Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
- Requires:
- Palo Alto Networks Url Logs
|
Detection Modules |
|
Detector Tags |
|
ATT&CK Tactic |
Command and Control (TA0011) |
ATT&CK Technique |
Web Service (T1102) |
Severity |
Low |
Description
Non-browser access to a pastebin-like site.
Attacker's Goals
Data exfiltration or attack tool staging.
Investigative actions
- Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
- Verify that the host doesn't have sensitive company data that can be easily exfiltrated.
Variations
Non-browser or an uncommon browser access to a pastebin-like site
Synopsis
Description
Non-browser or an uncommon browser access to a pastebin-like site.
Attacker's Goals
Data exfiltration or attack tool staging.
Investigative actions
- Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
- Verify that the host doesn't have sensitive company data that can be easily exfiltrated.
- Check if the process is indeed an uncommon browser or not.
Non-browser access to google sheets API
Synopsis
Description
Non-browser access to google sheets API.
Attacker's Goals
Data exfiltration or attack tool staging.
Investigative actions
- Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
- Verify that the host doesn't have sensitive company data that can be easily exfiltrated.
Non-browser failed access to a pastebin-like site
Synopsis
Description
Non-browser failed access to a pastebin-like site.
Attacker's Goals
Data exfiltration or attack tool staging.
Investigative actions
- Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
- Verify that the host doesn't have sensitive company data that can be easily exfiltrated.
Rare non-browser access to a pastebin-like site
Synopsis
Description
Rare non-browser access to a pastebin-like site.
Attacker's Goals
Data exfiltration or attack tool staging.
Investigative actions
- Examine the host to verify that the host was not part of infiltration or data exfiltration from the organization.
- Verify that the host doesn't have sensitive company data that can be easily exfiltrated.