Unique client computer model was detected via MS-Update protocol
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
7 Days
Required Data
Palo Alto Networks Firewall EAL Logs
ATT&CK Tactic
Initial Access (TA0001)
ATT&CK Technique
Hardware Additions (T1200)
Severity
Informational
Description
A unique client computer model was detected via MS-Update protocol.
Attacker's Goals
The Windows Server Update Services enable machines to discover and download software updates from a dedicated update server while providing the necessary client characteristics to install the suitable client version and build.
Characteristics may consist of computer model, BIOS version and architecture.
A unique computer model in the network may indicate an unauthorized and unmanaged connection to the internal network.
Investigative actions
Inspect the legitimacy of the host and its hardware components.
Verify that this host is not a newly deployed end-point or virtual machine as part of a legitimate IT activity.
Was this helpful?