A compromised process accessed a rare cloud resource

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	2 Hours
Deduplication Period	1 Day
Required Data	Requires all of the following: XDR Agent XDR Agent with eXtended Threat Hunting (XTH)
Detector Tags	EDR Windows C2 Analytics
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Informational

Description

A compromised process accessed a rare cloud resource.

Attacker's Goals

Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.

Investigative actions

• Investigate the compromised process.
• Identify the rare cloud resource accessed, is it managed by your organization?

Variations

A process compromised by DLL sideloading accessed a rare cloud resource and demonstrated abnormal communication patters

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Medium

Description

A process compromised by DLL sideloading accessed a rare cloud resource and demonstrated abnormal communication patters.

Attacker's Goals

Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.

Investigative actions

• Investigate the compromised process.
• Identify the rare cloud resource accessed, is it managed by your organization?

A process compromised by DLL sideloading accessed a rare cloud resource

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Informational

Description

A process compromised by DLL sideloading accessed a rare cloud resource.

Attacker's Goals

Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.

Investigative actions

• Investigate the compromised process.
• Identify the rare cloud resource accessed, is it managed by your organization?

An injected process accessed a rare cloud resource

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Application Layer Protocol (T1071)
Severity	Informational

Description

An injected process accessed a rare cloud resource.

Attacker's Goals

Communicate with the attacker's Command and Control (C2) infrastructure while leveraging a compromised process to evade detection.

Investigative actions

• Investigate the compromised process.
• Identify the rare cloud resource accessed, is it managed by your organization?