Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
5 detectors match the current filters. technique: T1204 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics | Multiple Rare LOLBIN Process Executions by User A user executed multiple living-off-the-land binary (LOLBIN) processes that are unusual for this user. This may be indicative of a compromised account. | Low | Identity Analytics | XDR Agent | Execution |
| Analytics | Multiple Rare Process Executions in Organization Multiple unusual processes were executed in the organization. This may be indicative of a compromised account. | Informational | Identity Analytics | XDR Agent | Execution |
| Analytics BIOC | Rare LOLBIN Process Execution by User A user executed a living-off-the-land binary (LOLBIN) process that is unusual for this user. This may be indicative of a compromised account. | Informational | Identity Analytics | XDR Agent | Execution |
| Analytics BIOC | Rare process execution by user An unusual process was executed by a user. This may be indicative of a compromised account. | Informational | Identity Analytics | XDR Agent | Execution |
| Analytics BIOC | Rare process execution in organization An unusual process was executed in the organization. This may be indicative of a compromised account. | Informational | Identity Analytics | XDR Agent | Execution |