Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
184 detectors match the current filters.
Download CSV13 tactics · 58 techniques · cell shade = number of matching detectors; click a cell to list them.
Resource Development
2 detectors
Initial Access
19 detectors
Execution
22 detectors
Persistence
24 detectors
- Account Manipulation (13)
- Valid Accounts (12)
- External Remote Services (2)
- Cloud Administration Command (1)
- Command and Scripting Interpreter (1)
- Create Account (1)
- Data Destruction (1)
- Impair Defenses (1)
- Modify Authentication Process (1)
- Remote Services (1)
- Scheduled Task/Job (1)
- Unsecured Credentials (1)
Privilege Escalation
20 detectors
Defense Evasion
38 detectors
- Impair Defenses (22)
- Modify Cloud Compute Infrastructure (6)
- Command and Scripting Interpreter (2)
- Indicator Removal (2)
- Unused/Unsupported Cloud Regions (2)
- Valid Accounts (2)
- Account Manipulation (1)
- Cloud Administration Command (1)
- Cloud Infrastructure Discovery (1)
- Cloud Service Discovery (1)
- Data Destruction (1)
- Data from Cloud Storage (1)
- Domain or Tenant Policy Modification (1)
- Email Collection (1)
- File and Directory Permissions Modification (1)
- Hide Artifacts (1)
- Masquerading (1)
- Network Boundary Bridging (1)
- Remote Services (1)
- Service Stop (1)
- Transfer Data to Cloud Account (1)
Credential Access
19 detectors
Discovery
21 detectors
Lateral Movement
5 detectors
Collection
14 detectors
Command and Control
3 detectors
Exfiltration
15 detectors