Possible use of IPFS was detected

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall traffic Logs OR XDR Agent
ATT&CK Tactic	Exfiltration (TA0010), Initial Access (TA0001)
ATT&CK Technique	Exfiltration Over Alternative Protocol (T1048), Phishing (T1566)
Severity	Informational

Description

The host produced traffic consistent with IPFS.

Attacker's Goals

IPFS access may expose your organization to new malware or allow attackers/ malicious insiders to exfiltrate data.

Investigative actions

• Check the host for IPFS client software.
• Look at the user's website history for IPFS url's and check the content ID (CID) for malicious indicators.
• Examine the client's network traffic for uploaded or downloaded file hashes.

Variations

Possible use of IPFS was detected

Synopsis

Field	Value
ATT&CK Tactic	Exfiltration (TA0010), Initial Access (TA0001)
ATT&CK Technique	Exfiltration Over Alternative Protocol (T1048), Phishing (T1566)
Severity	Informational

Description

The host produced traffic consistent with IPFS.

Attacker's Goals

IPFS access may expose your organization to new malware or allow attackers/ malicious insiders to exfiltrate data.

Investigative actions

• Check the host for IPFS client software.
• Look at the user's website history for IPFS url's and check the content ID (CID) for malicious indicators.
• Examine the client's network traffic for uploaded or downloaded file hashes.