> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent.md). # XDR Agent Alerts related to data source "XDR Agent". | Alert | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [A browser was opened in private mode](/analytics-alerts/alerts-by-name/a-browser-was-opened-in-private-mode.md) | | [A commonly abused process connected to a rare cloud resource](/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-cloud-resource.md) | | [A commonly abused process connected to a rare external host](/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-external-host.md) | | [A compressed file was exfiltrated over SSH](/analytics-alerts/alerts-by-name/a-compressed-file-was-exfiltrated-over-ssh.md) | | [A compromised process accessed a rare cloud resource](/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-cloud-resource.md) | | [A compromised process accessed a rare external host](/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-external-host.md) | | [A contained executable from a mounted share initiated a suspicious outbound network connection](/analytics-alerts/alerts-by-name/a-contained-executable-from-a-mounted-share-initiated-a-suspicious-outbound-network-connection.md) | | [A contained executable was executed by an unusual process](/analytics-alerts/alerts-by-name/a-contained-executable-was-executed-by-an-unusual-process.md) | | [A disabled user attempted to log in](/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-log-in.md) | | [A LOLBIN was copied to a different location](/analytics-alerts/alerts-by-name/a-lolbin-was-copied-to-a-different-location.md) | | [A Possible crypto miner was detected on a host](/analytics-alerts/alerts-by-name/a-possible-crypto-miner-was-detected-on-a-host.md) | | [A process connected to a rare cloud resource](/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-cloud-resource.md) | | [A process connected to a rare external host](/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-external-host.md) | | [A process connected to rare external host](/analytics-alerts/alerts-by-name/a-process-connected-to-rare-external-host.md) | | [A process is masquerading as a common Microsoft product](/analytics-alerts/alerts-by-name/a-process-is-masquerading-as-a-common-microsoft-product.md) | | [A process was executed with a command line obfuscated by Unicode character substitution](/analytics-alerts/alerts-by-name/a-process-was-executed-with-a-command-line-obfuscated-by-unicode-character-substitution.md) | | [A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process](/analytics-alerts/alerts-by-name/a-rare-dll-signed-by-an-uncommon-vendor-was-hijacked-into-a-microsoft-process.md) | | [A rare local administrator login](/analytics-alerts/alerts-by-name/a-rare-local-administrator-login.md) | | [A service was disabled](/analytics-alerts/alerts-by-name/a-service-was-disabled.md) | | [A Successful login from TOR](/analytics-alerts/alerts-by-name/a-successful-login-from-tor.md) | | [A suspicious process enrolled for a certificate](/analytics-alerts/alerts-by-name/a-suspicious-process-enrolled-for-a-certificate.md) | | [A TCP stream was created directly in a shell](/analytics-alerts/alerts-by-name/a-tcp-stream-was-created-directly-in-a-shell.md) | | [A third-party utility was copied to a different location](/analytics-alerts/alerts-by-name/a-third-party-utility-was-copied-to-a-different-location.md) | | [A Torrent client was detected on a host](/analytics-alerts/alerts-by-name/a-torrent-client-was-detected-on-a-host.md) | | [A user accessed an uncommon AppID](/analytics-alerts/alerts-by-name/a-user-accessed-an-uncommon-appid.md) | | [A user accessed multiple time-consuming websites](/analytics-alerts/alerts-by-name/a-user-accessed-multiple-time-consuming-websites.md) | | [A user authenticated with weak NTLM to multiple hosts](/analytics-alerts/alerts-by-name/a-user-authenticated-with-weak-ntlm-to-multiple-hosts.md) | | [A user logged in from an abnormal country or ASN](/analytics-alerts/alerts-by-name/a-user-logged-in-from-an-abnormal-country-or-asn.md) | | [A user logged on to multiple workstations via Schannel](/analytics-alerts/alerts-by-name/a-user-logged-on-to-multiple-workstations-via-schannel.md) | | [Abnormal Communication to a Rare Domain](/analytics-alerts/alerts-by-name/abnormal-communication-to-a-rare-domain.md) | | [Abnormal communication with a rare combination of TLS and HTTP User Agent](/analytics-alerts/alerts-by-name/abnormal-communication-with-a-rare-combination-of-tls-and-http-user-agent.md) | | [Abnormal connections to a dormant host from a newly seen endpoint](/analytics-alerts/alerts-by-name/abnormal-connections-to-a-dormant-host-from-a-newly-seen-endpoint.md) | | [Abnormal ICMP echo (PING) to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-icmp-echo-ping-to-multiple-hosts.md) | | [Abnormal network communication through TOR using an uncommon port](/analytics-alerts/alerts-by-name/abnormal-network-communication-through-tor-using-an-uncommon-port.md) | | [Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server](/analytics-alerts/alerts-by-name/abnormal-network-communication-with-a-rare-combination-of-http-user-agent-and-http-server.md) | | [Abnormal process connection to default Meterpreter port](/analytics-alerts/alerts-by-name/abnormal-process-connection-to-default-meterpreter-port.md) | | [Abnormal RDP connections to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-rdp-connections-to-multiple-hosts.md) | | [Abnormal RDP connections to multiple hosts from a rarely seen host](/analytics-alerts/alerts-by-name/abnormal-rdp-connections-to-multiple-hosts-from-a-rarely-seen-host.md) | | [Abnormal RDP session to a remote host from a rarely seen host](/analytics-alerts/alerts-by-name/abnormal-rdp-session-to-a-remote-host-from-a-rarely-seen-host.md) | | [Abnormal Recurring Communications to a Rare Domain](/analytics-alerts/alerts-by-name/abnormal-recurring-communications-to-a-rare-domain.md) | | [Abnormal SMB activity to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-smb-activity-to-multiple-hosts.md) | | [Abnormal SMB scanning activity to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-smb-scanning-activity-to-multiple-hosts.md) | | [Abnormal User Login to Domain Controller](/analytics-alerts/alerts-by-name/abnormal-user-login-to-domain-controller.md) | | [Account probing](/analytics-alerts/alerts-by-name/account-probing.md) | | [Adding execution privileges](/analytics-alerts/alerts-by-name/adding-execution-privileges.md) | | [An internal Cloud resource performed port scan on external networks](/analytics-alerts/alerts-by-name/an-internal-cloud-resource-performed-port-scan-on-external-networks.md) | | [An uncommon lolbin execution by scheduled task](/analytics-alerts/alerts-by-name/an-uncommon-lolbin-execution-by-scheduled-task.md) | | [An uncommon RDP session from a managed host](/analytics-alerts/alerts-by-name/an-uncommon-rdp-session-from-a-managed-host.md) | | [An uncommon RDP session was established](/analytics-alerts/alerts-by-name/an-uncommon-rdp-session-was-established.md) | | [An uncommon service was started](/analytics-alerts/alerts-by-name/an-uncommon-service-was-started.md) | | [An unsigned process created scheduled task and performed an injection](/analytics-alerts/alerts-by-name/an-unsigned-process-created-scheduled-task-and-performed-an-injection.md) | | [Analytics enhanced - Rare Internal Firewall Vulnerability Threat Alert](/analytics-alerts/alerts-by-name/analytics-enhanced-rare-internal-firewall-vulnerability-threat-alert.md) | | [AppleScript executed a shell script](/analytics-alerts/alerts-by-name/applescript-executed-a-shell-script.md) | | [AppleScript interpreter dynamic library loaded into a process](/analytics-alerts/alerts-by-name/applescript-interpreter-dynamic-library-loaded-into-a-process.md) | | [AppleScript process executed with a rare command line](/analytics-alerts/alerts-by-name/applescript-process-executed-with-a-rare-command-line.md) | | [Attempt to execute a command on a remote host using PsExec.exe](/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe.md) | | [Authentication Attempt From a Dormant Account](/analytics-alerts/alerts-by-name/authentication-attempt-from-a-dormant-account.md) | | [Autorun.inf created in root C drive](/analytics-alerts/alerts-by-name/autorun-inf-created-in-root-c-drive.md) | | [Azure Privilege Escalation Using an Application](/analytics-alerts/alerts-by-name/azure-privilege-escalation-using-an-application.md) | | [Bitsadmin.exe persistence using command-line callback](/analytics-alerts/alerts-by-name/bitsadmin-exe-persistence-using-command-line-callback.md) | | [Brute-force attempt on a local account](/analytics-alerts/alerts-by-name/brute-force-attempt-on-a-local-account.md) | | [Cached credentials discovery with cmdkey](/analytics-alerts/alerts-by-name/cached-credentials-discovery-with-cmdkey.md) | | [Certutil pfx parsing](/analytics-alerts/alerts-by-name/certutil-pfx-parsing.md) | | [Cloud IMDS access followed by remote token usage](/analytics-alerts/alerts-by-name/cloud-imds-access-followed-by-remote-token-usage.md) | | [Command execution in a Kubernetes pod](/analytics-alerts/alerts-by-name/command-execution-in-a-kubernetes-pod.md) | | [Command execution via wmiexec](/analytics-alerts/alerts-by-name/command-execution-via-wmiexec.md) | | [Command running with COMSPEC in the command line argument](/analytics-alerts/alerts-by-name/command-running-with-comspec-in-the-command-line-argument.md) | | [Common third-party software name masquerading](/analytics-alerts/alerts-by-name/common-third-party-software-name-masquerading.md) | | [Commonly abused AutoIT script connects to an external domain](/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-connects-to-an-external-domain.md) | | [Commonly abused process launched as a system service](/analytics-alerts/alerts-by-name/commonly-abused-process-launched-as-a-system-service.md) | | [Compressing data using python](/analytics-alerts/alerts-by-name/compressing-data-using-python.md) | | [Conhost.exe spawned a suspicious cmd process](/analytics-alerts/alerts-by-name/conhost-exe-spawned-a-suspicious-cmd-process.md) | | [Contained process execution with a rare GitHub URL](/analytics-alerts/alerts-by-name/contained-process-execution-with-a-rare-github-url.md) | | [Copy a process memory file](/analytics-alerts/alerts-by-name/copy-a-process-memory-file.md) | | [Copy a user's GnuPG directory with rsync](/analytics-alerts/alerts-by-name/copy-a-user-s-gnupg-directory-with-rsync.md) | | [Delayed Deletion of Files](/analytics-alerts/alerts-by-name/delayed-deletion-of-files.md) | | [Discovery of host users via WMIC](/analytics-alerts/alerts-by-name/discovery-of-host-users-via-wmic.md) | | [DNS Tunneling](/analytics-alerts/alerts-by-name/dns-tunneling.md) | | [Download a script using the python requests module](/analytics-alerts/alerts-by-name/download-a-script-using-the-python-requests-module.md) | | [Download pattern that resembles Peer to Peer traffic](/analytics-alerts/alerts-by-name/download-pattern-that-resembles-peer-to-peer-traffic.md) | | [Encoded information using Windows certificate management tool](/analytics-alerts/alerts-by-name/encoded-information-using-windows-certificate-management-tool.md) | | [Executable moved to Windows system folder](/analytics-alerts/alerts-by-name/executable-moved-to-windows-system-folder.md) | | [Execution of an uncommon process at an early startup stage](/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage.md) | | [Execution of an uncommon process at an early startup stage by Windows system binary](/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage-by-windows-system-binary.md) | | [Execution of an uncommon process with a local/domain user SID at an early startup stage](/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage.md) | | Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary | | [Execution of command from within a Kubernetes pod using kubelet credentials](/analytics-alerts/alerts-by-name/execution-of-command-from-within-a-kubernetes-pod-using-kubelet-credentials.md) | | [Execution of dllhost.exe with an empty command line](/analytics-alerts/alerts-by-name/execution-of-dllhost-exe-with-an-empty-command-line.md) | | [Execution of masqueraded third-party utility](/analytics-alerts/alerts-by-name/execution-of-masqueraded-third-party-utility.md) | | [Execution of renamed lolbin](/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin.md) | | [External Login Password Spray](/analytics-alerts/alerts-by-name/external-login-password-spray.md) | | [Extracting credentials from Unix files](/analytics-alerts/alerts-by-name/extracting-credentials-from-unix-files.md) | | [Failed Connections](/analytics-alerts/alerts-by-name/failed-connections.md) | | [Failed DNS](/analytics-alerts/alerts-by-name/failed-dns.md) | | [Failed Login For a Long Username With Special Characters](/analytics-alerts/alerts-by-name/failed-login-for-a-long-username-with-special-characters.md) | | [Failed Login For Locked-Out Account](/analytics-alerts/alerts-by-name/failed-login-for-locked-out-account.md) | | [File transfer from unusual IP using known tools](/analytics-alerts/alerts-by-name/file-transfer-from-unusual-ip-using-known-tools.md) | | [Fodhelper.exe UAC bypass](/analytics-alerts/alerts-by-name/fodhelper-exe-uac-bypass.md) | | [Globally uncommon high entropy module was loaded](/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-module-was-loaded.md) | | [Globally uncommon high entropy process was executed](/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-process-was-executed.md) | | [Globally uncommon image load from a signed process](/analytics-alerts/alerts-by-name/globally-uncommon-image-load-from-a-signed-process.md) | | [Globally uncommon injection from a signed process](/analytics-alerts/alerts-by-name/globally-uncommon-injection-from-a-signed-process.md) | | [Globally uncommon IP address by a common process (sha256)](/analytics-alerts/alerts-by-name/globally-uncommon-ip-address-by-a-common-process-sha256.md) | | [Globally uncommon IP address connection from a signed process](/analytics-alerts/alerts-by-name/globally-uncommon-ip-address-connection-from-a-signed-process.md) | | [Globally uncommon process execution from a signed process](/analytics-alerts/alerts-by-name/globally-uncommon-process-execution-from-a-signed-process.md) | | [Globally uncommon root domain from a signed process](/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-from-a-signed-process.md) | | [Globally uncommon root-domain port combination by a common process (sha256)](/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-port-combination-by-a-common-process-sha256.md) | | [Globally uncommon root-domain port combination from a signed process](/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-port-combination-from-a-signed-process.md) | | [Hidden Attribute was added to a file using attrib.exe](/analytics-alerts/alerts-by-name/hidden-attribute-was-added-to-a-file-using-attrib-exe.md) | | [HTTP with suspicious characteristics](/analytics-alerts/alerts-by-name/http-with-suspicious-characteristics.md) | | [Hydra Password Brute-Force Tool Execution](/analytics-alerts/alerts-by-name/hydra-password-brute-force-tool-execution.md) | | [Increase in Job-Related Site Visits](/analytics-alerts/alerts-by-name/increase-in-job-related-site-visits.md) | | [Indicator blocking](/analytics-alerts/alerts-by-name/indicator-blocking.md) | | [Indirect command execution using the Program Compatibility Assistant](/analytics-alerts/alerts-by-name/indirect-command-execution-using-the-program-compatibility-assistant.md) | | [Injection into rundll32.exe](/analytics-alerts/alerts-by-name/injection-into-rundll32-exe.md) | | [Installation of a new System-V service](/analytics-alerts/alerts-by-name/installation-of-a-new-system-v-service.md) | | [Interactive at.exe privilege escalation method](/analytics-alerts/alerts-by-name/interactive-at-exe-privilege-escalation-method.md) | | [Interactive local account enumeration](/analytics-alerts/alerts-by-name/interactive-local-account-enumeration.md) | | [Interactive login by a machine account](/analytics-alerts/alerts-by-name/interactive-login-by-a-machine-account.md) | | [Interactive login by a service account](/analytics-alerts/alerts-by-name/interactive-login-by-a-service-account.md) | | [Interactive login from a shared user account](/analytics-alerts/alerts-by-name/interactive-login-from-a-shared-user-account.md) | | [Internal Login Password Spray](/analytics-alerts/alerts-by-name/internal-login-password-spray.md) | | [Iptables configuration command was executed](/analytics-alerts/alerts-by-name/iptables-configuration-command-was-executed.md) | | [Kerberos Pre-Auth Failures by Host](/analytics-alerts/alerts-by-name/kerberos-pre-auth-failures-by-host.md) | | [Kerberos Pre-Auth Failures by User and Host](/analytics-alerts/alerts-by-name/kerberos-pre-auth-failures-by-user-and-host.md) | | [Kerberos Traffic from Non-Standard Process](/analytics-alerts/alerts-by-name/kerberos-traffic-from-non-standard-process.md) | | [Kerberos User Enumeration](/analytics-alerts/alerts-by-name/kerberos-user-enumeration.md) | | [Keylogging using system commands](/analytics-alerts/alerts-by-name/keylogging-using-system-commands.md) | | [Kubelet server communication from a pod](/analytics-alerts/alerts-by-name/kubelet-server-communication-from-a-pod.md) | | [Kubernetes API server communication from within a pod](/analytics-alerts/alerts-by-name/kubernetes-api-server-communication-from-within-a-pod.md) | | [Kubernetes environment enumeration activity](/analytics-alerts/alerts-by-name/kubernetes-environment-enumeration-activity.md) | | [Kubernetes nsenter container escape](/analytics-alerts/alerts-by-name/kubernetes-nsenter-container-escape.md) | | [Kubernetes secret enumeration activity](/analytics-alerts/alerts-by-name/kubernetes-secret-enumeration-activity.md) | | [Kubernetes version disclosure](/analytics-alerts/alerts-by-name/kubernetes-version-disclosure.md) | | [Kubernetes vulnerability scanner activity](/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanner-activity.md) | | [Large Upload (FTP)](/analytics-alerts/alerts-by-name/large-upload-ftp.md) | | [Large Upload (Generic)](/analytics-alerts/alerts-by-name/large-upload-generic.md) | | [Large Upload (HTTPS)](/analytics-alerts/alerts-by-name/large-upload-https.md) | | [Large Upload (SMTP)](/analytics-alerts/alerts-by-name/large-upload-smtp.md) | | [LDAP traffic from non-standard process](/analytics-alerts/alerts-by-name/ldap-traffic-from-non-standard-process.md) | | [Linux local user account creation](/analytics-alerts/alerts-by-name/linux-local-user-account-creation.md) | | [Linux network share discovery](/analytics-alerts/alerts-by-name/linux-network-share-discovery.md) | | [Linux process execution with a rare GitHub URL](/analytics-alerts/alerts-by-name/linux-process-execution-with-a-rare-github-url.md) | | [Local account discovery](/analytics-alerts/alerts-by-name/local-account-discovery.md) | | [Login attempt by a honey user](/analytics-alerts/alerts-by-name/login-attempt-by-a-honey-user.md) | | [Login by a dormant user](/analytics-alerts/alerts-by-name/login-by-a-dormant-user.md) | | [LOLBAS executable injects into another process](/analytics-alerts/alerts-by-name/lolbas-executable-injects-into-another-process.md) | | [LOLBIN process executed with a high integrity level](/analytics-alerts/alerts-by-name/lolbin-process-executed-with-a-high-integrity-level.md) | | [Machine Account NTLM Relay](/analytics-alerts/alerts-by-name/machine-account-ntlm-relay.md) | | [Manipulation of netsh helper DLLs Registry keys](/analytics-alerts/alerts-by-name/manipulation-of-netsh-helper-dlls-registry-keys.md) | | [Masquerading as the Linux crond process](/analytics-alerts/alerts-by-name/masquerading-as-the-linux-crond-process.md) | | [Massive upload to a rare storage or mail domain](/analytics-alerts/alerts-by-name/massive-upload-to-a-rare-storage-or-mail-domain.md) | | [Memory dumping with comsvcs.dll](/analytics-alerts/alerts-by-name/memory-dumping-with-comsvcs-dll.md) | | [Microsoft Configuration Manager device registration and policy request](/analytics-alerts/alerts-by-name/microsoft-configuration-manager-device-registration-and-policy-request.md) | | [Microsoft Office injects code into a process](/analytics-alerts/alerts-by-name/microsoft-office-injects-code-into-a-process.md) | | [Microsoft Office Process Spawning a Suspicious One-Liner](/analytics-alerts/alerts-by-name/microsoft-office-process-spawning-a-suspicious-one-liner.md) | | [Microsoft Office process spawns a commonly abused process](/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-a-commonly-abused-process.md) | | [Microsoft Office process spawns conhost.exe](/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-conhost-exe.md) | | [Mimikatz command-line arguments](/analytics-alerts/alerts-by-name/mimikatz-command-line-arguments.md) | | [Modification of PAM](/analytics-alerts/alerts-by-name/modification-of-pam.md) | | [Mount command was executed from within a Kubernetes pod to list all the attached filesystems](/analytics-alerts/alerts-by-name/mount-command-was-executed-from-within-a-kubernetes-pod-to-list-all-the-attached-filesystems.md) | | [MpCmdRun.exe was used to download files into the system](/analytics-alerts/alerts-by-name/mpcmdrun-exe-was-used-to-download-files-into-the-system.md) | | [Mshta.exe launched with suspicious arguments](/analytics-alerts/alerts-by-name/mshta-exe-launched-with-suspicious-arguments.md) | | [Mshta.exe spawns from a browser process](/analytics-alerts/alerts-by-name/mshta-exe-spawns-from-a-browser-process.md) | | [MSI accessed a web page running a server-side script](/analytics-alerts/alerts-by-name/msi-accessed-a-web-page-running-a-server-side-script.md) | | [Msiexec execution of an executable from an uncommon remote location](/analytics-alerts/alerts-by-name/msiexec-execution-of-an-executable-from-an-uncommon-remote-location.md) | | [Multiple discovery commands](/analytics-alerts/alerts-by-name/multiple-discovery-commands.md) | | [Multiple discovery commands on a Linux host by the same process](/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process.md) | | [Multiple discovery commands on a Windows host by the same process](/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-windows-host-by-the-same-process.md) | | [Multiple discovery-like commands](/analytics-alerts/alerts-by-name/multiple-discovery-like-commands.md) | | [Multiple Rare LOLBIN Process Executions by User](/analytics-alerts/alerts-by-name/multiple-rare-lolbin-process-executions-by-user.md) | | [Multiple Rare Process Executions in Organization](/analytics-alerts/alerts-by-name/multiple-rare-process-executions-in-organization.md) | | [Multiple uncommon SSH Servers with the same Server host key](/analytics-alerts/alerts-by-name/multiple-uncommon-ssh-servers-with-the-same-server-host-key.md) | | [Multiple user accounts failed login due to account lockouts](/analytics-alerts/alerts-by-name/multiple-user-accounts-failed-login-due-to-account-lockouts.md) | | [Multiple users authenticated with weak NTLM to a host](/analytics-alerts/alerts-by-name/multiple-users-authenticated-with-weak-ntlm-to-a-host.md) | | [Multiple Weakly-Encrypted Kerberos Tickets Received](/analytics-alerts/alerts-by-name/multiple-weakly-encrypted-kerberos-tickets-received.md) | | [Netcat makes or gets connections](/analytics-alerts/alerts-by-name/netcat-makes-or-gets-connections.md) | | [New addition to Windows Defender exclusion list](/analytics-alerts/alerts-by-name/new-addition-to-windows-defender-exclusion-list.md) | | [New Administrative Behavior](/analytics-alerts/alerts-by-name/new-administrative-behavior.md) | | [New FTP Server](/analytics-alerts/alerts-by-name/new-ftp-server.md) | | [New Shared User Account](/analytics-alerts/alerts-by-name/new-shared-user-account.md) | | [NTLM Brute Force](/analytics-alerts/alerts-by-name/ntlm-brute-force.md) | | [NTLM Brute Force on a Service Account](/analytics-alerts/alerts-by-name/ntlm-brute-force-on-a-service-account.md) | | [NTLM Brute Force on an Administrator Account](/analytics-alerts/alerts-by-name/ntlm-brute-force-on-an-administrator-account.md) | | [NTLM Hash Harvesting](/analytics-alerts/alerts-by-name/ntlm-hash-harvesting.md) | | [NTLM Password Spray](/analytics-alerts/alerts-by-name/ntlm-password-spray.md) | | [NTLM Relay](/analytics-alerts/alerts-by-name/ntlm-relay.md) | | [Office process spawned with suspicious command-line arguments](/analytics-alerts/alerts-by-name/office-process-spawned-with-suspicious-command-line-arguments.md) | | [Okta FastPass reported phishing attack suspected](/analytics-alerts/alerts-by-name/okta-fastpass-reported-phishing-attack-suspected.md) | | [Permission Groups discovery commands](/analytics-alerts/alerts-by-name/permission-groups-discovery-commands.md) | | [Phantom DLL Loading](/analytics-alerts/alerts-by-name/phantom-dll-loading.md) | | [Ping to localhost from an uncommon, unsigned parent process](/analytics-alerts/alerts-by-name/ping-to-localhost-from-an-uncommon-unsigned-parent-process.md) | | [Port Sweep](/analytics-alerts/alerts-by-name/port-sweep.md) | | [Possible AS-REP Roasting Attack](/analytics-alerts/alerts-by-name/possible-as-rep-roasting-attack.md) | | [Possible binary padding using dd](/analytics-alerts/alerts-by-name/possible-binary-padding-using-dd.md) | | [Possible brute force on sudo user](/analytics-alerts/alerts-by-name/possible-brute-force-on-sudo-user.md) | | [Possible brute force or configuration change attempt on cytool](/analytics-alerts/alerts-by-name/possible-brute-force-or-configuration-change-attempt-on-cytool.md) | | [Possible Brute-Force attempt](/analytics-alerts/alerts-by-name/possible-brute-force-attempt.md) | | [Possible code downloading from a remote host by Regsvr32](/analytics-alerts/alerts-by-name/possible-code-downloading-from-a-remote-host-by-regsvr32.md) | | [Possible collection of screen captures with Windows Problem Steps Recorder](/analytics-alerts/alerts-by-name/possible-collection-of-screen-captures-with-windows-problem-steps-recorder.md) | | [Possible compromised machine account](/analytics-alerts/alerts-by-name/possible-compromised-machine-account.md) | | [Possible data obfuscation](/analytics-alerts/alerts-by-name/possible-data-obfuscation.md) | | [Possible DLL Hijack into a Microsoft process](/analytics-alerts/alerts-by-name/possible-dll-hijack-into-a-microsoft-process.md) | | [Possible DLL Search Order Hijacking](/analytics-alerts/alerts-by-name/possible-dll-search-order-hijacking.md) | | [Possible Email collection using Outlook RPC](/analytics-alerts/alerts-by-name/possible-email-collection-using-outlook-rpc.md) | | [Possible external RDP Brute-Force](/analytics-alerts/alerts-by-name/possible-external-rdp-brute-force.md) | | [Possible Insider Threat Activity](/analytics-alerts/alerts-by-name/possible-insider-threat-activity.md) | | [Possible IPFS traffic was detected](/analytics-alerts/alerts-by-name/possible-ipfs-traffic-was-detected.md) | | [Possible Kerberoasting attack](/analytics-alerts/alerts-by-name/possible-kerberoasting-attack.md) | | [Possible Kerberoasting without SPNs](/analytics-alerts/alerts-by-name/possible-kerberoasting-without-spns.md) | | [Possible Kerberos relay attack](/analytics-alerts/alerts-by-name/possible-kerberos-relay-attack.md) | | [Possible malicious .NET compilation started by a commonly abused process](/analytics-alerts/alerts-by-name/possible-malicious-net-compilation-started-by-a-commonly-abused-process.md) | | [Possible network service discovery via command-line tool](/analytics-alerts/alerts-by-name/possible-network-service-discovery-via-command-line-tool.md) | | [Possible network sniffing attempt via tcpdump or tshark](/analytics-alerts/alerts-by-name/possible-network-sniffing-attempt-via-tcpdump-or-tshark.md) | | [Possible new DHCP server](/analytics-alerts/alerts-by-name/possible-new-dhcp-server.md) | | [Possible Pass-the-Hash](/analytics-alerts/alerts-by-name/possible-pass-the-hash.md) | | [Possible path traversal via HTTP request](/analytics-alerts/alerts-by-name/possible-path-traversal-via-http-request.md) | | [Possible phishing attack via Microsoft Teams](/analytics-alerts/alerts-by-name/possible-phishing-attack-via-microsoft-teams.md) | | [Possible RDP session hijacking using tscon.exe](/analytics-alerts/alerts-by-name/possible-rdp-session-hijacking-using-tscon-exe.md) | | [Possible Search For Password Files](/analytics-alerts/alerts-by-name/possible-search-for-password-files.md) | | [Possible TGT reuse from different hosts (pass the ticket)](/analytics-alerts/alerts-by-name/possible-tgt-reuse-from-different-hosts-pass-the-ticket.md) | | [Possible use of IPFS was detected](/analytics-alerts/alerts-by-name/possible-use-of-ipfs-was-detected.md) | | [Potential extraction of NAA Account Credentials in Microsoft Configuration Manager](/analytics-alerts/alerts-by-name/potential-extraction-of-naa-account-credentials-in-microsoft-configuration-manager.md) | | [Potential NTLM Relay Attack](/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack.md) | | [Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server](/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack-against-a-microsoft-configuration-manager-site-server.md) | | [PowerShell runs suspicious base64-encoded commands](/analytics-alerts/alerts-by-name/powershell-runs-suspicious-base64-encoded-commands.md) | | [PowerShell suspicious flags](/analytics-alerts/alerts-by-name/powershell-suspicious-flags.md) | | [Procdump executed from an atypical directory](/analytics-alerts/alerts-by-name/procdump-executed-from-an-atypical-directory.md) | | [PsExec was executed with a suspicious command line](/analytics-alerts/alerts-by-name/psexec-was-executed-with-a-suspicious-command-line.md) | | [Python HTTP server started](/analytics-alerts/alerts-by-name/python-http-server-started.md) | | [Random-Looking Domain Names](/analytics-alerts/alerts-by-name/random-looking-domain-names.md) | | [Rare access to known advertising domains](/analytics-alerts/alerts-by-name/rare-access-to-known-advertising-domains.md) | | [Rare AppID usage to a rare destination](/analytics-alerts/alerts-by-name/rare-appid-usage-to-a-rare-destination.md) | | [Rare binary connected to a rare cloud resource](/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-cloud-resource.md) | | [Rare binary connected to a rare external host](/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-external-host.md) | | [Rare communication over email ports to external email server by unsigned process](/analytics-alerts/alerts-by-name/rare-communication-over-email-ports-to-external-email-server-by-unsigned-process.md) | | [Rare file transfer over SMB protocol](/analytics-alerts/alerts-by-name/rare-file-transfer-over-smb-protocol.md) | | [Rare LOLBIN Process Execution by User](/analytics-alerts/alerts-by-name/rare-lolbin-process-execution-by-user.md) | | [Rare MS-Update traffic over HTTP](/analytics-alerts/alerts-by-name/rare-ms-update-traffic-over-http.md) | | [Rare NTLM Access By User To Host](/analytics-alerts/alerts-by-name/rare-ntlm-access-by-user-to-host.md) | | [Rare NTLM Usage by User](/analytics-alerts/alerts-by-name/rare-ntlm-usage-by-user.md) | | [Rare process created an SSH session to an uncommon cloud resource](/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-cloud-resource.md) | | [Rare process created an SSH session to an uncommon external host](/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-external-host.md) | | [Rare process executed by an AppleScript](/analytics-alerts/alerts-by-name/rare-process-executed-by-an-applescript.md) | | [Rare process execution by user](/analytics-alerts/alerts-by-name/rare-process-execution-by-user.md) | | [Rare process execution in organization](/analytics-alerts/alerts-by-name/rare-process-execution-in-organization.md) | | [Rare process spawned by srvany.exe](/analytics-alerts/alerts-by-name/rare-process-spawned-by-srvany-exe.md) | | [Rare process with VNC server capabilities started](/analytics-alerts/alerts-by-name/rare-process-with-vnc-server-capabilities-started.md) | | [Rare RDP session to a remote host](/analytics-alerts/alerts-by-name/rare-rdp-session-to-a-remote-host.md) | | [Rare security product signed executable executed in the network](/analytics-alerts/alerts-by-name/rare-security-product-signed-executable-executed-in-the-network.md) | | [Rare signature signed executable executed in the network](/analytics-alerts/alerts-by-name/rare-signature-signed-executable-executed-in-the-network.md) | | [Rare SMB session to a remote host](/analytics-alerts/alerts-by-name/rare-smb-session-to-a-remote-host.md) | | [Rare SMTP/S Session](/analytics-alerts/alerts-by-name/rare-smtp-s-session.md) | | [Rare SSH Session](/analytics-alerts/alerts-by-name/rare-ssh-session.md) | | [Rare Unix process divided files by size](/analytics-alerts/alerts-by-name/rare-unix-process-divided-files-by-size.md) | | [Rare unsigned process execution by scheduled task](/analytics-alerts/alerts-by-name/rare-unsigned-process-execution-by-scheduled-task.md) | | [Rare Unsigned Process Spawned by Office Process Under Suspicious Directory](/analytics-alerts/alerts-by-name/rare-unsigned-process-spawned-by-office-process-under-suspicious-directory.md) | | [Rare Windows Remote Management (WinRM) HTTP Activity](/analytics-alerts/alerts-by-name/rare-windows-remote-management-winrm-http-activity.md) | | [Rare WinRM Session](/analytics-alerts/alerts-by-name/rare-winrm-session.md) | | [RDP Connection to localhost](/analytics-alerts/alerts-by-name/rdp-connection-to-localhost.md) | | [RDP from an unmanaged endpoint in a typically managed subnet](/analytics-alerts/alerts-by-name/rdp-from-an-unmanaged-endpoint-in-a-typically-managed-subnet.md) | | [Reading bash command history file](/analytics-alerts/alerts-by-name/reading-bash-command-history-file.md) | | [Recurring access to rare domain](/analytics-alerts/alerts-by-name/recurring-access-to-rare-domain.md) | | [Recurring access to rare IP](/analytics-alerts/alerts-by-name/recurring-access-to-rare-ip.md) | | [Recurring rare domain access from an unsigned process](/analytics-alerts/alerts-by-name/recurring-rare-domain-access-from-an-unsigned-process.md) | | [Recurring rare domain access to dynamic DNS domain](/analytics-alerts/alerts-by-name/recurring-rare-domain-access-to-dynamic-dns-domain.md) | | [Registration of Uncommon .NET Services and/or Assemblies](/analytics-alerts/alerts-by-name/registration-of-uncommon-net-services-and-or-assemblies.md) | | [Remote account enumeration](/analytics-alerts/alerts-by-name/remote-account-enumeration.md) | | [Remote code execution into Kubernetes Pod](/analytics-alerts/alerts-by-name/remote-code-execution-into-kubernetes-pod.md) | | [Remote command execution via wmic.exe](/analytics-alerts/alerts-by-name/remote-command-execution-via-wmic-exe.md) | | [Remote DCOM command execution](/analytics-alerts/alerts-by-name/remote-dcom-command-execution.md) | | [Remote PsExec-like command execution](/analytics-alerts/alerts-by-name/remote-psexec-like-command-execution.md) | | [Remote service command execution from an uncommon source](/analytics-alerts/alerts-by-name/remote-service-command-execution-from-an-uncommon-source.md) | | [Remote service start from an uncommon source](/analytics-alerts/alerts-by-name/remote-service-start-from-an-uncommon-source.md) | | [Remote WMI process execution](/analytics-alerts/alerts-by-name/remote-wmi-process-execution.md) | | [Retrieval of kubelet credentials](/analytics-alerts/alerts-by-name/retrieval-of-kubelet-credentials.md) | | [Run downloaded script using pipe](/analytics-alerts/alerts-by-name/run-downloaded-script-using-pipe.md) | | [Rundll32.exe executes a rare unsigned module](/analytics-alerts/alerts-by-name/rundll32-exe-executes-a-rare-unsigned-module.md) | | [Rundll32.exe running with no command-line arguments](/analytics-alerts/alerts-by-name/rundll32-exe-running-with-no-command-line-arguments.md) | | [Rundll32.exe spawns conhost.exe](/analytics-alerts/alerts-by-name/rundll32-exe-spawns-conhost-exe.md) | | [Scrcons.exe Rare Child Process](/analytics-alerts/alerts-by-name/scrcons-exe-rare-child-process.md) | | [Screensaver process executed from Users or temporary folder](/analytics-alerts/alerts-by-name/screensaver-process-executed-from-users-or-temporary-folder.md) | | [Script file added to startup-related Registry keys](/analytics-alerts/alerts-by-name/script-file-added-to-startup-related-registry-keys.md) | | [Scripting engine connected to a rare external host](/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host.md) | | [Service execution via sc.exe](/analytics-alerts/alerts-by-name/service-execution-via-sc-exe.md) | | [Setuid and Setgid file bit manipulation](/analytics-alerts/alerts-by-name/setuid-and-setgid-file-bit-manipulation.md) | | [Signed process creates a scheduled task via file access](/analytics-alerts/alerts-by-name/signed-process-creates-a-scheduled-task-via-file-access.md) | | [Signed process performed an unpopular DLL injection](/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-dll-injection.md) | | [Signed process performed an unpopular injection](/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-injection.md) | | [SMB Traffic from Non-Standard Process](/analytics-alerts/alerts-by-name/smb-traffic-from-non-standard-process.md) | | [Spam Bot Traffic](/analytics-alerts/alerts-by-name/spam-bot-traffic.md) | | [SSH authentication brute force attempts](/analytics-alerts/alerts-by-name/ssh-authentication-brute-force-attempts.md) | | [Stored credentials exported using credwiz.exe](/analytics-alerts/alerts-by-name/stored-credentials-exported-using-credwiz-exe.md) | | [Subdomain Fuzzing](/analytics-alerts/alerts-by-name/subdomain-fuzzing.md) | | [Sudoedit Brute force attempt](/analytics-alerts/alerts-by-name/sudoedit-brute-force-attempt.md) | | [SUID/GUID permission discovery](/analytics-alerts/alerts-by-name/suid-guid-permission-discovery.md) | | [Suspicious .NET process loads an MSBuild DLL](/analytics-alerts/alerts-by-name/suspicious-net-process-loads-an-msbuild-dll.md) | | [Suspicious authentication package registered](/analytics-alerts/alerts-by-name/suspicious-authentication-package-registered.md) | | [Suspicious Certutil AD CS contact](/analytics-alerts/alerts-by-name/suspicious-certutil-ad-cs-contact.md) | | [Suspicious certutil command line](/analytics-alerts/alerts-by-name/suspicious-certutil-command-line.md) | | [Suspicious container orchestration job](/analytics-alerts/alerts-by-name/suspicious-container-orchestration-job.md) | | [Suspicious container reconnaissance activity in a Kubernetes pod](/analytics-alerts/alerts-by-name/suspicious-container-reconnaissance-activity-in-a-kubernetes-pod.md) | | [Suspicious container runtime connection from within a Kubernetes Pod](/analytics-alerts/alerts-by-name/suspicious-container-runtime-connection-from-within-a-kubernetes-pod.md) | | [Suspicious curl user agent](/analytics-alerts/alerts-by-name/suspicious-curl-user-agent.md) | | [Suspicious data encryption](/analytics-alerts/alerts-by-name/suspicious-data-encryption.md) | | [Suspicious disablement of the Windows Firewall](/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall.md) | | [Suspicious DNS traffic](/analytics-alerts/alerts-by-name/suspicious-dns-traffic.md) | | [Suspicious docker image download from an unusual repository](/analytics-alerts/alerts-by-name/suspicious-docker-image-download-from-an-unusual-repository.md) | | [Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin](/analytics-alerts/alerts-by-name/suspicious-dump-of-ntds-dit-using-shadow-copy-with-ntdsutil-vssadmin.md) | | [Suspicious External RDP Login](/analytics-alerts/alerts-by-name/suspicious-external-rdp-login.md) | | [Suspicious failed HTTP request - potential Spring4Shell exploit](/analytics-alerts/alerts-by-name/suspicious-failed-http-request-potential-spring4shell-exploit.md) | | [Suspicious HTTP parameters detected](/analytics-alerts/alerts-by-name/suspicious-http-parameters-detected.md) | | [Suspicious ICMP packet](/analytics-alerts/alerts-by-name/suspicious-icmp-packet.md) | | [Suspicious ICMP traffic that resembles smurf attack](/analytics-alerts/alerts-by-name/suspicious-icmp-traffic-that-resembles-smurf-attack.md) | | [Suspicious module load using direct syscall](/analytics-alerts/alerts-by-name/suspicious-module-load-using-direct-syscall.md) | | [Suspicious Network Connection Originating from AWS SSM Agent](/analytics-alerts/alerts-by-name/suspicious-network-connection-originating-from-aws-ssm-agent.md) | | [Suspicious NTLM authentication with machine account](/analytics-alerts/alerts-by-name/suspicious-ntlm-authentication-with-machine-account.md) | | [Suspicious PowerShell Command Line](/analytics-alerts/alerts-by-name/suspicious-powershell-command-line.md) | | [Suspicious PowerShell Enumeration of Running Processes](/analytics-alerts/alerts-by-name/suspicious-powershell-enumeration-of-running-processes.md) | | [Suspicious print processor registered](/analytics-alerts/alerts-by-name/suspicious-print-processor-registered.md) | | [Suspicious process accessed a site masquerading as Google](/analytics-alerts/alerts-by-name/suspicious-process-accessed-a-site-masquerading-as-google.md) | | [Suspicious process executed with a high integrity level](/analytics-alerts/alerts-by-name/suspicious-process-executed-with-a-high-integrity-level.md) | | [Suspicious process execution from tmp folder](/analytics-alerts/alerts-by-name/suspicious-process-execution-from-tmp-folder.md) | | [Suspicious process execution in a privileged container](/analytics-alerts/alerts-by-name/suspicious-process-execution-in-a-privileged-container.md) | | [Suspicious process loads a known PowerShell module](/analytics-alerts/alerts-by-name/suspicious-process-loads-a-known-powershell-module.md) | | [Suspicious Process Spawned by Adobe Reader](/analytics-alerts/alerts-by-name/suspicious-process-spawned-by-adobe-reader.md) | | [Suspicious Process Spawned by wininit.exe](/analytics-alerts/alerts-by-name/suspicious-process-spawned-by-wininit-exe.md) | | [Suspicious proxy environment variable setting](/analytics-alerts/alerts-by-name/suspicious-proxy-environment-variable-setting.md) | | [Suspicious RunOnce Parent Process](/analytics-alerts/alerts-by-name/suspicious-runonce-parent-process.md) | | [Suspicious runonce.exe parent process](/analytics-alerts/alerts-by-name/suspicious-runonce-exe-parent-process.md) | | [Suspicious SearchProtocolHost.exe parent process](/analytics-alerts/alerts-by-name/suspicious-searchprotocolhost-exe-parent-process.md) | | [Suspicious setspn.exe execution](/analytics-alerts/alerts-by-name/suspicious-setspn-exe-execution.md) | | [Suspicious SMB connection from domain controller](/analytics-alerts/alerts-by-name/suspicious-smb-connection-from-domain-controller.md) | | [Suspicious sshpass command execution](/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution.md) | | [Suspicious successful RDP connection to localhost](/analytics-alerts/alerts-by-name/suspicious-successful-rdp-connection-to-localhost.md) | | [Suspicious systemd timer activity](/analytics-alerts/alerts-by-name/suspicious-systemd-timer-activity.md) | | [Suspicious time provider registered](/analytics-alerts/alerts-by-name/suspicious-time-provider-registered.md) | | [Suspicious usage of File Server Remote VSS Protocol (FSRVP)](/analytics-alerts/alerts-by-name/suspicious-usage-of-file-server-remote-vss-protocol-fsrvp.md) | | [Svchost.exe loads a rare unsigned module](/analytics-alerts/alerts-by-name/svchost-exe-loads-a-rare-unsigned-module.md) | | [System information discovery via psinfo.exe](/analytics-alerts/alerts-by-name/system-information-discovery-via-psinfo-exe.md) | | [System shutdown or reboot](/analytics-alerts/alerts-by-name/system-shutdown-or-reboot.md) | | [Tampering with Internet Explorer Protected Mode configuration](/analytics-alerts/alerts-by-name/tampering-with-internet-explorer-protected-mode-configuration.md) | | [TGT request with a spoofed sAMAccountName - Network](/analytics-alerts/alerts-by-name/tgt-request-with-a-spoofed-samaccountname-network.md) | | [The CA policy EditFlags was queried](/analytics-alerts/alerts-by-name/the-ca-policy-editflags-was-queried.md) | | [The Linux system firewall was disabled](/analytics-alerts/alerts-by-name/the-linux-system-firewall-was-disabled.md) | | Uncommon AppleScript containing a potential defense-evasion command was executed via the command line | | [Uncommon AppleScript containing a potential obfuscation technique was executed](/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-obfuscation-technique-was-executed.md) | | [Uncommon AppleScript containing a potential persistence command was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-persistence-command-was-executed-via-the-command-line.md) | | Uncommon AppleScript containing a potential system information discovery command was executed via the command line | | [Uncommon AppleScript designed to access credential files was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-credential-files-was-executed-via-the-command-line.md) | | [Uncommon AppleScript designed to access cryptocurrency wallet data was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-cryptocurrency-wallet-data-was-executed-via-the-command-line.md) | | [Uncommon AppleScript designed to access sensitive application data was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-sensitive-application-data-was-executed-via-the-command-line.md) | | [Uncommon AppleScript designed to capture screen or clipboard data was executed via the command line](/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-capture-screen-or-clipboard-data-was-executed-via-the-command-line.md) | | [Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords](/analytics-alerts/alerts-by-name/uncommon-applescript-potentially-utilizes-credential-grabbing-techniques-to-steal-user-passwords.md) | | [Uncommon AppleScript was executed via the command line to contact an external server](/analytics-alerts/alerts-by-name/uncommon-applescript-was-executed-via-the-command-line-to-contact-an-external-server.md) | | [Uncommon ARP cache listing via arp.exe](/analytics-alerts/alerts-by-name/uncommon-arp-cache-listing-via-arp-exe.md) | | [Uncommon attempt to clear shell history](/analytics-alerts/alerts-by-name/uncommon-attempt-to-clear-shell-history.md) | | [Uncommon cloud CLI tool usage](/analytics-alerts/alerts-by-name/uncommon-cloud-cli-tool-usage.md) | | [Uncommon communication to an instant messaging server](/analytics-alerts/alerts-by-name/uncommon-communication-to-an-instant-messaging-server.md) | | [Uncommon DLL-sideloading from a logical CD-ROM (ISO) device](/analytics-alerts/alerts-by-name/uncommon-dll-sideloading-from-a-logical-cd-rom-iso-device.md) | | [Uncommon DotNet module load relationship](/analytics-alerts/alerts-by-name/uncommon-dotnet-module-load-relationship.md) | | [Uncommon driver loaded](/analytics-alerts/alerts-by-name/uncommon-driver-loaded.md) | | [Uncommon execution of ODBCConf](/analytics-alerts/alerts-by-name/uncommon-execution-of-odbcconf.md) | | [Uncommon IP Configuration Listing via ipconfig.exe](/analytics-alerts/alerts-by-name/uncommon-ip-configuration-listing-via-ipconfig-exe.md) | | [Uncommon kernel module load](/analytics-alerts/alerts-by-name/uncommon-kernel-module-load.md) | | [Uncommon Launch Agent persistency was registered or modified](/analytics-alerts/alerts-by-name/uncommon-launch-agent-persistency-was-registered-or-modified.md) | | [Uncommon Launch Daemon persistency was registered or modified](/analytics-alerts/alerts-by-name/uncommon-launch-daemon-persistency-was-registered-or-modified.md) | | [Uncommon Linux process communication to a rare external host](/analytics-alerts/alerts-by-name/uncommon-linux-process-communication-to-a-rare-external-host.md) | | [Uncommon Linux remote shell command execution](/analytics-alerts/alerts-by-name/uncommon-linux-remote-shell-command-execution.md) | | [Uncommon Linux shell command execution](/analytics-alerts/alerts-by-name/uncommon-linux-shell-command-execution.md) | | [Uncommon local scheduled task creation via schtasks.exe](/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe.md) | | [Uncommon login item persistency was registered or modified](/analytics-alerts/alerts-by-name/uncommon-login-item-persistency-was-registered-or-modified.md) | | [Uncommon macOS process communication to a rare external host](/analytics-alerts/alerts-by-name/uncommon-macos-process-communication-to-a-rare-external-host.md) | | [Uncommon macOS shell command execution](/analytics-alerts/alerts-by-name/uncommon-macos-shell-command-execution.md) | | [Uncommon Managed Object Format (MOF) compiler usage](/analytics-alerts/alerts-by-name/uncommon-managed-object-format-mof-compiler-usage.md) | | [Uncommon msiexec execution of an arbitrary file from a remote location](/analytics-alerts/alerts-by-name/uncommon-msiexec-execution-of-an-arbitrary-file-from-a-remote-location.md) | | [Uncommon net group command execution](/analytics-alerts/alerts-by-name/uncommon-net-group-command-execution.md) | | [Uncommon net localgroup command execution](/analytics-alerts/alerts-by-name/uncommon-net-localgroup-command-execution.md) | | [Uncommon RDP connection](/analytics-alerts/alerts-by-name/uncommon-rdp-connection.md) | | [Uncommon recurring rare external host access](/analytics-alerts/alerts-by-name/uncommon-recurring-rare-external-host-access.md) | | [Uncommon remote monitoring and management tool](/analytics-alerts/alerts-by-name/uncommon-remote-monitoring-and-management-tool.md) | | [Uncommon remote scheduled task creation](/analytics-alerts/alerts-by-name/uncommon-remote-scheduled-task-creation.md) | | [Uncommon remote service start via sc.exe](/analytics-alerts/alerts-by-name/uncommon-remote-service-start-via-sc-exe.md) | | [Uncommon reverse SSH tunnel to external domain/ip](/analytics-alerts/alerts-by-name/uncommon-reverse-ssh-tunnel-to-external-domain-ip.md) | | [Uncommon routing table listing via route.exe](/analytics-alerts/alerts-by-name/uncommon-routing-table-listing-via-route-exe.md) | | [Uncommon Service Create/Config](/analytics-alerts/alerts-by-name/uncommon-service-create-config.md) | | [Uncommon service stop operation](/analytics-alerts/alerts-by-name/uncommon-service-stop-operation.md) | | [Uncommon signed process execution by scheduled task](/analytics-alerts/alerts-by-name/uncommon-signed-process-execution-by-scheduled-task.md) | | [Uncommon SQL like command line](/analytics-alerts/alerts-by-name/uncommon-sql-like-command-line.md) | | [Uncommon SSH session was established](/analytics-alerts/alerts-by-name/uncommon-ssh-session-was-established.md) | | [Uncommon user management via net.exe](/analytics-alerts/alerts-by-name/uncommon-user-management-via-net-exe.md) | | [Uncommon VNC server communication](/analytics-alerts/alerts-by-name/uncommon-vnc-server-communication.md) | | [Uncommon WPAD queries](/analytics-alerts/alerts-by-name/uncommon-wpad-queries.md) | | [Unicode RTL Override Character](/analytics-alerts/alerts-by-name/unicode-rtl-override-character.md) | | [Unpopular rsync process execution](/analytics-alerts/alerts-by-name/unpopular-rsync-process-execution.md) | | [Unprivileged process opened a registry hive](/analytics-alerts/alerts-by-name/unprivileged-process-opened-a-registry-hive.md) | | [Unsigned and unpopular process performed a DLL injection](/analytics-alerts/alerts-by-name/unsigned-and-unpopular-process-performed-a-dll-injection.md) | | [Unsigned and unpopular process performed an injection](/analytics-alerts/alerts-by-name/unsigned-and-unpopular-process-performed-an-injection.md) | | [Unsigned DLL Hijack into a Microsoft process](/analytics-alerts/alerts-by-name/unsigned-dll-hijack-into-a-microsoft-process.md) | | [Unsigned DLL Side-Loading](/analytics-alerts/alerts-by-name/unsigned-dll-side-loading.md) | | [Unsigned process creates a scheduled task via file access](/analytics-alerts/alerts-by-name/unsigned-process-creates-a-scheduled-task-via-file-access.md) | | [Unsigned process injecting into a Windows system binary with no command line](/analytics-alerts/alerts-by-name/unsigned-process-injecting-into-a-windows-system-binary-with-no-command-line.md) | | [Untrusted process contacted LLM API](/analytics-alerts/alerts-by-name/untrusted-process-contacted-llm-api.md) | | [Unusual ADFS Remote Synchronization network connections from non-ADFS server](/analytics-alerts/alerts-by-name/unusual-adfs-remote-synchronization-network-connections-from-non-adfs-server.md) | | [Unusual AWS credentials creation](/analytics-alerts/alerts-by-name/unusual-aws-credentials-creation.md) | | [Unusual AWS user added to group](/analytics-alerts/alerts-by-name/unusual-aws-user-added-to-group.md) | | [Unusual Azure AD sync module load](/analytics-alerts/alerts-by-name/unusual-azure-ad-sync-module-load.md) | | [Unusual cloud Instance Metadata Service (IMDS) access](/analytics-alerts/alerts-by-name/unusual-cloud-instance-metadata-service-imds-access.md) | | [Unusual compressed file password protection](/analytics-alerts/alerts-by-name/unusual-compressed-file-password-protection.md) | | [Unusual DB process spawning a shell](/analytics-alerts/alerts-by-name/unusual-db-process-spawning-a-shell.md) | | [Unusual internal access to network device management interface](/analytics-alerts/alerts-by-name/unusual-internal-access-to-network-device-management-interface.md) | | [Unusual Kubernetes dashboard communication from a pod](/analytics-alerts/alerts-by-name/unusual-kubernetes-dashboard-communication-from-a-pod.md) | | [Unusual Lolbins Process Spawned by InstallUtil.exe](/analytics-alerts/alerts-by-name/unusual-lolbins-process-spawned-by-installutil-exe.md) | | [Unusual process accessed the PowerShell history file](/analytics-alerts/alerts-by-name/unusual-process-accessed-the-powershell-history-file.md) | | [Unusual process executed by AWS Systems Manager](/analytics-alerts/alerts-by-name/unusual-process-executed-by-aws-systems-manager.md) | | [Unusual Process Spawned by Nginx in Ingress-Nginx pod](/analytics-alerts/alerts-by-name/unusual-process-spawned-by-nginx-in-ingress-nginx-pod.md) | | [Unusual SSH Activity](/analytics-alerts/alerts-by-name/unusual-ssh-activity.md) | | [Unusual SSH activity that resembles SSH proxy](/analytics-alerts/alerts-by-name/unusual-ssh-activity-that-resembles-ssh-proxy.md) | | [Unusual weak authentication by user](/analytics-alerts/alerts-by-name/unusual-weak-authentication-by-user.md) | | [Upload pattern that resembles Peer to Peer traffic](/analytics-alerts/alerts-by-name/upload-pattern-that-resembles-peer-to-peer-traffic.md) | | [VM Detection attempt on Linux](/analytics-alerts/alerts-by-name/vm-detection-attempt-on-linux.md) | | [Wbadmin deleted files in quiet mode](/analytics-alerts/alerts-by-name/wbadmin-deleted-files-in-quiet-mode.md) | | [Weakly-Encrypted Kerberos TGT Response](/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-tgt-response.md) | | [Weakly-Encrypted Kerberos Ticket Requested](/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-ticket-requested.md) | | [Web server CGO executed an uncommon process](/analytics-alerts/alerts-by-name/web-server-cgo-executed-an-uncommon-process.md) | | [WebDAV drive mounted from net.exe over HTTPS](/analytics-alerts/alerts-by-name/webdav-drive-mounted-from-net-exe-over-https.md) | | [Windows CGO, actor and action processes with anomalous characteristics](/analytics-alerts/alerts-by-name/windows-cgo-actor-and-action-processes-with-anomalous-characteristics.md) | | [Windows CGO, actor process and action module with anomalous characteristics](/analytics-alerts/alerts-by-name/windows-cgo-actor-process-and-action-module-with-anomalous-characteristics.md) | | [Windows Event Log was cleared using wevtutil.exe](/analytics-alerts/alerts-by-name/windows-event-log-was-cleared-using-wevtutil-exe.md) | | [Windows Installer exploitation for local privilege escalation](/analytics-alerts/alerts-by-name/windows-installer-exploitation-for-local-privilege-escalation.md) | | [Windows LOLBIN executable connected to a rare external host](/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md) | | [WmiPrvSe.exe Rare Child Command Line](/analytics-alerts/alerts-by-name/wmiprvse-exe-rare-child-command-line.md) | | [Wscript/Cscript loads .NET DLLs](/analytics-alerts/alerts-by-name/wscript-cscript-loads-net-dlls.md) | | [Wsmprovhost.exe Rare Child Process](/analytics-alerts/alerts-by-name/wsmprovhost-exe-rare-child-process.md) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.