Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	IAM role trust policy modification A cloud identity updated the trust policy of an AWS IAM role.	Informational	Cortex Cloud	AWS Audit Log	Persistence, Privilege Escalation
Analytics BIOC	IAM role was created An IAM role was created.	Informational	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Persistence, Privilege Escalation
Analytics BIOC	IAM role-attached managed policies were listed AWS IAM managed policies that are attached to a role were listed.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics BIOC	IAM User added to an IAM group An IAM user was added to an IAM group.	Informational	Cortex Cloud	AWS Audit Log	Privilege Escalation, Persistence
Analytics BIOC	Identity assigned an Azure AD Administrator Role An identity was assigned an Azure AD Administrator role.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Persistence
Analytics BIOC	Image file execution options (IFEO) registry key set Attackers may use the Image File Execution Options Registry key to launch their executable whenever the user attempts to execute a certain executable.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation, Persistence
BIOC	Impersonation using Rubeus tool User authentication should not be impersonated, since this is considered a malicious behavior.	Medium	Platform Analytics	Process execution	Defense Evasion
Analytics	Impossible travel by a cloud identity Cloud identity activity detected from distant geographic regions within an short time window. This suggests unauthorized use of credentials, possibly indicating a compromised account.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Initial Access
Analytics	Impossible traveler - SSO User connected from several remote countries, at least one of which is not commonly used in the organization, within a short period of time. This may indicate the account is compromised.	Low	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics	Impossible traveler - VPN A user connected to a VPN service from multiple remote countries in a short period of time, which should normally be impossible. This may indicate the account is compromised.	Low	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Credential Access, Resource Development
Analytics	Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics BIOC	Indicator blocking Auditing or logging configuration changes on Linux host.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Indirect command execution using the Program Compatibility Assistant Pcalua.exe (Program Compatibility Assistant) is used for running old programs that have compatibility issues. Attackers can use pcalua.exe to indirectly execute their malicious programs.	Medium	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Initial person-to-person email contact Identifies when a sender initiates contact with individuals with no prior history of interaction in the last 30 days.	Informational	Email Security	Microsoft 365 Emails	Execution, Credential Access
BIOC	Injection into ping.exe A process injected into an instance of ping.exe.	Informational	Platform Analytics	Remote code	Defense Evasion
Analytics BIOC	Injection into rundll32.exe A process injected into an instance of rundll32.exe.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Installation of a new System-V service Installation of a new System-V service.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation
BIOC	Installation of Cain & Abel password recovery tool A process created a Registry key associated with the common password cracking tool Cain & Abel.	Low	Platform Analytics	Registry	Credential Access
BIOC	Installation of networking security tools A security or penetration testing tool such as wireshark and nmap is being installed.	Informational	Platform Analytics	Process execution	Discovery
Analytics	Intense SSO failures An abnormally high amount of SSO authentication attempts were seen within a short period of time. This could be the outcome of a brute-force login attempt.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Initial Access
Analytics BIOC	Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation.	Low	Platform Analytics	XDR Agent	Execution, Privilege Escalation
Analytics	Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.	Low	Identity Analytics	XDR Agent	Discovery, Credential Access
Analytics BIOC	Interactive login by a machine account A machine account performed an interactive or remote interactive login.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Interactive login by a service account A service account performed an interactive or remote interactive login.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.	Informational	Identity Analytics	XDR Agent	Initial Access
BIOC	Interface enumeration using netsh Attackers may enumerate existing network interfaces using netsh.exe.	Informational	Platform Analytics	Process execution	Discovery
Analytics	Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
BIOC	Internet Explorer home page modification The Internet Explorer home page could be changed to a malicious page.	Low	Platform Analytics	Registry	Impact, Credential Access
BIOC	Internet Explorer security settings modification The Security Settings Check feature, which checks Internet Explorer security settings to determine risk, was disabled.	Informational	Platform Analytics	Registry	Defense Evasion
Analytics BIOC	Invalid SAML Detected A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD, Okta	Credential Access
Analytics	IP Rotation Pattern in SSO Spray A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics BIOC	Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host.	Informational	Platform Analytics	XDR Agent	Defense Evasion
BIOC	ISO mounted manually A user manually mounted an ISO file.	Informational	Platform Analytics	File	Defense Evasion
BIOC	Kerberos brute-force attack using Kerbrute This is a known Kerbrute tool command, used to conduct Kerberos authentication brute-force attacks.	Informational	Platform Analytics	Process execution	Credential Access
Analytics	Kerberos Pre-Auth Failures by Host The endpoint failed an unusual number of Kerberos pre-authentications (TGT requests) from at least three users when compared to its baseline. This can indicate a password-spraying attack.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
BIOC	Kerberos service ticket request in PowerShell command Asking for a specific Kerberos service ticket can indicate an attacker's attempt to "Kerberoast" or use the ticket directly.	High	Platform Analytics	Process execution	Credential Access, Lateral Movement
BIOC	Kerberos ticket forging using Impacket ticketer Suspected execution of Impacket's ticketer.py script for forging TGT/TGS Kerberos tickets.	Medium	Platform Analytics	Process execution	Defense Evasion, Privilege Escalation
Analytics BIOC	Kerberos Traffic from Non-Standard Process The endpoint had a non-standard process communicating over ports normally used by Kerberos. An attacker might be using malicious tools to move laterally.	Medium	Platform Analytics	XDR Agent	Discovery
Analytics	Kerberos User Enumeration A high amount of Kerberos principal unknown errors were generated on users in the last hour. This may be indicative of Kerberos user enumeration.	Medium	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Discovery
BIOC	Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.	Informational	Platform Analytics	Process execution	Persistence
BIOC	Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits.	Informational	Platform Analytics	Process execution	Persistence
BIOC	Key Certificate Search And Exfiltrate Possible attempt to search for key certificates and exfiltrate them.	Informational	Platform Analytics	Process execution	Credential Access
Analytics BIOC	Key credential attribute modification A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
BIOC	Keychain Certificate Access Detected access to Keychain certificates.	Informational	Platform Analytics	Process execution	Credential Access
BIOC	Keychain Import Item An item was imported from the Keychain.	Informational	Platform Analytics	Process execution	Credential Access
BIOC	Keychain Unlock Detected Keychain unlocking.	Informational	Platform Analytics	Process execution	Credential Access
Analytics BIOC	Keylogging using system commands Usage of a Linux system utility to capture input.	Low	Platform Analytics	XDR Agent	Credential Access, Collection
Analytics BIOC	Known service display name with uncommon image-path Service created with a known display name but has an uncommon image-path.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Execution
Analytics BIOC	Known service name with an uncommon image-path A Service with a known service name has an uncommon image-path.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Execution
Analytics BIOC	Kubelet server communication from a pod The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges.	Informational	Platform Analytics	XDR Agent	Privilege Escalation, Discovery
Analytics BIOC	Kubernetes admission controller activity A Kubernetes admission controller has been created or modified.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Persistence, Credential Access
Analytics BIOC	Kubernetes API server communication from within a pod The Kubernetes API server was accessed from within a pod.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Kubernetes cluster events deletion Kubernetes cluster events deletion.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Defense Evasion
Analytics	Kubernetes enumeration activity An identity attempted to discover available resources within a cluster. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Discovery
Analytics	Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Kubernetes network policy modification A change has been made to the network policies of a Kubernetes cluster.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Impact
Analytics BIOC	Kubernetes nsenter container escape The nsenter command was used to execute a process in the context of the initialization process.	Informational	Platform Analytics	XDR Agent	Privilege Escalation
Analytics BIOC	Kubernetes Pod Created with host Inter Process Communications (IPC) namespace An identity created a Kubernetes pod with the host Inter Process Communications (IPC) namespace. This may indicate an adversary attempting to access data used by other pods that use the host's IPC namespace.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Privilege Escalation, Execution
Analytics BIOC	Kubernetes Pod created with host process ID (PID) namespace An identity created a Kubernetes pod with the host process ID (PID) namespace. This may indicate an adversary attempting to access processes running on the host, which could allow escalating privileges to root.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Privilege Escalation, Execution
Analytics BIOC	Kubernetes Pod Created With Sensitive Volume An identity created a Kubernetes Pod with a sensitive volume, allowing the Pod to have read or write permissions on the host's filesystem This could suggest an effort by an adversary to access sensitive files on the host and employ techniques for escalating privileges.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Privilege Escalation, Execution
Analytics BIOC	Kubernetes pod creation from unknown container image registry A Kubernetes pod was created with a container image from an unknown registry.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	Kubernetes pod creation with host network An identity created a Kubernetes pod attached to the host network. This may indicate an adversary attempting to access services bound to localhost, sniff traffic on any interface on the host, and potentially bypass the network policy.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Privilege Escalation, Execution
Analytics BIOC	Kubernetes Privileged Pod Creation An identity created a Kubernetes pod with a privileged container. This may indicate an adversary attempting to access that host's filesystem or gain root access to the host.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Privilege Escalation, Execution
Analytics BIOC	Kubernetes secret enumeration activity Kubectl secret enumeration command was executed.	Informational	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Kubernetes secrets enumeration for the first time An identity listed Kubernetes secrets for the first time.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Credential Access
Analytics BIOC	Kubernetes service account activity outside the cluster A service account user successfully invoked API calls outside the Kubernetes cluster.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Initial Access
Analytics BIOC	Kubernetes version disclosure The Kubernetes API server was inquired about the Kubernetes version by a process from within a pod.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Kubernetes vulnerability scanner activity A Kubernetes cluster was scanned by a known vulnerability scanner.	Medium	Platform Analytics	XDR Agent	Execution, Discovery
Analytics BIOC	Kubernetes vulnerability scanning tool usage A known vulnerability scanning tool was used within a Kubernetes cluster.	Medium	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution, Discovery
Analytics	Large Upload (FTP) The endpoint transferred an excessively large amounts of data to a single destination over FTP. Cortex XDR Analytics assumes endpoint traffic towards a specific destination should be about the same over long periods of time. For that reason, Cortex XDR detected this abnormal behavior of a large data upload. An attacker may be exfiltrating data directly to the internet using this protocol.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics	Large Upload (Generic) The endpoint transferred large amounts of data to an external site using a different protocol from HTTP/s, FTP, or SMTP. (A specific detector is used for each of those protocols.) Cortex XDR Analytics assumes that data transfers out of your network are ordinarily performed using one of those three services, so it expects that data transfers over all other ports to be low. For the same reason, Cortex XDR Analytics also assumes endpoint traffic towards a specific destination should be about the same over long periods of time. An attacker may be exfiltrating data directly to the internet.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics	Large Upload (HTTPS) The endpoint transferred an excessive amount of data to an external site over HTTPS. The destination is not a popular upload site for endpoints on your network, and the endpoint performing the upload has not previously downloaded a large amount of data from the site. The upload is considered excessive based on comparison to baseline measurements of HTTPS data transfers on your network. An attacker may be exfiltrating data directly to the internet.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration
Analytics	Large Upload (SMTP) The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration
Analytics	Large volume of files potentially containing credentials accessed in Google Drive A user accessed a large volume of files potentially containing credentials in Google Drive.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Collection, Credential Access
Analytics BIOC	LDAP AD CS Enumeration via Attack Tool A user sent a suspicious AD CS enumeration query via LDAP. The query is associated with an AD CS LDAP enumeration tool that may be used during attacks against the organization.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics BIOC	LDAP search query from an unpopular and unsigned process An unpopular and unsigned process performed an LDAP search query. This may be indicative of LDAP enumeration.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	LDAP traffic from non-standard process LDAP traffic is usually performed by a standard set of processes. The endpoint had a non-standard process communicating over ports normally used by LDAP. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Linux local user account creation A user executed a process associated with user account creation.	Informational	Identity Analytics	XDR Agent	Persistence
Analytics BIOC	Linux network share discovery An adversary might use known tools to discover SMB shares within the compromised network.	Informational	Platform Analytics	XDR Agent	Discovery
BIOC	Linux network share discovery A Linux network share discovery command was executed.	Informational	Platform Analytics	Process execution	Discovery
Analytics BIOC	Linux process execution with a rare GitHub URL A process was executed with an uncommon GitHub URL in its command line. This may have legitimate uses, but it might also be used by attackers to download malicious payloads.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Linux system firewall was modified The system firewall was modified.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Local account discovery One of several local account discovery commands were executed.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Local group enumeration A user performed an enumeration on local groups to retrieve their details.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	Local group enumeration via RPC A user enumerated local groups via RPC.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	Local user account creation A user was observed creating a rare local user account.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Local user account creation by a machine account A machine account was observed creating a rare local user account.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	Local user enumeration via SAMR A user enumerated local users via SAMR.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
BIOC	Log deletion in known log file directories Deletion of log files in known log directories.	Informational	Platform Analytics	File	Defense Evasion
BIOC	Log deletion using the truncate command Usage of the truncate utility using "-s 0" argument to clear log files.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Log deletion via command-line tool An attacker may use the rm command to remove traces of their activities.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics	Log enumeration via cloud native logging service An activity of log enumeration operations via cloud native logging service was detected.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics BIOC	Logging was impaired via external encryption key The resource was configured with an external key This might be an attempt to disrupt log inspection.	Medium	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Impact, Defense Evasion
Analytics BIOC	Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.	Low	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.	Informational	Identity Analytics	XDR Agent	Defense Evasion
Analytics	Logs were not collected from a data source for an abnormally long time Logs were not collected from a data source for an abnormally long time.	Low	Platform Analytics	Health Monitoring Data	Impact
Analytics BIOC	LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process.	Informational	Platform Analytics	XDR Agent	Defense Evasion
BIOC	LOLBAS reading a Windows credential manager file Encrypted files under the path AppData\Roaming\Microsoft\Credentials are associated with saved passwords in the Windows system.	Informational	Platform Analytics	File	Credential Access
Analytics BIOC	LOLBIN created a PSScriptPolicyTest PowerShell script file A LOLBIN created a PSScriptPolicyTest file. This may be a sign of malicious PowerShell execution without directly invoking the powershell.exe binary.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution

Analytics BIOC

IAM role trust policy modification A cloud identity updated the trust policy of an AWS IAM role.

Informational

Cortex Cloud

AWS Audit Log

Persistence, Privilege Escalation

Analytics BIOC

IAM role was created An IAM role was created.

Informational

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Persistence, Privilege Escalation

Analytics BIOC

IAM role-attached managed policies were listed AWS IAM managed policies that are attached to a role were listed.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics BIOC

IAM User added to an IAM group An IAM user was added to an IAM group.

Informational

Cortex Cloud

AWS Audit Log

Privilege Escalation, Persistence

Analytics BIOC

Identity assigned an Azure AD Administrator Role An identity was assigned an Azure AD Administrator role.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Persistence

Analytics BIOC

Image file execution options (IFEO) registry key set Attackers may use the Image File Execution Options Registry key to launch their executable whenever the user attempts to execute a certain executable.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation, Persistence

BIOC

Impersonation using Rubeus tool User authentication should not be impersonated, since this is considered a malicious behavior.

Medium

Platform Analytics

Process execution

Defense Evasion

Analytics

Impossible travel by a cloud identity Cloud identity activity detected from distant geographic regions within an short time window. This suggests unauthorized use of credentials, possibly indicating a compromised account.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Initial Access

Analytics

Impossible traveler - SSO User connected from several remote countries, at least one of which is not commonly used in the organization, within a short period of time. This may indicate the account is compromised.

Low

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics

Impossible traveler - VPN A user connected to a VPN service from multiple remote countries in a short period of time, which should normally be impossible. This may indicate the account is compromised.

Low

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Credential Access, Resource Development

Analytics

Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics BIOC

Indicator blocking Auditing or logging configuration changes on Linux host.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Indirect command execution using the Program Compatibility Assistant Pcalua.exe (Program Compatibility Assistant) is used for running old programs that have compatibility issues. Attackers can use pcalua.exe to indirectly execute their malicious programs.

Medium

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Initial person-to-person email contact Identifies when a sender initiates contact with individuals with no prior history of interaction in the last 30 days.

Informational

Email Security

Microsoft 365 Emails

Execution, Credential Access

BIOC

Injection into ping.exe A process injected into an instance of ping.exe.

Informational

Platform Analytics

Remote code

Defense Evasion

Analytics BIOC

Injection into rundll32.exe A process injected into an instance of rundll32.exe.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Installation of a new System-V service Installation of a new System-V service.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation

BIOC

Installation of Cain & Abel password recovery tool A process created a Registry key associated with the common password cracking tool Cain & Abel.

Low

Platform Analytics

Registry

Credential Access

BIOC

Installation of networking security tools A security or penetration testing tool such as wireshark and nmap is being installed.

Informational

Platform Analytics

Process execution

Discovery

Analytics

Intense SSO failures An abnormally high amount of SSO authentication attempts were seen within a short period of time. This could be the outcome of a brute-force login attempt.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Initial Access

Analytics BIOC

Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation.

Low

Platform Analytics

XDR Agent

Execution, Privilege Escalation

Analytics

Interactive local account enumeration Multiple non-existing accounts attempted interactive local logins to a host within a short period. This may indicate that an attacker has physical access to the host and is trying to enumerate accounts.

Low

Identity Analytics

XDR Agent

Discovery, Credential Access

Analytics BIOC

Interactive login by a machine account A machine account performed an interactive or remote interactive login.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Interactive login by a service account A service account performed an interactive or remote interactive login.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Interactive login from a shared user account A user account has been seen active on multiple hosts. Shared accounts are often considered 'bad practice' and may present multiple security risks to the organization.

Informational

Identity Analytics

XDR Agent

Initial Access

BIOC

Interface enumeration using netsh Attackers may enumerate existing network interfaces using netsh.exe.

Informational

Platform Analytics

Process execution

Discovery

Analytics

Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

BIOC

Internet Explorer home page modification The Internet Explorer home page could be changed to a malicious page.

Low

Platform Analytics

Registry

Impact, Credential Access

BIOC

Internet Explorer security settings modification The Security Settings Check feature, which checks Internet Explorer security settings to determine risk, was disabled.

Informational

Platform Analytics

Registry

Defense Evasion

Analytics BIOC

Invalid SAML Detected A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD, Okta

Credential Access

Analytics

IP Rotation Pattern in SSO Spray A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics BIOC

Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host.

Informational

Platform Analytics

XDR Agent

Defense Evasion

BIOC

ISO mounted manually A user manually mounted an ISO file.

Informational

Platform Analytics

File

Defense Evasion

BIOC

Kerberos brute-force attack using Kerbrute This is a known Kerbrute tool command, used to conduct Kerberos authentication brute-force attacks.

Informational

Platform Analytics

Process execution

Credential Access

Analytics

Kerberos Pre-Auth Failures by Host The endpoint failed an unusual number of Kerberos pre-authentications (TGT requests) from at least three users when compared to its baseline. This can indicate a password-spraying attack.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

BIOC

Kerberos service ticket request in PowerShell command Asking for a specific Kerberos service ticket can indicate an attacker's attempt to "Kerberoast" or use the ticket directly.

High

Platform Analytics

Process execution

Credential Access, Lateral Movement

BIOC

Kerberos ticket forging using Impacket ticketer Suspected execution of Impacket's ticketer.py script for forging TGT/TGS Kerberos tickets.

Medium

Platform Analytics

Process execution

Defense Evasion, Privilege Escalation

Analytics BIOC

Kerberos Traffic from Non-Standard Process The endpoint had a non-standard process communicating over ports normally used by Kerberos. An attacker might be using malicious tools to move laterally.

Medium

Platform Analytics

XDR Agent

Discovery

Analytics

Kerberos User Enumeration A high amount of Kerberos principal unknown errors were generated on users in the last hour. This may be indicative of Kerberos user enumeration.

Medium

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Discovery

BIOC

Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.

Informational

Platform Analytics

Process execution

Persistence

BIOC

Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits.

Informational

Platform Analytics

Process execution

Persistence

BIOC

Key Certificate Search And Exfiltrate Possible attempt to search for key certificates and exfiltrate them.

Informational

Platform Analytics

Process execution

Credential Access

Analytics BIOC

Key credential attribute modification A user modified the msDS-KeyCredentialLink attribute for an account, which may indicate a shadow credentials attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

BIOC

Keychain Certificate Access Detected access to Keychain certificates.

Informational

Platform Analytics

Process execution

Credential Access

BIOC

Keychain Import Item An item was imported from the Keychain.

Informational

Platform Analytics

Process execution

Credential Access

BIOC

Keychain Unlock Detected Keychain unlocking.

Informational

Platform Analytics

Process execution

Credential Access

Analytics BIOC

Keylogging using system commands Usage of a Linux system utility to capture input.

Low

Platform Analytics

XDR Agent

Credential Access, Collection

Analytics BIOC

Known service display name with uncommon image-path Service created with a known display name but has an uncommon image-path.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Execution

Analytics BIOC

Known service name with an uncommon image-path A Service with a known service name has an uncommon image-path.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Execution

Analytics BIOC

Kubelet server communication from a pod The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges.

Informational

Platform Analytics

XDR Agent

Privilege Escalation, Discovery

Analytics BIOC

Kubernetes admission controller activity A Kubernetes admission controller has been created or modified.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Persistence, Credential Access

Analytics BIOC

Kubernetes API server communication from within a pod The Kubernetes API server was accessed from within a pod.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Kubernetes cluster events deletion Kubernetes cluster events deletion.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Defense Evasion

Analytics

Kubernetes enumeration activity An identity attempted to discover available resources within a cluster. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Discovery

Analytics

Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Kubernetes network policy modification A change has been made to the network policies of a Kubernetes cluster.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Impact

Analytics BIOC

Kubernetes nsenter container escape The nsenter command was used to execute a process in the context of the initialization process.

Informational

Platform Analytics

XDR Agent

Privilege Escalation

Analytics BIOC

Kubernetes Pod Created with host Inter Process Communications (IPC) namespace An identity created a Kubernetes pod with the host Inter Process Communications (IPC) namespace. This may indicate an adversary attempting to access data used by other pods that use the host's IPC namespace.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Privilege Escalation, Execution

Analytics BIOC

Kubernetes Pod created with host process ID (PID) namespace An identity created a Kubernetes pod with the host process ID (PID) namespace. This may indicate an adversary attempting to access processes running on the host, which could allow escalating privileges to root.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Privilege Escalation, Execution

Analytics BIOC

Kubernetes Pod Created With Sensitive Volume An identity created a Kubernetes Pod with a sensitive volume, allowing the Pod to have read or write permissions on the host's filesystem This could suggest an effort by an adversary to access sensitive files on the host and employ techniques for escalating privileges.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Privilege Escalation, Execution

Analytics BIOC

Kubernetes pod creation from unknown container image registry A Kubernetes pod was created with a container image from an unknown registry.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

Kubernetes pod creation with host network An identity created a Kubernetes pod attached to the host network. This may indicate an adversary attempting to access services bound to localhost, sniff traffic on any interface on the host, and potentially bypass the network policy.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Privilege Escalation, Execution

Analytics BIOC

Kubernetes Privileged Pod Creation An identity created a Kubernetes pod with a privileged container. This may indicate an adversary attempting to access that host's filesystem or gain root access to the host.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Privilege Escalation, Execution

Analytics BIOC

Kubernetes secret enumeration activity Kubectl secret enumeration command was executed.

Informational

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Kubernetes secrets enumeration for the first time An identity listed Kubernetes secrets for the first time.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Credential Access

Analytics BIOC

Kubernetes service account activity outside the cluster A service account user successfully invoked API calls outside the Kubernetes cluster.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Initial Access

Analytics BIOC

Kubernetes version disclosure The Kubernetes API server was inquired about the Kubernetes version by a process from within a pod.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Kubernetes vulnerability scanner activity A Kubernetes cluster was scanned by a known vulnerability scanner.

Medium

Platform Analytics

XDR Agent

Execution, Discovery

Analytics BIOC

Kubernetes vulnerability scanning tool usage A known vulnerability scanning tool was used within a Kubernetes cluster.

Medium

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution, Discovery

Analytics

Large Upload (FTP) The endpoint transferred an excessively large amounts of data to a single destination over FTP. Cortex XDR Analytics assumes endpoint traffic towards a specific destination should be about the same over long periods of time. For that reason, Cortex XDR detected this abnormal behavior of a large data upload. An attacker may be exfiltrating data directly to the internet using this protocol.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics

Large Upload (Generic) The endpoint transferred large amounts of data to an external site using a different protocol from HTTP/s, FTP, or SMTP. (A specific detector is used for each of those protocols.) Cortex XDR Analytics assumes that data transfers out of your network are ordinarily performed using one of those three services, so it expects that data transfers over all other ports to be low. For the same reason, Cortex XDR Analytics also assumes endpoint traffic towards a specific destination should be about the same over long periods of time. An attacker may be exfiltrating data directly to the internet.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics

Large Upload (HTTPS) The endpoint transferred an excessive amount of data to an external site over HTTPS. The destination is not a popular upload site for endpoints on your network, and the endpoint performing the upload has not previously downloaded a large amount of data from the site. The upload is considered excessive based on comparison to baseline measurements of HTTPS data transfers on your network. An attacker may be exfiltrating data directly to the internet.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration

Analytics

Large Upload (SMTP) The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration

Analytics

Large volume of files potentially containing credentials accessed in Google Drive A user accessed a large volume of files potentially containing credentials in Google Drive.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Collection, Credential Access

Analytics BIOC

LDAP AD CS Enumeration via Attack Tool A user sent a suspicious AD CS enumeration query via LDAP. The query is associated with an AD CS LDAP enumeration tool that may be used during attacks against the organization.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics BIOC

LDAP search query from an unpopular and unsigned process An unpopular and unsigned process performed an LDAP search query. This may be indicative of LDAP enumeration.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

LDAP traffic from non-standard process LDAP traffic is usually performed by a standard set of processes. The endpoint had a non-standard process communicating over ports normally used by LDAP. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Linux local user account creation A user executed a process associated with user account creation.

Informational

Identity Analytics

XDR Agent

Persistence

Analytics BIOC

Linux network share discovery An adversary might use known tools to discover SMB shares within the compromised network.

Informational

Platform Analytics

XDR Agent

Discovery

BIOC

Linux network share discovery A Linux network share discovery command was executed.

Informational

Platform Analytics

Process execution

Discovery

Analytics BIOC

Linux process execution with a rare GitHub URL A process was executed with an uncommon GitHub URL in its command line. This may have legitimate uses, but it might also be used by attackers to download malicious payloads.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Linux system firewall was modified The system firewall was modified.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Local account discovery One of several local account discovery commands were executed.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Local group enumeration A user performed an enumeration on local groups to retrieve their details.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

Local group enumeration via RPC A user enumerated local groups via RPC.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

Local user account creation A user was observed creating a rare local user account.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Local user account creation by a machine account A machine account was observed creating a rare local user account.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

Local user enumeration via SAMR A user enumerated local users via SAMR.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

BIOC

Log deletion in known log file directories Deletion of log files in known log directories.

Informational

Platform Analytics

File

Defense Evasion

BIOC

Log deletion using the truncate command Usage of the truncate utility using "-s 0" argument to clear log files.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Log deletion via command-line tool An attacker may use the rm command to remove traces of their activities.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics

Log enumeration via cloud native logging service An activity of log enumeration operations via cloud native logging service was detected.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics BIOC

Logging was impaired via external encryption key The resource was configured with an external key This might be an attempt to disrupt log inspection.

Medium

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Impact, Defense Evasion

Analytics BIOC

Login attempt by a honey user A login attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Low

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker.

Informational

Identity Analytics

XDR Agent

Defense Evasion

Analytics

Logs were not collected from a data source for an abnormally long time Logs were not collected from a data source for an abnormally long time.

Low

Platform Analytics

Health Monitoring Data

Impact

Analytics BIOC

LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process.

Informational

Platform Analytics

XDR Agent

Defense Evasion

BIOC

LOLBAS reading a Windows credential manager file Encrypted files under the path AppData\Roaming\Microsoft\Credentials are associated with saved passwords in the Windows system.

Informational

Platform Analytics

File

Credential Access

Analytics BIOC

LOLBIN created a PSScriptPolicyTest PowerShell script file A LOLBIN created a PSScriptPolicyTest file. This may be a sign of malicious PowerShell execution without directly invoking the powershell.exe binary.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution