Rare access to known advertising domains

Cortex XDR Analytics Alert Reference by Alert name
Product
Cortex XDR
Last date published
2024-10-08
Category
Analytics Alert Reference
Order
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

1 Day

Deduplication Period

1 Day

Required Data

  • Requires:
    • Palo Alto Networks Platform Logs
  • Requires:
    • XDR Agent

Detection Modules

Detector Tags

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

Description

The endpoint performed many connections to unpopular advertising domains.
This could indicate the presence of adware on the endpoint.

Attacker's Goals

Causing the user to view excessive advertising content.

Investigative actions

  • Investigate the infected machine and search for suspicious browser extensions, See if changes were made to the homepage or if the browser is slower than usual, check whether sites that do not have ads usually, display ads when accessed from the possibly infected endpoint.
  • Search for suspicious redirections or proxy configuration on the infected machine.
  • Search for a C&C communication.

Variations

Rare access to known advertising domains from a Rare User Agent

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

Description

The endpoint performed many connections to unpopular advertising domains from a rare user agent.
This could indicate the presence of adware on the endpoint.

Attacker's Goals

Causing the user to view excessive advertising content.

Investigative actions

  • Investigate the infected machine and search for suspicious browser extensions, See if changes were made to the homepage or if the browser is slower than usual, check whether sites that do not have ads usually, display ads when accessed from the possibly infected endpoint.
  • Search for suspicious redirections or proxy configuration on the infected machine.
  • Search for a C&C communication.


Suspicious Rare access to known advertising domains

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Description

The endpoint performed many connections to unpopular advertising domains.
This could indicate the presence of adware on the endpoint.

Attacker's Goals

Causing the user to view excessive advertising content.

Investigative actions

  • Investigate the infected machine and search for suspicious browser extensions, See if changes were made to the homepage or if the browser is slower than usual, check whether sites that do not have ads usually, display ads when accessed from the possibly infected endpoint.
  • Search for suspicious redirections or proxy configuration on the infected machine.
  • Search for a C&C communication.