Globally uncommon process execution from a signed process

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Global Anomaly Analytics
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Informational

Description

A signed process has executed a process that, on a global level, it usually doesn't execute.

Attacker's Goals

Unusual processes may be executed for various purposes, including exfiltration, lateral movement, etc.

Investigative actions

Check if the actor process was injected or loaded a suspicious DLL before the alert.
Check if the process execution and connections are legitimate.

Variations

Globally uncommon process execution from a signed process from a known vendor

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Medium

Description

A signed process has executed a process that, on a global level, it usually doesn't execute.

Attacker's Goals

Unusual processes may be executed for various purposes, including exfiltration, lateral movement, etc.

Investigative actions

Check if the actor process was injected or loaded a suspicious DLL before the alert.
Check if the process execution and connections are legitimate.

Globally rare process execution from a signed process

Synopsis

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	Medium

Description

A signed process has executed a process that, on a global level, it usually doesn't execute.

Attacker's Goals

Unusual processes may be executed for various purposes, including exfiltration, lateral movement, etc.

Investigative actions

Check if the actor process was injected or loaded a suspicious DLL before the alert.
Check if the process execution and connections are legitimate.

Globally uncommon process execution from an injected thread in a signed process

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Description

An injected thread in a signed process has executed a process that, on a global level, it usually doesn't execute.

Attacker's Goals

Unusual processes may be executed for various purposes, including exfiltration, lateral movement, etc.

Investigative actions

Check if the actor process was injected or loaded a suspicious DLL before the alert.
Check if the process execution and connections are legitimate.

Globally uncommon process execution from a web server process or CGO

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Description

A web server process or CGO has executed a process that, on a global level, it usually doesn't execute.

Attacker's Goals

Unusual processes may be executed for various purposes, including exfiltration, lateral movement, etc.

Investigative actions

Check if the actor process was injected or loaded a suspicious DLL before the alert.
Check if the process execution and connections are legitimate.