Globally uncommon high entropy process was executed

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Informational

Description

A process with high entropy and a globally uncommon hash was executed.

Attacker's Goals

Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.

Investigative actions

Check if the process' file is either compressed, encrypted, obfuscated or packed.

Variations

Globally uncommon high entropy process was executed by a web server process or CGO

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005), Initial Access (TA0001), Persistence (TA0003)
ATT&CK Technique	Obfuscated Files or Information (T1027), External Remote Services (T1133), Server Software Component: Web Shell (T1505.003)
Severity	Low

Description

A process with high entropy and a globally uncommon hash was executed by a web server process or CGO.

Attacker's Goals

Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.

Investigative actions

Check if the process' file is either compressed, encrypted, obfuscated or packed.

Globally uncommon high entropy process was extracted from an internet-downloaded archive and executed

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Low

Description

A process with high entropy and a globally uncommon hash was extracted from an internet-downloaded archive and executed.

Attacker's Goals

Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.

Investigative actions

Check if the process' file is either compressed, encrypted, obfuscated or packed.

Globally uncommon high entropy process was downloaded from an uncommon source and executed

Synopsis

Field	Value
ATT&CK Tactic	Stealth (TA0005)
ATT&CK Technique	Obfuscated Files or Information (T1027)
Severity	Low

Description

A process with high entropy and a globally uncommon hash was downloaded from an uncommon source and executed.

Attacker's Goals

Adversaries may attempt to make an executable difficult to discover or analyze by compressing, encrypting, encoding, or otherwise obfuscating its contents.

Investigative actions

Check if the process' file is either compressed, encrypted, obfuscated or packed.