Post #4361340

So here I am checking HAD DISK PRICES and Cortex decides to call me out CORTEX XDR Alert Name: Abnormal Recurring Communications to a Rare Domain With a Less Common Port Alert id: [] Severity: Low Source: XDR Analytics BIOC Category: Command and Control Action: Detected Description: The host [] was seen communicating to the external entity diskprices.com Communication between these entities was seen 5 times. This external entity is rare in the organization as only 0 hosts within the organization accessed it. This external entity is also rare globally. This external entity was accessed using 2 distinct ports. Based on our machine learning models, this connection was flagged as suspicious Host: []