LoFP LoFP / t1557

t1557

TitleTags
a user simultaneously enrolling multiple workspace-aware apps on a new device (e.g., first-time setup of gmail, drive, calendar, and meet on a new laptop in a short window) may produce three or more distinct device ids in a minute. validate by checking whether the burst is tied to a fresh device or onboarding event.
automatic isatap configuration in some windows deployments
carrier-grade nat or load-balanced corporate egress that occasionally routes through alternate asns.
certain applications may install root certificates for the purpose of inspecting ssl traffic.
custom or portable notepad++ installations in non-standard directories.
google's risk engine occasionally flags legitimate sign-ins as suspicious when the user is on a new device, on a vpn egress that geo-resolves to a different region, or after extended time away. validate by checking the user's recent sign-in history and confirming with the user.
ipv6 transition projects and network infrastructure changes
legitimate administrative use
legitimate files with these rare hacktool names
legitimate first-time use of a new network: isp change, new vpn provider, travel to a region using a different mobile carrier, new home office.
legitimate isatap router configuration in enterprise environments
legitimate update processes creating temporary files in unexpected locations.
legitimate use of the impacket tools
legitimate webproxy settings modification
legitimate windivert driver usage
major os upgrades or workspace client refreshes that re-attest several apps concurrently may also produce a burst. cross-reference against the user's known device os transitions.
network administrators configuring dual-stack networking
other legitimate query to official domains not listed in the filter, needing tuning.
private hosted zones may be legitimately associated with vpcs by network or infrastructure administrators. verify whether the user identity, user agent, and source ip address align with expected administrative behavior. known and authorized associations may be exempted to reduce noise.
some legitimate network misconfigurations or proxy issues causing unexpected dns queries.
uncommon but legitimate windows administrator or software tasks that make use of the encrypting file system rpc calls. verify if this is common activity (see description).
unknown
unlikely
unlikely. except due to misconfigurations