> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent-with-extended-threat-hunting-xth.md). # XDR Agent with eXtended Threat Hunting (XTH) Alerts related to data source "XDR Agent with eXtended Threat Hunting (XTH)". | Alert | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [A browser extension was installed or loaded in an uncommon way](/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way.md) | | [A compiled HTML help file wrote a script file to the disk](/analytics-alerts/alerts-by-name/a-compiled-html-help-file-wrote-a-script-file-to-the-disk.md) | | [A compromised process accessed a rare cloud resource](/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-cloud-resource.md) | | [A compromised process accessed a rare external host](/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-external-host.md) | | [A computer account was promoted to DC](/analytics-alerts/alerts-by-name/a-computer-account-was-promoted-to-dc.md) | | [A contained process attempted to escape using the 'notify on release' feature](/analytics-alerts/alerts-by-name/a-contained-process-attempted-to-escape-using-the-notify-on-release-feature.md) | | [A machine certificate was issued with a mismatch](/analytics-alerts/alerts-by-name/a-machine-certificate-was-issued-with-a-mismatch.md) | | [A new machine attempted Kerberos delegation](/analytics-alerts/alerts-by-name/a-new-machine-attempted-kerberos-delegation.md) | | [A process modified an SSH authorized\_keys file](/analytics-alerts/alerts-by-name/a-process-modified-an-ssh-authorized-keys-file.md) | | [A process queried the ADFS database decryption key via LDAP](/analytics-alerts/alerts-by-name/a-process-queried-the-adfs-database-decryption-key-via-ldap.md) | | [A rare file path was added to the AppInit\_DLLs registry value](/analytics-alerts/alerts-by-name/a-rare-file-path-was-added-to-the-appinit-dlls-registry-value.md) | | [A remote service was created via RPC over SMB](/analytics-alerts/alerts-by-name/a-remote-service-was-created-via-rpc-over-smb.md) | | [A suspicious direct syscall was executed](/analytics-alerts/alerts-by-name/a-suspicious-direct-syscall-was-executed.md) | | [A suspicious executable with multiple file extensions was created](/analytics-alerts/alerts-by-name/a-suspicious-executable-with-multiple-file-extensions-was-created.md) | | [A suspicious process queried AD CS objects via LDAP](/analytics-alerts/alerts-by-name/a-suspicious-process-queried-ad-cs-objects-via-ldap.md) | | [A user accessed an abnormal number of files on a remote shared folder](/analytics-alerts/alerts-by-name/a-user-accessed-an-abnormal-number-of-files-on-a-remote-shared-folder.md) | | [A user accessed an abnormal number of remote shared folders](/analytics-alerts/alerts-by-name/a-user-accessed-an-abnormal-number-of-remote-shared-folders.md) | | [A user account was modified to password never expires](/analytics-alerts/alerts-by-name/a-user-account-was-modified-to-password-never-expires.md) | | [A user added a Windows firewall rule](/analytics-alerts/alerts-by-name/a-user-added-a-windows-firewall-rule.md) | | [A user certificate was issued with a mismatch](/analytics-alerts/alerts-by-name/a-user-certificate-was-issued-with-a-mismatch.md) | | [A user changed the Windows system time](/analytics-alerts/alerts-by-name/a-user-changed-the-windows-system-time.md) | | [A user connected a new USB storage device to a host](/analytics-alerts/alerts-by-name/a-user-connected-a-new-usb-storage-device-to-a-host.md) | | [A user connected a new USB storage device to multiple hosts](/analytics-alerts/alerts-by-name/a-user-connected-a-new-usb-storage-device-to-multiple-hosts.md) | | [A user connected a USB storage device for the first time](/analytics-alerts/alerts-by-name/a-user-connected-a-usb-storage-device-for-the-first-time.md) | | [A user created a pfx file for the first time](/analytics-alerts/alerts-by-name/a-user-created-a-pfx-file-for-the-first-time.md) | | [A user created an abnormal password-protected archive](/analytics-alerts/alerts-by-name/a-user-created-an-abnormal-password-protected-archive.md) | | [A user enabled a default local account](/analytics-alerts/alerts-by-name/a-user-enabled-a-default-local-account.md) | | [A user established an SMB connection to multiple hosts](/analytics-alerts/alerts-by-name/a-user-established-an-smb-connection-to-multiple-hosts.md) | | [A user executed multiple LDAP enumeration queries](/analytics-alerts/alerts-by-name/a-user-executed-multiple-ldap-enumeration-queries.md) | | [A user modified the CA audit policy](/analytics-alerts/alerts-by-name/a-user-modified-the-ca-audit-policy.md) | | [A user performed suspiciously massive file activity](/analytics-alerts/alerts-by-name/a-user-performed-suspiciously-massive-file-activity.md) | | [A user printed an unusual number of files](/analytics-alerts/alerts-by-name/a-user-printed-an-unusual-number-of-files.md) | | [A user queried AD CS objects via LDAP](/analytics-alerts/alerts-by-name/a-user-queried-ad-cs-objects-via-ldap.md) | | [A user received multiple weakly encrypted service tickets](/analytics-alerts/alerts-by-name/a-user-received-multiple-weakly-encrypted-service-tickets.md) | | [A user requested multiple service tickets](/analytics-alerts/alerts-by-name/a-user-requested-multiple-service-tickets.md) | | [A user sent multiple TGT requests to irregular service](/analytics-alerts/alerts-by-name/a-user-sent-multiple-tgt-requests-to-irregular-service.md) | | [A user took numerous screenshots](/analytics-alerts/alerts-by-name/a-user-took-numerous-screenshots.md) | | [A user was added to a Windows security group](/analytics-alerts/alerts-by-name/a-user-was-added-to-a-windows-security-group.md) | | [A WMI subscriber was created](/analytics-alerts/alerts-by-name/a-wmi-subscriber-was-created.md) | | [Abnormal File Activity in SCCMContentLib Shared Folder by user](/analytics-alerts/alerts-by-name/abnormal-file-activity-in-sccmcontentlib-shared-folder-by-user.md) | | [Abnormal RPC traffic to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-rpc-traffic-to-multiple-hosts.md) | | [Abnormal sensitive RPC traffic to multiple hosts](/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts.md) | | [Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host](/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts-from-a-rarely-seen-host.md) | | [Access to kubelet credentials file](/analytics-alerts/alerts-by-name/access-to-kubelet-credentials-file.md) | | [Access to Kubernetes CA certificate file](/analytics-alerts/alerts-by-name/access-to-kubernetes-ca-certificate-file.md) | | [Access to Kubernetes configuration file](/analytics-alerts/alerts-by-name/access-to-kubernetes-configuration-file.md) | | [Access to sensitive host files from within a Kubernetes pod](/analytics-alerts/alerts-by-name/access-to-sensitive-host-files-from-within-a-kubernetes-pod.md) | | [ADFS DKM Key Access](/analytics-alerts/alerts-by-name/adfs-dkm-key-access.md) | | [Administrator groups enumerated via LDAP](/analytics-alerts/alerts-by-name/administrator-groups-enumerated-via-ldap.md) | | [An executable was written and executed by a web server](/analytics-alerts/alerts-by-name/an-executable-was-written-and-executed-by-a-web-server.md) | | [An uncommon executable was remotely written over SMB to an uncommon destination](/analytics-alerts/alerts-by-name/an-uncommon-executable-was-remotely-written-over-smb-to-an-uncommon-destination.md) | | [An uncommon file added to startup-related Registry keys](/analytics-alerts/alerts-by-name/an-uncommon-file-added-to-startup-related-registry-keys.md) | | [An uncommon file was created in the startup folder](/analytics-alerts/alerts-by-name/an-uncommon-file-was-created-in-the-startup-folder.md) | | [An unpopular process accessed the microphone on the host](/analytics-alerts/alerts-by-name/an-unpopular-process-accessed-the-microphone-on-the-host.md) | | [An unusual archive file creation by a user](/analytics-alerts/alerts-by-name/an-unusual-archive-file-creation-by-a-user.md) | | [An unusual process in ingress-nginx has accessed a service-account token file](/analytics-alerts/alerts-by-name/an-unusual-process-in-ingress-nginx-has-accessed-a-service-account-token-file.md) | | [Azure Privilege Escalation Using an Application](/analytics-alerts/alerts-by-name/azure-privilege-escalation-using-an-application.md) | | [Bronze-Bit exploit](/analytics-alerts/alerts-by-name/bronze-bit-exploit.md) | | [Browser bookmark files accessed by a rare non-browser process](/analytics-alerts/alerts-by-name/browser-bookmark-files-accessed-by-a-rare-non-browser-process.md) | | [Browser Extension Installed](/analytics-alerts/alerts-by-name/browser-extension-installed.md) | | [Change of sudo caching configuration](/analytics-alerts/alerts-by-name/change-of-sudo-caching-configuration.md) | | [ClickFix - PowerShell executed through the run application](/analytics-alerts/alerts-by-name/clickfix-powershell-executed-through-the-run-application.md) | | [Commonly abused AutoIT script drops an executable file to disk](/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-drops-an-executable-file-to-disk.md) | | [Creation or modification of the default command executed when opening an application](/analytics-alerts/alerts-by-name/creation-or-modification-of-the-default-command-executed-when-opening-an-application.md) | | [Deletion of AD CS certificate database entries](/analytics-alerts/alerts-by-name/deletion-of-ad-cs-certificate-database-entries.md) | | [Disable Microsoft Defender Antivirus via registry](/analytics-alerts/alerts-by-name/disable-microsoft-defender-antivirus-via-registry.md) | | [Discovery of accounts with pre-authentication disabled via LDAP](/analytics-alerts/alerts-by-name/discovery-of-accounts-with-pre-authentication-disabled-via-ldap.md) | | [Discovery of misconfigured certificate templates using LDAP](/analytics-alerts/alerts-by-name/discovery-of-misconfigured-certificate-templates-using-ldap.md) | | [DSC (Desired State Configuration) lateral movement using PowerShell](/analytics-alerts/alerts-by-name/dsc-desired-state-configuration-lateral-movement-using-powershell.md) | | [Elevation to SYSTEM via services](/analytics-alerts/alerts-by-name/elevation-to-system-via-services.md) | | [Excessive user account lockouts](/analytics-alerts/alerts-by-name/excessive-user-account-lockouts.md) | | [Executable created to disk by lsass.exe](/analytics-alerts/alerts-by-name/executable-created-to-disk-by-lsass-exe.md) | | [Executable or Script file written by a web server process](/analytics-alerts/alerts-by-name/executable-or-script-file-written-by-a-web-server-process.md) | | [Image file execution options (IFEO) registry key set](/analytics-alerts/alerts-by-name/image-file-execution-options-ifeo-registry-key-set.md) | | [Key credential attribute modification](/analytics-alerts/alerts-by-name/key-credential-attribute-modification.md) | | [Known service display name with uncommon image-path](/analytics-alerts/alerts-by-name/known-service-display-name-with-uncommon-image-path.md) | | [Known service name with an uncommon image-path](/analytics-alerts/alerts-by-name/known-service-name-with-an-uncommon-image-path.md) | | [LDAP AD CS Enumeration via Attack Tool](/analytics-alerts/alerts-by-name/ldap-ad-cs-enumeration-via-attack-tool.md) | | [LDAP search query from an unpopular and unsigned process](/analytics-alerts/alerts-by-name/ldap-search-query-from-an-unpopular-and-unsigned-process.md) | | [Linux system firewall was modified](/analytics-alerts/alerts-by-name/linux-system-firewall-was-modified.md) | | [Local group enumeration](/analytics-alerts/alerts-by-name/local-group-enumeration.md) | | [Local group enumeration via RPC](/analytics-alerts/alerts-by-name/local-group-enumeration-via-rpc.md) | | [Local user account creation](/analytics-alerts/alerts-by-name/local-user-account-creation.md) | | [Local user account creation by a machine account](/analytics-alerts/alerts-by-name/local-user-account-creation-by-a-machine-account.md) | | [Local user enumeration via SAMR](/analytics-alerts/alerts-by-name/local-user-enumeration-via-samr.md) | | [LOLBIN created a PSScriptPolicyTest PowerShell script file](/analytics-alerts/alerts-by-name/lolbin-created-a-psscriptpolicytest-powershell-script-file.md) | | [LSASS dump file written to disk](/analytics-alerts/alerts-by-name/lsass-dump-file-written-to-disk.md) | | [Machine account was added to a domain admins group](/analytics-alerts/alerts-by-name/machine-account-was-added-to-a-domain-admins-group.md) | | [Mailbox Client Access Setting (CAS) changed](/analytics-alerts/alerts-by-name/mailbox-client-access-setting-cas-changed.md) | | [Masquerading as a default local account](/analytics-alerts/alerts-by-name/masquerading-as-a-default-local-account.md) | | [Massive file activity abnormal to process](/analytics-alerts/alerts-by-name/massive-file-activity-abnormal-to-process.md) | | [Massive file compression by user](/analytics-alerts/alerts-by-name/massive-file-compression-by-user.md) | | [Member added to a Windows local security group](/analytics-alerts/alerts-by-name/member-added-to-a-windows-local-security-group.md) | | [Microsoft Office adds a value to autostart Registry key](/analytics-alerts/alerts-by-name/microsoft-office-adds-a-value-to-autostart-registry-key.md) | | [Modification of NTLM restrictions in the Registry](/analytics-alerts/alerts-by-name/modification-of-ntlm-restrictions-in-the-registry.md) | | [Modification of the AD FS IdentityServer configuration file](/analytics-alerts/alerts-by-name/modification-of-the-ad-fs-identityserver-configuration-file.md) | | [Multiple suspicious user accounts were created](/analytics-alerts/alerts-by-name/multiple-suspicious-user-accounts-were-created.md) | | [Multiple TGT requests for users without Kerberos pre-authentication](/analytics-alerts/alerts-by-name/multiple-tgt-requests-for-users-without-kerberos-pre-authentication.md) | | [Multiple user accounts were deleted](/analytics-alerts/alerts-by-name/multiple-user-accounts-were-deleted.md) | | [NTDS.dit file written by an uncommon executable](/analytics-alerts/alerts-by-name/ntds-dit-file-written-by-an-uncommon-executable.md) | | [Office process accessed an unusual .LNK file](/analytics-alerts/alerts-by-name/office-process-accessed-an-unusual-lnk-file.md) | | [Outlook files accessed by an unsigned process](/analytics-alerts/alerts-by-name/outlook-files-accessed-by-an-unsigned-process.md) | | [PKINIT TGT authentication request](/analytics-alerts/alerts-by-name/pkinit-tgt-authentication-request.md) | | [Possible AS-REP Roasting Attack](/analytics-alerts/alerts-by-name/possible-as-rep-roasting-attack.md) | | [Possible authentication coercion](/analytics-alerts/alerts-by-name/possible-authentication-coercion.md) | | [Possible data exfiltration over a USB storage device](/analytics-alerts/alerts-by-name/possible-data-exfiltration-over-a-usb-storage-device.md) | | [Possible DCSync from a non domain controller](/analytics-alerts/alerts-by-name/possible-dcsync-from-a-non-domain-controller.md) | | [Possible Distributed File System Namespace Management (DFSNM) abuse](/analytics-alerts/alerts-by-name/possible-distributed-file-system-namespace-management-dfsnm-abuse.md) | | [Possible GPO Enumeration](/analytics-alerts/alerts-by-name/possible-gpo-enumeration.md) | | [Possible Insider Threat Activity](/analytics-alerts/alerts-by-name/possible-insider-threat-activity.md) | | [Possible internal data exfiltration over a USB storage device](/analytics-alerts/alerts-by-name/possible-internal-data-exfiltration-over-a-usb-storage-device.md) | | [Possible Kerberoasting attack](/analytics-alerts/alerts-by-name/possible-kerberoasting-attack.md) | | [Possible Kerberos User Enumeration](/analytics-alerts/alerts-by-name/possible-kerberos-user-enumeration.md) | | [Possible LDAP enumeration by unsigned process](/analytics-alerts/alerts-by-name/possible-ldap-enumeration-by-unsigned-process.md) | | [Possible LDAP Enumeration of Microsoft Configuration Manager](/analytics-alerts/alerts-by-name/possible-ldap-enumeration-of-microsoft-configuration-manager.md) | | [Possible LDAP Enumeration Tool Usage](/analytics-alerts/alerts-by-name/possible-ldap-enumeration-tool-usage.md) | | [Possible Persistence via group policy Registry keys](/analytics-alerts/alerts-by-name/possible-persistence-via-group-policy-registry-keys.md) | | [Possible phishing attack via Microsoft Teams](/analytics-alerts/alerts-by-name/possible-phishing-attack-via-microsoft-teams.md) | | [Possible Privilege Escalation using Delegated MSA account](/analytics-alerts/alerts-by-name/possible-privilege-escalation-using-delegated-msa-account.md) | | [Possible SPN enumeration](/analytics-alerts/alerts-by-name/possible-spn-enumeration.md) | | [Possible use of a networking driver for network sniffing](/analytics-alerts/alerts-by-name/possible-use-of-a-networking-driver-for-network-sniffing.md) | | [Possible webshell file written by a web server process](/analytics-alerts/alerts-by-name/possible-webshell-file-written-by-a-web-server-process.md) | | [Potential DCSync by an unusual user](/analytics-alerts/alerts-by-name/potential-dcsync-by-an-unusual-user.md) | | [Potential extraction of NAA Account Credentials in Microsoft Configuration Manager](/analytics-alerts/alerts-by-name/potential-extraction-of-naa-account-credentials-in-microsoft-configuration-manager.md) | | [Potential kubelet impersonation attempt](/analytics-alerts/alerts-by-name/potential-kubelet-impersonation-attempt.md) | | [Potential SCCM credential harvesting using WMI detected](/analytics-alerts/alerts-by-name/potential-sccm-credential-harvesting-using-wmi-detected.md) | | [PowerShell pfx certificate extraction](/analytics-alerts/alerts-by-name/powershell-pfx-certificate-extraction.md) | | [PowerShell used to export mailbox contents](/analytics-alerts/alerts-by-name/powershell-used-to-export-mailbox-contents.md) | | [PowerShell used to remove mailbox export request logs](/analytics-alerts/alerts-by-name/powershell-used-to-remove-mailbox-export-request-logs.md) | | [Privileged certificate request via certificate template](/analytics-alerts/alerts-by-name/privileged-certificate-request-via-certificate-template.md) | | [Rare DCOM RPC activity](/analytics-alerts/alerts-by-name/rare-dcom-rpc-activity.md) | | [Rare machine account creation](/analytics-alerts/alerts-by-name/rare-machine-account-creation.md) | | [Rare process accessed a Keychain file](/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md) | | [Rare Remote Service (SVCCTL) RPC activity](/analytics-alerts/alerts-by-name/rare-remote-service-svcctl-rpc-activity.md) | | [Rare scheduled task created](/analytics-alerts/alerts-by-name/rare-scheduled-task-created.md) | | [Rare Scheduled Task RPC activity](/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity.md) | | [Rare Scheduled Task RPC activity from a rarely seen host](/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity-from-a-rarely-seen-host.md) | | [Rare service DLL was added to the registry](/analytics-alerts/alerts-by-name/rare-service-dll-was-added-to-the-registry.md) | | [RDP connections enabled remotely via Registry](/analytics-alerts/alerts-by-name/rdp-connections-enabled-remotely-via-registry.md) | | [SCCM log files enumeration](/analytics-alerts/alerts-by-name/sccm-log-files-enumeration.md) | | [Scheduled Task hidden by registry modification](/analytics-alerts/alerts-by-name/scheduled-task-hidden-by-registry-modification.md) | | [SecureBoot was disabled](/analytics-alerts/alerts-by-name/secureboot-was-disabled.md) | | [Security tools detection attempt](/analytics-alerts/alerts-by-name/security-tools-detection-attempt.md) | | [Sensitive account password reset attempt](/analytics-alerts/alerts-by-name/sensitive-account-password-reset-attempt.md) | | [Sensitive browser credential files accessed by a rare non browser process](/analytics-alerts/alerts-by-name/sensitive-browser-credential-files-accessed-by-a-rare-non-browser-process.md) | | [Service ticket request with a spoofed sAMAccountName](/analytics-alerts/alerts-by-name/service-ticket-request-with-a-spoofed-samaccountname.md) | | [Setting Windows Auto Logon by uncommon process](/analytics-alerts/alerts-by-name/setting-windows-auto-logon-by-uncommon-process.md) | | [Short-lived user account](/analytics-alerts/alerts-by-name/short-lived-user-account.md) | | [Single account excessively locked out](/analytics-alerts/alerts-by-name/single-account-excessively-locked-out.md) | | [Space after filename](/analytics-alerts/alerts-by-name/space-after-filename.md) | | [SPNs cleared from a machine account](/analytics-alerts/alerts-by-name/spns-cleared-from-a-machine-account.md) | | [Suspicious access of the System Management Container](/analytics-alerts/alerts-by-name/suspicious-access-of-the-system-management-container.md) | | [Suspicious access to cloud credential files](/analytics-alerts/alerts-by-name/suspicious-access-to-cloud-credential-files.md) | | [Suspicious access to Kubernetes API with kubelet credentials](/analytics-alerts/alerts-by-name/suspicious-access-to-kubernetes-api-with-kubelet-credentials.md) | | [Suspicious access to shadow file](/analytics-alerts/alerts-by-name/suspicious-access-to-shadow-file.md) | | [Suspicious account attribute modification that matches that of another account](/analytics-alerts/alerts-by-name/suspicious-account-attribute-modification-that-matches-that-of-another-account.md) | | [Suspicious active setup registered](/analytics-alerts/alerts-by-name/suspicious-active-setup-registered.md) | | [Suspicious AMSI decode attempt](/analytics-alerts/alerts-by-name/suspicious-amsi-decode-attempt.md) | | [Suspicious certificate template modification](/analytics-alerts/alerts-by-name/suspicious-certificate-template-modification.md) | | [Suspicious disablement of the Windows Firewall using PowerShell commands](/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall-using-powershell-commands.md) | | [Suspicious dNSHostName attribute change to DC name](/analytics-alerts/alerts-by-name/suspicious-dnshostname-attribute-change-to-dc-name.md) | | [Suspicious domain user account creation](/analytics-alerts/alerts-by-name/suspicious-domain-user-account-creation.md) | | [Suspicious DotNet log file created](/analytics-alerts/alerts-by-name/suspicious-dotnet-log-file-created.md) | | [Suspicious Encrypting File System Remote call (EFSRPC) to domain controller](/analytics-alerts/alerts-by-name/suspicious-encrypting-file-system-remote-call-efsrpc-to-domain-controller.md) | | [Suspicious hidden user created](/analytics-alerts/alerts-by-name/suspicious-hidden-user-created.md) | | [Suspicious Kerberos Pre-Auth Failures by Host](/analytics-alerts/alerts-by-name/suspicious-kerberos-pre-auth-failures-by-host.md) | | [Suspicious Kubernetes pod token access](/analytics-alerts/alerts-by-name/suspicious-kubernetes-pod-token-access.md) | | [Suspicious LDAP queries followed by shared folder access](/analytics-alerts/alerts-by-name/suspicious-ldap-queries-followed-by-shared-folder-access.md) | | [Suspicious LDAP search query executed](/analytics-alerts/alerts-by-name/suspicious-ldap-search-query-executed.md) | | [Suspicious modification of the AdminSDHolder's ACL](/analytics-alerts/alerts-by-name/suspicious-modification-of-the-adminsdholder-s-acl.md) | | [Suspicious PowerSploit's recon module (PowerView) net function was executed](/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-net-function-was-executed.md) | | [Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts](/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-used-to-search-for-exposed-hosts.md) | | [Suspicious Print System Remote Protocol usage by a process](/analytics-alerts/alerts-by-name/suspicious-print-system-remote-protocol-usage-by-a-process.md) | | [Suspicious process accessed certificate files](/analytics-alerts/alerts-by-name/suspicious-process-accessed-certificate-files.md) | | [Suspicious process modified RC script file](/analytics-alerts/alerts-by-name/suspicious-process-modified-rc-script-file.md) | | [Suspicious reconnaissance using LDAP](/analytics-alerts/alerts-by-name/suspicious-reconnaissance-using-ldap.md) | | [Suspicious sAMAccountName change](/analytics-alerts/alerts-by-name/suspicious-samaccountname-change.md) | | [Suspicious Udev driver rule execution manipulation](/analytics-alerts/alerts-by-name/suspicious-udev-driver-rule-execution-manipulation.md) | | [Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet](/analytics-alerts/alerts-by-name/suspicious-usage-of-microsoft-s-active-directory-powershell-module-remote-discovery-cmdlet.md) | | [System profiling WMI query execution](/analytics-alerts/alerts-by-name/system-profiling-wmi-query-execution.md) | | [Tampering with the Windows User Account Controls (UAC) configuration](/analytics-alerts/alerts-by-name/tampering-with-the-windows-user-account-controls-uac-configuration.md) | | [TGT request with a spoofed sAMAccountName - Event log](/analytics-alerts/alerts-by-name/tgt-request-with-a-spoofed-samaccountname-event-log.md) | | [Uncommon access to /etc/passwd](/analytics-alerts/alerts-by-name/uncommon-access-to-etc-passwd.md) | | [Uncommon access to cloud platforms' sensitive files by a scripting engine](/analytics-alerts/alerts-by-name/uncommon-access-to-cloud-platforms-sensitive-files-by-a-scripting-engine.md) | | [Uncommon access to Microsoft Teams cookies files](/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-cookies-files.md) | | [Uncommon access to Microsoft Teams credential files](/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-credential-files.md) | | [Uncommon AT task-job creation by user](/analytics-alerts/alerts-by-name/uncommon-at-task-job-creation-by-user.md) | | [Uncommon attempt at discovering a sensitive file](/analytics-alerts/alerts-by-name/uncommon-attempt-at-discovering-a-sensitive-file.md) | | [Uncommon attempt at grabbing credentials from a sensitive file](/analytics-alerts/alerts-by-name/uncommon-attempt-at-grabbing-credentials-from-a-sensitive-file.md) | | [Uncommon browser extension loaded](/analytics-alerts/alerts-by-name/uncommon-browser-extension-loaded.md) | | [Uncommon creation or access operation of sensitive shadow copy](/analytics-alerts/alerts-by-name/uncommon-creation-or-access-operation-of-sensitive-shadow-copy.md) | | [Uncommon file access over WebDAV](/analytics-alerts/alerts-by-name/uncommon-file-access-over-webdav.md) | | [Uncommon GetClipboardData API function invocation of a possible information stealer](/analytics-alerts/alerts-by-name/uncommon-getclipboarddata-api-function-invocation-of-a-possible-information-stealer.md) | | [Uncommon jsp file write by a Java process](/analytics-alerts/alerts-by-name/uncommon-jsp-file-write-by-a-java-process.md) | | [Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer](/analytics-alerts/alerts-by-name/uncommon-ntwritevirtualmemoryremote-api-invocation-with-a-pe-header-buffer.md) | | [Uncommon PowerShell commands used to create or alter scheduled task parameters](/analytics-alerts/alerts-by-name/uncommon-powershell-commands-used-to-create-or-alter-scheduled-task-parameters.md) | | [Uncommon Security Support Provider (SSP) registered via a registry key](/analytics-alerts/alerts-by-name/uncommon-security-support-provider-ssp-registered-via-a-registry-key.md) | | [Uncommon sensitive filesystem registry hive access](/analytics-alerts/alerts-by-name/uncommon-sensitive-filesystem-registry-hive-access.md) | | [Uncommon sensitive registry hive dump](/analytics-alerts/alerts-by-name/uncommon-sensitive-registry-hive-dump.md) | | [Uncommon SetWindowsHookEx API invocation of a possible keylogger](/analytics-alerts/alerts-by-name/uncommon-setwindowshookex-api-invocation-of-a-possible-keylogger.md) | | [Unknown DLL was added to the AD FS Global Assembly Cache path](/analytics-alerts/alerts-by-name/unknown-dll-was-added-to-the-ad-fs-global-assembly-cache-path.md) | | [Unusual access to the AD Sync credential files](/analytics-alerts/alerts-by-name/unusual-access-to-the-ad-sync-credential-files.md) | | [Unusual access to the Windows Internal Database on an ADFS server](/analytics-alerts/alerts-by-name/unusual-access-to-the-windows-internal-database-on-an-adfs-server.md) | | [Unusual ADConnect database file access](/analytics-alerts/alerts-by-name/unusual-adconnect-database-file-access.md) | | [Unusual CertLog Remote File Write](/analytics-alerts/alerts-by-name/unusual-certlog-remote-file-write.md) | | [Unusual CIM repository file access](/analytics-alerts/alerts-by-name/unusual-cim-repository-file-access.md) | | [Unusual Encrypting File System Remote call (EFSRPC) to domain controller](/analytics-alerts/alerts-by-name/unusual-encrypting-file-system-remote-call-efsrpc-to-domain-controller.md) | | [Unusual Kubernetes service account file read](/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read.md) | | [Unusual Netsh PortProxy rule](/analytics-alerts/alerts-by-name/unusual-netsh-portproxy-rule.md) | | [Unusual process access to ld.so.preload file](/analytics-alerts/alerts-by-name/unusual-process-access-to-ld-so-preload-file.md) | | [Unusual process accessed a crypto wallet's files](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-crypto-wallet-s-files.md) | | [Unusual process accessed a macOS notes DB file](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md) | | [Unusual process accessed a messaging app's files](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-messaging-app-s-files.md) | | [Unusual process accessed a web browser history file](/analytics-alerts/alerts-by-name/unusual-process-accessed-a-web-browser-history-file.md) | | [Unusual process accessed FTP Client credentials](/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md) | | [Unusual process accessed web browser cookies](/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md) | | [Unusual process accessed web browser credentials](/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md) | | [Unusual use of a 'SysInternals' tool](/analytics-alerts/alerts-by-name/unusual-use-of-a-sysinternals-tool.md) | | [Unusual user account enablement](/analytics-alerts/alerts-by-name/unusual-user-account-enablement.md) | | [Unusual user account unlock](/analytics-alerts/alerts-by-name/unusual-user-account-unlock.md) | | [User account delegation change](/analytics-alerts/alerts-by-name/user-account-delegation-change.md) | | [User added SID History to an account](/analytics-alerts/alerts-by-name/user-added-sid-history-to-an-account.md) | | [User added to a group and removed](/analytics-alerts/alerts-by-name/user-added-to-a-group-and-removed.md) | | [User added to the SMS Admins local group](/analytics-alerts/alerts-by-name/user-added-to-the-sms-admins-local-group.md) | | [User and Group Enumeration via SAMR](/analytics-alerts/alerts-by-name/user-and-group-enumeration-via-samr.md) | | [User collected remote shared files in an archive](/analytics-alerts/alerts-by-name/user-collected-remote-shared-files-in-an-archive.md) | | [User discovery via WMI query execution](/analytics-alerts/alerts-by-name/user-discovery-via-wmi-query-execution.md) | | [User set insecure CA registry setting for global SANs](/analytics-alerts/alerts-by-name/user-set-insecure-ca-registry-setting-for-global-sans.md) | | [VM Detection attempt](/analytics-alerts/alerts-by-name/vm-detection-attempt.md) | | [Vulnerable certificate template loaded](/analytics-alerts/alerts-by-name/vulnerable-certificate-template-loaded.md) | | [Web server CGO executed a process following a potential Webshell dropped](/analytics-alerts/alerts-by-name/web-server-cgo-executed-a-process-following-a-potential-webshell-dropped.md) | | [Windows event logs were cleared with PowerShell](/analytics-alerts/alerts-by-name/windows-event-logs-were-cleared-with-powershell.md) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent-with-extended-threat-hunting-xth.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.