Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. technique: T1543 ✕

Download CSV Show ATT&CK heatmap
  • Uncommon Launch Agent persistency was registered or modified Informational 9 variations

    An uncommon Launch Agent persistence mechanism was registered/modified on the system.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process (T1543) Create or Modify System Process: Launch Agent (T1543.001)
    Required data: XDR Agent
    Detector tags: Generic Persistence Analytics
    Attacker's goals: Establish persistent access to the compromised host by registering malicious code.
    Investigative actions: Analyze the persistency item and determine whether it performs any malicious or suspicious actions. Analyze the registered process and determine whether it performs any malicious or suspicious actions. Check the events generated by the process for potential malicious behavior.

    Variations

    Uncommon Launch Agent persistency was registered or modified by a security testing tool

    High overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system by a security testing tool. overridden

    Uncommon Launch Agent persistency was registered or modified by a tool with possible web access

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system by a tool with possible web access. overridden

    Uncommon Launch Agent persistency was registered or modified while using a data communication tool

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system while using a data communication tool for persistency registration or as a persistency-triggered execution. overridden

    Uncommon Launch Agent persistency was registered or modified while using osascript

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system while using osascript for persistency registration or as a persistency-triggered execution. overridden

    Uncommon Launch Agent persistency was registered or modified using Plist Buddy with Run-At-Load key

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system using Plist Buddy with Run-At-Load key set to True. overridden

    Uncommon Launch Agent persistency was registered or modified with an uncommon path containing a known vendor name

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system with an uncommon path containing a known vendor name. overridden

    Uncommon Launch Agent persistency was registered or modified with an unusual persistency executable path

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system with an unusual persistency executable path. overridden

    Uncommon Launch Agent persistency was registered or modified by a non validly signed process

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system by a non validly signed process. overridden

    Uncommon Launch Agent persistency was registered or modified by an unsigned process

    Low overridden

    An uncommon Launch Agent persistence mechanism was registered/modified on the system by an unsigned process. overridden