Suspicious sshpass command execution

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Brute Force: Credential Stuffing (T1110.004)
Severity	Low

The sshpass command was executed, This could be an attempt to check for credential stuffing.

Attackers may try to check and reuse credentials on the host.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Brute Force: Credential Stuffing (T1110.004)
Severity	Low

The sshpass command was executed, This could be an attempt to check for credential stuffing.

Attackers may try to check and reuse credentials on the host.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.