Non-browser access to a pastebin-like site

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Palo Alto Networks Url Logs
Detection Modules
Detector Tags
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Web Service (T1102)
Severity	Low

Non-browser access to a pastebin-like site.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

Non-browser access to google sheets API.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

Non-browser failed access to a pastebin-like site.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.

Rare non-browser access to a pastebin-like site.

Data exfiltration or attack tool staging.

Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
Verify that the host doesn't have sensitive company data that can be easily exfiltrated.