Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

43 detectors match the current filters. tactic: TA0005 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks. Informational Identity Threat Detection (ITDR) XDR Agent Defense Evasion
Analytics BIOC A LOLBIN was copied to a different location To evade detection, attackers may copy a LOLBIN executable to a different location. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC A process is masquerading as a common Microsoft product An attacker might leverage common Microsoft software image names to run malicious processes without being caught. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC A third-party utility was copied to a different location To evade detection, attackers may copy a third-party utility executable to a different location. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Authentication Attempt From a Dormant Account A dormant user account tried to authenticate to a service using a TGS after having been unused for a year or more. This may indicate the account is misused by an attacker. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Defense Evasion
Analytics BIOC Common third-party software name masquerading An attacker might leverage common third-party software image names to run malicious processes without being caught. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Executable moved to Windows system folder An attacker may be trying to avoid detection by moving an executable to a Windows system folder. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Execution of masqueraded third-party utility An attacker may be trying to avoid detection of third-party utility execution by renaming it. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Execution of renamed lolbin An attacker may be trying to avoid detection of lolbin's execution using a renamed lolbin. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Failed Login For Locked-Out Account A locked-out user account (event ID 4725 or 4740) was used in a Kerberos TGT pre-authentication attempt. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Defense Evasion
Analytics BIOC Globally uncommon high entropy module was loaded A module with high entropy and a globally uncommon hash was loaded. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Globally uncommon high entropy process was executed A process with high entropy and a globally uncommon hash was executed. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Globally uncommon image load from a signed process A signed process loaded a DLL that, on a global level, it usually doesn't load. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level. Informational Platform Analytics XDR Agent Defense Evasion, Persistence
Analytics BIOC Globally uncommon IP address connection from a signed process A signed process connected to an external IP address that, on a global level, it usually doesn't connect to. Informational Platform Analytics XDR Agent Defense Evasion, Command and Control
Analytics BIOC Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Indicator blocking Auditing or logging configuration changes on Linux host. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Injection into rundll32.exe A process injected into an instance of rundll32.exe. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Login by a dormant user A dormant user logged on after having been unused for a month or longer. This may indicate the account is misused by an attacker. Informational Identity Analytics XDR Agent Defense Evasion
Analytics BIOC LOLBAS executable injects into another process A signed binary, which can be abused to run code, injected code to another process. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Modification of PAM Modification of PAM configuration files. Informational Platform Analytics XDR Agent Persistence, Defense Evasion, Credential Access
Analytics BIOC MSI accessed a web page running a server-side script The Microsoft installer command line included a URL to a web page running a server-side script, which is suspicious. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Msiexec execution of an executable from an uncommon remote location Msiexec is the command-line utility for the Windows Installer. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads from remote locations. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Possible binary padding using dd A suspicious dd command ran and added data to a binary. This may indicate binary padding to change the hash of a file. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Possible data obfuscation A command that can be used for file obfuscation was executed with an uncommon command line. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC Rare signature signed executable executed in the network Attackers may use signed executables by less known vendors to bypass security features. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Registration of Uncommon .NET Services and/or Assemblies Regasm.exe and regsvcs.exe are used to register .NET COM assemblies, which are typically located in specific paths, attackers might leverage that to execute code within a Microsoft signed binary. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Signed process performed an unpopular DLL injection A signed process performed an unpopular DLL injection into another process. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Signed process performed an unpopular injection A signed process performed an unpopular injection to another process. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Suspicious process accessed a site masquerading as Google A suspicious process accessed a site masquerading as Google. Informational Platform Analytics XDR Agent Command and Control, Defense Evasion
Analytics BIOC Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Tampering with Internet Explorer Protected Mode configuration When an add-on is running inside Protected Mode attempts to launch a broker process (or any other program), the ElevationPolicy Registry key is checked to determine how the process should be launched. Internet Explorer will run a broker process with higher rights that can use the current user's permissions to take actions that would otherwise be prohibited when rendering content inside the Protected Mode sandbox. https://blogs.msdn.microsoft.com/ieinternals/2009/11/30/understanding-the-protected-mode-elevation-dialog/. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Uncommon DotNet module load relationship A signed process that usually doesn't use DotNet loaded a common DotNet module. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Uncommon kernel module load Loading of a kernel module using the modprobe command. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Unpopular rsync process execution An unpopular rsync process was executed on the host. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC VM Detection attempt on Linux A Process executed a command and/or accessed a file that can be used to detect VM environments. Informational Platform Analytics XDR Agent Defense Evasion, Discovery
Analytics BIOC Weakly-Encrypted Kerberos TGT Response A weakly encrypted Kerberos TGT was issued by a domain controller. The encryption type is abnormal for this DC and results in a TGT that is easier to crack. This behavior may indicate a Skeleton Key attack. Informational Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Credential Access, Defense Evasion, Persistence