Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
10 detectors match the current filters. tactic: TA0009 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Certutil pfx parsing Certutil was used to parse a pfx certificate file. | Low | Platform Analytics | XDR Agent | Collection |
| Analytics BIOC | Compressing data using python Usage of a Python module to compress files. | Low | Platform Analytics | XDR Agent | Collection |
| Analytics BIOC | Keylogging using system commands Usage of a Linux system utility to capture input. | Low | Platform Analytics | XDR Agent | Credential Access, Collection |
| Analytics BIOC | New FTP Server A new FTP server has been detected. | Low | Platform Analytics | Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls | Initial Access, Collection |
| Analytics BIOC | Possible collection of screen captures with Windows Problem Steps Recorder Windows Problem Steps Recorder (psr.exe), can record screen and clicks. Adversaries may abuse psr.exe to create screen captures and collect them afterward. | Medium | Platform Analytics | XDR Agent | Collection |
| Analytics BIOC | Possible Email collection using Outlook RPC Outlook was executed using RPC by an uncommon parent process, this may be an indication of email collection activities. | Informational | Platform Analytics | XDR Agent | Collection |
| Analytics BIOC | Uncommon AppleScript designed to access cryptocurrency wallet data was executed via the command line The AppleScript interpreter was executed with a script designed to access cryptocurrency wallet data. | Informational | Platform Analytics | XDR Agent | Execution, Collection |
| Analytics BIOC | Uncommon AppleScript designed to access sensitive application data was executed via the command line The AppleScript interpreter was executed with a script designed to access sensitive application data such as Telegram messages, Apple Notes, or cached data. | High | Platform Analytics | XDR Agent | Execution, Collection |
| Analytics BIOC | Uncommon AppleScript designed to capture screen or clipboard data was executed via the command line The AppleScript interpreter was executed with a script designed to capture screen content or clipboard data. | Low | Platform Analytics | XDR Agent | Execution, Collection |
| Analytics BIOC | Unusual compressed file password protection An adversary might compress sensitive files with password protection to bypass security mitigations when attempting to exfiltrate them. | Low | Platform Analytics | XDR Agent | Collection |