Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A browser extension was installed or loaded in an uncommon way A browser extension was installed or loaded in an uncommon way.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks.	Informational	Identity Threat Detection (ITDR)	XDR Agent	Defense Evasion
Analytics BIOC	A Cloud DB instance was exported to an unknown destination A Cloud DB instance was exported to a foreign storage destination. The destination storage has not been seen in the organization in the last 30 days.	Informational	Cortex Cloud	Gcp Audit Log	Exfiltration
Analytics BIOC	A cloud identity created or modified a security group A cloud identity created or modified a security group.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Defense Evasion
Analytics BIOC	A cloud identity executed an API call from an unusual country A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Initial Access
Analytics BIOC	A cloud identity had escalated its permissions A cloud identity had updated its permissions.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Privilege Escalation
Analytics BIOC	A cloud identity invoked IAM related persistence operations A cloud identity invoked IAM related persistence operations.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Persistence
Analytics BIOC	A cloud identity started a Cloud Shell session A cloud identity started a Cloud Shell session.	Informational	Cortex Cloud	AWS Audit Log	Execution
Analytics BIOC	A cloud instance was stopped A cloud compute instance was stopped.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics BIOC	A cloud snapshot of AWS database or storage was modified or shared A cloud identity has shared a snapshot of an AWS database or storage instance.	Informational	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	A cloud storage configuration was modified A cloud storage configuration was modified.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Defense Evasion
Analytics BIOC	A compressed file was exfiltrated over SSH Exfiltration of a compressed file over SSH.	Informational	Platform Analytics	XDR Agent	Exfiltration
Analytics BIOC	A compute-attached identity executed API calls outside the instance's region A compute-attached identity performed actions outside the compute instance region.	Informational	Cortex Cloud	AWS Audit Log	Initial Access, Credential Access
Analytics BIOC	A container registry was created or deleted A container registry was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Impact
Analytics BIOC	A disabled user attempted to authenticate via SSO A disabled user attempted to authenticate via SSO.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	A disabled user attempted to log in A disabled user attempted to log in.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	A GCP Cloud SQL DB instance was exported from a production account A GCP Cloud SQL DB instance was exported to a storage bucket. The DB instance was exported from a production account.	Informational	Cortex Cloud	Gcp Audit Log	Exfiltration
Analytics BIOC	A Google Workspace identity created, assigned or modified a role A Google Workspace identity created, assigned or modified a delegated admin role.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Persistence
Analytics BIOC	A Google Workspace identity performed an unusual admin console activity A Google Workspace identity performed an admin console activity for the first time.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Persistence
Analytics BIOC	A Google Workspace identity used the security investigation tool A Google Workspace identity used the security investigation tool The Google Workspace security investigation tool can be abused to access sensitive data.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Collection
Analytics BIOC	A Google Workspace Role privilege was deleted A privilege was removed from a Google Workspace Role, This could potentially affect the access to services and data in the organization.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Impact
Analytics BIOC	A Google Workspace service was configured as unrestricted An identity configured a Google Workspace service as unrestricted Apps configured with a trusted or limited access setting can access data for unrestricted services.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Privilege Escalation
Analytics BIOC	A Google Workspace user was added to a group A user added another user to a Google Workspace group.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Persistence
Analytics BIOC	A Google Workspace user was removed from a group A user removed another user from a Google Workspace group.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Impact
Analytics BIOC	A Kubernetes cluster role binding was created or deleted A Kubernetes cluster role binding was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Privilege Escalation
Analytics BIOC	A Kubernetes cluster role was created A Kubernetes cluster role was created.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Persistence, Privilege Escalation
Analytics BIOC	A Kubernetes cluster was created or deleted A Kubernetes cluster was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Impact
Analytics BIOC	A Kubernetes ConfigMap was created or deleted A Kubernetes ConfigMap was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Persistence
Analytics BIOC	A Kubernetes Cronjob was created A Kubernetes CronJob was created.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Persistence
Analytics BIOC	A Kubernetes DaemonSet was created A Kubernetes DaemonSet was created.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	A Kubernetes deployment was created A Kubernetes deployment was created.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	A Kubernetes ephemeral container was created A Kubernetes ephemeral container was created.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	A Kubernetes namespace was created or deleted A Kubernetes namespace was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Defense Evasion
Analytics BIOC	A Kubernetes node service account activity from external IP A Kubernetes node service account was seen operating from an external IP.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Initial Access
Analytics BIOC	A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was created with a sidecar container.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	A Kubernetes Pod was deleted A Kubernetes Pod was deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Impact
Analytics BIOC	A Kubernetes ReplicaSet was created A Kubernetes ReplicaSet was created.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	A Kubernetes role binding was created or deleted A Kubernetes role binding was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Privilege Escalation
Analytics BIOC	A Kubernetes secret was created or deleted A Kubernetes secret was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Credential Access
Analytics BIOC	A Kubernetes service account executed an unusual API call A Kubernetes service account executed an unusual API call.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	A Kubernetes service account has enumerated its permissions A Kubernetes service account has enumerated its permissions using the self subject review API.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Discovery
Analytics BIOC	A Kubernetes service account was created or deleted A Kubernetes service account was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Persistence
Analytics BIOC	A Kubernetes service was created or deleted A Kubernetes service was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Impact
Analytics BIOC	A Kubernetes StatefulSet was created A Kubernetes StatefulSet was created.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Execution
Analytics BIOC	A LOLBIN was copied to a different location To evade detection, attackers may copy a LOLBIN executable to a different location.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	A Microsoft Teams application was installed A Microsoft Teams application was installed.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Persistence
Analytics BIOC	A Microsoft Teams bot was added to a team A user added a bot to a team in Microsoft Teams.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Persistence
Analytics BIOC	A new Azure email domain verification was requested A new Azure email domain verification was requested.	Informational	Cortex Cloud	Azure Audit Log	Resource Development
Analytics BIOC	A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A new server has been added to an Azure Active Directory Hybrid Health AD FS Environment.	Informational	Cortex Cloud	Azure Audit Log	Discovery
Analytics BIOC	A non-browser process accessed a website UI An uncommon network communication between a non-browser process and a website UI.	Informational	Platform Analytics	Palo Alto Networks Url Logs	Command and Control
Analytics BIOC	A possible risky login to Azure A risky sign-in attempt was observed in Azure.	Informational	Identity Analytics	AzureAD	Initial Access, Resource Development
Analytics BIOC	A process connected to a rare cloud resource A process connected to a rare cloud resource.	Informational	Platform Analytics	XDR Agent	Command and Control, Exfiltration
Analytics BIOC	A process connected to a rare external host A process connected to an external host name or directly to an IP address, which is rarely connected to from the organization.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	A process connected to rare external host A process connected to a rare external host.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	A process is masquerading as a common Microsoft product An attacker might leverage common Microsoft software image names to run malicious processes without being caught.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	A process modified an SSH authorized_keys file A process modified an SSH authorized_keys file, which is used in SSH authentication. An attack can add or remove an SSH key to gain access to a targeted host.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics BIOC	A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	A rare local administrator login A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.	Informational	Identity Analytics	XDR Agent	Initial Access
Analytics BIOC	A Service Principal was created in Azure A Service Principal was created in Azure. This could indicate a malicious actor attempting to gain access to a resource.	Informational	Cortex Cloud	Azure Audit Log	Initial Access, Privilege Escalation
Analytics BIOC	A Service Principal was removed from Azure A service principal was removed from Azure. This indicates a change in access permissions and may indicate malicious activity.	Informational	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	A service was disabled A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.	Informational	Platform Analytics	XDR Agent	Impact
Analytics BIOC	A suspicious process queried AD CS objects via LDAP A suspicious process queried AD CS objects via LDAP.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics BIOC	A third-party application was authorized to access the Google Workspace APIs A domain administrator authorized a third-party application to access the Google Workspace APIs. This allows the application to interact with the domain user's data within the authorized scope, as specified in the API call.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Initial Access, Privilege Escalation
Analytics BIOC	A third-party application's access to the Google Workspace domain's resources was revoked An identity removed a third-party application's access to Google Workspace domain's resources.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Impact
Analytics BIOC	A third-party utility was copied to a different location To evade detection, attackers may copy a third-party utility executable to a different location.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	A Torrent client was detected on a host The host produced traffic consistent with the BitTorrent protocol. Torrent usage may expose the organization to malware or enable attackers or malicious insiders to exfiltrate data.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Exfiltration, Initial Access
Analytics BIOC	A user accessed an uncommon AppID A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization.	Informational	Identity Threat Detection (ITDR)	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall traffic Logs, XDR Agent	Exfiltration
Analytics BIOC	A user accessed Okta's admin application An attempt to access Okta's admin management application.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Initial Access, Persistence, Privilege Escalation
Analytics BIOC	A user account was modified to password never expires A user account was modified to password never expires.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access
Analytics BIOC	A user added a Windows firewall rule A user added a new Windows Firewall rule. Adding a firewall rule may indicate an attempt to bypass controls limiting network usage or to disrupt network communications.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	A user certificate was issued with a mismatch A certificate was issued to a user who was not the requester, this may indicate a certificate manipulation.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation, Credential Access
Analytics BIOC	A user changed the Windows system time A user changed the Windows system time. This may be indicative of a malicious activity and may affect authentication from the source machine.	Informational	Identity Threat Detection (ITDR)	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Discovery
Analytics BIOC	A user connected a new USB storage device to a host A user connected a new USB storage device that was not seen for this user and host in the last 30 days.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration
Analytics BIOC	A user connected a USB storage device for the first time A user connected a USB storage device for the first time in the past 30 days.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration
Analytics BIOC	A user connected from a new country A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne	Credential Access, Resource Development
Analytics BIOC	A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Credential Access, Resource Development
Analytics BIOC	A user created a pfx file for the first time A user created a pfx file for the first time.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	A user created an abnormal password-protected archive A user created an abnormal password-protected archive using an archive program.	Informational	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics BIOC	A user enabled a default local account A user enabled a default local account. Enabling a default account may pose a security risk, as they are often exploited by attackers.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Initial Access, Persistence
Analytics BIOC	A user logged in at an unusual time via SSO A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.	Informational	Identity Analytics	AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne	Defense Evasion
Analytics BIOC	A user logged in at an unusual time via VPN A user connected to a VPN on a day and hour, which is unusual for this user. This may indicate that the account was compromised.	Informational	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Defense Evasion
Analytics BIOC	A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.	Informational	Identity Analytics	XDR Agent	Credential Access, Resource Development
Analytics BIOC	A user logged in to the AWS console for the first time A user logged in to the AWS console for the first time.	Informational	Cortex Cloud	AWS Audit Log	Initial Access, Persistence, Lateral Movement
Analytics BIOC	A user modified an Okta MFA factor An Okta MFA factor was modified by a user, suggesting a potential compromise of the account.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Credential Access, Persistence
Analytics BIOC	A user modified an Okta network zone An Okta network zone was modified by a user.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Defense Evasion
Analytics BIOC	A user modified an Okta policy rule An Okta policy rule was modified by a user, suggesting a potential compromise of the account.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Defense Evasion, Persistence
Analytics BIOC	A user queried AD CS objects via LDAP A user queried AD CS objects via LDAP.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
Analytics BIOC	A user was added to a Windows security group A user was added to a Windows security group.	Informational	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	A WMI subscriber was created A WMI subscriber was created.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	Abnormal Communication to a Rare Domain An abnormal communication was seen from an internal entity to a rare domain.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server to an external address.	Informational	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Abnormal process connection to default Meterpreter port This process has probably been compromised by Meterpreter and is now used by it to run malicious commands.	Informational	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	Abnormal Recurring Communications to a Rare Domain Abnormal communications were seen from an internal entity to a rare external domain. This could be a case of beaconing to a C2 Server.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Command and Control
Analytics BIOC	Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.	Informational	Identity Analytics	XDR Agent	Lateral Movement, Privilege Escalation
Analytics BIOC	Access to kubelet credentials file A process accessed a kubelet credentials file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Access to Kubernetes CA certificate file A process accessed a Kubernetes CA certificate file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Access to Kubernetes configuration file A process accessed a Kubernetes node configuration file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Access to sensitive host files from within a Kubernetes pod A process accessed sensitive host files inside a Kubernetes pod, indicating a potential container escape or privilege escalation attempt.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation
Analytics BIOC	Adding execution privileges A script was granted execution privileges using chmod before being run.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Admin privileges were granted to a Google Workspace user Admin privileges were granted to a Google Workspace user. This user now has access to additional administrative functions and settings.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Privilege Escalation

Analytics BIOC

A browser extension was installed or loaded in an uncommon way A browser extension was installed or loaded in an uncommon way.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks.

Informational

Identity Threat Detection (ITDR)

XDR Agent

Defense Evasion

Analytics BIOC

A Cloud DB instance was exported to an unknown destination A Cloud DB instance was exported to a foreign storage destination. The destination storage has not been seen in the organization in the last 30 days.

Informational

Cortex Cloud

Gcp Audit Log

Exfiltration

Analytics BIOC

A cloud identity created or modified a security group A cloud identity created or modified a security group.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Defense Evasion

Analytics BIOC

A cloud identity executed an API call from an unusual country A cloud identity that normally connects from a limited set of countries connected from a new country for the first time.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Initial Access

Analytics BIOC

A cloud identity had escalated its permissions A cloud identity had updated its permissions.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Privilege Escalation

Analytics BIOC

A cloud identity invoked IAM related persistence operations A cloud identity invoked IAM related persistence operations.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Persistence

Analytics BIOC

A cloud identity started a Cloud Shell session A cloud identity started a Cloud Shell session.

Informational

Cortex Cloud

AWS Audit Log

Execution

Analytics BIOC

A cloud instance was stopped A cloud compute instance was stopped.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics BIOC

A cloud snapshot of AWS database or storage was modified or shared A cloud identity has shared a snapshot of an AWS database or storage instance.

Informational

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

A cloud storage configuration was modified A cloud storage configuration was modified.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Defense Evasion

Analytics BIOC

A compressed file was exfiltrated over SSH Exfiltration of a compressed file over SSH.

Informational

Platform Analytics

XDR Agent

Exfiltration

Analytics BIOC

A compute-attached identity executed API calls outside the instance's region A compute-attached identity performed actions outside the compute instance region.

Informational

Cortex Cloud

AWS Audit Log

Initial Access, Credential Access

Analytics BIOC

A container registry was created or deleted A container registry was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Impact

Analytics BIOC

A disabled user attempted to authenticate via SSO A disabled user attempted to authenticate via SSO.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

A disabled user attempted to log in A disabled user attempted to log in.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

A GCP Cloud SQL DB instance was exported from a production account A GCP Cloud SQL DB instance was exported to a storage bucket. The DB instance was exported from a production account.

Informational

Cortex Cloud

Gcp Audit Log

Exfiltration

Analytics BIOC

A Google Workspace identity created, assigned or modified a role A Google Workspace identity created, assigned or modified a delegated admin role.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Persistence

Analytics BIOC

A Google Workspace identity performed an unusual admin console activity A Google Workspace identity performed an admin console activity for the first time.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Persistence

Analytics BIOC

A Google Workspace identity used the security investigation tool A Google Workspace identity used the security investigation tool The Google Workspace security investigation tool can be abused to access sensitive data.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Collection

Analytics BIOC

A Google Workspace Role privilege was deleted A privilege was removed from a Google Workspace Role, This could potentially affect the access to services and data in the organization.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Impact

Analytics BIOC

A Google Workspace service was configured as unrestricted An identity configured a Google Workspace service as unrestricted Apps configured with a trusted or limited access setting can access data for unrestricted services.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Privilege Escalation

Analytics BIOC

A Google Workspace user was added to a group A user added another user to a Google Workspace group.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Persistence

Analytics BIOC

A Google Workspace user was removed from a group A user removed another user from a Google Workspace group.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Impact

Analytics BIOC

A Kubernetes cluster role binding was created or deleted A Kubernetes cluster role binding was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Privilege Escalation

Analytics BIOC

A Kubernetes cluster role was created A Kubernetes cluster role was created.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Persistence, Privilege Escalation

Analytics BIOC

A Kubernetes cluster was created or deleted A Kubernetes cluster was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Impact

Analytics BIOC

A Kubernetes ConfigMap was created or deleted A Kubernetes ConfigMap was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Persistence

Analytics BIOC

A Kubernetes Cronjob was created A Kubernetes CronJob was created.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Persistence

Analytics BIOC

A Kubernetes DaemonSet was created A Kubernetes DaemonSet was created.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

A Kubernetes deployment was created A Kubernetes deployment was created.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

A Kubernetes ephemeral container was created A Kubernetes ephemeral container was created.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

A Kubernetes namespace was created or deleted A Kubernetes namespace was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Defense Evasion

Analytics BIOC

A Kubernetes node service account activity from external IP A Kubernetes node service account was seen operating from an external IP.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Initial Access

Analytics BIOC

A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was created with a sidecar container.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

A Kubernetes Pod was deleted A Kubernetes Pod was deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Impact

Analytics BIOC

A Kubernetes ReplicaSet was created A Kubernetes ReplicaSet was created.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

A Kubernetes role binding was created or deleted A Kubernetes role binding was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Privilege Escalation

Analytics BIOC

A Kubernetes secret was created or deleted A Kubernetes secret was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Credential Access

Analytics BIOC

A Kubernetes service account executed an unusual API call A Kubernetes service account executed an unusual API call.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

A Kubernetes service account has enumerated its permissions A Kubernetes service account has enumerated its permissions using the self subject review API.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Discovery

Analytics BIOC

A Kubernetes service account was created or deleted A Kubernetes service account was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Persistence

Analytics BIOC

A Kubernetes service was created or deleted A Kubernetes service was created or deleted.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Impact

Analytics BIOC

A Kubernetes StatefulSet was created A Kubernetes StatefulSet was created.

Informational

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs

Execution

Analytics BIOC

A LOLBIN was copied to a different location To evade detection, attackers may copy a LOLBIN executable to a different location.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

A Microsoft Teams application was installed A Microsoft Teams application was installed.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Persistence

Analytics BIOC

A Microsoft Teams bot was added to a team A user added a bot to a team in Microsoft Teams.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Persistence

Analytics BIOC

A new Azure email domain verification was requested A new Azure email domain verification was requested.

Informational

Cortex Cloud

Azure Audit Log

Resource Development

Analytics BIOC

A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment A new server has been added to an Azure Active Directory Hybrid Health AD FS Environment.

Informational

Cortex Cloud

Azure Audit Log

Discovery

Analytics BIOC

A non-browser process accessed a website UI An uncommon network communication between a non-browser process and a website UI.

Informational

Platform Analytics

Palo Alto Networks Url Logs

Command and Control

Analytics BIOC

A possible risky login to Azure A risky sign-in attempt was observed in Azure.

Informational

Identity Analytics

AzureAD

Initial Access, Resource Development

Analytics BIOC

A process connected to a rare cloud resource A process connected to a rare cloud resource.

Informational

Platform Analytics

XDR Agent

Command and Control, Exfiltration

Analytics BIOC

A process connected to a rare external host A process connected to an external host name or directly to an IP address, which is rarely connected to from the organization.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

A process connected to rare external host A process connected to a rare external host.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

A process is masquerading as a common Microsoft product An attacker might leverage common Microsoft software image names to run malicious processes without being caught.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

A process modified an SSH authorized_keys file A process modified an SSH authorized_keys file, which is used in SSH authentication. An attack can add or remove an SSH key to gain access to a targeted host.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics BIOC

A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.

Informational

Platform Analytics

XDR Agent

Persistence, Privilege Escalation, Defense Evasion

Analytics BIOC

A rare local administrator login A rare local administrator login was observed. This may indicate an attempt to change sensitive settings on the host.

Informational

Identity Analytics

XDR Agent

Initial Access

Analytics BIOC

A Service Principal was created in Azure A Service Principal was created in Azure. This could indicate a malicious actor attempting to gain access to a resource.

Informational

Cortex Cloud

Azure Audit Log

Initial Access, Privilege Escalation

Analytics BIOC

A Service Principal was removed from Azure A service principal was removed from Azure. This indicates a change in access permissions and may indicate malicious activity.

Informational

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

A service was disabled A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.

Informational

Platform Analytics

XDR Agent

Impact

Analytics BIOC

A suspicious process queried AD CS objects via LDAP A suspicious process queried AD CS objects via LDAP.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics BIOC

A third-party application was authorized to access the Google Workspace APIs A domain administrator authorized a third-party application to access the Google Workspace APIs. This allows the application to interact with the domain user's data within the authorized scope, as specified in the API call.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Initial Access, Privilege Escalation

Analytics BIOC

A third-party application's access to the Google Workspace domain's resources was revoked An identity removed a third-party application's access to Google Workspace domain's resources.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Impact

Analytics BIOC

A third-party utility was copied to a different location To evade detection, attackers may copy a third-party utility executable to a different location.

Informational

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

A Torrent client was detected on a host The host produced traffic consistent with the BitTorrent protocol. Torrent usage may expose the organization to malware or enable attackers or malicious insiders to exfiltrate data.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Exfiltration, Initial Access

Analytics BIOC

A user accessed an uncommon AppID A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization.

Informational

Identity Threat Detection (ITDR)

Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall traffic Logs, XDR Agent

Exfiltration

Analytics BIOC

A user accessed Okta's admin application An attempt to access Okta's admin management application.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Initial Access, Persistence, Privilege Escalation

Analytics BIOC

A user account was modified to password never expires A user account was modified to password never expires.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access

Analytics BIOC

A user added a Windows firewall rule A user added a new Windows Firewall rule. Adding a firewall rule may indicate an attempt to bypass controls limiting network usage or to disrupt network communications.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

A user certificate was issued with a mismatch A certificate was issued to a user who was not the requester, this may indicate a certificate manipulation.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation, Credential Access

Analytics BIOC

A user changed the Windows system time A user changed the Windows system time. This may be indicative of a malicious activity and may affect authentication from the source machine.

Informational

Identity Threat Detection (ITDR)

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Discovery

Analytics BIOC

A user connected a new USB storage device to a host A user connected a new USB storage device that was not seen for this user and host in the last 30 days.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration

Analytics BIOC

A user connected a USB storage device for the first time A user connected a USB storage device for the first time in the past 30 days.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration

Analytics BIOC

A user connected from a new country A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne

Credential Access, Resource Development

Analytics BIOC

A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Credential Access, Resource Development

Analytics BIOC

A user created a pfx file for the first time A user created a pfx file for the first time.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

A user created an abnormal password-protected archive A user created an abnormal password-protected archive using an archive program.

Informational

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics BIOC

A user enabled a default local account A user enabled a default local account. Enabling a default account may pose a security risk, as they are often exploited by attackers.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Initial Access, Persistence

Analytics BIOC

A user logged in at an unusual time via SSO A user connected via SSO on a day and hour that is unusual for this user. This may indicate that the account was compromised.

Informational

Identity Analytics

AzureAD, Azure SignIn Log, Idira, Duo, Google Workspace Authentication, Okta, OneLogin, PingOne

Defense Evasion

Analytics BIOC

A user logged in at an unusual time via VPN A user connected to a VPN on a day and hour, which is unusual for this user. This may indicate that the account was compromised.

Informational

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Defense Evasion

Analytics BIOC

A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised.

Informational

Identity Analytics

XDR Agent

Credential Access, Resource Development

Analytics BIOC

A user logged in to the AWS console for the first time A user logged in to the AWS console for the first time.

Informational

Cortex Cloud

AWS Audit Log

Initial Access, Persistence, Lateral Movement

Analytics BIOC

A user modified an Okta MFA factor An Okta MFA factor was modified by a user, suggesting a potential compromise of the account.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Credential Access, Persistence

Analytics BIOC

A user modified an Okta network zone An Okta network zone was modified by a user.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Defense Evasion

Analytics BIOC

A user modified an Okta policy rule An Okta policy rule was modified by a user, suggesting a potential compromise of the account.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Defense Evasion, Persistence

Analytics BIOC

A user queried AD CS objects via LDAP A user queried AD CS objects via LDAP.

Informational

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

Analytics BIOC

A user was added to a Windows security group A user was added to a Windows security group.

Informational

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

A WMI subscriber was created A WMI subscriber was created.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

Abnormal Communication to a Rare Domain An abnormal communication was seen from an internal entity to a rare domain.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server to an external address.

Informational

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Abnormal process connection to default Meterpreter port This process has probably been compromised by Meterpreter and is now used by it to run malicious commands.

Informational

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

Abnormal Recurring Communications to a Rare Domain Abnormal communications were seen from an internal entity to a rare external domain. This could be a case of beaconing to a C2 Server.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Command and Control

Analytics BIOC

Abnormal User Login to Domain Controller A user account has successfully logged on to a Domain Controller (DC), generating a Windows Event Log. This may be a sign of DC and Active Directory (AD) compromise.

Informational

Identity Analytics

XDR Agent

Lateral Movement, Privilege Escalation

Analytics BIOC

Access to kubelet credentials file A process accessed a kubelet credentials file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Access to Kubernetes CA certificate file A process accessed a Kubernetes CA certificate file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Access to Kubernetes configuration file A process accessed a Kubernetes node configuration file.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Access to sensitive host files from within a Kubernetes pod A process accessed sensitive host files inside a Kubernetes pod, indicating a potential container escape or privilege escalation attempt.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation

Analytics BIOC

Adding execution privileges A script was granted execution privileges using chmod before being run.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Admin privileges were granted to a Google Workspace user Admin privileges were granted to a Google Workspace user. This user now has access to additional administrative functions and settings.

Informational

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Privilege Escalation