Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
156 detectors match the current filters.
Download CSV13 tactics · 56 techniques · cell shade = number of matching detectors; click a cell to list them.
Resource Development
2 detectors
Initial Access
13 detectors
Execution
17 detectors
Persistence
24 detectors
- Account Manipulation (13)
- Valid Accounts (12)
- External Remote Services (2)
- Cloud Administration Command (1)
- Command and Scripting Interpreter (1)
- Create Account (1)
- Data Destruction (1)
- Impair Defenses (1)
- Modify Authentication Process (1)
- Remote Services (1)
- Scheduled Task/Job (1)
- Unsecured Credentials (1)
Privilege Escalation
19 detectors
Defense Evasion
35 detectors
- Impair Defenses (19)
- Modify Cloud Compute Infrastructure (6)
- Command and Scripting Interpreter (2)
- Indicator Removal (2)
- Unused/Unsupported Cloud Regions (2)
- Valid Accounts (2)
- Account Manipulation (1)
- Cloud Administration Command (1)
- Cloud Infrastructure Discovery (1)
- Cloud Service Discovery (1)
- Data Destruction (1)
- Data from Cloud Storage (1)
- Domain or Tenant Policy Modification (1)
- Email Collection (1)
- File and Directory Permissions Modification (1)
- Hide Artifacts (1)
- Masquerading (1)
- Network Boundary Bridging (1)
- Remote Services (1)
- Service Stop (1)
- Transfer Data to Cloud Account (1)
Credential Access
17 detectors
Discovery
18 detectors
Lateral Movement
5 detectors
Collection
11 detectors
Command and Control
2 detectors
Exfiltration
12 detectors