Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

895 detectors match the current filters.

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC Executable moved to Windows system folder An attacker may be trying to avoid detection by moving an executable to a Windows system folder. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Executable or Script file written by a web server process An uncommon executable or script file was created, written, or renamed by a web server process. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Initial Access, Persistence
Analytics BIOC Execution of an uncommon process at an early startup stage Uncommon execution of an executable found in an early startup stage. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Execution of an uncommon process at an early startup stage by Windows system binary Uncommon execution of an executable found in an early startup stage by Windows system binary. Low Platform Analytics XDR Agent Persistence
Analytics BIOC Execution of an uncommon process with a local/domain user SID at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage may be an indication of a persistent mechanism on boot that is being actively abused. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Execution of command from within a Kubernetes pod using kubelet credentials A command was executed from within a Kubernetes pod using Kubelet credentials. This activity allows an attacker to impersonate the node and perform privileged operations against the cluster API. Low Platform Analytics XDR Agent Privilege Escalation
BIOC Execution of commonly abused AutoIT script AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Execution of dllhost.exe with an empty command line The process dllhost.exe was executed with an empty command line. This behavior is suspicious, and may be caused by a malicious actor using 'Image File Execution Options' in the registry to evade detection. Low Platform Analytics XDR Agent Defense Evasion
BIOC Execution of Fsociety tool pack The Fsociety tool pack is an array of tools for information gathering, password attacks, exploitation, and more. Medium Platform Analytics Process execution Discovery, Credential Access
Analytics BIOC Execution of masqueraded third-party utility An attacker may be trying to avoid detection of third-party utility execution by renaming it. Informational Platform Analytics XDR Agent Defense Evasion
BIOC Execution of regsvcs/regasm with uncommon paths The regasm.exe/regsvcs.exe commands are used to register .NET COM assemblies, which are typically located in specific paths. Uncommon paths may indicate malicious code is being registered. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Execution of renamed lolbin An attacker may be trying to avoid detection of lolbin's execution using a renamed lolbin. Informational Platform Analytics XDR Agent Defense Evasion
BIOC Execution of WSL Distro Detecting a new instance execution of Windows Subsystem for Linux distro. Informational Platform Analytics File Defense Evasion
Analytics BIOC Extracting credentials from Unix files Suspicious Unix files containing insecurely stored credentials were accessed. Low Platform Analytics XDR Agent Credential Access
Analytics Failed Connections The endpoint has failed connections to other endpoints that have been inactive for more than 24 hours, or that Cortex XDR Analytics has never seen on the network. The endpoint has made an abnormally large number of these failed connections and/or is attempting to connect to an abnormal mixture of missing or inactive endpoints. Your network might contain legitimate scanners that could cause a false positive for this alert. Cortex XDR Analytics attempts to filter these out by checking if a scanner has been active for a long consecutive period of time. Consequently, if this alert is seen, it represents new activity on your network. An attacker may be trying to move laterally, or to scan different parts of the network to look for other endpoints that expose a specific service. Worms also perform a similar activity to automatically infect additional hosts in the network. Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls Discovery
Analytics Failed DNS The endpoint is performing DNS lookups that are failing at an excessively high rate when compared to its peer group. This alert might be symptomatic of malware that is trying to connect to its command and control (C2) servers. The attacker's C2 server runs on one or more domains that can eventually be identified and blacklisted. To avoid this, malware will sometimes use Domain Generation Algorithms (DGA) that produce many domain names every day. Because only a few of these domains are ever registered, the installed malware must blindly try to access each generated domain name in an effort to locate an active one. Low Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Command and Control
Analytics BIOC Failed Login For a Long Username With Special Characters A long username containing special characters failed to log in to the domain. Informational Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Initial Access
Analytics BIOC Failed Login For Locked-Out Account A locked-out user account (event ID 4725 or 4740) was used in a Kerberos TGT pre-authentication attempt. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Defense Evasion
BIOC File renamed to have a script extension Adversaries may create 'benign-looking' files, which are later used as malicious scripts by changing their extension. Informational Platform Analytics File Defense Evasion
BIOC File timestamp tampering An attacker may modify file timestamps by running the touch command to hide their activities. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC File transfer from unusual IP using known tools An adversary might use known tools to transfer tools/payloads into the compromised machine. Informational Platform Analytics XDR Agent Command and Control
BIOC Fltmc.exe used to unload filter driver Attackers can abuse the Filter Manager Control Program (fltMC.exe) to unload MiniFilter drivers, some of which may be used for activity monitoring. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Fodhelper.exe UAC bypass Attackers may use Fodhelper.exe to bypass UAC (User Account Control) by having it spawn their malicious process. Medium Platform Analytics XDR Agent Privilege Escalation
BIOC Fontdrvhost.exe makes network connections A remote code execution vulnerability(CVE-2020-1020) exists in the Windows Adobe Type Manager Library. Network activity of the vulnerable process fontdrvhost.exe can be a possible indicator of exploitation. Informational Platform Analytics Network Execution
BIOC Forensics Driver Loaded A forensics driver has been loaded. Informational Platform Analytics Module Collection, Credential Access
Analytics BIOC FTP Connection Using an Anonymous Login or Default Credentials An FTP connection using an anonymous login was detected. Low Platform Analytics Palo Alto Networks Firewall EAL Logs Initial Access, Credential Access
BIOC FTP/SSH client reads office files Seeing FTP/SSH related software accessing office files could be an indication of data exfiltration. Low Platform Analytics File Exfiltration
Correlation Rule Gitlab - User Permission Changed User''s permissions have changed from Guest to Owner Medium Platform Analytics gitlab_gitlab_raw
Analytics BIOC Globally uncommon high entropy module was loaded A module with high entropy and a globally uncommon hash was loaded. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Globally uncommon high entropy process was executed A process with high entropy and a globally uncommon hash was executed. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Globally uncommon image load from a signed process A signed process loaded a DLL that, on a global level, it usually doesn't load. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level. Informational Platform Analytics XDR Agent Defense Evasion, Persistence
Analytics BIOC Globally uncommon IP address by a common process (sha256) A process with a common sha256 connected to an external IP address that, on a global level, it usually doesn't connect to. Informational Platform Analytics XDR Agent Command and Control
Analytics BIOC Globally uncommon IP address connection from a signed process A signed process connected to an external IP address that, on a global level, it usually doesn't connect to. Informational Platform Analytics XDR Agent Defense Evasion, Command and Control
Analytics BIOC Globally uncommon process execution from a signed process A signed process has executed a process that, on a global level, it usually doesn't execute. Informational Platform Analytics XDR Agent Execution
Analytics BIOC Globally uncommon root domain from a signed process A signed process connected to an external domain that, on a global level, it usually doesn't connect to. Low Platform Analytics XDR Agent Defense Evasion, Command and Control
Analytics BIOC Globally uncommon root-domain port combination by a common process (sha256) A process with a common sha256 connected to an external domain in a specific port that, on a global level, it usually doesn't connect to. Informational Platform Analytics XDR Agent Command and Control
Analytics BIOC Globally uncommon root-domain port combination from a signed process A signed process connected to an external domain on a specific port that, on a global level, it usually doesn't connect to. Low Platform Analytics XDR Agent Defense Evasion, Command and Control
BIOC Gost tunneling execution Possible use of Gost (tunnel written in Golang) SSH tunnel. Medium Platform Analytics Process execution Command and Control
BIOC Grepping for passwords Attackers may look for cleartext passwords in files using the grep command. Informational Platform Analytics Process execution Credential Access
BIOC Group policy discovery using gpresult.exe Attackers may use gpresult.exe to gather information on Group Policy settings. Informational Platform Analytics Process execution Discovery
BIOC GUI Input Capture Prompt user to supply a password in response to a System Preference dialog pop up message. Informational Platform Analytics Process execution Credential Access
BIOC Hash cracking using Hashcat tool Hash cracking allows attackers to collect passwords and use them later on as part of their operation. Medium Platform Analytics Process execution Credential Access
Analytics BIOC Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms. Informational Platform Analytics XDR Agent Defense Evasion
BIOC Hidden directory creation Attackers may create hidden directories to hide malware or staged files. Informational Platform Analytics Process execution Defense Evasion
BIOC Hidden file and directory creation Creation of a hidden file inside a hidden directory. Informational Platform Analytics File Defense Evasion
Analytics HTTP with suspicious characteristics Uncommon HTTP communication was performed by the host that might indicate its attempt to hide malicious activities. Low Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Command and Control, Exfiltration
Analytics BIOC Hydra Password Brute-Force Tool Execution Attackers may use brute-force techniques to gain access to accounts when usernames and/or passwords are unknown. High Platform Analytics XDR Agent Credential Access
Analytics BIOC Image file execution options (IFEO) registry key set Attackers may use the Image File Execution Options Registry key to launch their executable whenever the user attempts to execute a certain executable. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Privilege Escalation, Persistence
BIOC Impersonation using Rubeus tool User authentication should not be impersonated, since this is considered a malicious behavior. Medium Platform Analytics Process execution Defense Evasion
Analytics BIOC Indicator blocking Auditing or logging configuration changes on Linux host. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Indirect command execution using the Program Compatibility Assistant Pcalua.exe (Program Compatibility Assistant) is used for running old programs that have compatibility issues. Attackers can use pcalua.exe to indirectly execute their malicious programs. Medium Platform Analytics XDR Agent Defense Evasion
BIOC Injection into ping.exe A process injected into an instance of ping.exe. Informational Platform Analytics Remote code Defense Evasion
Analytics BIOC Injection into rundll32.exe A process injected into an instance of rundll32.exe. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Installation of a new System-V service Installation of a new System-V service. Low Platform Analytics XDR Agent Persistence, Privilege Escalation
BIOC Installation of Cain & Abel password recovery tool A process created a Registry key associated with the common password cracking tool Cain & Abel. Low Platform Analytics Registry Credential Access
BIOC Installation of networking security tools A security or penetration testing tool such as wireshark and nmap is being installed. Informational Platform Analytics Process execution Discovery
Analytics BIOC Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation. Low Platform Analytics XDR Agent Execution, Privilege Escalation
BIOC Interface enumeration using netsh Attackers may enumerate existing network interfaces using netsh.exe. Informational Platform Analytics Process execution Discovery
BIOC Internet Explorer home page modification The Internet Explorer home page could be changed to a malicious page. Low Platform Analytics Registry Impact, Credential Access
BIOC Internet Explorer security settings modification The Security Settings Check feature, which checks Internet Explorer security settings to determine risk, was disabled. Informational Platform Analytics Registry Defense Evasion
Analytics BIOC Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host. Informational Platform Analytics XDR Agent Defense Evasion
BIOC ISO mounted manually A user manually mounted an ISO file. Informational Platform Analytics File Defense Evasion
BIOC Kerberos brute-force attack using Kerbrute This is a known Kerbrute tool command, used to conduct Kerberos authentication brute-force attacks. Informational Platform Analytics Process execution Credential Access
Analytics Kerberos Pre-Auth Failures by Host The endpoint failed an unusual number of Kerberos pre-authentications (TGT requests) from at least three users when compared to its baseline. This can indicate a password-spraying attack. Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Credential Access
Analytics Kerberos Pre-Auth Failures by User and Host The user account on this host failed Kerberos pre-authentications (TGT requests) an unusual number of times. This can indicate a Kerberos brute-force attack. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Credential Access
BIOC Kerberos service ticket request in PowerShell command Asking for a specific Kerberos service ticket can indicate an attacker's attempt to "Kerberoast" or use the ticket directly. High Platform Analytics Process execution Credential Access, Lateral Movement
BIOC Kerberos ticket forging using Impacket ticketer Suspected execution of Impacket's ticketer.py script for forging TGT/TGS Kerberos tickets. Medium Platform Analytics Process execution Defense Evasion, Privilege Escalation
Analytics BIOC Kerberos Traffic from Non-Standard Process The endpoint had a non-standard process communicating over ports normally used by Kerberos. An attacker might be using malicious tools to move laterally. Medium Platform Analytics XDR Agent Discovery
BIOC Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits. Informational Platform Analytics Process execution Persistence
BIOC Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits. Informational Platform Analytics Process execution Persistence
BIOC Key Certificate Search And Exfiltrate Possible attempt to search for key certificates and exfiltrate them. Informational Platform Analytics Process execution Credential Access
BIOC Keychain Certificate Access Detected access to Keychain certificates. Informational Platform Analytics Process execution Credential Access
BIOC Keychain Import Item An item was imported from the Keychain. Informational Platform Analytics Process execution Credential Access
BIOC Keychain Unlock Detected Keychain unlocking. Informational Platform Analytics Process execution Credential Access
Analytics BIOC Keylogging using system commands Usage of a Linux system utility to capture input. Low Platform Analytics XDR Agent Credential Access, Collection
Analytics BIOC Known service display name with uncommon image-path Service created with a known display name but has an uncommon image-path. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence, Execution
Analytics BIOC Known service name with an uncommon image-path A Service with a known service name has an uncommon image-path. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence, Execution
Analytics BIOC Kubelet server communication from a pod The Kubelet server was accessed from within a pod, which may indicate an attempt to escape container boundaries or escalate privileges. Informational Platform Analytics XDR Agent Privilege Escalation, Discovery
Analytics BIOC Kubernetes API server communication from within a pod The Kubernetes API server was accessed from within a pod. Informational Platform Analytics XDR Agent Discovery
Analytics Kubernetes environment enumeration activity Multiple resources within a Kubernetes cluster were enumerated. This may indicate an adversary attempting to map the Kubernetes environment and discover resources that may assist to perform additional attacks within the environment. Informational Platform Analytics XDR Agent Discovery
Analytics BIOC Kubernetes nsenter container escape The nsenter command was used to execute a process in the context of the initialization process. Informational Platform Analytics XDR Agent Privilege Escalation
Analytics BIOC Kubernetes secret enumeration activity Kubectl secret enumeration command was executed. Informational Platform Analytics XDR Agent Credential Access
Analytics BIOC Kubernetes version disclosure The Kubernetes API server was inquired about the Kubernetes version by a process from within a pod. Informational Platform Analytics XDR Agent Discovery
Analytics BIOC Kubernetes vulnerability scanner activity A Kubernetes cluster was scanned by a known vulnerability scanner. Medium Platform Analytics XDR Agent Execution, Discovery
Analytics Large Upload (FTP) The endpoint transferred an excessively large amounts of data to a single destination over FTP. Cortex XDR Analytics assumes endpoint traffic towards a specific destination should be about the same over long periods of time. For that reason, Cortex XDR detected this abnormal behavior of a large data upload. An attacker may be exfiltrating data directly to the internet using this protocol. Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Exfiltration
Analytics Large Upload (Generic) The endpoint transferred large amounts of data to an external site using a different protocol from HTTP/s, FTP, or SMTP. (A specific detector is used for each of those protocols.) Cortex XDR Analytics assumes that data transfers out of your network are ordinarily performed using one of those three services, so it expects that data transfers over all other ports to be low. For the same reason, Cortex XDR Analytics also assumes endpoint traffic towards a specific destination should be about the same over long periods of time. An attacker may be exfiltrating data directly to the internet. Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Exfiltration
Analytics Large Upload (HTTPS) The endpoint transferred an excessive amount of data to an external site over HTTPS. The destination is not a popular upload site for endpoints on your network, and the endpoint performing the upload has not previously downloaded a large amount of data from the site. The upload is considered excessive based on comparison to baseline measurements of HTTPS data transfers on your network. An attacker may be exfiltrating data directly to the internet. Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls Exfiltration
Analytics Large Upload (SMTP) The endpoint, which is not an internal SMTP server, emailed an excessive amount of data from your network. Low Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls Exfiltration
Analytics BIOC LDAP search query from an unpopular and unsigned process An unpopular and unsigned process performed an LDAP search query. This may be indicative of LDAP enumeration. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Discovery
Analytics BIOC LDAP traffic from non-standard process LDAP traffic is usually performed by a standard set of processes. The endpoint had a non-standard process communicating over ports normally used by LDAP. This may be indicative of Active Directory domain enumeration, which may be used during attacks against the organization. Informational Platform Analytics XDR Agent Discovery
Analytics BIOC Linux network share discovery An adversary might use known tools to discover SMB shares within the compromised network. Informational Platform Analytics XDR Agent Discovery
BIOC Linux network share discovery A Linux network share discovery command was executed. Informational Platform Analytics Process execution Discovery
Analytics BIOC Linux process execution with a rare GitHub URL A process was executed with an uncommon GitHub URL in its command line. This may have legitimate uses, but it might also be used by attackers to download malicious payloads. Informational Platform Analytics XDR Agent Execution
Analytics BIOC Linux system firewall was modified The system firewall was modified. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion
Analytics BIOC Local account discovery One of several local account discovery commands were executed. Informational Platform Analytics XDR Agent Discovery
Analytics BIOC Local group enumeration via RPC A user enumerated local groups via RPC. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Discovery
Analytics BIOC Local user enumeration via SAMR A user enumerated local users via SAMR. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Discovery
BIOC Log deletion in known log file directories Deletion of log files in known log directories. Informational Platform Analytics File Defense Evasion
BIOC Log deletion using the truncate command Usage of the truncate utility using "-s 0" argument to clear log files. Informational Platform Analytics Process execution Defense Evasion