A non-browser process accessed a website UI

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Palo Alto Networks Url Logs
Detection Modules
Detector Tags
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Web Service (T1102)
Severity	Informational

An uncommon network communication between a non-browser process and a website UI.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

Uncommon data upload to a known text share website through a Non-browser process.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

Uncommon data upload to a website through a Non browser process.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

Uncommon content download from a known text share website through a Non browser process.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.