Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0002 ✕

Download CSV Show ATT&CK heatmap
  • LOLBIN created a PSScriptPolicyTest PowerShell script file Informational 1 variation

    A LOLBIN created a PSScriptPolicyTest file. This may be a sign of malicious PowerShell execution without directly invoking the powershell.exe binary.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Required data: XDR Agent with eXtended Threat Hunting (XTH)
    Detector tags: LOLBIN Execution Analytics
    Attacker's goals: Executing PowerShell scripts in a stealthy manner.
    Investigative actions: Investigate the process and command line that created the file and whether it's benign or normal for this host. Investigate the created PowerShell file for potential malicious commands.

    Variations

    LOLBIN created a larger than usual PSScriptPolicyTest PowerShell script file

    Medium overridden

    A LOLBIN created a PSScriptPolicyTest file. This may be a sign of malicious PowerShell execution without directly invoking the powershell.exe binary. overridden