Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
123 detectors match the current filters. tactic: TA0002 ✕
Download CSV11 tactics · 33 techniques · cell shade = number of matching detectors; click a cell to list them.
Resource Development
3 detectors
Initial Access
5 detectors
Execution
123 detectors
- User Execution (39)
- Command and Scripting Interpreter (38)
- Deploy Container (12)
- System Services (12)
- Brute Force (11)
- Windows Management Instrumentation (9)
- Remote Services (8)
- Escape to Host (6)
- Cloud Administration Command (5)
- Container Administration Command (5)
- Phishing (5)
- Masquerading (4)
- Impair Defenses (3)
- Obtain Capabilities (3)
- Serverless Execution (3)
- System Information Discovery (3)
- Account Manipulation (2)
- Event Triggered Execution (2)
- Exploitation for Client Execution (2)
- Native API (2)
- Scheduled Task/Job (2)
- Access Token Manipulation (1)
- Account Discovery (1)
- Automated Exfiltration (1)
- Data from Local System (1)
- Hide Artifacts (1)
- Impersonation (1)
- Lateral Tool Transfer (1)
- Remote System Discovery (1)
- Steal Application Access Token (1)
- System Owner/User Discovery (1)
- System Service Discovery (1)
- Valid Accounts (1)
Persistence
6 detectors
Privilege Escalation
8 detectors
Defense Evasion
9 detectors
Credential Access
12 detectors
Discovery
6 detectors
Lateral Movement
8 detectors
Collection
1 detector
Exfiltration
1 detector