Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • Phantom DLL Loading Medium 2 variations

    An attacker might leverage existing processes missing module loads to load malicious code into trusted processes.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Required data: XDR Agent
    Detector tags: DLL Hijacking Analytics
    Attacker's goals: An attacker is attempting to load untrusted code into trusted contexts to avoid detection, persist or escalate privileges.
    Investigative actions: Investigate the loaded module and verify if it is malicious.

    Variations

    Phantom DLL Loading was used to load a DLL into a process after it was extracted from an internet-downloaded archive

    High overridden

    An attacker might leverage existing processes missing module loads to load malicious code into trusted processes. overridden

    Phantom DLL Loading was used to load a DLL into a process after it was downloaded from an uncommon source

    High overridden

    An attacker might leverage existing processes missing module loads to load malicious code into trusted processes. overridden