Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • Unsigned and unpopular process performed an injection Low 7 variations

    An unsigned process with low popularity injected code to another process.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Stealth (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Required data: XDR Agent
    Detector tags: Injection Analytics
    Attacker's goals: Attackers may inject code into processes to evade process-based defenses, as well as possibly elevate privileges.
    Investigative actions: Check whether the injecting process is benign and if this was a desired behavior as part of its normal execution flow.

    Variations

    Unsigned and unpopular process performed process hollowing injection

    High overridden

    An unsigned process with low popularity injected code to another process. overridden

    Unsigned and unpopular process performed queue APC injection

    High overridden

    An unsigned process with low popularity injected code to another process. overridden

    Unsigned and unpopular process performed injection into a sensitive process

    Medium overridden

    An unsigned process with low popularity injected code to another process. overridden

    Unsigned and unpopular process performed injection into svchost.exe

    High overridden

    An unsigned process with low popularity injected code to another process. This process attempted to obtain System user permissions. overridden

    Unsigned and unpopular process performed injection into a commonly abused process

    High overridden

    An unsigned process with low popularity injected code to another process. overridden

    Unsigned and unpopular process performed injection into a process signed by a security vendor

    Medium overridden

    An unsigned process with low popularity injected code to another process. overridden

    Unsigned and unpopular process executed by a scheduled task performed an injection

    Low overridden

    An unsigned process with low popularity injected code to another process. overridden