Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Identity Threat Module |
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
A browser was opened in private mode, which may indicate an attempt to cover tracks.
Attacker's Goals
A browser was opened in private mode. Users might use private mode if they wish to stay anonymous online or hide their search and browsing history.
Investigative actions
Check for any other suspicious activity related to the host and the user involved in the alert.