Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
10 detectors match the current filters. tactic: TA0005 ✕ technique: T1578 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A cloud storage configuration was modified A cloud storage configuration was modified. | Informational | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Defense Evasion |
| Analytics BIOC | A Service Principal was removed from Azure A service principal was removed from Azure. This indicates a change in access permissions and may indicate malicious activity. | Informational | Cortex Cloud | Azure Audit Log | Defense Evasion |
| Analytics BIOC | An unusual cloud identity was granted permissions to a BigQuery resource An unusual cloud identity was granted permissions to a BigQuery table or dataset. | Informational | Cortex Cloud | Gcp Audit Log | Exfiltration, Defense Evasion |
| Analytics BIOC | Azure route table creation or modification An Azure route table, or one of its individual routes, was created or modified. Azure route tables control how traffic flows between subnets and virtual networks. Adversaries can tamper with route tables to redirect traffic to attacker-controlled destinations, bypassing security appliances or enabling man-in-the-middle attacks. | Informational | Cortex Cloud | Azure Audit Log | Defense Evasion, Lateral Movement |
| Analytics BIOC | Cloud compute volume creation attempt An attempt was made to create an EBS volume. | Informational | Cortex Cloud | AWS Audit Log | Defense Evasion, Collection |
| Analytics BIOC | Cloud instance creation attempt An attempt was made to create a cloud compute instance. | Informational | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Defense Evasion |
| Analytics BIOC | Cloud instance deletion attempt An attempt was made to delete a cloud compute instance. | Informational | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Defense Evasion |
| Analytics BIOC | Cloud snapshot created or modified A cloud identity has created or modified a cloud snapshot. | Informational | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Exfiltration, Defense Evasion, Collection |
| Analytics BIOC | EBS volume attachment attempt An attempt was made to attach an EBS volume to an EC2 instance. | Informational | Cortex Cloud | AWS Audit Log | Defense Evasion |
| Analytics BIOC | EBS volume detachment attempt An attempt was made to detach an AWS EBS volume from an EC2 instance. | Informational | Cortex Cloud | AWS Audit Log | Defense Evasion |