Abnormal communication with a rare combination of TLS and HTTP User Agent

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-05-13

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Logs OR XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Command and Control (TA0011) Exfiltration (TA0010)
ATT&CK Technique	Web Service (T1102) Exfiltration Over Web Service (T1567)
Severity	Low

Abnormal communication with a rare combination of TLS and HTTP User Agent to an external address.

Data exfiltration, attack tool staging or command and control channel through a trusted service.

Examine the legitimacy of the application that produced this rare TLS fingerprint with the external server.
Examine the parent process of this application.
Check for anomalies at the time when the communication occurred.
Verify if the outbound communication is being routed through a legitimate HTTP tunneling solution.