Detectors

Type	Name	Severity	Module	Data source / event	ATT&CK
BIOC	Bypass UAC using the control.exe Registry key Control.exe is a Registry key known to be altered by attackers to allow themselves to run their malware with elevated privileges.	Medium	Platform Analytics	Registry	Privilege Escalation
BIOC	Bypass UAC using the IsolatedCommand Registry value IsolatedCommand is a Registry value known to be altered by attackers to allow themselves to run their malware with elevated privileges.	Medium	Platform Analytics	Registry	Privilege Escalation
BIOC	Bypassing Windows UAC using sysprep Attackers may use the sysprep.exe built-in Windows tools to bypass Windows UAC.	Informational	Platform Analytics	Process execution	Privilege Escalation
Analytics BIOC	Cached credentials discovery with cmdkey Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list.	Low	Platform Analytics	XDR Agent	Credential Access, Discovery
Analytics BIOC	Certutil pfx parsing Certutil was used to parse a pfx certificate file.	Low	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Change of sudo caching configuration Change of sudo caching configuration may have been intended to enable privilege escalation.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Privilege Escalation
BIOC	Changing permissions or ownership of a file or folder Changing the permissions or ownership of a file or folder can be done to get access to sensitive data.	Informational	Platform Analytics	Process execution	Defense Evasion
Correlation Rule	Chrome - Chrome Extension Install Event The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username	Low	Platform Analytics	google_workspace_chrome_raw	Persistence
Correlation Rule	Chrome - Known Malicious Site Visit Unsafe site $xdm.network.http.url was visited by $xdm.source.user.username via chrome profile $xdm.intermediate.user.username.	Medium	Platform Analytics	google_workspace_chrome_raw
Correlation Rule	Chrome - Known Malware Downloaded User $xdm.source.user.username downloaded the file $xdm.target.file.filename via chrome profile $$xdm.intermediate.user.username on $xdm.source.host.hostname.	Medium	Platform Analytics	google_workspace_chrome_raw	Execution
Correlation Rule	Chrome - User Phished and/or Password Re-use/Breach event The user $xdm.source.user.username had $xdm.event.type event via $xdm.intermediate.user.username chrome profile, which resulted in $xdm.observer.action.	Medium	Platform Analytics	google_workspace_chrome_raw	Initial Access
BIOC	Chrome launched in Incognito mode May be used to cover up malware or malicious insider activity.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.	Low	Platform Analytics	Process execution	Persistence
BIOC	Clear event logging policy using auditpol.exe Attackers may clear Windows Event Logging policies using auditpol.exe.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Clear logs - using dd and /dev/null Usage of the dd utility to clear the contents of a file using /dev/null.	Medium	Platform Analytics	Process execution	Defense Evasion
BIOC	Clearing logs by copying /dev/null to a log file Usage of the cp command to copy /dev/null to a file and clear its content.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Clearing logs by executing cat /dev/null Usage of cat /dev/null to clear the contents of a log file.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Cleartext password harvesting using find tools On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords.	Informational	Platform Analytics	Process execution	Credential Access
Analytics BIOC	ClickFix - PowerShell executed through the run application An attacker may be trying to trick a user to execute PowerShell through the run application.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Initial Access
BIOC	Collecting audio via PowerShell command An attacker may collect audio from the microphone using PowerShell.	Low	Platform Analytics	Process execution	Collection
Analytics BIOC	Collection error A collection error was detected.	High	Platform Analytics	Health Monitoring Data	Impact
BIOC	Command enumeration via sudo The 'sudo -l' command was executed to enumerate commands that can be executed by a user.	Informational	Platform Analytics	Process execution	Privilege Escalation
Analytics BIOC	Command execution in a Kubernetes pod Container administration commands were executed within a Kubernetes pod.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Command execution via wmiexec Attackers may use WMI to execute commands on the target host.	Informational	Platform Analytics	XDR Agent	Execution
Analytics BIOC	Command running with COMSPEC in the command line argument COMSPEC is an environmental variable that points to cmd.exe. Attackers may use this command to obfuscate their command and avoid detection.	Low	Platform Analytics	XDR Agent	Execution
BIOC	Command-line arguments match Mimikatz execution These command-line arguments are often used by Mimikatz to dump credentials.	High	Platform Analytics	Process execution	Credential Access
BIOC	Command-line creation of a RAR archive Compression of data into a RAR archive using the rar.exe utility.	Informational	Platform Analytics	Process execution	Collection
BIOC	Common Apple process name missing Apple digital signature These common Apple process names should normally be signed with the Apple Inc. digital signature. Naming processes with common names is a common way attackers obfuscate their activities.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Common Mozilla process name missing Mozilla digital certificate These common Mozilla process names should normally be signed with the Mozilla Corporation digital signature. Naming processes with common names is a common way attackers obfuscate their activities.	Informational	Platform Analytics	Process execution	Defense Evasion
Analytics BIOC	Common third-party software name masquerading An attacker might leverage common third-party software image names to run malicious processes without being caught.	Informational	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Commonly abused AutoIT script connects to a remote host AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.	Low	Platform Analytics	Network	Exfiltration
Analytics BIOC	Commonly abused AutoIT script connects to an external domain AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.	Medium	Platform Analytics	XDR Agent	Exfiltration, Execution
Analytics BIOC	Commonly abused AutoIT script drops an executable file to disk AutoIT scripts have legitimate uses but are often abused by malware to execute in a signed process context.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution
BIOC	Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique.	Informational	Platform Analytics	Process execution	Persistence
BIOC	Commonly abused process executed with obfuscated characters Commonly abused process executed with obfuscated characters.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Commonly abused process executes by a remote host using PsExec This commonly abused shell/host process was spawned by psexesvc.exe, indicating it was called by a remote host via PsExec.	Informational	Platform Analytics	Process execution	Lateral Movement, Execution
Analytics BIOC	Commonly abused process launched as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.	Informational	Platform Analytics	XDR Agent	Execution
BIOC	Commonly abused process launches as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.	Informational	Platform Analytics	Process execution	Execution
BIOC	Commonly abused process spawns from Scripted Diagnostics Host This Scripted Diagnostics Host (sdiagnhost.exe) process has been observed launching a commonly abused host process. This behavior is known to be associated with an exploitation technique designed to deliver a malicious payload, often via a weaponized document. https://www.proofpoint.com/us/threat-insight/post/windows-troubleshooting-platform-leveraged-deliver-malware.	Informational	Platform Analytics	Process execution	Execution
BIOC	Commonly abused process spawns out of rundll32.exe This type of execution happens in .dll based attacks.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Compiled HTML (help file) makes network connections Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload.	Informational	Platform Analytics	Network	Defense Evasion
BIOC	Compiler process started by an Office process The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine.	Informational	Platform Analytics	Process execution	Defense Evasion
BIOC	Compressed archive created using tar Attackers may use the tar built-in tool to stage a file for exfiltration.	Informational	Platform Analytics	Process execution	Collection
Analytics BIOC	Compressing data using python Usage of a Python module to compress files.	Low	Platform Analytics	XDR Agent	Collection
Analytics BIOC	Conhost.exe spawned a suspicious cmd process Attackers may abuse the conhost process to execute malicious files and evade detection.	Low	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Contained process execution with a rare GitHub URL A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads.	Low	Platform Analytics	XDR Agent	Execution
BIOC	Container enumeration An attacker may run a command to enumerate containers on a machine.	Informational	Platform Analytics	Process execution	Discovery
Analytics BIOC	Copy a process memory file Copy a process memory file using the dd utility.	High	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Copy a user's GnuPG directory with rsync Copy a user's GnuPG (.gnupg) directory on to a staging folder using the 'find' and 'rsync' commands.	Low	Platform Analytics	XDR Agent	Credential Access
Analytics BIOC	Correlation rule error An error was identified while running a correlation rule.	Medium	Platform Analytics	Health Monitoring Data	Impact
BIOC	Creation of a new Microsoft Office default template Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.	Informational	Platform Analytics	File	Persistence
BIOC	Creation of volume shadow copy using vssadmin.exe An attacker may create volume shadow copies to gain access to protected or locked files, whereas backup is the common legitimate use.	Informational	Platform Analytics	Process execution	Credential Access
Analytics BIOC	Creation or modification of the default command executed when opening an application Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Privilege Escalation
BIOC	Credential dumping via fgdump.exe Attackers may use fgdump.exe to perform local credential dumping.	Medium	Platform Analytics	Process execution	Credential Access
BIOC	Credential dumping via gsecdump.exe Attackers may use gsecdump to obtain password hashes and LSA secrets.	Medium	Platform Analytics	Process execution	Credential Access
BIOC	Credential dumping via LaZagne LaZagne has been executed. Attackers may use this tool to gather account and password information from credential dumping.	High	Platform Analytics	Process execution	Credential Access
BIOC	Credential dumping via pwdumpx.exe Attackers may use pwdumpx.exe to perform local or remote credential dumping.	Medium	Platform Analytics	Process execution	Credential Access
BIOC	Credential dumping via wce.exe Attackers may use wce.exe (Windows Credential Editor) to obtain user credentials.	Medium	Platform Analytics	Process execution	Credential Access
BIOC	Credential Vault command-line access The Credential Vault command line was used to enumerate a user's saved credentials.	Medium	Platform Analytics	Process execution	Credential Access
BIOC	Credentials from Web Browsers Detects attempt to copy browser files to acquire credentials.	Informational	Platform Analytics	Process execution	Credential Access
BIOC	Curl connects to an external network Curl is a command-line utility used to transfer data. Attackers may use curl to exfiltrate data outside your organization.	Informational	Platform Analytics	Network	Exfiltration
Correlation Rule	CyberArk Failed Logins This correlation rule will trigger in an event in which 4 or more Failed Logins events occurred from a single user during a 10 minutes timeframe.	Medium	Platform Analytics	cyberark_identity_raw
BIOC	Data destruction using sdelete.exe Attackers may use sdelete.exe to delete files from the target host.	Informational	Platform Analytics	Process execution	Defense Evasion, Impact
Analytics BIOC	Delayed Deletion of Files A command line deleting files used the time-out or ping commands to delay the file deletion. This is suspicious, as malware sometimes uses these techniques to cover their tracks.	Low	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Delete Volume USN Journal with fsutil This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.	Medium	Platform Analytics	Process execution	Defense Evasion
BIOC	Direct access to free online DNS servers Online DNS servers are often used to bypass the company's internal DNS servers and evade detection.	Informational	Platform Analytics	Network	Command and Control
Analytics BIOC	Disable Microsoft Defender Antivirus via registry Disable Microsoft Defender Antivirus via registry.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion
BIOC	Disable outlook security via Registry Attackers may try to disable outlook security features by modifying the Registry.	Informational	Platform Analytics	Registry	Defense Evasion
BIOC	Disabling Windows Defender via Registry Windows Defender stores its configuration in the Registry. By modifying these values, an attacker can disable security features.	Informational	Platform Analytics	Registry	Defense Evasion
BIOC	Discovery of files with setgid or setuid bits Attackers may try to locate files with setgid or setuid bits set to escalate privileges.	Informational	Platform Analytics	Process execution	Privilege Escalation
Analytics BIOC	Discovery of host users via WMIC Attackers may use wmic.exe to list the users of a host, and potentially its owner.	Informational	Platform Analytics	XDR Agent	Discovery
Analytics BIOC	Discovery of misconfigured certificate templates using LDAP An LDAP query searching for misconfigured certificate templates was executed.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Discovery
BIOC	DLL sideloading attack using Xwizard Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.	Low	Platform Analytics	Process execution	Defense Evasion
BIOC	DNS reconnaissance or enumeration via DNSRecon DNSRecon enables DNS reconnaissance and enumeration, and may be used by attackers to learn about targets' network infrastructure.	Medium	Platform Analytics	Process execution	Discovery
BIOC	DNS resolution to the Palo Alto Networks sinkhole DNS resolution to the Palo Alto Networks sinkhole.	Informational	Platform Analytics	Network	Command and Control
Analytics	DNS Tunneling 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. The endpoint may be remotely controlled by an attacker, and/or an attacker may have exfiltrated data from it. This detector is not supported when networking events arrive solely from Cortex XDR Linux agents.	Low	Platform Analytics	Palo Alto Networks Firewall EAL Logs, XDR Agent	Command and Control, Exfiltration
BIOC	Document discovery Attackers may use the find command to look for documents.	Informational	Platform Analytics	Process execution	Discovery
Analytics BIOC	Download a script using the python requests module Download a shell script from a remote location using the Python requests module.	Low	Platform Analytics	XDR Agent	Execution
Analytics	Download pattern that resembles Peer to Peer traffic A possible P2P protocol was spotted from an internal host.	Informational	Platform Analytics	Palo Alto Networks Firewall traffic Logs, XDR Agent	Command and Control, Initial Access
BIOC	Driver written to a temporary directory Drivers are highly unlikely to be written or moved to a temp directory. Check whether this driver is legitimate.	Informational	Platform Analytics	File	Defense Evasion
Correlation Rule	DropBox - Massive File Alterations This rule detects more than 100 edited files during an hour by the same user. This is a suspicious behavior which can be an indication of a ransomware attack.	High	Platform Analytics	dropbox_dropbox_raw	Impact
Correlation Rule	DropBox - Massive File Downloads This rule detects more than 100 downloaded files during an hour by the same user. This is a suspicious behavior which can be an indication of a data exfiltration.	Medium	Platform Analytics	dropbox_dropbox_raw	Exfiltration
Analytics BIOC	DSC (Desired State Configuration) lateral movement using PowerShell An attacker is using the DSC feature with PowerShell to remotely modify / execute content / components on the machine.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Lateral Movement, Execution
BIOC	Dumping lsass.exe memory for credential extraction Dumping lsass.exe memory to a file allows attackers to later extract credentials from the dumped memory.	Medium	Platform Analytics	Process execution	Credential Access
BIOC	Dumping Registry hives with passwords Dumping registry hives can be used to obtain stored credentials/hashes.	Low	Platform Analytics	Process execution	Credential Access
Analytics BIOC	Elevation to SYSTEM via services Services were affected by a non SYSTEM integrity level process.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Execution, Privilege Escalation
Analytics BIOC	Encoded information using Windows certificate management tool Encoding/decoding to/from using certutil.exe could be used to evade detection.	Medium	Platform Analytics	XDR Agent	Defense Evasion
BIOC	Encoded VBScript executed Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding.	High	Platform Analytics	Process execution	Execution, Defense Evasion
BIOC	Encrypted zip archive creation Attackers may stage information for exfiltration by encrypting it beforehand in a zip archive.	Informational	Platform Analytics	Process execution	Collection
BIOC	Enumeration command called by commonly abused CGO Some malware uses these commands for reconnaissance.	Informational	Platform Analytics	Process execution	Discovery
BIOC	Enumeration of installed AV or FW products using WMIC Attackers often check for the existence of security tools before launching an attack, and this is one of the methods that can be used.	Informational	Platform Analytics	Process execution	Discovery
BIOC	Enumeration of services via WMIC Attackers may enumerate existing services using wmic.exe.	Informational	Platform Analytics	Process execution	Discovery, Execution
BIOC	Enumeration of Windows services from public IP addresses Attackers may enumerate internet-facing services which use Windows protocols; as these services were not meant to be exposed to the internet, they may be attacked by enumerating users, brute-forcing passwords and through exploits.	Informational	Platform Analytics	Dml connection	Discovery
Analytics BIOC	Error in event forwarding An error was detected in event forwarding.	Medium	Platform Analytics	Health Monitoring Data	Impact
BIOC	Evasion using time-based properties Attackers may check Event Log to evade virtualized environments.	Informational	Platform Analytics	Process execution	Defense Evasion, Discovery
BIOC	EventLog service disabled by a Registry operation A Registry set-value operation that disables the EventLog service was executed on the machine.	High	Platform Analytics	Registry	Defense Evasion
BIOC	Excel Web Query file created on disk Excel uses Excel Web Query (.iqy) files to download data from the internet. There are campaigns in which .iqy files download a PowerShell script, which is launched via Excel and kicks off a chain of malicious downloads.	Informational	Platform Analytics	File	Initial Access
BIOC	Exchange process writing aspx files An exchange process is writing to .aspx files. This may be an actor dropping web shells.	High	Platform Analytics	File	Initial Access, Command and Control
BIOC	Executable copied to remote host via admin share An executable file was written to a remote host's shared system folder (such as c:\ or c:\windows) from an unsigned CGO process.	Informational	Platform Analytics	File	Lateral Movement
Analytics BIOC	Executable created to disk by lsass.exe Lsass.exe does not normally create executables to disk. This activity was seen as part of several exploits, like EternalBlue and DoublePulsar, used during the WannaCry attacks.	Medium	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion

BIOC

Bypass UAC using the control.exe Registry key Control.exe is a Registry key known to be altered by attackers to allow themselves to run their malware with elevated privileges.

Medium

Platform Analytics

Registry

Privilege Escalation

BIOC

Bypass UAC using the IsolatedCommand Registry value IsolatedCommand is a Registry value known to be altered by attackers to allow themselves to run their malware with elevated privileges.

Medium

Platform Analytics

Registry

Privilege Escalation

BIOC

Bypassing Windows UAC using sysprep Attackers may use the sysprep.exe built-in Windows tools to bypass Windows UAC.

Informational

Platform Analytics

Process execution

Privilege Escalation

Analytics BIOC

Cached credentials discovery with cmdkey Cmdkey is a built-in Windows tool that can cache domain user credentials for use on specific target machines, Attackers can access cached user credentials using cmdkey /list.

Low

Platform Analytics

XDR Agent

Credential Access, Discovery

Analytics BIOC

Certutil pfx parsing Certutil was used to parse a pfx certificate file.

Low

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Change of sudo caching configuration Change of sudo caching configuration may have been intended to enable privilege escalation.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion, Privilege Escalation

BIOC

Changing permissions or ownership of a file or folder Changing the permissions or ownership of a file or folder can be done to get access to sensitive data.

Informational

Platform Analytics

Process execution

Defense Evasion

Correlation Rule

Chrome - Chrome Extension Install Event The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username

Low

Platform Analytics

google_workspace_chrome_raw

Persistence

Correlation Rule

Chrome - Known Malicious Site Visit Unsafe site $xdm.network.http.url was visited by $xdm.source.user.username via chrome profile $xdm.intermediate.user.username.

Medium

Platform Analytics

google_workspace_chrome_raw

Correlation Rule

Chrome - Known Malware Downloaded User $xdm.source.user.username downloaded the file $xdm.target.file.filename via chrome profile $$xdm.intermediate.user.username on $xdm.source.host.hostname.

Medium

Platform Analytics

google_workspace_chrome_raw

Execution

Correlation Rule

Chrome - User Phished and/or Password Re-use/Breach event The user $xdm.source.user.username had $xdm.event.type event via $xdm.intermediate.user.username chrome profile, which resulted in $xdm.observer.action.

Medium

Platform Analytics

google_workspace_chrome_raw

Initial Access

BIOC

Chrome launched in Incognito mode May be used to cover up malware or malicious insider activity.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.

Low

Platform Analytics

Process execution

Persistence

BIOC

Clear event logging policy using auditpol.exe Attackers may clear Windows Event Logging policies using auditpol.exe.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Clear logs - using dd and /dev/null Usage of the dd utility to clear the contents of a file using /dev/null.

Medium

Platform Analytics

Process execution

Defense Evasion

BIOC

Clearing logs by copying /dev/null to a log file Usage of the cp command to copy /dev/null to a file and clear its content.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Clearing logs by executing cat /dev/null Usage of cat /dev/null to clear the contents of a log file.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Cleartext password harvesting using find tools On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords.

Informational

Platform Analytics

Process execution

Credential Access

Analytics BIOC

ClickFix - PowerShell executed through the run application An attacker may be trying to trick a user to execute PowerShell through the run application.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Initial Access

BIOC

Collecting audio via PowerShell command An attacker may collect audio from the microphone using PowerShell.

Low

Platform Analytics

Process execution

Collection

Analytics BIOC

Collection error A collection error was detected.

High

Platform Analytics

Health Monitoring Data

Impact

BIOC

Command enumeration via sudo The 'sudo -l' command was executed to enumerate commands that can be executed by a user.

Informational

Platform Analytics

Process execution

Privilege Escalation

Analytics BIOC

Command execution in a Kubernetes pod Container administration commands were executed within a Kubernetes pod.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Command execution via wmiexec Attackers may use WMI to execute commands on the target host.

Informational

Platform Analytics

XDR Agent

Execution

Analytics BIOC

Command running with COMSPEC in the command line argument COMSPEC is an environmental variable that points to cmd.exe. Attackers may use this command to obfuscate their command and avoid detection.

Low

Platform Analytics

XDR Agent

Execution

BIOC

Command-line arguments match Mimikatz execution These command-line arguments are often used by Mimikatz to dump credentials.

High

Platform Analytics

Process execution

Credential Access

BIOC

Command-line creation of a RAR archive Compression of data into a RAR archive using the rar.exe utility.

Informational

Platform Analytics

Process execution

Collection

BIOC

Common Apple process name missing Apple digital signature These common Apple process names should normally be signed with the Apple Inc. digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Common Mozilla process name missing Mozilla digital certificate These common Mozilla process names should normally be signed with the Mozilla Corporation digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

Informational

Platform Analytics

Process execution

Defense Evasion

Analytics BIOC

Common third-party software name masquerading An attacker might leverage common third-party software image names to run malicious processes without being caught.

Informational

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Commonly abused AutoIT script connects to a remote host AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

Low

Platform Analytics

Network

Exfiltration

Analytics BIOC

Commonly abused AutoIT script connects to an external domain AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

Medium

Platform Analytics

XDR Agent

Exfiltration, Execution

Analytics BIOC

Commonly abused AutoIT script drops an executable file to disk AutoIT scripts have legitimate uses but are often abused by malware to execute in a signed process context.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution

BIOC

Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique.

Informational

Platform Analytics

Process execution

Persistence

BIOC

Commonly abused process executed with obfuscated characters Commonly abused process executed with obfuscated characters.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Commonly abused process executes by a remote host using PsExec This commonly abused shell/host process was spawned by psexesvc.exe, indicating it was called by a remote host via PsExec.

Informational

Platform Analytics

Process execution

Lateral Movement, Execution

Analytics BIOC

Commonly abused process launched as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.

Informational

Platform Analytics

XDR Agent

Execution

BIOC

Commonly abused process launches as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.

Informational

Platform Analytics

Process execution

Execution

BIOC

Commonly abused process spawns from Scripted Diagnostics Host This Scripted Diagnostics Host (sdiagnhost.exe) process has been observed launching a commonly abused host process. This behavior is known to be associated with an exploitation technique designed to deliver a malicious payload, often via a weaponized document. https://www.proofpoint.com/us/threat-insight/post/windows-troubleshooting-platform-leveraged-deliver-malware.

Informational

Platform Analytics

Process execution

Execution

BIOC

Commonly abused process spawns out of rundll32.exe This type of execution happens in .dll based attacks.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Compiled HTML (help file) makes network connections Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload.

Informational

Platform Analytics

Network

Defense Evasion

BIOC

Compiler process started by an Office process The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine.

Informational

Platform Analytics

Process execution

Defense Evasion

BIOC

Compressed archive created using tar Attackers may use the tar built-in tool to stage a file for exfiltration.

Informational

Platform Analytics

Process execution

Collection

Analytics BIOC

Compressing data using python Usage of a Python module to compress files.

Low

Platform Analytics

XDR Agent

Collection

Analytics BIOC

Conhost.exe spawned a suspicious cmd process Attackers may abuse the conhost process to execute malicious files and evade detection.

Low

Platform Analytics

XDR Agent

Defense Evasion

Analytics BIOC

Contained process execution with a rare GitHub URL A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads.

Low

Platform Analytics

XDR Agent

Execution

BIOC

Container enumeration An attacker may run a command to enumerate containers on a machine.

Informational

Platform Analytics

Process execution

Discovery

Analytics BIOC

Copy a process memory file Copy a process memory file using the dd utility.

High

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Copy a user's GnuPG directory with rsync Copy a user's GnuPG (.gnupg) directory on to a staging folder using the 'find' and 'rsync' commands.

Low

Platform Analytics

XDR Agent

Credential Access

Analytics BIOC

Correlation rule error An error was identified while running a correlation rule.

Medium

Platform Analytics

Health Monitoring Data

Impact

BIOC

Creation of a new Microsoft Office default template Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.

Informational

Platform Analytics

File

Persistence

BIOC

Creation of volume shadow copy using vssadmin.exe An attacker may create volume shadow copies to gain access to protected or locked files, whereas backup is the common legitimate use.

Informational

Platform Analytics

Process execution

Credential Access

Analytics BIOC

Creation or modification of the default command executed when opening an application Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Privilege Escalation

BIOC

Credential dumping via fgdump.exe Attackers may use fgdump.exe to perform local credential dumping.

Medium

Platform Analytics

Process execution

Credential Access

BIOC

Credential dumping via gsecdump.exe Attackers may use gsecdump to obtain password hashes and LSA secrets.

Medium

Platform Analytics

Process execution

Credential Access

BIOC

Credential dumping via LaZagne LaZagne has been executed. Attackers may use this tool to gather account and password information from credential dumping.

High

Platform Analytics

Process execution

Credential Access

BIOC

Credential dumping via pwdumpx.exe Attackers may use pwdumpx.exe to perform local or remote credential dumping.

Medium

Platform Analytics

Process execution

Credential Access

BIOC

Credential dumping via wce.exe Attackers may use wce.exe (Windows Credential Editor) to obtain user credentials.

Medium

Platform Analytics

Process execution

Credential Access

BIOC

Credential Vault command-line access The Credential Vault command line was used to enumerate a user's saved credentials.

Medium

Platform Analytics

Process execution

Credential Access

BIOC

Credentials from Web Browsers Detects attempt to copy browser files to acquire credentials.

Informational

Platform Analytics

Process execution

Credential Access

BIOC

Curl connects to an external network Curl is a command-line utility used to transfer data. Attackers may use curl to exfiltrate data outside your organization.

Informational

Platform Analytics

Network

Exfiltration

Correlation Rule

CyberArk Failed Logins This correlation rule will trigger in an event in which 4 or more Failed Logins events occurred from a single user during a 10 minutes timeframe.

Medium

Platform Analytics

cyberark_identity_raw

BIOC

Data destruction using sdelete.exe Attackers may use sdelete.exe to delete files from the target host.

Informational

Platform Analytics

Process execution

Defense Evasion, Impact

Analytics BIOC

Delayed Deletion of Files A command line deleting files used the time-out or ping commands to delay the file deletion. This is suspicious, as malware sometimes uses these techniques to cover their tracks.

Low

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Delete Volume USN Journal with fsutil This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.

Medium

Platform Analytics

Process execution

Defense Evasion

BIOC

Direct access to free online DNS servers Online DNS servers are often used to bypass the company's internal DNS servers and evade detection.

Informational

Platform Analytics

Network

Command and Control

Analytics BIOC

Disable Microsoft Defender Antivirus via registry Disable Microsoft Defender Antivirus via registry.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion

BIOC

Disable outlook security via Registry Attackers may try to disable outlook security features by modifying the Registry.

Informational

Platform Analytics

Registry

Defense Evasion

BIOC

Disabling Windows Defender via Registry Windows Defender stores its configuration in the Registry. By modifying these values, an attacker can disable security features.

Informational

Platform Analytics

Registry

Defense Evasion

BIOC

Discovery of files with setgid or setuid bits Attackers may try to locate files with setgid or setuid bits set to escalate privileges.

Informational

Platform Analytics

Process execution

Privilege Escalation

Analytics BIOC

Discovery of host users via WMIC Attackers may use wmic.exe to list the users of a host, and potentially its owner.

Informational

Platform Analytics

XDR Agent

Discovery

Analytics BIOC

Discovery of misconfigured certificate templates using LDAP An LDAP query searching for misconfigured certificate templates was executed.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Discovery

BIOC

DLL sideloading attack using Xwizard Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.

Low

Platform Analytics

Process execution

Defense Evasion

BIOC

DNS reconnaissance or enumeration via DNSRecon DNSRecon enables DNS reconnaissance and enumeration, and may be used by attackers to learn about targets' network infrastructure.

Medium

Platform Analytics

Process execution

Discovery

BIOC

DNS resolution to the Palo Alto Networks sinkhole DNS resolution to the Palo Alto Networks sinkhole.

Informational

Platform Analytics

Network

Command and Control

Analytics

DNS Tunneling 10 KB or more were sent encoded in subdomain names during a 10-minute window. All subdomains queried were under a single suspicious domain. DNS tunneling encodes data in DNS queries and responses, allowing an attacker to bypass firewalls and proxies to reach his or her command and control server, even when HTTP/S traffic is blocked. The endpoint may be remotely controlled by an attacker, and/or an attacker may have exfiltrated data from it. This detector is not supported when networking events arrive solely from Cortex XDR Linux agents.

Low

Platform Analytics

Palo Alto Networks Firewall EAL Logs, XDR Agent

Command and Control, Exfiltration

BIOC

Document discovery Attackers may use the find command to look for documents.

Informational

Platform Analytics

Process execution

Discovery

Analytics BIOC

Download a script using the python requests module Download a shell script from a remote location using the Python requests module.

Low

Platform Analytics

XDR Agent

Execution

Analytics

Download pattern that resembles Peer to Peer traffic A possible P2P protocol was spotted from an internal host.

Informational

Platform Analytics

Palo Alto Networks Firewall traffic Logs, XDR Agent

Command and Control, Initial Access

BIOC

Driver written to a temporary directory Drivers are highly unlikely to be written or moved to a temp directory. Check whether this driver is legitimate.

Informational

Platform Analytics

File

Defense Evasion

Correlation Rule

DropBox - Massive File Alterations This rule detects more than 100 edited files during an hour by the same user. This is a suspicious behavior which can be an indication of a ransomware attack.

High

Platform Analytics

dropbox_dropbox_raw

Impact

Correlation Rule

DropBox - Massive File Downloads This rule detects more than 100 downloaded files during an hour by the same user. This is a suspicious behavior which can be an indication of a data exfiltration.

Medium

Platform Analytics

dropbox_dropbox_raw

Exfiltration

Analytics BIOC

DSC (Desired State Configuration) lateral movement using PowerShell An attacker is using the DSC feature with PowerShell to remotely modify / execute content / components on the machine.

Informational

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Lateral Movement, Execution

BIOC

Dumping lsass.exe memory for credential extraction Dumping lsass.exe memory to a file allows attackers to later extract credentials from the dumped memory.

Medium

Platform Analytics

Process execution

Credential Access

BIOC

Dumping Registry hives with passwords Dumping registry hives can be used to obtain stored credentials/hashes.

Low

Platform Analytics

Process execution

Credential Access

Analytics BIOC

Elevation to SYSTEM via services Services were affected by a non SYSTEM integrity level process.

Low

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Execution, Privilege Escalation

Analytics BIOC

Encoded information using Windows certificate management tool Encoding/decoding to/from using certutil.exe could be used to evade detection.

Medium

Platform Analytics

XDR Agent

Defense Evasion

BIOC

Encoded VBScript executed Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding.

High

Platform Analytics

Process execution

Execution, Defense Evasion

BIOC

Encrypted zip archive creation Attackers may stage information for exfiltration by encrypting it beforehand in a zip archive.

Informational

Platform Analytics

Process execution

Collection

BIOC

Enumeration command called by commonly abused CGO Some malware uses these commands for reconnaissance.

Informational

Platform Analytics

Process execution

Discovery

BIOC

Enumeration of installed AV or FW products using WMIC Attackers often check for the existence of security tools before launching an attack, and this is one of the methods that can be used.

Informational

Platform Analytics

Process execution

Discovery

BIOC

Enumeration of services via WMIC Attackers may enumerate existing services using wmic.exe.

Informational

Platform Analytics

Process execution

Discovery, Execution

BIOC

Enumeration of Windows services from public IP addresses Attackers may enumerate internet-facing services which use Windows protocols; as these services were not meant to be exposed to the internet, they may be attacked by enumerating users, brute-forcing passwords and through exploits.

Informational

Platform Analytics

Dml connection

Discovery

Analytics BIOC

Error in event forwarding An error was detected in event forwarding.

Medium

Platform Analytics

Health Monitoring Data

Impact

BIOC

Evasion using time-based properties Attackers may check Event Log to evade virtualized environments.

Informational

Platform Analytics

Process execution

Defense Evasion, Discovery

BIOC

EventLog service disabled by a Registry operation A Registry set-value operation that disables the EventLog service was executed on the machine.

High

Platform Analytics

Registry

Defense Evasion

BIOC

Excel Web Query file created on disk Excel uses Excel Web Query (.iqy) files to download data from the internet. There are campaigns in which .iqy files download a PowerShell script, which is launched via Excel and kicks off a chain of malicious downloads.

Informational

Platform Analytics

File

Initial Access

BIOC

Exchange process writing aspx files An exchange process is writing to .aspx files. This may be an actor dropping web shells.

High

Platform Analytics

File

Initial Access, Command and Control

BIOC

Executable copied to remote host via admin share An executable file was written to a remote host's shared system folder (such as c:\ or c:\windows) from an unsigned CGO process.

Informational

Platform Analytics

File

Lateral Movement

Analytics BIOC

Executable created to disk by lsass.exe Lsass.exe does not normally create executables to disk. This activity was seen as part of several exploits, like EternalBlue and DoublePulsar, used during the WannaCry attacks.

Medium

Platform Analytics

XDR Agent with eXtended Threat Hunting (XTH)

Defense Evasion