Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
108 detectors match the current filters.
Download CSV12 tactics · 40 techniques · cell shade = number of matching detectors; click a cell to list them.
Initial Access
17 detectors
- Valid Accounts (8)
- Phishing (6)
- Impair Defenses (4)
- Trusted Relationship (2)
- Account Manipulation (1)
- Automated Collection (1)
- Automated Exfiltration (1)
- Domain or Tenant Policy Modification (1)
- External Remote Services (1)
- Software Extensions (1)
- Steal Application Access Token (1)
- Supply Chain Compromise (1)
Execution
2 detectors
Persistence
31 detectors
- Account Manipulation (15)
- Valid Accounts (9)
- Cloud Application Integration (4)
- Modify Authentication Process (4)
- Domain or Tenant Policy Modification (3)
- Command and Scripting Interpreter (2)
- Impair Defenses (2)
- Use Alternate Authentication Material (2)
- Access Token Manipulation (1)
- Automated Exfiltration (1)
- Create Account (1)
- Event Triggered Execution (1)
- Software Extensions (1)
- Supply Chain Compromise (1)
Privilege Escalation
15 detectors
Defense Evasion
33 detectors
- Impair Defenses (18)
- Abuse Elevation Control Mechanism (5)
- Modify Authentication Process (5)
- Phishing (4)
- Domain or Tenant Policy Modification (3)
- Hide Artifacts (3)
- Account Manipulation (2)
- Use Alternate Authentication Material (2)
- Valid Accounts (2)
- Cloud Application Integration (1)
- Data Manipulation (1)
- Exfiltration Over Alternative Protocol (1)
- Indicator Removal (1)
- Remote Services (1)
Credential Access
10 detectors
Discovery
1 detector
Lateral Movement
1 detector
Collection
16 detectors
Command and Control
2 detectors
Exfiltration
11 detectors
- Automated Exfiltration (6)
- Email Collection (4)
- Data Staged (2)
- Exfiltration Over Physical Medium (2)
- Command and Scripting Interpreter (1)
- Event Triggered Execution (1)
- Exfiltration Over Alternative Protocol (1)
- Exfiltration Over Web Service (1)
- Impair Defenses (1)
- Transfer Data to Cloud Account (1)
- Valid Accounts (1)
Impact
5 detectors