Possible authentication coercion

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2025-06-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Forced Authentication (T1187) Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay (T1557.001)
Severity	Informational

An unusual Remote Procedure Call (RPC) was made to potentially cause authentication coercion.

An attacker can abuse Remote Procedure Calls to coerce an authentication from servers.

Check for a suspicious process on the initiator.
Check if the source host is a vulnerability scanner.
Check for unusual connections from {actor_remote_ip} to other servers in the network.
Check for logged-in users to {actor_remote_ip} and investigate their actions.
Check for indicators of compromise on {actor_remote_ip}.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

An unusual Remote Procedure Call (RPC) was made towards a sensitive server, to potentially cause authentication coercion.

An attacker can abuse Remote Procedure Calls to coerce an authentication from servers.

Check for a suspicious process on the initiator.
Check if the source host is a vulnerability scanner.
Check for unusual connections from {actor_remote_ip} to other servers in the network.
Check for logged-in users to {actor_remote_ip} and investigate their actions.
Check for indicators of compromise on {actor_remote_ip}.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

An unusual Remote Procedure Call (RPC) was made towards a sensitive server, to potentially cause authentication coercion.

An attacker can abuse Remote Procedure Calls to coerce an authentication from servers.

Check for a suspicious process on the initiator.
Check if the source host is a vulnerability scanner.
Check for unusual connections from {actor_remote_ip} to other servers in the network.
Check for logged-in users to {actor_remote_ip} and investigate their actions.
Check for indicators of compromise on {actor_remote_ip}.