XDR Agent with eXtended Threat Hunting (XTH)

Alerts related to data source "XDR Agent with eXtended Threat Hunting (XTH)".

Alert
A browser extension was installed or loaded in an uncommon way
A compiled HTML help file wrote a script file to the disk
A compromised process accessed a rare cloud resource
A compromised process accessed a rare external host
A computer account was promoted to DC
A contained process attempted to escape using the 'notify on release' feature
A machine certificate was issued with a mismatch
A new machine attempted Kerberos delegation
A process modified an SSH authorized_keys file
A process queried the ADFS database decryption key via LDAP
A rare file path was added to the AppInit_DLLs registry value
A remote service was created via RPC over SMB
A suspicious direct syscall was executed
A suspicious executable with multiple file extensions was created
A suspicious process queried AD CS objects via LDAP
A user accessed an abnormal number of files on a remote shared folder
A user accessed an abnormal number of remote shared folders
A user account was modified to password never expires
A user added a Windows firewall rule
A user certificate was issued with a mismatch
A user changed the Windows system time
A user connected a new USB storage device to a host
A user connected a new USB storage device to multiple hosts
A user connected a USB storage device for the first time
A user created a pfx file for the first time
A user created an abnormal password-protected archive
A user enabled a default local account
A user established an SMB connection to multiple hosts
A user executed multiple LDAP enumeration queries
A user modified the CA audit policy
A user performed suspiciously massive file activity
A user printed an unusual number of files
A user queried AD CS objects via LDAP
A user received multiple weakly encrypted service tickets
A user requested multiple service tickets
A user sent multiple TGT requests to irregular service
A user took numerous screenshots
A user was added to a Windows security group
A WMI subscriber was created
Abnormal File Activity in SCCMContentLib Shared Folder by user
Abnormal RPC traffic to multiple hosts
Abnormal sensitive RPC traffic to multiple hosts
Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host
Access to kubelet credentials file
Access to Kubernetes CA certificate file
Access to Kubernetes configuration file
Access to sensitive host files from within a Kubernetes pod
ADFS DKM Key Access
Administrator groups enumerated via LDAP
An executable was written and executed by a web server
An uncommon executable was remotely written over SMB to an uncommon destination
An uncommon file added to startup-related Registry keys
An uncommon file was created in the startup folder
An unpopular process accessed the microphone on the host
An unusual archive file creation by a user
An unusual process in ingress-nginx has accessed a service-account token file
Azure Privilege Escalation Using an Application
Bronze-Bit exploit
Browser bookmark files accessed by a rare non-browser process
Browser Extension Installed
Change of sudo caching configuration
ClickFix - PowerShell executed through the run application
Commonly abused AutoIT script drops an executable file to disk
Creation or modification of the default command executed when opening an application
Deletion of AD CS certificate database entries
Disable Microsoft Defender Antivirus via registry
Discovery of accounts with pre-authentication disabled via LDAP
Discovery of misconfigured certificate templates using LDAP
DSC (Desired State Configuration) lateral movement using PowerShell
Elevation to SYSTEM via services
Excessive user account lockouts
Executable created to disk by lsass.exe
Executable or Script file written by a web server process
Image file execution options (IFEO) registry key set
Key credential attribute modification
Known service display name with uncommon image-path
Known service name with an uncommon image-path
LDAP AD CS Enumeration via Attack Tool
LDAP search query from an unpopular and unsigned process
Linux system firewall was modified
Local group enumeration
Local group enumeration via RPC
Local user account creation
Local user account creation by a machine account
Local user enumeration via SAMR
LOLBIN created a PSScriptPolicyTest PowerShell script file
LSASS dump file written to disk
Machine account was added to a domain admins group
Mailbox Client Access Setting (CAS) changed
Masquerading as a default local account
Massive file activity abnormal to process
Massive file compression by user
Member added to a Windows local security group
Microsoft Office adds a value to autostart Registry key
Modification of NTLM restrictions in the Registry
Modification of the AD FS IdentityServer configuration file
Multiple suspicious user accounts were created
Multiple TGT requests for users without Kerberos pre-authentication
Multiple user accounts were deleted
NTDS.dit file written by an uncommon executable
Office process accessed an unusual .LNK file
Outlook files accessed by an unsigned process
PKINIT TGT authentication request
Possible AS-REP Roasting Attack
Possible authentication coercion
Possible data exfiltration over a USB storage device
Possible DCSync from a non domain controller
Possible Distributed File System Namespace Management (DFSNM) abuse
Possible GPO Enumeration
Possible Insider Threat Activity
Possible internal data exfiltration over a USB storage device
Possible Kerberoasting attack
Possible Kerberos User Enumeration
Possible LDAP enumeration by unsigned process
Possible LDAP Enumeration of Microsoft Configuration Manager
Possible LDAP Enumeration Tool Usage
Possible Persistence via group policy Registry keys
Possible phishing attack via Microsoft Teams
Possible Privilege Escalation using Delegated MSA account
Possible SPN enumeration
Possible use of a networking driver for network sniffing
Possible webshell file written by a web server process
Potential DCSync by an unusual user
Potential extraction of NAA Account Credentials in Microsoft Configuration Manager
Potential kubelet impersonation attempt
Potential SCCM credential harvesting using WMI detected
PowerShell pfx certificate extraction
PowerShell used to export mailbox contents
PowerShell used to remove mailbox export request logs
Privileged certificate request via certificate template
Rare DCOM RPC activity
Rare machine account creation
Rare process accessed a Keychain file
Rare Remote Service (SVCCTL) RPC activity
Rare scheduled task created
Rare Scheduled Task RPC activity
Rare Scheduled Task RPC activity from a rarely seen host
Rare service DLL was added to the registry
RDP connections enabled remotely via Registry
SCCM log files enumeration
Scheduled Task hidden by registry modification
SecureBoot was disabled
Security tools detection attempt
Sensitive account password reset attempt
Sensitive browser credential files accessed by a rare non browser process
Service ticket request with a spoofed sAMAccountName
Setting Windows Auto Logon by uncommon process
Short-lived user account
Single account excessively locked out
Space after filename
SPNs cleared from a machine account
Suspicious access of the System Management Container
Suspicious access to cloud credential files
Suspicious access to Kubernetes API with kubelet credentials
Suspicious access to shadow file
Suspicious account attribute modification that matches that of another account
Suspicious active setup registered
Suspicious AMSI decode attempt
Suspicious certificate template modification
Suspicious disablement of the Windows Firewall using PowerShell commands
Suspicious dNSHostName attribute change to DC name
Suspicious domain user account creation
Suspicious DotNet log file created
Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
Suspicious hidden user created
Suspicious Kerberos Pre-Auth Failures by Host
Suspicious Kubernetes pod token access
Suspicious LDAP queries followed by shared folder access
Suspicious LDAP search query executed
Suspicious modification of the AdminSDHolder's ACL
Suspicious PowerSploit's recon module (PowerView) net function was executed
Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts
Suspicious Print System Remote Protocol usage by a process
Suspicious process accessed certificate files
Suspicious process modified RC script file
Suspicious reconnaissance using LDAP
Suspicious sAMAccountName change
Suspicious Udev driver rule execution manipulation
Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet
System profiling WMI query execution
Tampering with the Windows User Account Controls (UAC) configuration
TGT request with a spoofed sAMAccountName - Event log
Uncommon access to /etc/passwd
Uncommon access to cloud platforms' sensitive files by a scripting engine
Uncommon access to Microsoft Teams cookies files
Uncommon access to Microsoft Teams credential files
Uncommon AT task-job creation by user
Uncommon attempt at discovering a sensitive file
Uncommon attempt at grabbing credentials from a sensitive file
Uncommon browser extension loaded
Uncommon creation or access operation of sensitive shadow copy
Uncommon file access over WebDAV
Uncommon GetClipboardData API function invocation of a possible information stealer
Uncommon jsp file write by a Java process
Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
Uncommon PowerShell commands used to create or alter scheduled task parameters
Uncommon Security Support Provider (SSP) registered via a registry key
Uncommon sensitive filesystem registry hive access
Uncommon sensitive registry hive dump
Uncommon SetWindowsHookEx API invocation of a possible keylogger
Unknown DLL was added to the AD FS Global Assembly Cache path
Unusual access to the AD Sync credential files
Unusual access to the Windows Internal Database on an ADFS server
Unusual ADConnect database file access
Unusual CertLog Remote File Write
Unusual CIM repository file access
Unusual Encrypting File System Remote call (EFSRPC) to domain controller
Unusual Kubernetes service account file read
Unusual Netsh PortProxy rule
Unusual process access to ld.so.preload file
Unusual process accessed a crypto wallet's files
Unusual process accessed a macOS notes DB file
Unusual process accessed a messaging app's files
Unusual process accessed a web browser history file
Unusual process accessed FTP Client credentials
Unusual process accessed web browser cookies
Unusual process accessed web browser credentials
Unusual use of a 'SysInternals' tool
Unusual user account enablement
Unusual user account unlock
User account delegation change
User added SID History to an account
User added to a group and removed
User added to the SMS Admins local group
User and Group Enumeration via SAMR
User collected remote shared files in an archive
User discovery via WMI query execution
User set insecure CA registry setting for global SANs
VM Detection attempt
Vulnerable certificate template loaded
Web server CGO executed a process following a potential Webshell dropped
Windows event logs were cleared with PowerShell