Globally uncommon IP address by a common process (sha256)

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Global Anomaly Analytics
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Informational

Description

A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.

Attacker's Goals

Attackers may use various methods to execute code from a context of another process to avoid detection.

Investigative actions

Check the destination IP address reputation.
Check if the actor process loaded a suspicious DLL before the alert.
Check if the actor process was injected before the alert.
Check if the process execution and connections are legitimate.

Variations

Globally uncommon IP address by a common process (sha256) from an injected thread

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

High

Description

A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.

Attacker's Goals

Attackers may use various methods to execute code from a context of another process to avoid detection.

Investigative actions

Check the destination IP address reputation.
Check if the actor process loaded a suspicious DLL before the alert.
Check if the actor process was injected before the alert.
Check if the process execution and connections are legitimate.

Globally uncommon IP address by a common process (sha256) from a known vendor

Synopsis

ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Medium

Description

A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.

Attacker's Goals

Attackers may use various methods to execute code from a context of another process to avoid detection.

Investigative actions

Check the destination IP address reputation.
Check if the actor process loaded a suspicious DLL before the alert.
Check if the actor process was injected before the alert.
Check if the process execution and connections are legitimate.

Globally uncommon and very rare IP address by a common process (sha256)

Synopsis

ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Medium

Description

A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.

Attacker's Goals

Attackers may use various methods to execute code from a context of another process to avoid detection.

Investigative actions

Check the destination IP address reputation.
Check if the actor process loaded a suspicious DLL before the alert.
Check if the actor process was injected before the alert.
Check if the process execution and connections are legitimate.

Globally uncommon and a rare IP address by a common process (sha256)

Synopsis

ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Low

Description

A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to.

Attacker's Goals

Attackers may use various methods to execute code from a context of another process to avoid detection.

Investigative actions

Check the destination IP address reputation.
Check if the actor process loaded a suspicious DLL before the alert.
Check if the actor process was injected before the alert.
Check if the process execution and connections are legitimate.