Multiple detection on Suspicious Network Activity - 3045255237

Microsoc_Team — Wed, 30 Aug 2023 21:02:34 GMT

Hello ,

We are a MSSP and since less than one hour, a new rules appeared in many of our Cortex XDR tenant : Suspicious Network Activity - 3045255237 involving the IP 2.58.113.190. The communication is launched by the process System, like if a rootkit has been woke up. Whereas the description says "Generic Webshell Command and Control Traffic Detection " that not match the System process.

Is it a new rule that has been pushed to the Cortex XDR tenants ?

Regards, Benjamin

Re: Multiple detection on Suspicious Network Activity - 3045255237

aspatil — Fri, 01 Sep 2023 08:39:46 GMT

Hello,

Kindly open Support Case, so that they can check with the concerned Team.

topic Re: Multiple detection on Suspicious Network Activity - 3045255237 in Cortex XDR Discussions

Multiple detection on Suspicious Network Activity - 3045255237

Re: Multiple detection on Suspicious Network Activity - 3045255237