Analytics rules — August 10, 2026

18 files changed, 60 insertions, 22 deletions — view the commit on the mirror.

Run-together required_data entries split into separate sources on 18 rules

18 analytics rules were modified; nothing was added or withdrawn.
Every edit is inside required_data: sources that had been stored as one run-together string are now separate list items.
Four identity and cloud rules went from two merged strings to eight named sources each.
No severity, test period, description or investigative action changed on any rule.

Highlights

Eight identity and cloud sources unmerged across four rules

Azure Privilege Escalation Using an Application, Possible Insider Threat Activity, Possible phishing attack via Microsoft Teams and Potential extraction of NAA Account Credentials each replaced two merged strings with AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs and both XDR Agent tiers.
The split reveals a duplicated source on two firewall rules

A user accessed multiple time-consuming websites and Increase in Job-Related Site Visits now list Palo Alto Networks Firewall EAL Logs twice, a repeat the merged string had concealed.
XDR Agent and XDR Agent with XTH are now distinct requirements

Four rules carried "XDR AgentXDR Agent with eXtended Threat Hunting (XTH)" as a single value and now name the base agent and the XTH agent separately.
No detection parameter moved

All 18 changed files are modifications confined to required_data; severity, test period, name, description and investigative actions are untouched.

Changes

18 files listed, 12 written up and shaded below.

▸ ▾ A compromised process accessed a rare cloud resource modified +2 −1 analytics/a-compromised-process-accessed-a-rare-cloud-resource

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,17 +9,18 @@

"attackers_goals": "Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.",

"attackers_goals": "Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A compromised process accessed a rare cloud resource.",

"description": "A compromised process accessed a rare cloud resource.",

"detection_modules": "",

"detection_modules": "",

"detector_tags": "EDR Windows C2 Analytics",

"detector_tags": "EDR Windows C2 Analytics",

"investigative_actions": "Investigate the compromised process. Identify the rare cloud resource accessed, is it managed by your organization?",

"investigative_actions": "Investigate the compromised process. Identify the rare cloud resource accessed, is it managed by your organization?",

"name": "A compromised process accessed a rare cloud resource",

"name": "A compromised process accessed a rare cloud resource",

"required_data": [

"required_data": [

"XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Informational",

"severity": "Informational",

"test_period": "2 Hours",

"test_period": "2 Hours",

"variations": [

"variations": [

{

{

"name": "A process compromised by DLL sideloading accessed a rare cloud resource and demonstrated abnormal communication patters",

"name": "A process compromised by DLL sideloading accessed a rare cloud resource and demonstrated abnormal communication patters",

"severity": "Medium",

"severity": "Medium",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -9,17 +9,18 @@
   "attackers_goals": "Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.",
   "deduplication_period": "1 Day",
   "description": "A compromised process accessed a rare cloud resource.",
   "detection_modules": "",
   "detector_tags": "EDR Windows C2 Analytics",
   "investigative_actions": "Investigate the compromised process. Identify the rare cloud resource accessed, is it managed by your organization?",
   "name": "A compromised process accessed a rare cloud resource",
   "required_data": [
-    "XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Informational",
   "test_period": "2 Hours",
   "variations": [
     {
       "name": "A process compromised by DLL sideloading accessed a rare cloud resource and demonstrated abnormal communication patters",
       "severity": "Medium",
       "attack_tactics": [
```
▸ ▾ A compromised process accessed a rare external host modified +2 −1 analytics/a-compromised-process-accessed-a-rare-external-host

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,17 +9,18 @@

"attackers_goals": "Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.",

"attackers_goals": "Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A compromised process accessed a rare external host.",

"description": "A compromised process accessed a rare external host.",

"detection_modules": "",

"detection_modules": "",

"detector_tags": "EDR Windows C2 Analytics",

"detector_tags": "EDR Windows C2 Analytics",

"investigative_actions": "Investigate the compromised process. Check the rare remote host.",

"investigative_actions": "Investigate the compromised process. Check the rare remote host.",

"name": "A compromised process accessed a rare external host",

"name": "A compromised process accessed a rare external host",

"required_data": [

"required_data": [

"XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Low",

"severity": "Low",

"test_period": "2 Hours",

"test_period": "2 Hours",

"variations": [

"variations": [

{

{

"name": "A process compromised by DLL sideloading accessed a rare external host and transferred a large amount of data",

"name": "A process compromised by DLL sideloading accessed a rare external host and transferred a large amount of data",

"severity": "High",

"severity": "High",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -9,17 +9,18 @@
   "attackers_goals": "Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.",
   "deduplication_period": "1 Day",
   "description": "A compromised process accessed a rare external host.",
   "detection_modules": "",
   "detector_tags": "EDR Windows C2 Analytics",
   "investigative_actions": "Investigate the compromised process. Check the rare remote host.",
   "name": "A compromised process accessed a rare external host",
   "required_data": [
-    "XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Low",
   "test_period": "2 Hours",
   "variations": [
     {
       "name": "A process compromised by DLL sideloading accessed a rare external host and transferred a large amount of data",
       "severity": "High",
       "attack_tactics": [
```
▸ ▾ A user accessed an uncommon AppID modified +2 −1 analytics/a-user-accessed-an-uncommon-appid

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -11,17 +11,18 @@

"description": "A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization.",

"description": "A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Check for any other suspicious activity related to the host and the user involved in the alert.",

"investigative_actions": "Check for any other suspicious activity related to the host and the user involved in the alert.",

"name": "A user accessed an uncommon AppID",

"name": "A user accessed an uncommon AppID",

"required_data": [

"required_data": [

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall threat Logs",

"Palo Alto Networks Firewall threat Logs",

"Palo Alto Networks Firewall traffic LogsXDR Agent"

"Palo Alto Networks Firewall traffic Logs",

"XDR Agent"

],

],

"severity": "Informational",

"severity": "Informational",

"test_period": "N/A (single event)",

"test_period": "N/A (single event)",

"variations": [

"variations": [

{

{

"name": "A user accessed an uncommon external peer-to-peer service",

"name": "A user accessed an uncommon external peer-to-peer service",

"severity": "Informational",

"severity": "Informational",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -11,17 +11,18 @@
   "description": "A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "",
   "investigative_actions": "Check for any other suspicious activity related to the host and the user involved in the alert.",
   "name": "A user accessed an uncommon AppID",
   "required_data": [
     "Palo Alto Networks Firewall EAL Logs",
     "Palo Alto Networks Firewall threat Logs",
-    "Palo Alto Networks Firewall traffic LogsXDR Agent"
+    "Palo Alto Networks Firewall traffic Logs",
+    "XDR Agent"
   ],
   "severity": "Informational",
   "test_period": "N/A (single event)",
   "variations": [
     {
       "name": "A user accessed an uncommon external peer-to-peer service",
       "severity": "Informational",
       "attack_tactics": [
```
▸ ▾ A user accessed multiple time-consuming websites modified +2 −1 Now lists Palo Alto Networks Firewall EAL Logs twice; the duplicate sat inside the previously merged threat-logs string. analytics/a-user-accessed-multiple-time-consuming-websites

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -10,15 +10,16 @@

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.",

"description": "A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Investigate the domains accessed and how popular they are in the organization. Verify that the user is not part of a department that visits these websites as part of their daily operations.",

"investigative_actions": "Investigate the domains accessed and how popular they are in the organization. Verify that the user is not part of a department that visits these websites as part of their daily operations.",

"name": "A user accessed multiple time-consuming websites",

"name": "A user accessed multiple time-consuming websites",

"required_data": [

"required_data": [

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall threat LogsPalo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall threat Logs",

"Palo Alto Networks Firewall EAL Logs",

"XDR Agent"

"XDR Agent"

],

],

"severity": "Informational",

"severity": "Informational",

"test_period": "12 Hours",

"test_period": "12 Hours",

"variations": []

"variations": []

}

}
Show markdown source
```
@@ -10,15 +10,16 @@
   "deduplication_period": "1 Day",
   "description": "A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "",
   "investigative_actions": "Investigate the domains accessed and how popular they are in the organization. Verify that the user is not part of a department that visits these websites as part of their daily operations.",
   "name": "A user accessed multiple time-consuming websites",
   "required_data": [
     "Palo Alto Networks Firewall EAL Logs",
-    "Palo Alto Networks Firewall threat LogsPalo Alto Networks Firewall EAL Logs",
+    "Palo Alto Networks Firewall threat Logs",
+    "Palo Alto Networks Firewall EAL Logs",
     "XDR Agent"
   ],
   "severity": "Informational",
   "test_period": "12 Hours",
   "variations": []
 }
```
▸ ▾ Azure Privilege Escalation Using an Application modified +8 −2 Two merged required_data strings became eight entries, from AzureAD Audit Log through XDR Agent with eXtended Threat Hunting (XTH). analytics/azure-privilege-escalation-using-an-application

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,15 +9,21 @@

"attackers_goals": "An attacker may add additional roles or permissions to an attacker controlled cloud account to maintain persistent access to a tenant.",

"attackers_goals": "An attacker may add additional roles or permissions to an attacker controlled cloud account to maintain persistent access to a tenant.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "An Azure application was observed assigning an Azure administrator role to a user. This might indicate a privilege escalation attempt.",

"description": "An Azure application was observed assigning an Azure administrator role to a user. This might indicate a privilege escalation attempt.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Check if the affected account is new to the organization. Check whether the application that added the account to the role is permitted to perform such actions. Check what can be affected by the assigned role* Follow further actions done by the account that was added to the role.",

"investigative_actions": "Check if the affected account is new to the organization. Check whether the application that added the account to the role is permitted to perform such actions. Check what can be affected by the assigned role* Follow further actions done by the account that was added to the role.",

"name": "Azure Privilege Escalation Using an Application",

"name": "Azure Privilege Escalation Using an Application",

"required_data": [

"required_data": [

"AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",

"AzureAD Audit Log",

"Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"Microsoft Graph Logs",

"Office 365 Audit",

"Okta",

"Palo Alto Networks Global Protect",

"Third-Party VPNs",

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Medium",

"severity": "Medium",

"test_period": "5 Hours",

"test_period": "5 Hours",

"variations": []

"variations": []

}

}
Show markdown source
```
@@ -9,15 +9,21 @@
   "attackers_goals": "An attacker may add additional roles or permissions to an attacker controlled cloud account to maintain persistent access to a tenant.",
   "deduplication_period": "1 Day",
   "description": "An Azure application was observed assigning an Azure administrator role to a user. This might indicate a privilege escalation attempt.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "",
   "investigative_actions": "Check if the affected account is new to the organization. Check whether the application that added the account to the role is permitted to perform such actions. Check what can be affected by the assigned role* Follow further actions done by the account that was added to the role.",
   "name": "Azure Privilege Escalation Using an Application",
   "required_data": [
-    "AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",
-    "Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "AzureAD Audit Log",
+    "Microsoft Graph Logs",
+    "Office 365 Audit",
+    "Okta",
+    "Palo Alto Networks Global Protect",
+    "Third-Party VPNs",
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Medium",
   "test_period": "5 Hours",
   "variations": []
 }
```
▸ ▾ Cloud IMDS access followed by remote token usage modified +2 −1 "AWS Audit LogXDR Agent" separated into AWS Audit Log and XDR Agent. analytics/cloud-imds-access-followed-by-remote-token-usage

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -11,14 +11,15 @@

"attackers_goals": "Gain unauthorized access by leveraging valid cloud credentials.",

"attackers_goals": "Gain unauthorized access by leveraging valid cloud credentials.",

"deduplication_period": "1 Hour",

"deduplication_period": "1 Hour",

"description": "A request was made to the cloud Instance Metadata Service (IMDS) followed by a remote usage of EC2 role token.",

"description": "A request was made to the cloud Instance Metadata Service (IMDS) followed by a remote usage of EC2 role token.",

"detection_modules": "Cloud",

"detection_modules": "Cloud",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Identify the process that accessed the IMDS on the cloud instance. Examine the AWS API calls made by the stolen token, focusing on unusual or sensitive actions. Assess the role's permissions and rotate credentials if compromise is confirmed.",

"investigative_actions": "Identify the process that accessed the IMDS on the cloud instance. Examine the AWS API calls made by the stolen token, focusing on unusual or sensitive actions. Assess the role's permissions and rotate credentials if compromise is confirmed.",

"name": "Cloud IMDS access followed by remote token usage",

"name": "Cloud IMDS access followed by remote token usage",

"required_data": [

"required_data": [

"AWS Audit LogXDR Agent"

"AWS Audit Log",

"XDR Agent"

],

],

"severity": "Medium",

"severity": "Medium",

"test_period": "1 Hour",

"test_period": "1 Hour",

"variations": []

"variations": []

}

}
Show markdown source
```
@@ -11,14 +11,15 @@
   "attackers_goals": "Gain unauthorized access by leveraging valid cloud credentials.",
   "deduplication_period": "1 Hour",
   "description": "A request was made to the cloud Instance Metadata Service (IMDS) followed by a remote usage of EC2 role token.",
   "detection_modules": "Cloud",
   "detector_tags": "",
   "investigative_actions": "Identify the process that accessed the IMDS on the cloud instance. Examine the AWS API calls made by the stolen token, focusing on unusual or sensitive actions. Assess the role's permissions and rotate credentials if compromise is confirmed.",
   "name": "Cloud IMDS access followed by remote token usage",
   "required_data": [
-    "AWS Audit LogXDR Agent"
+    "AWS Audit Log",
+    "XDR Agent"
   ],
   "severity": "Medium",
   "test_period": "1 Hour",
   "variations": []
 }
```
▸ ▾ Increase in Job-Related Site Visits modified +2 −1 The same duplicated Palo Alto Networks Firewall EAL Logs entry surfaces once the merged string is split. analytics/increase-in-job-related-site-visits

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -10,15 +10,16 @@

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A user has visited multiple job-related sites in the past day.",

"description": "A user has visited multiple job-related sites in the past day.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Investigate the domains accessed and how popular they are in the organization. Check how long the user has been part of the organization. Verify that the user is not part of a department that accesses job sites as part of daily operations.",

"investigative_actions": "Investigate the domains accessed and how popular they are in the organization. Check how long the user has been part of the organization. Verify that the user is not part of a department that accesses job sites as part of daily operations.",

"name": "Increase in Job-Related Site Visits",

"name": "Increase in Job-Related Site Visits",

"required_data": [

"required_data": [

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall threat LogsPalo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall threat Logs",

"Palo Alto Networks Firewall EAL Logs",

"XDR Agent"

"XDR Agent"

],

],

"severity": "Informational",

"severity": "Informational",

"test_period": "1 Day",

"test_period": "1 Day",

"variations": []

"variations": []

}

}
Show markdown source
```
@@ -10,15 +10,16 @@
   "deduplication_period": "1 Day",
   "description": "A user has visited multiple job-related sites in the past day.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "",
   "investigative_actions": "Investigate the domains accessed and how popular they are in the organization. Check how long the user has been part of the organization. Verify that the user is not part of a department that accesses job sites as part of daily operations.",
   "name": "Increase in Job-Related Site Visits",
   "required_data": [
     "Palo Alto Networks Firewall EAL Logs",
-    "Palo Alto Networks Firewall threat LogsPalo Alto Networks Firewall EAL Logs",
+    "Palo Alto Networks Firewall threat Logs",
+    "Palo Alto Networks Firewall EAL Logs",
     "XDR Agent"
   ],
   "severity": "Informational",
   "test_period": "1 Day",
   "variations": []
 }
```
▸ ▾ Invalid SAML Detected modified +2 −1 "AzureADOkta" separated into AzureAD and Okta. analytics/invalid-saml-detected

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,17 +9,18 @@

"attackers_goals": "An attacker might forge a valid SAML token to impersonate other user accounts. This is used to gain persistent, unauthorized access to cloud resources, and bypassing MFA.",

"attackers_goals": "An attacker might forge a valid SAML token to impersonate other user accounts. This is used to gain persistent, unauthorized access to cloud resources, and bypassing MFA.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack.",

"description": "A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "Active Directory Federation Services Analytics",

"detector_tags": "Active Directory Federation Services Analytics",

"investigative_actions": "Check for recent changes to the SAML signing certificate on both the Identity Provider and the Service Provider to rule out a configuration drift or expiration issue. Check for other correlated alerts on on-premises systems that may be related to the Golden SAML attack. Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).",

"investigative_actions": "Check for recent changes to the SAML signing certificate on both the Identity Provider and the Service Provider to rule out a configuration drift or expiration issue. Check for other correlated alerts on on-premises systems that may be related to the Golden SAML attack. Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).",

"name": "Invalid SAML Detected",

"name": "Invalid SAML Detected",

"required_data": [

"required_data": [

"AzureADOkta"

"AzureAD",

"Okta"

],

],

"severity": "Informational",

"severity": "Informational",

"test_period": "N/A (single event)",

"test_period": "N/A (single event)",

"variations": [

"variations": [

{

{

"name": "Suspicious Invalid SAML Detected",

"name": "Suspicious Invalid SAML Detected",

"severity": "Low",

"severity": "Low",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -9,17 +9,18 @@
   "attackers_goals": "An attacker might forge a valid SAML token to impersonate other user accounts. This is used to gain persistent, unauthorized access to cloud resources, and bypassing MFA.",
   "deduplication_period": "1 Day",
   "description": "A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "Active Directory Federation Services Analytics",
   "investigative_actions": "Check for recent changes to the SAML signing certificate on both the Identity Provider and the Service Provider to rule out a configuration drift or expiration issue. Check for other correlated alerts on on-premises systems that may be related to the Golden SAML attack. Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).",
   "name": "Invalid SAML Detected",
   "required_data": [
-    "AzureADOkta"
+    "AzureAD",
+    "Okta"
   ],
   "severity": "Informational",
   "test_period": "N/A (single event)",
   "variations": [
     {
       "name": "Suspicious Invalid SAML Detected",
       "severity": "Low",
       "attack_tactics": [
```
▸ ▾ Massive upload to a rare storage or mail domain modified +2 −1 analytics/massive-upload-to-a-rare-storage-or-mail-domain

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -11,17 +11,18 @@

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.",

"description": "A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "Data Detection & Response",

"detector_tags": "Data Detection & Response",

"investigative_actions": "Check for any other suspicious activity related to the host and the user involved in the alert. Identify the user uploading the data to determine if the transfer is sanctioned.",

"investigative_actions": "Check for any other suspicious activity related to the host and the user involved in the alert. Identify the user uploading the data to determine if the transfer is sanctioned.",

"name": "Massive upload to a rare storage or mail domain",

"name": "Massive upload to a rare storage or mail domain",

"required_data": [

"required_data": [

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall threat LogsXDR Agent"

"Palo Alto Networks Firewall threat Logs",

"XDR Agent"

],

],

"severity": "Informational",

"severity": "Informational",

"test_period": "1 Hour",

"test_period": "1 Hour",

"variations": [

"variations": [

{

{

"name": "A user uploaded over 500 MB to a rare storage or mail domain",

"name": "A user uploaded over 500 MB to a rare storage or mail domain",

"severity": "Low",

"severity": "Low",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -11,17 +11,18 @@
   "deduplication_period": "1 Day",
   "description": "A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "Data Detection & Response",
   "investigative_actions": "Check for any other suspicious activity related to the host and the user involved in the alert. Identify the user uploading the data to determine if the transfer is sanctioned.",
   "name": "Massive upload to a rare storage or mail domain",
   "required_data": [
     "Palo Alto Networks Firewall EAL Logs",
-    "Palo Alto Networks Firewall threat LogsXDR Agent"
+    "Palo Alto Networks Firewall threat Logs",
+    "XDR Agent"
   ],
   "severity": "Informational",
   "test_period": "1 Hour",
   "variations": [
     {
       "name": "A user uploaded over 500 MB to a rare storage or mail domain",
       "severity": "Low",
       "attack_tactics": [
```
▸ ▾ Multiple uncommon SSH Servers with the same Server host key modified +2 −1 "Palo Alto Networks Firewall EAL LogsXDR Agent" separated into two sources. analytics/multiple-uncommon-ssh-servers-with-the-same-server-host-key

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,14 +9,15 @@

"attackers_goals": "Attackers may attempt to move laterally within the network by exploiting and relaying stolen client credentials to another SSH server.",

"attackers_goals": "Attackers may attempt to move laterally within the network by exploiting and relaying stolen client credentials to another SSH server.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "Multiple uncommon SSH servers were observed using the same host key.",

"description": "Multiple uncommon SSH servers were observed using the same host key.",

"detection_modules": "",

"detection_modules": "",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Audit the authentication attempts to the SSH server using the same key. Look for unusual or repeated connections from the same or unexpected hosts. Audit Client Credentials, check for any signs of compromised client credentials being used on different SSH servers.",

"investigative_actions": "Audit the authentication attempts to the SSH server using the same key. Look for unusual or repeated connections from the same or unexpected hosts. Audit Client Credentials, check for any signs of compromised client credentials being used on different SSH servers.",

"name": "Multiple uncommon SSH Servers with the same Server host key",

"name": "Multiple uncommon SSH Servers with the same Server host key",

"required_data": [

"required_data": [

"Palo Alto Networks Firewall EAL LogsXDR Agent"

"Palo Alto Networks Firewall EAL Logs",

"XDR Agent"

],

],

"severity": "Low",

"severity": "Low",

"test_period": "N/A (single event)",

"test_period": "N/A (single event)",

"variations": []

"variations": []

}

}
Show markdown source
```
@@ -9,14 +9,15 @@
   "attackers_goals": "Attackers may attempt to move laterally within the network by exploiting and relaying stolen client credentials to another SSH server.",
   "deduplication_period": "1 Day",
   "description": "Multiple uncommon SSH servers were observed using the same host key.",
   "detection_modules": "",
   "detector_tags": "",
   "investigative_actions": "Audit the authentication attempts to the SSH server using the same key. Look for unusual or repeated connections from the same or unexpected hosts. Audit Client Credentials, check for any signs of compromised client credentials being used on different SSH servers.",
   "name": "Multiple uncommon SSH Servers with the same Server host key",
   "required_data": [
-    "Palo Alto Networks Firewall EAL LogsXDR Agent"
+    "Palo Alto Networks Firewall EAL Logs",
+    "XDR Agent"
   ],
   "severity": "Low",
   "test_period": "N/A (single event)",
   "variations": []
 }
```
▸ ▾ Okta FastPass reported phishing attack suspected modified +2 −1 "XDR AgentPalo Alto Networks Firewall threat Logs" separated into two sources. analytics/okta-fastpass-reported-phishing-attack-suspected

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -10,17 +10,18 @@

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "Okta FastPass authentication reported a phishing attack suspected.",

"description": "Okta FastPass authentication reported a phishing attack suspected.",

"detection_modules": "Identity Analytics",

"detection_modules": "Identity Analytics",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Examine Okta alerts and search for signs of compromise to evaluate the potential risk. Examine email logs and headers to understand how the phishing email bypassed email security filters. Review the details of the phishing attempt, including the source email address, sender domain, and the content of the phishing message if available. Review recent login attempts, session details, and activity logs in OKTA for anomalies. Use threat intelligence feeds to identify if similar phishing tactics are part of a larger campaign. Examine historical access logs to see if there have been other attempts from the same IP or country and evaluate the potential threat level.",

"investigative_actions": "Examine Okta alerts and search for signs of compromise to evaluate the potential risk. Examine email logs and headers to understand how the phishing email bypassed email security filters. Review the details of the phishing attempt, including the source email address, sender domain, and the content of the phishing message if available. Review recent login attempts, session details, and activity logs in OKTA for anomalies. Use threat intelligence feeds to identify if similar phishing tactics are part of a larger campaign. Examine historical access logs to see if there have been other attempts from the same IP or country and evaluate the potential threat level.",

"name": "Okta FastPass reported phishing attack suspected",

"name": "Okta FastPass reported phishing attack suspected",

"required_data": [

"required_data": [

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall EAL Logs",

"XDR AgentPalo Alto Networks Firewall threat Logs"

"XDR Agent",

"Palo Alto Networks Firewall threat Logs"

],

],

"severity": "Low",

"severity": "Low",

"test_period": "N/A (single event)",

"test_period": "N/A (single event)",

"variations": [

"variations": [

{

{

"name": "Okta FastPass reported phishing attack suspected from a suspicious IP",

"name": "Okta FastPass reported phishing attack suspected from a suspicious IP",

"severity": "Medium",

"severity": "Medium",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -10,17 +10,18 @@
   "deduplication_period": "1 Day",
   "description": "Okta FastPass authentication reported a phishing attack suspected.",
   "detection_modules": "Identity Analytics",
   "detector_tags": "",
   "investigative_actions": "Examine Okta alerts and search for signs of compromise to evaluate the potential risk. Examine email logs and headers to understand how the phishing email bypassed email security filters. Review the details of the phishing attempt, including the source email address, sender domain, and the content of the phishing message if available. Review recent login attempts, session details, and activity logs in OKTA for anomalies. Use threat intelligence feeds to identify if similar phishing tactics are part of a larger campaign. Examine historical access logs to see if there have been other attempts from the same IP or country and evaluate the potential threat level.",
   "name": "Okta FastPass reported phishing attack suspected",
   "required_data": [
     "Palo Alto Networks Firewall EAL Logs",
-    "XDR AgentPalo Alto Networks Firewall threat Logs"
+    "XDR Agent",
+    "Palo Alto Networks Firewall threat Logs"
   ],
   "severity": "Low",
   "test_period": "N/A (single event)",
   "variations": [
     {
       "name": "Okta FastPass reported phishing attack suspected from a suspicious IP",
       "severity": "Medium",
       "attack_tactics": [
```
▸ ▾ Possible AS-REP Roasting Attack modified +2 −1 analytics/possible-as-rep-roasting-attack

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,17 +9,18 @@

"attackers_goals": "Crack account credentials by obtaining an easy-to-crack Kerberos ticket.",

"attackers_goals": "Crack account credentials by obtaining an easy-to-crack Kerberos ticket.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.",

"description": "A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.",

"detection_modules": "Identity Analytics",

"detection_modules": "Identity Analytics",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Check who used the host at the time of the alert, to rule out a benign service or tool requesting weak Kerberos encryption.",

"investigative_actions": "Check who used the host at the time of the alert, to rule out a benign service or tool requesting weak Kerberos encryption.",

"name": "Possible AS-REP Roasting Attack",

"name": "Possible AS-REP Roasting Attack",

"required_data": [

"required_data": [

"XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Medium",

"severity": "Medium",

"test_period": "1 Hour",

"test_period": "1 Hour",

"variations": [

"variations": [

{

{

"name": "AS-REP Roasting Attack",

"name": "AS-REP Roasting Attack",

"severity": "High",

"severity": "High",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -9,17 +9,18 @@
   "attackers_goals": "Crack account credentials by obtaining an easy-to-crack Kerberos ticket.",
   "deduplication_period": "1 Day",
   "description": "A user enumerated all accounts that don't require pre-authentication in the organization and specifically requested tickets for those accounts. This is typically a sign of an AS-REP Roasting attack.",
   "detection_modules": "Identity Analytics",
   "detector_tags": "",
   "investigative_actions": "Check who used the host at the time of the alert, to rule out a benign service or tool requesting weak Kerberos encryption.",
   "name": "Possible AS-REP Roasting Attack",
   "required_data": [
-    "XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Medium",
   "test_period": "1 Hour",
   "variations": [
     {
       "name": "AS-REP Roasting Attack",
       "severity": "High",
       "attack_tactics": [
```
▸ ▾ Possible Insider Threat Activity modified +8 −2 Same eight-source split: AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Global Protect, Third-Party VPNs and both XDR Agent tiers. analytics/possible-insider-threat-activity

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,18 +9,24 @@

"attackers_goals": "An insider threat might use their access to organizational resources for personal gain.",

"attackers_goals": "An insider threat might use their access to organizational resources for personal gain.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain.",

"description": "A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Check how long the user has been part of the organization. Check if the user is about to leave the company. Verify that the user is not part of a department that performs such activity as part of daily operations.",

"investigative_actions": "Check how long the user has been part of the organization. Check if the user is about to leave the company. Verify that the user is not part of a department that performs such activity as part of daily operations.",

"name": "Possible Insider Threat Activity",

"name": "Possible Insider Threat Activity",

"required_data": [

"required_data": [

"AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",

"AzureAD Audit Log",

"Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"Microsoft Graph Logs",

"Office 365 Audit",

"Okta",

"Palo Alto Networks Global Protect",

"Third-Party VPNs",

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Low",

"severity": "Low",

"test_period": "3 Hours",

"test_period": "3 Hours",

"variations": [

"variations": [

{

{

"name": "Indicate Insider Threat Activity",

"name": "Indicate Insider Threat Activity",

"severity": "Medium",

"severity": "Medium",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -9,18 +9,24 @@
   "attackers_goals": "An insider threat might use their access to organizational resources for personal gain.",
   "deduplication_period": "1 Day",
   "description": "A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "",
   "investigative_actions": "Check how long the user has been part of the organization. Check if the user is about to leave the company. Verify that the user is not part of a department that performs such activity as part of daily operations.",
   "name": "Possible Insider Threat Activity",
   "required_data": [
-    "AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",
-    "Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "AzureAD Audit Log",
+    "Microsoft Graph Logs",
+    "Office 365 Audit",
+    "Okta",
+    "Palo Alto Networks Global Protect",
+    "Third-Party VPNs",
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Low",
   "test_period": "3 Hours",
   "variations": [
     {
       "name": "Indicate Insider Threat Activity",
       "severity": "Medium",
       "attack_tactics": [
```
▸ ▾ Possible Kerberoasting attack modified +2 −1 analytics/possible-kerberoasting-attack

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,17 +9,18 @@

"attackers_goals": "Crack account credentials by obtaining an easy-to-crack Kerberos ticket.",

"attackers_goals": "Crack account credentials by obtaining an easy-to-crack Kerberos ticket.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A user enumerated all service principals in the organization and specifically requested weak and deprecated encryption in a ticket request. This is typically a sign of a Kerberoasting attack.",

"description": "A user enumerated all service principals in the organization and specifically requested weak and deprecated encryption in a ticket request. This is typically a sign of a Kerberoasting attack.",

"detection_modules": "Identity Analytics",

"detection_modules": "Identity Analytics",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Check who used the host at the time of the alert to rule out a benign service or tool requesting weak Kerberos encryption.",

"investigative_actions": "Check who used the host at the time of the alert to rule out a benign service or tool requesting weak Kerberos encryption.",

"name": "Possible Kerberoasting attack",

"name": "Possible Kerberoasting attack",

"required_data": [

"required_data": [

"XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Medium",

"severity": "Medium",

"test_period": "1 Hour",

"test_period": "1 Hour",

"variations": [

"variations": [

{

{

"name": "Kerberoasting attack",

"name": "Kerberoasting attack",

"severity": "High",

"severity": "High",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -9,17 +9,18 @@
   "attackers_goals": "Crack account credentials by obtaining an easy-to-crack Kerberos ticket.",
   "deduplication_period": "1 Day",
   "description": "A user enumerated all service principals in the organization and specifically requested weak and deprecated encryption in a ticket request. This is typically a sign of a Kerberoasting attack.",
   "detection_modules": "Identity Analytics",
   "detector_tags": "",
   "investigative_actions": "Check who used the host at the time of the alert to rule out a benign service or tool requesting weak Kerberos encryption.",
   "name": "Possible Kerberoasting attack",
   "required_data": [
-    "XDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Medium",
   "test_period": "1 Hour",
   "variations": [
     {
       "name": "Kerberoasting attack",
       "severity": "High",
       "attack_tactics": [
```
▸ ▾ Possible phishing attack via Microsoft Teams modified +8 −2 Same eight-source split, so its Microsoft Graph Logs and Office 365 Audit requirements now stand on their own. analytics/possible-phishing-attack-via-microsoft-teams

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -9,18 +9,24 @@

"attackers_goals": "Attackers may leverage Microsoft Teams to conduct phishing attacks by exploiting trusted communication channels with users inside the organization.",

"attackers_goals": "Attackers may leverage Microsoft Teams to conduct phishing attacks by exploiting trusted communication channels with users inside the organization.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "An external tenant is possibly attempting a phishing attack via Microsoft Teams.",

"description": "An external tenant is possibly attempting a phishing attack via Microsoft Teams.",

"detection_modules": "Identity Threat Module",

"detection_modules": "Identity Threat Module",

"detector_tags": "Microsoft Teams",

"detector_tags": "Microsoft Teams",

"investigative_actions": "Verify the suspicious sign-in activity to validate the legitimacy of the suspicious login. Review Teams chat logs and meeting invites for interactions with external tenants, focusing on unusual file sharing or unsolicited links. Hunt for known phishing indicators (suspicious domains, URL patterns, or IPs) in the Teams messages and linked content. Evaluate the external tenant reputation. Check for anomalous MS Teams actions like suspicious application installation, message extraction, policy changes or internal spear phishing attempts linked to the user post-login. Follow further actions done by the account.",

"investigative_actions": "Verify the suspicious sign-in activity to validate the legitimacy of the suspicious login. Review Teams chat logs and meeting invites for interactions with external tenants, focusing on unusual file sharing or unsolicited links. Hunt for known phishing indicators (suspicious domains, URL patterns, or IPs) in the Teams messages and linked content. Evaluate the external tenant reputation. Check for anomalous MS Teams actions like suspicious application installation, message extraction, policy changes or internal spear phishing attempts linked to the user post-login. Follow further actions done by the account.",

"name": "Possible phishing attack via Microsoft Teams",

"name": "Possible phishing attack via Microsoft Teams",

"required_data": [

"required_data": [

"AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",

"AzureAD Audit Log",

"Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"Microsoft Graph Logs",

"Office 365 Audit",

"Okta",

"Palo Alto Networks Global Protect",

"Third-Party VPNs",

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Low",

"severity": "Low",

"test_period": "5 Hours",

"test_period": "5 Hours",

"variations": [

"variations": [

{

{

"name": "Potential phishing attack with post compromise stages had been detected",

"name": "Potential phishing attack with post compromise stages had been detected",

"severity": "High",

"severity": "High",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -9,18 +9,24 @@
   "attackers_goals": "Attackers may leverage Microsoft Teams to conduct phishing attacks by exploiting trusted communication channels with users inside the organization.",
   "deduplication_period": "1 Day",
   "description": "An external tenant is possibly attempting a phishing attack via Microsoft Teams.",
   "detection_modules": "Identity Threat Module",
   "detector_tags": "Microsoft Teams",
   "investigative_actions": "Verify the suspicious sign-in activity to validate the legitimacy of the suspicious login. Review Teams chat logs and meeting invites for interactions with external tenants, focusing on unusual file sharing or unsolicited links. Hunt for known phishing indicators (suspicious domains, URL patterns, or IPs) in the Teams messages and linked content. Evaluate the external tenant reputation. Check for anomalous MS Teams actions like suspicious application installation, message extraction, policy changes or internal spear phishing attempts linked to the user post-login. Follow further actions done by the account.",
   "name": "Possible phishing attack via Microsoft Teams",
   "required_data": [
-    "AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",
-    "Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "AzureAD Audit Log",
+    "Microsoft Graph Logs",
+    "Office 365 Audit",
+    "Okta",
+    "Palo Alto Networks Global Protect",
+    "Third-Party VPNs",
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Low",
   "test_period": "5 Hours",
   "variations": [
     {
       "name": "Potential phishing attack with post compromise stages had been detected",
       "severity": "High",
       "attack_tactics": [
```
▸ ▾ Potential extraction of NAA Account Credentials in Microsoft Configuration Manager modified +8 −2 Same eight-source split across the identity, VPN and XDR Agent requirements. analytics/potential-extraction-of-naa-account-credentials-in-microsoft-configuration-manager

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -12,18 +12,24 @@

"attackers_goals": "An attacker may extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment to access resources and lateral movement within the network.",

"attackers_goals": "An attacker may extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment to access resources and lateral movement within the network.",

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.",

"description": "Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.",

"detection_modules": "Identity Analytics",

"detection_modules": "Identity Analytics",

"detector_tags": "Microsoft SCCM Analytics",

"detector_tags": "Microsoft SCCM Analytics",

"investigative_actions": "Verify the activity with the performing user. Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts. Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns. Looking for signs of credential extraction, such as tools or scripts.",

"investigative_actions": "Verify the activity with the performing user. Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts. Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns. Looking for signs of credential extraction, such as tools or scripts.",

"name": "Potential extraction of NAA Account Credentials in Microsoft Configuration Manager",

"name": "Potential extraction of NAA Account Credentials in Microsoft Configuration Manager",

"required_data": [

"required_data": [

"AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",

"AzureAD Audit Log",

"Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"

"Microsoft Graph Logs",

"Office 365 Audit",

"Okta",

"Palo Alto Networks Global Protect",

"Third-Party VPNs",

"XDR Agent",

"XDR Agent with eXtended Threat Hunting (XTH)"

],

],

"severity": "Low",

"severity": "Low",

"test_period": "3 Hours",

"test_period": "3 Hours",

"variations": [

"variations": [

{

{

"name": "Suspicious extraction of NAA Account Credentials in Microsoft Configuration Manager",

"name": "Suspicious extraction of NAA Account Credentials in Microsoft Configuration Manager",

"severity": "Medium",

"severity": "Medium",

"attack_tactics": [

"attack_tactics": [
Show markdown source
```
@@ -12,18 +12,24 @@
   "attackers_goals": "An attacker may extract plaintext credentials of the Network Access Account (NAA) from an SCCM environment to access resources and lateral movement within the network.",
   "deduplication_period": "1 Day",
   "description": "Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account.",
   "detection_modules": "Identity Analytics",
   "detector_tags": "Microsoft SCCM Analytics",
   "investigative_actions": "Verify the activity with the performing user. Review related logs (e.g., Active Directory, SCCM logs) to identify the source of the modification and associated accounts. Look for unusual logins using the Network Access Account (NAA), on systems or at times that deviate from normal patterns. Looking for signs of credential extraction, such as tools or scripts.",
   "name": "Potential extraction of NAA Account Credentials in Microsoft Configuration Manager",
   "required_data": [
-    "AzureAD Audit LogMicrosoft Graph LogsOffice 365 AuditOktaPalo Alto Networks Global Protect",
-    "Third-Party VPNsXDR AgentXDR Agent with eXtended Threat Hunting (XTH)"
+    "AzureAD Audit Log",
+    "Microsoft Graph Logs",
+    "Office 365 Audit",
+    "Okta",
+    "Palo Alto Networks Global Protect",
+    "Third-Party VPNs",
+    "XDR Agent",
+    "XDR Agent with eXtended Threat Hunting (XTH)"
   ],
   "severity": "Low",
   "test_period": "3 Hours",
   "variations": [
     {
       "name": "Suspicious extraction of NAA Account Credentials in Microsoft Configuration Manager",
       "severity": "Medium",
       "attack_tactics": [
```
▸ ▾ Recurring access to rare domain modified +2 −1 "Palo Alto Networks Firewall threat LogsXDR Agent" separated, leaving Third-Party Firewalls as before. analytics/recurring-access-to-rare-domain

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -10,17 +10,18 @@

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.",

"description": "The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.",

"detection_modules": "",

"detection_modules": "",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Identify the process/user contacting the remote domain and determine whether the traffic is malicious. Look for other endpoints on your network that are also periodically contacting the suspicious domain.",

"investigative_actions": "Identify the process/user contacting the remote domain and determine whether the traffic is malicious. Look for other endpoints on your network that are also periodically contacting the suspicious domain.",

"name": "Recurring access to rare domain",

"name": "Recurring access to rare domain",

"required_data": [

"required_data": [

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall EAL Logs",

"Palo Alto Networks Firewall threat LogsXDR Agent",

"Palo Alto Networks Firewall threat Logs",

"XDR Agent",

"Third-Party Firewalls"

"Third-Party Firewalls"

],

],

"severity": "Low",

"severity": "Low",

"test_period": "N/A (single event)",

"test_period": "N/A (single event)",

"variations": [

"variations": [

{

{

"name": "Recurring access to rare domain",

"name": "Recurring access to rare domain",

"severity": "Low",

"severity": "Low",
Show markdown source
```
@@ -10,17 +10,18 @@
   "deduplication_period": "1 Day",
   "description": "The endpoint is periodically connecting to an external domain (categorized as malware) that it and its peers rarely use. Access to this domain has occurred repeatedly over multiple days. This connection pattern is consistent with malware connecting to its command and control server for updates and operating instructions.",
   "detection_modules": "",
   "detector_tags": "",
   "investigative_actions": "Identify the process/user contacting the remote domain and determine whether the traffic is malicious. Look for other endpoints on your network that are also periodically contacting the suspicious domain.",
   "name": "Recurring access to rare domain",
   "required_data": [
     "Palo Alto Networks Firewall EAL Logs",
-    "Palo Alto Networks Firewall threat LogsXDR Agent",
+    "Palo Alto Networks Firewall threat Logs",
+    "XDR Agent",
     "Third-Party Firewalls"
   ],
   "severity": "Low",
   "test_period": "N/A (single event)",
   "variations": [
     {
       "name": "Recurring access to rare domain",
       "severity": "Low",
```
▸ ▾ SSO with abnormal operating system modified +2 −1 "OktaOneLogin" separated into Okta and OneLogin. analytics/sso-with-abnormal-operating-system

Read it here → This file's diff on GitHub ↗

Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.

Before After

@@ -10,14 +10,15 @@

"deduplication_period": "1 Day",

"deduplication_period": "1 Day",

"description": "A user successfully authenticated via SSO with an abnormal operating system.",

"description": "A user successfully authenticated via SSO with an abnormal operating system.",

"detection_modules": "Identity Analytics",

"detection_modules": "Identity Analytics",

"detector_tags": "",

"detector_tags": "",

"investigative_actions": "Confirm that the activity is benign (e.g. the user has really moved to a new operating system). Follow actions and suspicious activities regarding the user.",

"investigative_actions": "Confirm that the activity is benign (e.g. the user has really moved to a new operating system). Follow actions and suspicious activities regarding the user.",

"name": "SSO with abnormal operating system",

"name": "SSO with abnormal operating system",

"required_data": [

"required_data": [

"AzureAD",

"AzureAD",

"OktaOneLogin"

"Okta",

"OneLogin"

],

],

"severity": "Informational",

"severity": "Informational",

"test_period": "N/A (single event)",

"test_period": "N/A (single event)",

"variations": []

"variations": []

}

}
Show markdown source
```
@@ -10,14 +10,15 @@
   "deduplication_period": "1 Day",
   "description": "A user successfully authenticated via SSO with an abnormal operating system.",
   "detection_modules": "Identity Analytics",
   "detector_tags": "",
   "investigative_actions": "Confirm that the activity is benign (e.g. the user has really moved to a new operating system). Follow actions and suspicious activities regarding the user.",
   "name": "SSO with abnormal operating system",
   "required_data": [
     "AzureAD",
-    "OktaOneLogin"
+    "Okta",
+    "OneLogin"
   ],
   "severity": "Informational",
   "test_period": "N/A (single event)",
   "variations": []
 }
```