsoft Graph Logs

Persistence

Analytics BIOC

Weakly-Encrypted Kerberos TGT Response A weakly encrypted Kerberos TGT was issued by a domain controller. The encryption type is abnormal for this DC and results in a TGT that is easier to crack. This behavior may indicate a Skeleton Key attack.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Credential Access, Defense Evasion, Persistence

Analytics

Web server CGO executed a process following a potential Webshell dropped A process was executed by a web server CGO following a potential drop of a webshell file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Web server CGO executed an uncommon process An uncommon process was executed by a web server CGO, which might indicate a Webshell activity or a web server exploit.

Informational

Platform Analytics

XDR Agent

Initial Access, Persistence

BIOC

Write to .bash_profile Commands in ~/.bash_profile are executed on every user shell login with a username and password.

Informational

Platform Analytics

File

Persistence