Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾

Informational Low Medium High

Detection module ▾

Cloud Email Identity Analytics Identity Threat Module Identity Threat Module Email

Data source ▾

1 alert match the current filters. tactic: TA0005 ✕ technique: T1105 ✕

Show ATT&CK heatmap

Suspicious certutil command line Medium

An attacker may use certutil to download malware.

Activation:

14 Days

Training:

30 Days

Test:

N/A (single event)

Deduplication:

1 Day

ATT&CK tactics: Command and Control (TA0011) Defense Evasion (TA0005)

ATT&CK techniques: System Binary Proxy Execution (T1218) Ingress Tool Transfer (T1105)

Required data: XDR Agent

Attacker's goals: An attacker may use certutil to download malware.

Investigative actions: Check whether the URL is benign and if this was a desired behavior as part of its normal execution flow. Check whether the downloaded file is malicious.