Rare signature signed executable executed in the network

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	30 Days
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Subvert Trust Controls: Code Signing (T1553.002)
Severity	Informational

Attackers may use signed executables by less known vendors to bypass security features.

Adversaries may use signed binaries to bypass security features.

Check if this is legitimate software installed by a legitimate user and intentionally.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Subvert Trust Controls: Code Signing (T1553.002)
Severity	Medium

Attackers may use signed executables by less known vendors to bypass security features.

Adversaries may use signed binaries to bypass security features.

Check the capabilities of the forensic tool, for example if it can read data directly from the disk.
Check other activities seen from the same remote IP address.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Subvert Trust Controls: Code Signing (T1553.002)
Severity	Low

Attackers may use signed executables by less known vendors to bypass security features.

Adversaries may use signed binaries to bypass security features.

Check the capabilities of the forensic tool, for example if it can read data directly from the disk.