Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
175 detectors match the current filters.
Download CSV12 tactics · 42 techniques · cell shade = number of matching detectors; click a cell to list them.
Reconnaissance
1 detector
Resource Development
18 detectors
Initial Access
44 detectors
Execution
6 detectors
Persistence
30 detectors
Privilege Escalation
25 detectors
Defense Evasion
16 detectors
- Valid Accounts (7)
- Hide Artifacts (2)
- Impair Defenses (2)
- Access Token Manipulation (1)
- Account Manipulation (1)
- Create Account (1)
- Credentials from Password Stores (1)
- Deobfuscate/Decode Files or Information (1)
- Hijack Execution Flow (1)
- Indicator Removal (1)
- Masquerading (1)
- Modify Authentication Process (1)
- OS Credential Dumping (1)
- Rogue Domain Controller (1)
- Unsecured Credentials (1)
- Use Alternate Authentication Material (1)
Credential Access
65 detectors
- Brute Force (34)
- Compromise Accounts (16)
- Steal or Forge Authentication Certificates (9)
- Steal or Forge Kerberos Tickets (7)
- Valid Accounts (6)
- Account Discovery (4)
- Adversary-in-the-Middle (4)
- Forced Authentication (4)
- Unsecured Credentials (4)
- Account Manipulation (2)
- Credentials from Password Stores (2)
- File and Directory Discovery (2)
- OS Credential Dumping (2)
- Use Alternate Authentication Material (2)
- Deobfuscate/Decode Files or Information (1)
- Modify Authentication Process (1)
- Multi-Factor Authentication Request Generation (1)
- Remote Services (1)
- Rogue Domain Controller (1)
- Steal Application Access Token (1)
Discovery
16 detectors
- Account Discovery (10)
- Permission Groups Discovery (3)
- Steal or Forge Authentication Certificates (3)
- Brute Force (2)
- Domain Trust Discovery (2)
- File and Directory Discovery (2)
- Remote System Discovery (2)
- System Network Configuration Discovery (2)
- Cloud Service Discovery (1)
- Group Policy Discovery (1)
- Log Enumeration (1)
- Steal or Forge Kerberos Tickets (1)
- Valid Accounts (1)
Lateral Movement
13 detectors
Command and Control
3 detectors
Impact
2 detectors