Execution of an uncommon process at an early startup stage by Windows system binary

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Generic Persistence Analytics
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution (T1547)
Severity	Low

Uncommon execution of an executable found in an early startup stage by Windows system binary.

Check if the Causality Group Owner (CGO) has a related persistence mechanism that may have been abused by an attacker.

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution (T1547)
Severity	Medium

Uncommon execution of an executable found in an early startup stage by Windows system binary.

Check if the Causality Group Owner (CGO) has a related persistence mechanism that may have been abused by an attacker.

ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Boot or Logon Autostart Execution (T1547)
Severity	Low

Uncommon execution of an executable found in an early startup stage by Windows system binary.

Check if the Causality Group Owner (CGO) has a related persistence mechanism that may have been abused by an attacker.