Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
BIOC	64-bit PowerShell spawning a 32-bit PowerShell Malware typically spawns 32-bit processes to work on as many hosts as possible. This case is therefore suspicious when it happens on a 64-bit host.	Low	Platform Analytics	Process execution	Execution
Analytics BIOC	A Backup vault policy was modified A cloud identity has modified backup vault access policy.	Low	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	A cloud function was created with an unusual runtime A cloud function was created with an unusual runtime.	Low	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Execution
Analytics BIOC	A Command Line Interface (CLI) command was executed from a GCP serverless compute service A GCP serverless compute service token was used to execute a Command Line Interface (CLI) command.	Low	Cortex Cloud	Gcp Audit Log	Initial Access, Credential Access
Analytics BIOC	A Command Line Interface (CLI) command was executed from an AWS serverless compute service AWS serverless compute service token was used to execute a Command Line Interface (CLI) command. This may indicate token theft due to the nature of serverless compute.	Low	Cortex Cloud	AWS Audit Log	Initial Access, Credential Access, Execution
Analytics BIOC	A commonly abused process connected to a rare cloud resource A commonly abused process connected to a rare cloud resource.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	A commonly abused process connected to a rare external host A commonly abused process connected to a rare external host.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics BIOC	A compiled HTML help file wrote a script file to the disk A compiled HTML help file wrote a script file to the disk. Compiled HTLM help files usually don't write script files to the disk. This behavior is often employed by malware that leverages malicious CHM files to deliver a 2nd stage payload.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics	A compromised process accessed a rare external host A compromised process accessed a rare external host.	Low	Platform Analytics	XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)	Command and Control
Analytics BIOC	A computer account was promoted to DC A computer account was promoted to a domain controller via a User Account Control (UAC) change.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	A disabled user attempted to log in to a VPN A disabled user attempted to log in suspiciously to a VPN.	Low	Identity Analytics	Palo Alto Networks Global Protect, Third-Party VPNs	Initial Access
Analytics BIOC	A domain was added to the trusted domains list A domain was added to the Google Workspace trusted domains list.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Defense Evasion
Analytics BIOC	A GCP service account was delegated domain-wide authority in Google Workspace A Google Workspace admin has enabled domain-wide delegation to a GCP service account.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	Google Workspace Audit Logs	Privilege Escalation
Analytics BIOC	A process queried the ADFS database decryption key via LDAP A process queried the ADFS database decryption key (DKM key) via LDAP.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	A rare file path was added to the AppInit_DLLs registry value A rare file path was added to AppInit_DLLs registry value.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Privilege Escalation
Analytics BIOC	A rare FTP user has been detected on an existing FTP server A rare or new FTP user has been detected on an existing FTP server.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs	Initial Access, Collection
Analytics BIOC	A remote service was created via RPC over SMB A remote service was created via RPC over SMB.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Execution
Analytics BIOC	A suspicious direct syscall was executed A suspicious direct syscall was executed.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution
Analytics BIOC	A suspicious process enrolled for a certificate A suspicious process enrolled for a certificate.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	A user attempted to bypass Okta MFA A user may have attempted to bypass Okta MFA.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	Okta Audit Log	Credential Access
Analytics	A user connected a new USB storage device to multiple hosts A user connected a new USB storage device to multiple endpoints.	Low	Identity Threat Detection (ITDR)	XDR Agent with eXtended Threat Hunting (XTH)	Collection, Exfiltration
Analytics BIOC	A user modified the CA audit policy A user modified the CA audit policy. This may indicate that an attacker is attempting to cover their tracks before an AD CS attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics	A user rejected an SSO request from an unusual country A user rejected an SSO authentication request from an abnormal country.	Low	Identity Analytics	Okta, OneLogin	Credential Access, Resource Development
Analytics	A user sent multiple TGT requests to irregular service A user sent multiple TGT requests to services other than KRBTGT and KADMIN. This is typically a sign of a Kerberoasting attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	A user uploaded malware to SharePoint or OneDrive A user uploaded a file that was classified as malware to SharePoint or OneDrive.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Lateral Movement, Execution
Analytics BIOC	Abnormal communication with a rare combination of TLS and HTTP User Agent Abnormal communication with a rare combination of TLS and HTTP User Agent to an external address.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics	Abnormal ICMP echo (PING) to multiple hosts An endpoint performed an abnormal ICMP echo (PING) to multiple hosts on the network.	Low	Platform Analytics	XDR Agent	Discovery
Analytics	Abnormal increase in network-related alerts on the same host Abnormal increase in network-related alerts on the same host.	Low	Platform Analytics	Palo Alto Networks Platform Alerts, Third-Party Alerts	Execution
Analytics BIOC	Abnormal network communication through TOR using an uncommon port Suspicious connection from a known TOR IP to an uncommon port.	Low	Platform Analytics	XDR Agent	Command and Control
Analytics	Abnormal RDP connections to multiple hosts from a rarely seen host The endpoint attempted to initiate rare RDP connections to multiple hosts.	Low	Platform Analytics	XDR Agent	Lateral Movement
Analytics BIOC	Abnormal RDP session to a remote host from a rarely seen host The endpoint performed a rare RDP session to a remote host.	Low	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls	Lateral Movement
Analytics	Abnormal RPC traffic to multiple hosts The endpoint performed unfamiliar RPC activity to multiple hosts.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Reconnaissance
Analytics	Abnormal sensitive RPC traffic to multiple hosts The endpoint performed unfamiliar RPC activity to multiple hosts using a known sensitive interface.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics	Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host The endpoint performed unfamiliar RPC activity to multiple hosts using a known sensitive interface.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics	Abnormal SMB activity to multiple hosts An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network.	Low	Platform Analytics	XDR Agent	Lateral Movement
BIOC	Accessing bash history file Clearing bash history file is a known procedure of attackers to delete traces.	Low	Platform Analytics	Process execution	Defense Evasion
BIOC	Accessing bash history file using bash commands Clearing bash history files is a known attacker procedure for covering their tracks.	Low	Platform Analytics	Process execution	Defense Evasion
Analytics	Account probing A user failed to log in to multiple hosts it never accessed before in a short amount of time. This may indicate the account is compromised and an attacker is probing for a host it can access with those credentials.	Low	Identity Analytics	XDR Agent	Initial Access, Credential Access
BIOC	Active Setup Registry Autostart Suspicious modification of the active setup registry for persistence and privilege escalation.	Low	Platform Analytics	Registry	Persistence
Analytics BIOC	ADFS DKM Key Access ADFS DKM key attribute (thumbnailphoto) access in AD container, potential Golden SAML token forging attempt.	Low	Identity Threat Detection (ITDR)	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics	AI model discovery A cloud identity listed available AI models. This behavior often suggests reconnaissance on AI models and potential misuse. MITRE ATLAS Technique: AML.T0007 - Discover ML Artifacts.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Discovery
Analytics BIOC	An Azure Firewall policy deletion An Azure Firewall policy was deleted. An attacker might use this technique to disable network defenses.	Low	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics	An executable was written and executed by a web server Web server process had written an executable file that was executed shortly after.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics	An identity successfully extracted multiple secrets within the organization An identity successfully dumped multiple secrets from the project. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.	Low	Cortex Cloud	AWS Audit Log	Credential Access
Analytics BIOC	An RDS snapshot was exported to an unknown S3 bucket An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.	Low	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An S3 replication policy to an unknown bucket was created An S3 replication policy was added to an S3 bucket. The referenced destination bucket was not seen in your tenant in the last 30 days.	Low	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	An uncommon executable was remotely written over SMB to an uncommon destination An uncommon executable was remotely written over SMB to a destination, which was not involved in significant similar activity during last month.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement
Analytics BIOC	An uncommon service was started An uncommon service was started using systemctl or service processes.	Low	Platform Analytics	XDR Agent	Persistence, Privilege Escalation
Analytics BIOC	An unpopular process accessed the microphone on the host An unpopular process accessed the microphone on the host, the process can abuse this device.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Collection
Analytics BIOC	Attempt to execute a command on a remote host using PsExec.exe There was an attempt to run a command on a remote host using PsExec.exe.	Low	Platform Analytics	XDR Agent	Lateral Movement, Execution
Analytics BIOC	Authentication attempt by a honey user An authentication attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.	Low	Identity Analytics	AzureAD, Okta, OneLogin, PingOne	Initial Access
Analytics BIOC	AWS Bedrock model invocation logging deletion A cloud identity deleted the model invocation logging.	Low	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	AWS data asset shared public A data asset was publicly shared.	Low	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	AWS Guard-Duty detector deletion AWS Guard-Duty detector was deleted.	Low	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	AWS IAM Role Created with Cross-Account Access A cloud identity has created a new IAM role with trust policy that allows external AWS account access.	Low	Cortex Cloud	AWS Audit Log	Persistence
Analytics BIOC	AWS IAM Role's Trusted Policy Modification Allows Cross-Account Access A cloud identity has updated an IAM role's trust policy to allow external AWS account access.	Low	Cortex Cloud	AWS Audit Log	Persistence
Analytics BIOC	AWS Lambda Cross-Account sensitive permissions configured A cloud identity has granted external AWS account sensitive permissions to a Lambda function.	Low	Cortex Cloud	AWS Audit Log	Persistence
Analytics BIOC	AWS S3 bucket was exposed to public access AWS S3 bucket was publicly shared.	Low	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	AWS Security Group remote access allowed from an unknown external IP address A cloud identity has modified the ingress rules to allow unfamiliar ip addresses SSH or RDP access.	Low	Cortex Cloud	AWS Audit Log	Defense Evasion
Analytics BIOC	Azure account deletion by a non-standard account An Azure AD account deletion was performed by a user that doesn't typically delete users.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Impact
Analytics BIOC	Azure AD PIM role settings change An identity changed the PIM role settings.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Defense Evasion, Privilege Escalation
Analytics BIOC	Azure domain federation settings modification attempt A user or application attempted to modify the federation settings of the domain.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Persistence, Privilege Escalation
Analytics BIOC	Azure Event Hub Deletion An Azure event hub was deleted. An attacker might use this technique to evade detection.	Low	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	Azure Network Watcher Deletion Azure Network Watchers are used for monitoring and diagnosing Azure resources. An attacker might use this technique to avoid security mitigations.	Low	Cortex Cloud	Azure Audit Log	Defense Evasion
Analytics BIOC	Bedrock model shared with a foreign account A bedrock model was shared with a foreign account through AWS resource access manager.	Low	Cortex Cloud	AWS Audit Log	Exfiltration
Analytics BIOC	Billing admin role was removed Sensitive Action - Billing admin role was removed.	Low	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics BIOC	Cached credentials discovery with cmdkey Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list.	Low	Platform Analytics	XDR Agent	Credential Access, Discovery
Analytics BIOC	Certutil pfx parsing Certutil was used to parse a pfx certificate file.	Low	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Change of sudo caching configuration Change of sudo caching configuration may have been intended to enable privilege escalation.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Privilege Escalation
Correlation Rule	Chrome - Chrome Extension Install Event The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username	Low	Platform Analytics	google_workspace_chrome_raw	Persistence
BIOC	Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.	Low	Platform Analytics	Process execution	Persistence
Analytics BIOC	ClickFix - PowerShell executed through the run application An attacker may be trying to trick a user to execute PowerShell through the run application.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Initial Access
BIOC	Collecting audio via PowerShell command An attacker may collect audio from the microphone using PowerShell.	Low	Platform Analytics	Process execution	Collection
Analytics BIOC	Command running with COMSPEC in the command line argument COMSPEC is an environmental variable that points to cmd.exe. Attackers may use this command to obfuscate their command and avoid detection.	Low	Platform Analytics	XDR Agent	Execution
BIOC	Commonly abused AutoIT script connects to a remote host AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.	Low	Platform Analytics	Network	Exfiltration
Analytics BIOC	Compressing data using python Usage of a Python module to compress files.	Low	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Conditional Access policy removed An identity removed a Conditional Access policy.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection	AzureAD Audit Log	Defense Evasion
Analytics BIOC	Conhost.exe spawned a suspicious cmd process Attackers may abuse the conhost process to execute malicious files and evade detection.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Contained process execution with a rare GitHub URL A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads.	Low	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Copy a user's GnuPG directory with rsync Copy a user's GnuPG (.gnupg) directory on to a staging folder using the 'find' and 'rsync' commands.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics	Data exfiltration from cloud database An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.	Low	Cortex Cloud	Azure Audit Log, Gcp Audit Log	Exfiltration, Collection
Analytics BIOC	Delayed Deletion of Files A command line deleting files used the time-out or ping commands to delay the file deletion. This is suspicious, as malware sometimes uses these techniques to cover their tracks.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Disable encryption operations Encryption was disabled on the servers that host EC2 instances, both for data-at-rest and data-in-transit.	Low	Cortex Cloud	AWS Audit Log	Impact
Analytics BIOC	Disable Microsoft Defender Antivirus via registry Disable Microsoft Defender Antivirus via registry.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
Analytics BIOC	Discovery of accounts with pre-authentication disabled via LDAP A possible discovery of accounts without pre-authentication required via LDAP was performed. Such enumeration may be used during attacks against the organization.	Low	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery, Credential Access
BIOC	DLL sideloading attack using Xwizard Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.	Low	Platform Analytics	Process execution	Defense Evasion
Analytics	DNS Tunneling 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. The endpoint may be remotely controlled by an attacker, and/or an attacker may have exfiltrated data from it. This detector is not supported when networking events arrive solely from Cortex XDR Linux agents.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
Analytics BIOC	Download a script using the python requests module Download a shell script from a remote location using the Python requests module.	Low	Platform Analytics	XDR Agent	Execution
BIOC	Dumping Registry hives with passwords Dumping registry hives can be used to obtain stored credentials/hashes.	Low	Platform Analytics	Process execution	Credential Access
Analytics BIOC	Elevation to SYSTEM via services Services were affected by a non SYSTEM integrity level process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Privilege Escalation
Analytics BIOC	Email attachment with Right-to-Left Override Unicode character The email message contains an attachment with a hidden Right-to-Left Override Unicode character.	Low	Email Security	Microsoft 365 Emails	Defense Evasion, Execution
Analytics BIOC	Email was received from an unknown sender using a disposable domain The email was received from an unknown sender using a disposable email provider, first seen in the organization in the past month.	Low	Email Security	Microsoft 365 Emails	Reconnaissance, Initial Access
Analytics BIOC	Email with file-sharing link containing auto-download parameter The email contains a link to a file-sharing service that includes parameters likely to trigger automatic download.	Low	Email Security	Microsoft 365 Emails	Initial Access, Execution
Analytics	Excessive user account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.	Low	Identity Analytics	Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)	Credential Access
Analytics BIOC	Exchange anti-phish policy disabled or removed A user disabled or removed an Exchange anti-phish policy, which may indicate evasion of a possible phishing campaign.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Defense Evasion, Initial Access
Analytics BIOC	Exchange audit log disabled A user disabled the Exchange audit log. This may indicate an attempt to evade detection.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Defense Evasion
Analytics BIOC	Exchange DKIM signing configuration disabled A user disabled an Exchange DomainKeys Identified Mail (DKIM) signing configuration. DKIM helps ensure that emails are authorized and not spoofed.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Defense Evasion, Initial Access
Analytics BIOC	Exchange mailbox audit bypass A user added mailbox audit bypass for an account. This will allow the account to perform actions without being logged, and may indicate an attempt to evade detection.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Defense Evasion
Analytics BIOC	Exchange malware filter policy removed A user removed an Exchange malware filter policy, which may prevent the detection of malware.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Defense Evasion
Analytics BIOC	Exchange Safe Attachment policy disabled or removed A user disabled an Exchange Safe Attachment policy, which provides phishing protection to email attachments.	Low	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Defense Evasion, Initial Access

BIOC

64-bit PowerShell spawning a 32-bit PowerShell Malware typically spawns 32-bit processes to work on as many hosts as possible. This case is therefore suspicious when it happens on a 64-bit host.

Low

Platform Analytics

Process execution

Execution

Analytics BIOC

A Backup vault policy was modified A cloud identity has modified backup vault access policy.

Low

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

A cloud function was created with an unusual runtime A cloud function was created with an unusual runtime.

Low

Cortex Cloud

AWS Audit Log, Gcp Audit Log

Execution

Analytics BIOC

A Command Line Interface (CLI) command was executed from a GCP serverless compute service A GCP serverless compute service token was used to execute a Command Line Interface (CLI) command.

Low

Cortex Cloud

Gcp Audit Log

Initial Access, Credential Access

Analytics BIOC

A Command Line Interface (CLI) command was executed from an AWS serverless compute service AWS serverless compute service token was used to execute a Command Line Interface (CLI) command. This may indicate token theft due to the nature of serverless compute.

Low

Cortex Cloud

AWS Audit Log

Initial Access, Credential Access, Execution

Analytics BIOC

A commonly abused process connected to a rare cloud resource A commonly abused process connected to a rare cloud resource.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

A commonly abused process connected to a rare external host A commonly abused process connected to a rare external host.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics BIOC

A compiled HTML help file wrote a script file to the disk A compiled HTML help file wrote a script file to the disk. Compiled HTLM help files usually don't write script files to the disk. This behavior is often employed by malware that leverages malicious CHM files to deliver a 2nd stage payload.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics

A compromised process accessed a rare external host A compromised process accessed a rare external host.

Low

Platform Analytics

XDR Agent, XDR Agent with eXtended Threat Hunting (XTH)

Command and Control

Analytics BIOC

A computer account was promoted to DC A computer account was promoted to a domain controller via a User Account Control (UAC) change.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

A disabled user attempted to log in to a VPN A disabled user attempted to log in suspiciously to a VPN.

Low

Identity Analytics

Palo Alto Networks Global Protect, Third-Party VPNs

Initial Access

Analytics BIOC

A domain was added to the trusted domains list A domain was added to the Google Workspace trusted domains list.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Defense Evasion

Analytics BIOC

A GCP service account was delegated domain-wide authority in Google Workspace A Google Workspace admin has enabled domain-wide delegation to a GCP service account.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

Google Workspace Audit Logs

Privilege Escalation

Analytics BIOC

A process queried the ADFS database decryption key via LDAP A process queried the ADFS database decryption key (DKM key) via LDAP.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

A rare file path was added to the AppInit_DLLs registry value A rare file path was added to AppInit_DLLs registry value.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence, Privilege Escalation

Analytics BIOC

A rare FTP user has been detected on an existing FTP server A rare or new FTP user has been detected on an existing FTP server.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs

Initial Access, Collection

Analytics BIOC

A remote service was created via RPC over SMB A remote service was created via RPC over SMB.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Execution

Analytics BIOC

A suspicious direct syscall was executed A suspicious direct syscall was executed.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution

Analytics BIOC

A suspicious process enrolled for a certificate A suspicious process enrolled for a certificate.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

A user attempted to bypass Okta MFA A user may have attempted to bypass Okta MFA.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

Okta Audit Log

Credential Access

Analytics

A user connected a new USB storage device to multiple hosts A user connected a new USB storage device to multiple endpoints.

Low

Identity Threat Detection (ITDR)

XDR Agent with eXtended Threat Hunting (XTH)

Collection, Exfiltration

Analytics BIOC

A user modified the CA audit policy A user modified the CA audit policy. This may indicate that an attacker is attempting to cover their tracks before an AD CS attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics

A user rejected an SSO request from an unusual country A user rejected an SSO authentication request from an abnormal country.

Low

Identity Analytics

Okta, OneLogin

Credential Access, Resource Development

Analytics

A user sent multiple TGT requests to irregular service A user sent multiple TGT requests to services other than KRBTGT and KADMIN. This is typically a sign of a Kerberoasting attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

A user uploaded malware to SharePoint or OneDrive A user uploaded a file that was classified as malware to SharePoint or OneDrive.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

Office 365 Audit

Lateral Movement, Execution

Analytics BIOC

Abnormal communication with a rare combination of TLS and HTTP User Agent Abnormal communication with a rare combination of TLS and HTTP User Agent to an external address.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics

Abnormal ICMP echo (PING) to multiple hosts An endpoint performed an abnormal ICMP echo (PING) to multiple hosts on the network.

Low

Platform Analytics

XDR Agent

Discovery

Analytics

Abnormal increase in network-related alerts on the same host Abnormal increase in network-related alerts on the same host.

Low

Platform Analytics

Palo Alto Networks Platform Alerts, Third-Party Alerts

Execution

Analytics BIOC

Abnormal network communication through TOR using an uncommon port Suspicious connection from a known TOR IP to an uncommon port.

Low

Platform Analytics

XDR Agent

Command and Control

Analytics

Abnormal RDP connections to multiple hosts from a rarely seen host The endpoint attempted to initiate rare RDP connections to multiple hosts.

Low

Platform Analytics

XDR Agent

Lateral Movement

Analytics BIOC

Abnormal RDP session to a remote host from a rarely seen host The endpoint performed a rare RDP session to a remote host.

Low

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls

Lateral Movement

Analytics

Abnormal RPC traffic to multiple hosts The endpoint performed unfamiliar RPC activity to multiple hosts.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Reconnaissance

Analytics

Abnormal sensitive RPC traffic to multiple hosts The endpoint performed unfamiliar RPC activity to multiple hosts using a known sensitive interface.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics

Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host The endpoint performed unfamiliar RPC activity to multiple hosts using a known sensitive interface.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics

Abnormal SMB activity to multiple hosts An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network.

Low

Platform Analytics

XDR Agent

Lateral Movement

BIOC

Accessing bash history file Clearing bash history file is a known procedure of attackers to delete traces.

Low

Platform Analytics

Process execution

Defense Evasion

BIOC

Accessing bash history file using bash commands Clearing bash history files is a known attacker procedure for covering their tracks.

Low

Platform Analytics

Process execution

Defense Evasion

Analytics

Account probing A user failed to log in to multiple hosts it never accessed before in a short amount of time. This may indicate the account is compromised and an attacker is probing for a host it can access with those credentials.

Low

Identity Analytics

XDR Agent

Initial Access, Credential Access

BIOC

Active Setup Registry Autostart Suspicious modification of the active setup registry for persistence and privilege escalation.

Low

Platform Analytics

Registry

Persistence

Analytics BIOC

ADFS DKM Key Access ADFS DKM key attribute (thumbnailphoto) access in AD container, potential Golden SAML token forging attempt.

Low

Identity Threat Detection (ITDR)

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics

AI model discovery A cloud identity listed available AI models. This behavior often suggests reconnaissance on AI models and potential misuse. MITRE ATLAS Technique: AML.T0007 - Discover ML Artifacts.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Discovery

Analytics BIOC

An Azure Firewall policy deletion An Azure Firewall policy was deleted. An attacker might use this technique to disable network defenses.

Low

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics

An executable was written and executed by a web server Web server process had written an executable file that was executed shortly after.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Persistence

Analytics

An identity successfully extracted multiple secrets within the organization An identity successfully dumped multiple secrets from the project. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.

Low

Cortex Cloud

AWS Audit Log

Credential Access

Analytics BIOC

An RDS snapshot was exported to an unknown S3 bucket An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.

Low

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An S3 replication policy to an unknown bucket was created An S3 replication policy was added to an S3 bucket. The referenced destination bucket was not seen in your tenant in the last 30 days.

Low

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

An uncommon executable was remotely written over SMB to an uncommon destination An uncommon executable was remotely written over SMB to a destination, which was not involved in significant similar activity during last month.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement

Analytics BIOC

An uncommon service was started An uncommon service was started using systemctl or service processes.

Low

Platform Analytics

XDR Agent

Persistence, Privilege Escalation

Analytics BIOC

An unpopular process accessed the microphone on the host An unpopular process accessed the microphone on the host, the process can abuse this device.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Collection

Analytics BIOC

Attempt to execute a command on a remote host using PsExec.exe There was an attempt to run a command on a remote host using PsExec.exe.

Low

Platform Analytics

XDR Agent

Lateral Movement, Execution

Analytics BIOC

Authentication attempt by a honey user An authentication attempt was made by a honey user, a decoy account created to detect unauthorized access. This may indicate potential attacker activity attempting to use valid or stolen credentials.

Low

Identity Analytics

AzureAD, Okta, OneLogin, PingOne

Initial Access

Analytics BIOC

AWS Bedrock model invocation logging deletion A cloud identity deleted the model invocation logging.

Low

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

AWS data asset shared public A data asset was publicly shared.

Low

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

AWS Guard-Duty detector deletion AWS Guard-Duty detector was deleted.

Low

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

AWS IAM Role Created with Cross-Account Access A cloud identity has created a new IAM role with trust policy that allows external AWS account access.

Low

Cortex Cloud

AWS Audit Log

Persistence

Analytics BIOC

AWS IAM Role's Trusted Policy Modification Allows Cross-Account Access A cloud identity has updated an IAM role's trust policy to allow external AWS account access.

Low

Cortex Cloud

AWS Audit Log

Persistence

Analytics BIOC

AWS Lambda Cross-Account sensitive permissions configured A cloud identity has granted external AWS account sensitive permissions to a Lambda function.

Low

Cortex Cloud

AWS Audit Log

Persistence

Analytics BIOC

AWS S3 bucket was exposed to public access AWS S3 bucket was publicly shared.

Low

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

AWS Security Group remote access allowed from an unknown external IP address A cloud identity has modified the ingress rules to allow unfamiliar ip addresses SSH or RDP access.

Low

Cortex Cloud

AWS Audit Log

Defense Evasion

Analytics BIOC

Azure account deletion by a non-standard account An Azure AD account deletion was performed by a user that doesn't typically delete users.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Impact

Analytics BIOC

Azure AD PIM role settings change An identity changed the PIM role settings.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Defense Evasion, Privilege Escalation

Analytics BIOC

Azure domain federation settings modification attempt A user or application attempted to modify the federation settings of the domain.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Persistence, Privilege Escalation

Analytics BIOC

Azure Event Hub Deletion An Azure event hub was deleted. An attacker might use this technique to evade detection.

Low

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

Azure Network Watcher Deletion Azure Network Watchers are used for monitoring and diagnosing Azure resources. An attacker might use this technique to avoid security mitigations.

Low

Cortex Cloud

Azure Audit Log

Defense Evasion

Analytics BIOC

Bedrock model shared with a foreign account A bedrock model was shared with a foreign account through AWS resource access manager.

Low

Cortex Cloud

AWS Audit Log

Exfiltration

Analytics BIOC

Billing admin role was removed Sensitive Action - Billing admin role was removed.

Low

Cortex Cloud

AWS Audit Log, Azure Audit Log, Gcp Audit Log

Impact

Analytics BIOC

Cached credentials discovery with cmdkey Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list.

Low

Platform Analytics

XDR Agent

Credential Access, Discovery

Analytics BIOC

Certutil pfx parsing Certutil was used to parse a pfx certificate file.

Low

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Change of sudo caching configuration Change of sudo caching configuration may have been intended to enable privilege escalation.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Privilege Escalation

Correlation Rule

Chrome - Chrome Extension Install Event The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username

Low

Platform Analytics

google_workspace_chrome_raw

Persistence

BIOC

Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.

Low

Platform Analytics

Process execution

Persistence

Analytics BIOC

ClickFix - PowerShell executed through the run application An attacker may be trying to trick a user to execute PowerShell through the run application.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Initial Access

BIOC

Collecting audio via PowerShell command An attacker may collect audio from the microphone using PowerShell.

Low

Platform Analytics

Process execution

Collection

Analytics BIOC

Command running with COMSPEC in the command line argument COMSPEC is an environmental variable that points to cmd.exe. Attackers may use this command to obfuscate their command and avoid detection.

Low

Platform Analytics

XDR Agent

Execution

BIOC

Commonly abused AutoIT script connects to a remote host AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

Low

Platform Analytics

Network

Exfiltration

Analytics BIOC

Compressing data using python Usage of a Python module to compress files.

Low

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Conditional Access policy removed An identity removed a Conditional Access policy.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection

AzureAD Audit Log

Defense Evasion

Analytics BIOC

Conhost.exe spawned a suspicious cmd process Attackers may abuse the conhost process to execute malicious files and evade detection.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Contained process execution with a rare GitHub URL A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads.

Low

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Copy a user's GnuPG directory with rsync Copy a user's GnuPG (.gnupg) directory on to a staging folder using the 'find' and 'rsync' commands.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics

Data exfiltration from cloud database An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.

Low

Cortex Cloud

Azure Audit Log, Gcp Audit Log

Exfiltration, Collection

Analytics BIOC

Delayed Deletion of Files A command line deleting files used the time-out or ping commands to delay the file deletion. This is suspicious, as malware sometimes uses these techniques to cover their tracks.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Disable encryption operations Encryption was disabled on the servers that host EC2 instances, both for data-at-rest and data-in-transit.

Low

Cortex Cloud

AWS Audit Log

Impact

Analytics BIOC

Disable Microsoft Defender Antivirus via registry Disable Microsoft Defender Antivirus via registry.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

Analytics BIOC

Discovery of accounts with pre-authentication disabled via LDAP A possible discovery of accounts without pre-authentication required via LDAP was performed. Such enumeration may be used during attacks against the organization.

Low

Identity Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery, Credential Access

BIOC

DLL sideloading attack using Xwizard Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.

Low

Platform Analytics

Process execution

Defense Evasion

Analytics

DNS Tunneling 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. The endpoint may be remotely controlled by an attacker, and/or an attacker may have exfiltrated data from it. This detector is not supported when networking events arrive solely from Cortex XDR Linux agents.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

Analytics BIOC

Download a script using the python requests module Download a shell script from a remote location using the Python requests module.

Low

Platform Analytics

XDR Agent

Execution

BIOC

Dumping Registry hives with passwords Dumping registry hives can be used to obtain stored credentials/hashes.

Low

Platform Analytics

Process execution

Credential Access

Analytics BIOC

Elevation to SYSTEM via services Services were affected by a non SYSTEM integrity level process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Privilege Escalation

Analytics BIOC

Email attachment with Right-to-Left Override Unicode character The email message contains an attachment with a hidden Right-to-Left Override Unicode character.

Low

Email Security

Microsoft 365 Emails

Defense Evasion, Execution

Analytics BIOC

Email was received from an unknown sender using a disposable domain The email was received from an unknown sender using a disposable email provider, first seen in the organization in the past month.

Low

Email Security

Microsoft 365 Emails

Reconnaissance, Initial Access

Analytics BIOC

Email with file-sharing link containing auto-download parameter The email contains a link to a file-sharing service that includes parameters likely to trigger automatic download.

Low

Email Security

Microsoft 365 Emails

Initial Access, Execution

Analytics

Excessive user account lockouts A high amount of user accounts were locked out from a single source host in a short time period. This may be the result of a brute-force or password spray attack.

Low

Identity Analytics

Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH)

Credential Access

Analytics BIOC

Exchange anti-phish policy disabled or removed A user disabled or removed an Exchange anti-phish policy, which may indicate evasion of a possible phishing campaign.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Defense Evasion, Initial Access

Analytics BIOC

Exchange audit log disabled A user disabled the Exchange audit log. This may indicate an attempt to evade detection.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Defense Evasion

Analytics BIOC

Exchange DKIM signing configuration disabled A user disabled an Exchange DomainKeys Identified Mail (DKIM) signing configuration. DKIM helps ensure that emails are authorized and not spoofed.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Defense Evasion, Initial Access

Analytics BIOC

Exchange mailbox audit bypass A user added mailbox audit bypass for an account. This will allow the account to perform actions without being logged, and may indicate an attempt to evade detection.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Defense Evasion

Analytics BIOC

Exchange malware filter policy removed A user removed an Exchange malware filter policy, which may prevent the detection of malware.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Defense Evasion

Analytics BIOC

Exchange Safe Attachment policy disabled or removed A user disabled an Exchange Safe Attachment policy, which provides phishing protection to email attachments.

Low

Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security

Office 365 Audit

Defense Evasion, Initial Access