Contained process execution with a rare GitHub URL
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
3 Hours
Required Data
XDR Agent
ATT&CK Tactic
Execution (TA0002)
ATT&CK Technique
User Execution: Malicious Image (T1204.003)
Severity
Low
Description
A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads.
Attacker's Goals
Download a second stage payload for execution.
Investigative actions
Check if the initiator process is malicious.
Check the user activity on the same container at that time.
Check if the container is a development container.
Check if this installation was related to more installations at the same time.
Check for additional file/network operations by the same process instance.
Was this helpful?