Possible IPFS traffic was detected

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall traffic Logs OR XDR Agent
ATT&CK Tactic	Exfiltration (TA0010), Initial Access (TA0001)
ATT&CK Technique	Exfiltration Over Alternative Protocol (T1048), Phishing (T1566)
Severity	Informational

Description

The host attempted to access other nodes in an IPFS manner.

Attacker's Goals

IPFS access may expose your organization to new malware or allow attackers/ malicious insiders to exfiltrate data.

Investigative actions

• Check the host for IPFS client software.
• Examine the client's network traffic for uploaded or downloaded file hashes.