Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics	A compromised process accessed a rare cloud resource A compromised process accessed a rare cloud resource.	Informational	Platform Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Command and Control
Analytics	A user accessed an abnormal number of files on a remote shared folder A user remotely accessed an abnormal number of files on a remote shared folder. This might indicate an attempt to collect data before exfiltration.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics	A user accessed an abnormal number of remote shared folders A user accessed an abnormal number of remote shared folders. This might indicate an attempt to collect data before exfiltration.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	A user accessed multiple time-consuming websites A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics	A user accessed multiple unusual resources via SSO A user accessed multiple resources via SSO that are unusual for this user. This may be indicative of a compromised account.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Discovery, Initial Access
Analytics	A user authenticated with weak NTLM to multiple hosts A user account authenticated to multiple hosts via NTLMv1 or LM authentication for the first time in the past 30 days.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics	A user established an SMB connection to multiple hosts A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics	A user executed multiple LDAP enumeration queries A user executed multiple LDAP enumeration queries.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics	A user logged on to multiple workstations via Schannel A user logged on to multiple workstations with a certificate via Schannel. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Persistence, Privilege Escalation, Credential Access
Analytics	A user observed and reported unusual activity in Okta A user observed and reported unusual activity in Okta.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access
Analytics	A user performed suspiciously massive file activity A user generated massive file activity by size or distinct file count.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	A user printed an unusual number of files A user printed an unusual number of files. This may be indicative of malicious activity and an attempt to exfiltrate data.	Informational	Identity Threat Detection (ITDR)	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Exfiltration
Analytics	A user received multiple weakly encrypted service tickets A user received multiple weakly encrypted service tickets. This is typically a sign of a Kerberoasting attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	A user requested multiple service tickets A user requested multiple service tickets. This is typically a sign of a Kerberoasting attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	A user took numerous screenshots A user took numerous screenshots. A valuable organization's information may have been collected in this way.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	Abnormal Allocation of compute resources in multiple regions An identity allocated an unusual compute resource pool, suspected as mining activity.	Informational	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Impact, Initial Access
Analytics	Abnormal connections to a dormant host from a newly seen endpoint The endpoint has performed multiple connections to an endpoint that is relatively inactive on the network.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Discovery
Analytics	Abnormal File Activity in SCCMContentLib Shared Folder by user A user generated suspicious file activity within the SCCMContentLib shared folder, which is considered a high-value target for attackers.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access, Privilege Escalation
Analytics	Abnormal RDP connections to multiple hosts The endpoint attempted to initiate rare RDP connections to multiple hosts.	Informational	Platform Analytics	XDR Agent	Lateral Movement
Analytics	Abnormal SMB scanning activity to multiple hosts An endpoint performed a new, unfamiliar SMB scanning activity to multiple hosts on the network.	Informational	Platform Analytics	XDR Agent	Reconnaissance
Analytics	AI-determined combination of risky alerts under the same actor process Multiple alerts likely to be associated with an incident were identified under the same actor process.	Informational	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Execution
Analytics	AI-determined combination of risky alerts under the same causality Multiple alerts likely to be associated with an incident were identified under the same causality.	Informational	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Execution
Analytics	Allocation of multiple cloud compute resources An identity allocated multiple compute resources.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact, Initial Access
Analytics	An Azure identity performed multiple actions that were denied An identity performed multiple Microsoft Graph actions that were denied, which may indicate it is being misused.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	An identity initiated a download of multiple cloud objects An identity initiated a download of multiple cloud objects. This might be an indication for an adversary trying to exfiltrate data from cloud storage.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection, Exfiltration
Analytics	An identity performed a suspicious download of multiple cloud storage objects An identity downloaded multiple objects from cloud storage. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection, Exfiltration
Analytics	AWS Bedrock AI infrastructure enumeration activity Bedrock AI infrastructure enumeration activity detected, potentially indicating reconnaissance on AI resources.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	AWS EBS enumeration activity EBS volume and snapshot enumeration activity, potentially indicating block storage reconnaissance.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	AWS EC2 infrastructure enumeration activity EC2 infrastructure enumeration activity detected within a specific AWS region.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	AWS Lambda infrastructure enumeration activity Lambda infrastructure enumeration activity detected within a specific AWS region.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	AWS S3 Buckets enumeration activity Enumeration of S3 buckets, suggesting potential cloud storage reconnaissance.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	AWS Security Service Enumeration AWS security service enumeration activity, potentially indicating reconnaissance.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	Azure enumeration activity using Microsoft Graph API The Microsoft Graph API was used to enumerate an Azure tenant.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Brute-force attempt on a local account A local user account failed to log in multiple times in a short time period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	Cloud email infrastructure enumeration activity A cloud identity attempted to discover available email sending resources within the cloud environment. This may indicate an adversary attempting to map the organization's email sending environment and discover cloud resources that may assist to send phishing emails or spam.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log	Discovery
Analytics	Cloud infrastructure discovery across multiple regions Discovery API calls were executed across multiple AWS regions.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	Cloud infrastructure enumeration activity A cloud identity attempted to discover available resources within the cloud environment. This may indicate an adversary attempting to map the organization's cloud environment and discover cloud resources that may assist to perform additional attacks within the environment.	Informational	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Discovery
Analytics	Cloud user performed multiple actions that were denied An identity performed multiple actions that were denied, which may indicate it is being misused.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Discovery
Analytics	Deletion of multiple cloud resources An identity deleted multiple cloud resources.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics	Download pattern that resembles Peer to Peer traffic A possible P2P protocol was spotted from an internal host.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Command and Control, Initial Access
Analytics	Exchange mailbox delegation permissions added A user added delegation permissions to an Exchange mailbox.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Persistence
Analytics	External Login Password Spray An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	External SaaS file-sharing activity A user shared files from within a SaaS service to an external domain.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit	Collection
Analytics	External user call via Microsoft Teams An external user called a user in the organization via Microsoft Teams.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Initial Access
Analytics	External user created a Microsoft Teams conversation with suspicious operations An external user created a Microsoft Teams conversation with users in the organization with additional suspicious operations.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Initial Access
Analytics	External user started a Microsoft Teams conversation An external user started a Microsoft Teams conversation with users in the organization.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Initial Access
Analytics	IAM Enumeration sequence An identity has executed a sequence of events which may be related to an IAM recon enumeration.	Informational	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Discovery
Analytics	Impossible travel by a cloud identity Cloud identity activity detected from distant geographic regions within an short time window. This suggests unauthorized use of credentials, possibly indicating a compromised account.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Initial Access
Analytics	Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics	Intense SSO failures An abnormally high amount of SSO authentication attempts were seen within a short period of time. This could be the outcome of a brute-force login attempt.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Initial Access
Analytics	Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	IP Rotation Pattern in SSO Spray A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics	Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	Kubernetes enumeration activity An identity attempted to discover available resources within a cluster. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Discovery
Analytics	Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Large volume of files potentially containing credentials accessed in Google Drive A user accessed a large volume of files potentially containing credentials in Google Drive.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Collection, Credential Access
Analytics	Local group enumeration A user performed an enumeration on local groups to retrieve their details.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics	Log enumeration via cloud native logging service An activity of log enumeration operations via cloud native logging service was detected.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics	Mailbox enumeration activity by Azure application Microsoft Graph API was used to enumerate mailboxes in Azure tenant.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Massive file activity abnormal to process A user generated massive file activity by size or distinct file count.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	Massive file compression by user Multiple archive files were created by a user. This might indicate an attempt to stage data before exfiltration.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics	Massive file downloads from SaaS service A user downloaded a large volume of files from an organizational SaaS service, either exceeding the normal file count or size for the user's typical behavior.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit	Collection
Analytics	Massive files deletion in Box A user deleted a large amount of data in Box. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	Box Audit Log	Impact
Analytics	Massive files deletion in Dropbox A user deleted a large amount of data in Dropbox. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	DropBox	Impact
Analytics	Massive files deletion in Google Drive A user deleted a large amount of data in Google Drive. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	Google Workspace Audit Logs	Impact
Analytics	Massive files deletion in Microsoft SharePoint or OneDrive A user deleted a large amount of data in Microsoft SharePoint or OneDrive. This behavior may indicate that the data is being wiped.	Informational	Identity Threat Detection (ITDR)	Office 365 Audit	Impact
Analytics	Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent	Exfiltration
Analytics	Massive upload to SaaS service A user uploaded a large amount of data to an organizational cloud storage. This behavior may indicate that the data is being exfiltrated or staged.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit	Exfiltration, Collection
Analytics	Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.	Informational	Identity Analytics	XDR Agent	Credential Access, Privilege Escalation
Analytics	Microsoft OneDrive enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneDrive items.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Microsoft OneNote enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneNote items.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Microsoft SharePoint enumeration activity The Microsoft Graph API was used to enumerate Microsoft SharePoint sites in an Azure tenant.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Microsoft Teams enumeration activity The Microsoft Graph API was used to enumerate Microsoft Teams channels in an Azure tenant.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Discovery
Analytics	Multi region enumeration activity An internal identity performed an operation on multiple regions, considerably more than usual. This may indicate an attacker's attempt to identify all available resources in the cloud environment.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Discovery, Defense Evasion
Analytics	Multiple alerts associated with a single RDP connection Multiple alerts associated with a single RDP connection were triggered.	Informational	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Lateral Movement
Analytics	Multiple cloud snapshots export A cloud identity has downloaded multiple virtual machines or DB snapshots locally.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Exfiltration
Analytics	Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics	Multiple failed AWS assume role attempts An AWS identity performed an unusual high number of failed assume role attempts.	Informational	Cortex Cloud	AWS Audit Log	Discovery, Privilege Escalation
Analytics	Multiple failed logins from a single IP Multiple failed logins were observed in a short period of time from a single external IP. The IP is not a known identity provider.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Initial Access
Analytics	Multiple Okta MFA requests sent to a user Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.	Informational	Identity Analytics	Okta	Credential Access, Resource Development
Analytics	Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.	Informational	Identity Analytics	XDR Agent	Execution
Analytics	Multiple TGT requests for users without Kerberos pre-authentication Multiple TGT requests for users that do not require Kerberos pre-authentication were observed. This is typically a sign of an AS-REP attack.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	Multiple user accounts were deleted A user deleted multiple user accounts.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Impact
Analytics	Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.	Informational	Identity Analytics	XDR Agent	Lateral Movement
Analytics	NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.	Informational	Identity Analytics	XDR Agent	Credential Access
Analytics	NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.	Informational	Identity Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access
Analytics	NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Credential Access, Lateral Movement
Analytics	Numerous emails sent by a single sender to multiple internal recipients Numerous emails were sent to multiple internal recipients. This may indicate spam or any other malicious attempt.	Informational	Email Security	Microsoft 365 Emails	Initial Access
Analytics	Okta account reset password attempt A user used a weak factor to reset their Okta password.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access
Analytics	Okta account unlock Okta user account was unlocked.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access
Analytics	Okta device assignment A device was assigned as an Okta MFA device to a user.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access, Persistence
Analytics	Okta Reported Threat Detected Okta Threat Insight Reported Threat Detected.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access
Analytics	Port Scan The endpoint connected, or attempted to connect, to multiple privileged ports, which are infrequently used by other endpoints (i.e. destination ports that are normally used by many endpoints will not raise this alert). Attackers perform port scans for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port scans using data arriving solely from Cortex agents is incomplete.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, Third-Party Firewalls	Discovery
Analytics	Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Discovery
Analytics	Possible Brute Force in universal authentication An abnormally high amount of authentication attempts via universal authentication were seen within a short period of time. This may indicate a brute-force attack.	Informational	Identity Analytics		Credential Access, Resource Development
Analytics	Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.	Informational	Platform Analytics	XDR Agent	Credential Access
Analytics	Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.	Informational	Identity Analytics	XDR Agent	Credential Access, Lateral Movement
Analytics	Possible ConsentFix - OAuth Token Theft Detected Detection of potential OAuth token theft via a forced 'localhost' redirect and first-party app abuse. This indicates an attacker has likely bypassed MFA to hijack a user's cloud session.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD	Initial Access, Credential Access, Execution
Analytics	Possible data exfiltration over a USB storage device A process generated massive file creation, renaming and write activity to a USB storage device.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration

Analytics

A compromised process accessed a rare cloud resource A compromised process accessed a rare cloud resource.

Informational

Platform Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Command and Control

Analytics

A user accessed an abnormal number of files on a remote shared folder A user remotely accessed an abnormal number of files on a remote shared folder. This might indicate an attempt to collect data before exfiltration.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics

A user accessed an abnormal number of remote shared folders A user accessed an abnormal number of remote shared folders. This might indicate an attempt to collect data before exfiltration.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

A user accessed multiple time-consuming websites A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics

A user accessed multiple unusual resources via SSO A user accessed multiple resources via SSO that are unusual for this user. This may be indicative of a compromised account.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Discovery, Initial Access

Analytics

A user authenticated with weak NTLM to multiple hosts A user account authenticated to multiple hosts via NTLMv1 or LM authentication for the first time in the past 30 days.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics

A user established an SMB connection to multiple hosts A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics

A user executed multiple LDAP enumeration queries A user executed multiple LDAP enumeration queries.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics

A user logged on to multiple workstations via Schannel A user logged on to multiple workstations with a certificate via Schannel. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Persistence, Privilege Escalation, Credential Access

Analytics

A user observed and reported unusual activity in Okta A user observed and reported unusual activity in Okta.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access

Analytics

A user performed suspiciously massive file activity A user generated massive file activity by size or distinct file count.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

A user printed an unusual number of files A user printed an unusual number of files. This may be indicative of malicious activity and an attempt to exfiltrate data.

Informational

Identity Threat Detection (ITDR)

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Exfiltration

Analytics

A user received multiple weakly encrypted service tickets A user received multiple weakly encrypted service tickets. This is typically a sign of a Kerberoasting attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

A user requested multiple service tickets A user requested multiple service tickets. This is typically a sign of a Kerberoasting attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

A user took numerous screenshots A user took numerous screenshots. A valuable organization's information may have been collected in this way.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

Abnormal Allocation of compute resources in multiple regions An identity allocated an unusual compute resource pool, suspected as mining activity.

Informational

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Impact, Initial Access

Analytics

Abnormal connections to a dormant host from a newly seen endpoint The endpoint has performed multiple connections to an endpoint that is relatively inactive on the network.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Discovery

Analytics

Abnormal File Activity in SCCMContentLib Shared Folder by user A user generated suspicious file activity within the SCCMContentLib shared folder, which is considered a high-value target for attackers.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access, Privilege Escalation

Analytics

Abnormal RDP connections to multiple hosts The endpoint attempted to initiate rare RDP connections to multiple hosts.

Informational

Platform Analytics

XDR Agent

Lateral Movement

Analytics

Abnormal SMB scanning activity to multiple hosts An endpoint performed a new, unfamiliar SMB scanning activity to multiple hosts on the network.

Informational

Platform Analytics

XDR Agent

Reconnaissance

Analytics

AI-determined combination of risky alerts under the same actor process Multiple alerts likely to be associated with an incident were identified under the same actor process.

Informational

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Execution

Analytics

AI-determined combination of risky alerts under the same causality Multiple alerts likely to be associated with an incident were identified under the same causality.

Informational

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Execution

Analytics

Allocation of multiple cloud compute resources An identity allocated multiple compute resources.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact, Initial Access

Analytics

An Azure identity performed multiple actions that were denied An identity performed multiple Microsoft Graph actions that were denied, which may indicate it is being misused.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

An identity initiated a download of multiple cloud objects An identity initiated a download of multiple cloud objects. This might be an indication for an adversary trying to exfiltrate data from cloud storage.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Collection, Exfiltration

Analytics

An identity performed a suspicious download of multiple cloud storage objects An identity downloaded multiple objects from cloud storage. This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Collection, Exfiltration

Analytics

AWS Bedrock AI infrastructure enumeration activity Bedrock AI infrastructure enumeration activity detected, potentially indicating reconnaissance on AI resources.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

AWS EBS enumeration activity EBS volume and snapshot enumeration activity, potentially indicating block storage reconnaissance.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

AWS EC2 infrastructure enumeration activity EC2 infrastructure enumeration activity detected within a specific AWS region.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

AWS Lambda infrastructure enumeration activity Lambda infrastructure enumeration activity detected within a specific AWS region.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

AWS S3 Buckets enumeration activity Enumeration of S3 buckets, suggesting potential cloud storage reconnaissance.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

AWS Security Service Enumeration AWS security service enumeration activity, potentially indicating reconnaissance.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

Azure enumeration activity using Microsoft Graph API The Microsoft Graph API was used to enumerate an Azure tenant.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Brute-force attempt on a local account A local user account failed to log in multiple times in a short time period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

Cloud email infrastructure enumeration activity A cloud identity attempted to discover available email sending resources within the cloud environment. This may indicate an adversary attempting to map the organization's email sending environment and discover cloud resources that may assist to send phishing emails or spam.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log

Discovery

Analytics

Cloud infrastructure discovery across multiple regions Discovery API calls were executed across multiple AWS regions.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

Cloud infrastructure enumeration activity A cloud identity attempted to discover available resources within the cloud environment. This may indicate an adversary attempting to map the organization's cloud environment and discover cloud resources that may assist to perform additional attacks within the environment.

Informational

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Discovery

Analytics

Cloud user performed multiple actions that were denied An identity performed multiple actions that were denied, which may indicate it is being misused.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Discovery

Analytics

Deletion of multiple cloud resources An identity deleted multiple cloud resources.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics

Download pattern that resembles Peer to Peer traffic A possible P2P protocol was spotted from an internal host.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Command and Control, Initial Access

Analytics

Exchange mailbox delegation permissions added A user added delegation permissions to an Exchange mailbox.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Persistence

Analytics

External Login Password Spray An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

External SaaS file-sharing activity A user shared files from within a SaaS service to an external domain.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit

Collection

Analytics

External user call via Microsoft Teams An external user called a user in the organization via Microsoft Teams.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Initial Access

Analytics

External user created a Microsoft Teams conversation with suspicious operations An external user created a Microsoft Teams conversation with users in the organization with additional suspicious operations.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Initial Access

Analytics

External user started a Microsoft Teams conversation An external user started a Microsoft Teams conversation with users in the organization.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Initial Access

Analytics

IAM Enumeration sequence An identity has executed a sequence of events which may be related to an IAM recon enumeration.

Informational

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Discovery

Analytics

Impossible travel by a cloud identity Cloud identity activity detected from distant geographic regions within an short time window. This suggests unauthorized use of credentials, possibly indicating a compromised account.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Initial Access

Analytics

Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent

Reconnaissance

Analytics

Intense SSO failures An abnormally high amount of SSO authentication attempts were seen within a short period of time. This could be the outcome of a brute-force login attempt.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Initial Access

Analytics

Internal Login Password Spray An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

IP Rotation Pattern in SSO Spray A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics

Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

Kubernetes enumeration activity An identity attempted to discover available resources within a cluster. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Discovery

Analytics

Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Large volume of files potentially containing credentials accessed in Google Drive A user accessed a large volume of files potentially containing credentials in Google Drive.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Collection, Credential Access

Analytics

Local group enumeration A user performed an enumeration on local groups to retrieve their details.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics

Log enumeration via cloud native logging service An activity of log enumeration operations via cloud native logging service was detected.

Informational

Cortex Cloud

AWS Audit Log

Discovery

Analytics

Mailbox enumeration activity by Azure application Microsoft Graph API was used to enumerate mailboxes in Azure tenant.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Massive file activity abnormal to process A user generated massive file activity by size or distinct file count.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

Massive file compression by user Multiple archive files were created by a user. This might indicate an attempt to stage data before exfiltration.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics

Massive file downloads from SaaS service A user downloaded a large volume of files from an organizational SaaS service, either exceeding the normal file count or size for the user's typical behavior.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit

Collection

Analytics

Massive files deletion in Box A user deleted a large amount of data in Box. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

Box Audit Log

Impact

Analytics

Massive files deletion in Dropbox A user deleted a large amount of data in Dropbox. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

DropBox

Impact

Analytics

Massive files deletion in Google Drive A user deleted a large amount of data in Google Drive. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

Google Workspace Audit Logs

Impact

Analytics

Massive files deletion in Microsoft SharePoint or OneDrive A user deleted a large amount of data in Microsoft SharePoint or OneDrive. This behavior may indicate that the data is being wiped.

Informational

Identity Threat Detection (ITDR)

Office 365 Audit

Impact

Analytics

Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent

Exfiltration

Analytics

Massive upload to SaaS service A user uploaded a large amount of data to an organizational cloud storage. This behavior may indicate that the data is being exfiltrated or staged.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit

Exfiltration, Collection

Analytics

Microsoft Configuration Manager device registration and policy request A user registered a device and requested a Microsoft Configuration Manager policy.

Informational

Identity Analytics

XDR Agent

Credential Access, Privilege Escalation

Analytics

Microsoft OneDrive enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneDrive items.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Microsoft OneNote enumeration activity The Microsoft Graph API was used to enumerate Microsoft OneNote items.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Microsoft SharePoint enumeration activity The Microsoft Graph API was used to enumerate Microsoft SharePoint sites in an Azure tenant.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Microsoft Teams enumeration activity The Microsoft Graph API was used to enumerate Microsoft Teams channels in an Azure tenant.

Informational

Cortex Cloud

Azure Audit Log, Microsoft Graph Logs

Discovery

Analytics

Multi region enumeration activity An internal identity performed an operation on multiple regions, considerably more than usual. This may indicate an attacker's attempt to identify all available resources in the cloud environment.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Discovery, Defense Evasion

Analytics

Multiple alerts associated with a single RDP connection Multiple alerts associated with a single RDP connection were triggered.

Informational

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Lateral Movement

Analytics

Multiple cloud snapshots export A cloud identity has downloaded multiple virtual machines or DB snapshots locally.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Exfiltration

Analytics

Multiple discovery commands on a Linux host by the same process The alerted process performed multiple consecutive discovery commands in a short timeframe.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple discovery-like commands The alerted process performed multiple consecutive discovery commands in a short time frame.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics

Multiple failed AWS assume role attempts An AWS identity performed an unusual high number of failed assume role attempts.

Informational

Cortex Cloud

AWS Audit Log

Discovery, Privilege Escalation

Analytics

Multiple failed logins from a single IP Multiple failed logins were observed in a short period of time from a single external IP. The IP is not a known identity provider.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Initial Access

Analytics

Multiple Okta MFA requests sent to a user Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack.

Informational

Identity Analytics

Okta

Credential Access, Resource Development

Analytics

Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account.

Informational

Identity Analytics

XDR Agent

Execution

Analytics

Multiple TGT requests for users without Kerberos pre-authentication Multiple TGT requests for users that do not require Kerberos pre-authentication were observed. This is typically a sign of an AS-REP attack.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

Multiple user accounts were deleted A user deleted multiple user accounts.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Impact

Analytics

Multiple users authenticated with weak NTLM to a host Multiple user accounts authenticated to a host via NTLMv1 or LM authentication for the first time in the past 30 days. This may be a result of an NTLM downgrade attack A downgrade attack may force the client to authenticate with a weaker hash/protocol (such as NTLMv1 or even LM) instead of NTLMv2.

Informational

Identity Analytics

XDR Agent

Lateral Movement

Analytics

NTLM Brute Force A user account attempted to authenticate to a target using NTLM an excessive number of times in a short period. This may indicate an NTLM brute force attack.

Informational

Identity Analytics

XDR Agent

Credential Access

Analytics

NTLM Password Spray A single host tried to perform an unusual amount of login attempts using NTLM in a short period of time. This may be indicative of a NTLM password spray attack.

Informational

Identity Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access

Analytics

NTLM Relay An NTLM NTProofStr was seen from more than one source. This indicates that NTLM authentication data has been relayed.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Credential Access, Lateral Movement

Analytics

Numerous emails sent by a single sender to multiple internal recipients Numerous emails were sent to multiple internal recipients. This may indicate spam or any other malicious attempt.

Informational

Email Security

Microsoft 365 Emails

Initial Access

Analytics

Okta account reset password attempt A user used a weak factor to reset their Okta password.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access

Analytics

Okta account unlock Okta user account was unlocked.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access

Analytics

Okta device assignment A device was assigned as an Okta MFA device to a user.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access, Persistence

Analytics

Okta Reported Threat Detected Okta Threat Insight Reported Threat Detected.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access

Analytics

Port Scan The endpoint connected, or attempted to connect, to multiple privileged ports, which are infrequently used by other endpoints (i.e. destination ports that are normally used by many endpoints will not raise this alert). Attackers perform port scans for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port scans using data arriving solely from Cortex agents is incomplete.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, Third-Party Firewalls

Discovery

Analytics

Port Sweep The endpoint connected, or attempted to connect, to multiple hosts using privileged ports that serve a well-defined function. Attackers perform port sweep for reconnaissance purposes, to find computers or servers that accept connections on these ports, and to find vulnerable services that can be exploited. Coverage for port sweeps using data arriving solely from Cortex agents is incomplete.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Discovery

Analytics

Possible Brute Force in universal authentication An abnormally high amount of authentication attempts via universal authentication were seen within a short period of time. This may indicate a brute-force attack.

Informational

Identity Analytics

Credential Access, Resource Development

Analytics

Possible brute force on sudo user A user executed an unusual amount of sudo commands in a short time period. This may indicate an attempt to guess the sudo password.

Informational

Platform Analytics

XDR Agent

Credential Access

Analytics

Possible Brute-Force attempt A user account attempted to authenticate to a target an excessive number of times in a short period. This may indicate a brute-force attack.

Informational

Identity Analytics

XDR Agent

Credential Access, Lateral Movement

Analytics

Possible ConsentFix - OAuth Token Theft Detected Detection of potential OAuth token theft via a forced 'localhost' redirect and first-party app abuse. This indicates an attacker has likely bypassed MFA to hijack a user's cloud session.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD

Initial Access, Credential Access, Execution

Analytics

Possible data exfiltration over a USB storage device A process generated massive file creation, renaming and write activity to a USB storage device.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration