A user accessed multiple time-consuming websites
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
12 Hours
Deduplication Period
1 Day
Required Data
Requires all of the following: Palo Alto Networks Firewall EAL Logs OR Palo Alto Networks Firewall threat Logs Palo Alto Networks Firewall EAL Logs OR XDR Agent
Detection Modules
Identity Threat Module, SaaS Threat Detection
ATT&CK Tactic
Reconnaissance (TA0043)
ATT&CK Technique
Search Open Websites/Domains (T1593)
Severity
Informational
Description
A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.
Attacker's Goals
A user may utilize work time for personal reasons.
Investigative actions
Investigate the domains accessed and how popular they are in the organization.
Verify that the user is not part of a department that visits these websites as part of their daily operations.
Was this helpful?