LowALERT-4203engine: heuristic

Policy Violation: Unapproved Cloud Storage

analyst review

Raw alert — normalized QRadar offense

asset: hmi-station-03
protocol: TCP :80
src_ip: 10.22.9.77
dest_ip: 10.50.3.44
magnitude: 1/10
severity: 3/10
credibility: 3/10
relevance: 1/10
src network: internal_corp
events / flows: 17 / 21

triggered rules

▹ Auth: Repeated Failures Single Account
▹ Policy: Acceptable Use Violation

full offense JSON

{
  "offense_id": 4203,
  "description": "Policy Violation: Unapproved Cloud Storage :: Benign/Low targeting hmi-station-03",
  "offense_type": "Source IP",
  "offense_source": "10.22.9.77",
  "magnitude": 1,
  "severity": 3,
  "credibility": 3,
  "relevance": 1,
  "status": "OPEN",
  "source_network": "internal_corp",
  "destination_networks": [
    "ot_scada"
  ],
  "event_count": 17,
  "flow_count": 21,
  "start_time": "2025-11-03T12:38:00+00:00",
  "last_updated_time": "2025-11-03T13:08:00+00:00",
  "categories": [
    "Recon",
    "Information Gathering"
  ],
  "rules": [
    "Auth: Repeated Failures Single Account",
    "Policy: Acceptable Use Violation"
  ],
  "assigned_to": null,
  "dest_port": 80
}

AI triage

Likely port scan: Policy Violation: Unapproved Cloud Storage from internal host 10.22.9.77 against hmi-station-03 (10.50.3.44) over TCP, 17 events observed.

MITRE ATT&CK

T1590Gather Victim Network InformationReconnaissanceconfidence 63%

Alert indicators (Policy Violation: Unapproved Cloud Storage; rules: Auth: Repeated Failures Single Account) overlap most strongly with T1590 Gather Victim Network Information among the ATT&CK shortlist.

Priority — Low

Scored Low based on: QRadar magnitude 1/10; targets OT/SCADA asset "hmi-station-03" (critical energy infrastructure).

Recommended next steps

1.Confirm the scan scope: how many destination ports/hosts were touched by the source IP.
2.Check whether any scanned port returned a SYN-ACK (successful connection) vs. all resets.
3.Block or rate-limit the source IP at the perimeter if it is external and unrecognized.
4.Search for follow-on activity from the same source (exploit attempts, logins).

Suggested hunting query (KQL)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "10.22.9.77" and DestinationIP == "10.50.3.44"
| summarize Events=count() by DestinationPort, Protocol
| order by Events desc

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1590Gather Victim Network Information·7.5T1595Active Scanning·6.5T1046Network Service Discovery·6T1087.004Cloud Account·5T1136.003Cloud Account·5T1530Data from Cloud Storage·5T1537Transfer Data to Cloud Account·5