Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
43 detectors match the current filters. tactic: TA0005 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks. | Informational | Identity Threat Detection (ITDR) | XDR Agent | Defense Evasion |
| Analytics BIOC | A LOLBIN was copied to a different location To evade detection, attackers may copy a LOLBIN executable to a different location. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | A process is masquerading as a common Microsoft product An attacker might leverage common Microsoft software image names to run malicious processes without being caught. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| Analytics BIOC | A third-party utility was copied to a different location To evade detection, attackers may copy a third-party utility executable to a different location. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Authentication Attempt From a Dormant Account A dormant user account tried to authenticate to a service using a TGS after having been unused for a year or more. This may indicate the account is misused by an attacker. | Informational | Platform Analytics | Palo Alto Networks Firewall traffic Logs, XDR Agent | Defense Evasion |
| Analytics BIOC | Common third-party software name masquerading An attacker might leverage common third-party software image names to run malicious processes without being caught. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Executable moved to Windows system folder An attacker may be trying to avoid detection by moving an executable to a Windows system folder. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Execution of masqueraded third-party utility An attacker may be trying to avoid detection of third-party utility execution by renaming it. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Execution of renamed lolbin An attacker may be trying to avoid detection of lolbin's execution using a renamed lolbin. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Failed Login For Locked-Out Account A locked-out user account (event ID 4725 or 4740) was used in a Kerberos TGT pre-authentication attempt. | Informational | Platform Analytics | Palo Alto Networks Firewall traffic Logs, XDR Agent | Defense Evasion |
| Analytics BIOC | Globally uncommon high entropy module was loaded A module with high entropy and a globally uncommon hash was loaded. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Globally uncommon high entropy process was executed A process with high entropy and a globally uncommon hash was executed. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Globally uncommon image load from a signed process A signed process loaded a DLL that, on a global level, it usually doesn't load. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level. | Informational | Platform Analytics | XDR Agent | Defense Evasion, Persistence |
| Analytics BIOC | Globally uncommon IP address connection from a signed process A signed process connected to an external IP address that, on a global level, it usually doesn't connect to. | Informational | Platform Analytics | XDR Agent | Defense Evasion, Command and Control |
| Analytics BIOC | Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Indicator blocking Auditing or logging configuration changes on Linux host. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Injection into rundll32.exe A process injected into an instance of rundll32.exe. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker. | Informational | Identity Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Modification of PAM Modification of PAM configuration files. | Informational | Platform Analytics | XDR Agent | Persistence, Defense Evasion, Credential Access |
| Analytics BIOC | MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Possible data obfuscation A command that can be used for file obfuscation was executed with an uncommon command line. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| Analytics BIOC | Rare signature signed executable executed in the network Attackers may use signed executables by less known vendors to bypass security features. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Registration of Uncommon .NET Services and/or Assemblies Regasm.exe and regsvcs.exe are used to register .NET COM assemblies, which are typically located in specific paths, attackers might leverage that to execute code within a Microsoft signed binary. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Signed process performed an unpopular DLL injection A signed process performed an unpopular DLL injection into another process. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Signed process performed an unpopular injection A signed process performed an unpopular injection to another process. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Suspicious process accessed a site masquerading as Google A suspicious process accessed a site masquerading as Google. | Informational | Platform Analytics | XDR Agent | Command and Control, Defense Evasion |
| Analytics BIOC | Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Tampering with Internet Explorer Protected Mode configuration When an add-on is running inside Protected Mode attempts to launch a broker process (or any other program), the ElevationPolicy Registry key is checked to determine how the process should be launched. Internet Explorer will run a broker process with higher rights that can use the current user's permissions to take actions that would otherwise be prohibited when rendering content inside the Protected Mode sandbox. https://blogs.msdn.microsoft.com/ieinternals/2009/11/30/understanding-the-protected-mode-elevation-dialog/. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Uncommon DotNet module load relationship A signed process that usually doesn't use DotNet loaded a common DotNet module. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Uncommon kernel module load Loading of a kernel module using the modprobe command. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Unpopular rsync process execution An unpopular rsync process was executed on the host. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| Analytics BIOC | Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| Analytics BIOC | VM Detection attempt on Linux A Process executed a command and/or accessed a file that can be used to detect VM environments. | Informational | Platform Analytics | XDR Agent | Defense Evasion, Discovery |
| Analytics BIOC | Weakly-Encrypted Kerberos TGT Response A weakly encrypted Kerberos TGT was issued by a domain controller. The encryption type is abnormal for this DC and results in a TGT that is easier to crack. This behavior may indicate a Skeleton Key attack. | Informational | Platform Analytics | Palo Alto Networks Firewall EAL Logs, XDR Agent | Credential Access, Defense Evasion, Persistence |