Possible use of IPFS was detected

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Logs OR XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Exfiltration (TA0010) Initial Access (TA0001)
ATT&CK Technique	Exfiltration Over Alternative Protocol (T1048) Phishing (T1566)
Severity	Informational

The host produced traffic consistent with IPFS.

IPFS access may expose your organization to new malware or allow attackers/ malicious insiders to exfiltrate data.

Check the host for IPFS client software.
Look at the user's website history for IPFS url's and check the content ID (CID) for malicious indicators.
Examine the client's network traffic for uploaded or downloaded file hashes.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

The host produced traffic consistent with IPFS.

IPFS access may expose your organization to new malware or allow attackers/ malicious insiders to exfiltrate data.

Check the host for IPFS client software.
Look at the user's website history for IPFS url's and check the content ID (CID) for malicious indicators.
Examine the client's network traffic for uploaded or downloaded file hashes.