Suspicious process accessed a site masquerading as Google

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Command and Control (TA0011) Defense Evasion (TA0005)
ATT&CK Technique	Web Service: Bidirectional Communication (T1102.002) Masquerading (T1036)
Severity	Informational

A suspicious process accessed a site masquerading as Google.

Masquerade legitimate looking Google services for defense evasion and C&C.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

A suspicious process resolved the DNS name of a site masquerading as Google.

Masquerade legitimate looking Google services for defense evasion and C&C.