Multiple detection on Suspicious Network Activity - 3045255237

[Microsoc_Team]

Hello ,

We are a MSSP and since less than one hour, a new rules appeared in many of our Cortex XDR tenant : Suspicious Network Activity - 3045255237 involving the IP 2.58.113.190. The communication is launched by the process System, like if a rootkit has been woke up. Whereas the description says "Generic Webshell Command and Control Traffic Detection " that not match the System process.

Is it a new rule that has been pushed to the Cortex XDR tenants ?

Regards, Benjamin

[aspatil]

Hello,

Kindly open Support Case, so that they can check with the concerned Team.