An unusual archive file creation by a user

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	3 Days
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Archive Collected Data: Archive via Utility (T1560.001) Data Staged (T1074)
Severity	Informational

An archive file was created by a user who doesn't usually create such files. This might indicate an attempt to stage data before exfiltration.

Stage data on an endpoint in the organization.

Check for any other suspicious activity related to the host and the user involved in the alert.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

A user created an archive file for the first time. This might indicate an attempt to stage data before exfiltration.

Stage data on an endpoint in the organization.

Check for any other suspicious activity related to the host and the user involved in the alert.