Globally uncommon high entropy module was loaded

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Informational

Description

A module with high entropy and a globally uncommon hash was loaded.

Attacker's Goals

Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.

Investigative actions

Check if the module is either compressed, encrypted, obfuscated or packed.

Variations

Globally uncommon high entropy module was loaded by process which was executed by a scheduled task

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Low

Description

A module with high entropy and a globally uncommon hash was loaded.

Attacker's Goals

Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.

Investigative actions

Check if the module is either compressed, encrypted, obfuscated or packed.