Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
4 detectors match the current filters. technique: T1053 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task. | Informational | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Signed process creates a scheduled task via file access A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence. | Informational | Platform Analytics | XDR Agent | Execution, Persistence |
| Analytics BIOC | Uncommon local scheduled task creation via schtasks.exe The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks. | Informational | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Uncommon signed process execution by scheduled task An uncommon process was executed by a scheduled task. | Informational | Platform Analytics | XDR Agent | Persistence |