Uncommon WPAD queries

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2025-03-09

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Logs OR XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Adversary-in-the-Middle (T1557)
Severity	Informational

There were multiple attempts to access WPAD resources by a single host in your network. This may indicate a malicious activity.

Attackers may attempt to move laterally over the network by exploiting problems in WPAD.

There were multiple attempts to access WPAD resources by a single host in your network. This may indicate a malicious activity.

Attackers may attempt to move laterally over the network by exploiting problems in WPAD.

Suspicious WPAD queries

There were multiple attempts to access WPAD resources by a single host in your network. This may indicate a malicious activity.

Attackers may attempt to move laterally over the network by exploiting problems in WPAD.

There were multiple attempts to access WPAD resources by a single host in your network. This may indicate a malicious activity.

Attackers may attempt to move laterally over the network by exploiting problems in WPAD.