Rare process created an SSH session to an uncommon cloud resource
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
Requires one of the following data sources: Palo Alto Networks Firewall traffic Logs OR XDR Agent OR Third-Party Firewalls
Detector Tags
EDR Windows C2 Analytics
ATT&CK Tactic
Command and Control (TA0011)
ATT&CK Technique
Application Layer Protocol (T1071)
Severity
Low
Description
A rare process created an SSH session to an uncommon cloud resource.
Attacker's Goals
Attackers may use SSH or any similar utility as a Command and Control (C2) channel or to exfiltrate data to a remote host.
Investigative actions
Investigate the actor process and its causality.
Review the remote cloud asset, is it managed by the organization or a partner?
Search for processes or files that were accessed by this SSH instance.
Was this helpful?