Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
367 detectors match the current filters.
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Possible ARP reconnaissance The ARP binary could be used for network mapping (common with malware). | Informational | Platform Analytics | Process execution | Discovery |
| BIOC | Possible ARP reconnaissance via netdiscover Netdiscover is an active/passive ARP reconnaissance tool, which attackers may use to learn your network. | Informational | Platform Analytics | Process execution | Discovery |
| BIOC | Possible C2 via dnscat2 Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic. | High | Platform Analytics | Process execution | Execution |
| BIOC | Possible data destruction via dd Attackers may use dd to zero out or write random data to files. | Informational | Platform Analytics | Process execution | Impact |
| BIOC | Possible Firefox browser history and bookmarks collection via command-line tool Attackers may collect history and bookmarks details by accessing the Firefox database. | Medium | Platform Analytics | Process execution | Discovery |
| BIOC | Possible log destruction using the dd command Possible destruction of system log files using the dd command. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | Possible LSASS memory dump Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump. | High | Platform Analytics | Process execution | Credential Access |
| BIOC | Possible Oracle enumeration via Oscanner The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase. | Low | Platform Analytics | Process execution | Discovery |
| BIOC | Possible Oracle enumeration via tnscmd10g The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs. | Low | Platform Analytics | Process execution | Discovery |
| BIOC | Possible ping sweep Ping sweeps are useful tools that can detect which machines are up in the network and can be the step before lateral movement. | Medium | Platform Analytics | Process execution | Discovery |
| BIOC | Possible UAC bypass via Event Viewer Eventvwr.exe normally only spawns mmc.exe. Attackers may use it for bypassing UAC (User Account Control) by having it spawn a different process. | Medium | Platform Analytics | Process execution | Privilege Escalation |
| BIOC | Possible user enumeration via /etc/passwd Attackers may enumerate users by reading the /etc/passwd file. | Informational | Platform Analytics | Process execution | Discovery |
| BIOC | Possible user enumeration via finger The Linux 'finger' command performs user enumeration, which attackers may attempt to gather during the reconnaissance phase. | Informational | Platform Analytics | Process execution | Discovery |
| BIOC | Possible web shell command execution Possible command execution via a web shell for reconnaissance. | Informational | Platform Analytics | Process execution | Persistence |
| BIOC | Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory. | Informational | Platform Analytics | File | Persistence |
| BIOC | Potential Network Sniffing Network sniffing related processes were detected. | Informational | Platform Analytics | Process execution | Credential Access, Discovery |
| BIOC | Potential web shell installation A web-app script file was installed on a web server. This can indicate an installation of web shell. | Informational | Platform Analytics | File | Persistence |
| BIOC | PowerShell calling Invoke-Expression argument These PowerShell arguments are often used to run commands with malicious intent. | Informational | Platform Analytics | Process execution | Execution |
| BIOC | PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine. | Low | Platform Analytics | Process execution | Persistence |
| BIOC | PowerShell downloads files via BITS This PowerShell argument is often used to run commands with malicious intent. | Medium | Platform Analytics | Process execution | Persistence |
| BIOC | PowerShell dumps users and roles from Exchange server PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign). | Medium | Platform Analytics | Process execution | Discovery |
| BIOC | PowerShell is used to execute a CPL file Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | PowerShell is used to modify a timestamp Attackers may use PowerShell.exe to modify the timestamp of a file. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | PowerShell possibly attempting to execute as administrator This PowerShell argument is often used to run commands with malicious intent. | Informational | Platform Analytics | Process execution | Execution |
| BIOC | PowerShell reverse shell This rule looks for a PowerShell instance that is communicating over known Metasploit ports back to an attacker in cases of reverse shell. | Medium | Platform Analytics | Network | Execution |
| BIOC | PowerShell running with download in the command line PowerShell can be used to download malicious content from the internet. | Informational | Platform Analytics | Process execution | Execution |
| BIOC | PowerShell runs with known Mimikatz arguments These PowerShell arguments are often used to run commands with malicious intent while running Mimikatz, a credential harvesting tool. | Medium | Platform Analytics | Process execution | Credential Access |
| BIOC | PowerShell script executed from a temporary directory An attacker may try to avoid detection by executing a PowerShell script from a temporary directory. | Informational | Platform Analytics | Process execution | Collection |
| BIOC | Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence. | Low | Platform Analytics | Registry | Persistence |
| BIOC | Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Process attempts to kill a known security/AV tool This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection. | Medium | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Process calls ActiveX Object with a shell command This rule looks for ActiveX being used to run commands on a machine, seen in cases of evasive attacks. | Medium | Platform Analytics | Process execution | Execution |
| BIOC | Process changes the Windows logon text This registry key is used to display a legal notice when logging on to the computer. This is used by the DXXD ransomware to notify the user. | Medium | Platform Analytics | Registry | Impact |
| BIOC | Process requests the deletion of Windows Shadowcopies Ransomware and wipers may use the wmic.exe or vssadmin.exe utilities to delete or modify Shadowcopies (a Windows backup mechanism). | High | Platform Analytics | Process execution | Impact |
| BIOC | Process runs from the recycle bin Process running from the recycle bin. | Low | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Process runs with a double extension Look for executables with a common double extension. These are often used to disguise malware as some form of user content. | Medium | Platform Analytics | Process execution | Execution |
| BIOC | PsExec attempts to execute a command on a remote host PsExec is a SysInternals tool used to execute commands on remote hosts. | Informational | Platform Analytics | Network | Lateral Movement, Execution |
| BIOC | PsExec executed with plain-text credentials on the command line PsExec.exe is a Windows administrative tool, which may be used by adversaries to execute remote commands. | Informational | Platform Analytics | Process execution | Execution |
| BIOC | PsExec execution EulaAccepted flag added to the Registry PsExec is commonly used by malware for lateral movement, seeing this value in the Registry means that the user ran PsExec and approved the EULA either automatically or manually. | Informational | Platform Analytics | Registry | Lateral Movement, Execution |
| BIOC | PsExec runs with System privileges PsExec.exe is a Windows administrative tool, it can be used to elevate privileges and run other processes with NT/System privilege level. | Informational | Platform Analytics | Process execution | Privilege Escalation |
| BIOC | Psexesvc.exe executes a command from a remote host Psexesvc.exe executes to run a command received from a remote host via PsExec. | Informational | Platform Analytics | Process execution | Execution |
| BIOC | Pubprn.vbs signed script proxy execution Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions. | High | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Python script connecting to network Python scripts may be used by attackers to connect to their command-and-control infrastructure. | Medium | Platform Analytics | Process execution | Execution |
| BIOC | Query startup programs using wmic.exe Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system. | Informational | Platform Analytics | Process execution | Discovery, Execution |
| BIOC | Rar.exe execution with password protection parameters Rar.exe was executed with parameters indicating password protection of the output file. | Informational | Platform Analytics | Process execution | Collection |
| BIOC | RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0. | Low | Platform Analytics | Registry | Lateral Movement |
| BIOC | RDP connections enabled via Registry from a script host or rundll32.exe An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0. | Informational | Platform Analytics | Registry | Lateral Movement |
| BIOC | Reading .ssh files Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Reading the contents of /etc/mtab or /etc/fstab File read on /etc/mtab or /etc/fstab using the cat utility. | Informational | Platform Analytics | Process execution | Discovery |
| BIOC | Registry credentials extraction Attackers may extract credentials from the Registry using system commands. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host. | High | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec. | Low | Platform Analytics | Process execution | Execution |
| BIOC | Remote file copy Remote copy operation of a file using rsync or scp or sftp. | Informational | Platform Analytics | Process execution | Lateral Movement |
| BIOC | Remote RDP session enumeration via query.exe Attackers may use the built-in query.exe tool to enumerate remote sessions, using the session flag. | Informational | Platform Analytics | Process execution | Lateral Movement |
| BIOC | Remote RDP session enumeration via qwinsta.exe Attackers may use the built-in qwinsta.exe tool to enumerate remote sessions. | Informational | Platform Analytics | Process execution | Lateral Movement |
| BIOC | Remote system discovery Remote system discovery using a system utility. | Informational | Platform Analytics | Process execution | Discovery |
| BIOC | Reverse shell one-liner using a scripting engine An attacker may use scripting engines to execute code from the command line to open a reverse shell. | Informational | Platform Analytics | Process execution | Execution |
| BIOC | Reverse shell using PowerShell PowerShell can start a reverse shell console for attackers using these commands and take control of the machine. | Informational | Platform Analytics | Process execution | Execution |
| BIOC | Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Rubeus tool execution Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity. | High | Platform Analytics | Process execution | Execution |
| BIOC | Rundll32 loads a known abused DLL Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Rundll32.exe launches an executable using ordinal numbers argument Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection. | Medium | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Rundll32.exe was used to run JavaScript Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe. | Medium | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Rundll32.exe with 'main' as EntryPoint Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs. | Medium | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity. | Low | Platform Analytics | Process execution | Execution |
| BIOC | Screen capture via command-line tool Attackers may use the window system screen capture tool to collect screenshots. | Informational | Platform Analytics | Process execution | Collection |
| BIOC | Scripting engine creates a compressed file under a suspicious folder Attackers may compress data before exfiltrating it to reduce network bandwidth consumption; if a compressed file is placed in a suspicious folder, it may be due to malicious activity. | Informational | Platform Analytics | File | Collection |
| BIOC | Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | Scripting engine makes connections over DNS ports Scripting engine makes connections over DNS ports should not happen, as DNS traffic is typically managed by svchost and sometimes the browsers. Attackers are known to use DNS traffic to exfiltrate data and avoid detection. | Informational | Platform Analytics | Network | Exfiltration |
| BIOC | Scripting process reads Outlook data files Attackers may try to retrieve email data and sensitive information from .ost and .pst files. | Informational | Platform Analytics | File | Collection |
| BIOC | Security services stopped Attackers may stop security critical services to avoid possible detection of their activities. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Security Support Provider (SSP) registered via a registry key Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords. | Informational | Platform Analytics | Registry | Privilege Escalation |
| BIOC | SELinux was set to permissive mode SELinux was set to permissive mode using the "setenforce 0" command. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Setuid on file Setting user identification on an executable file causes it to run with the privileges of the owning user. | Informational | Platform Analytics | Process execution | Privilege Escalation |
| BIOC | Shared resource management discovery using wmic.exe Attackers may use wmic.exe to discover shared resource management information. | Informational | Platform Analytics | Process execution | Discovery, Execution |
| BIOC | SharpHound LDAP query SharpHound is a BloodHound ingestor that performs LDAP queries to enumerate Active Directory. | Medium | Platform Analytics | Windows event log | Discovery |
| BIOC | Shell binary copied to another location Attackers may try to evade detection by copying the shell binary to an innocent-looking name. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Shell History Access Access to files holding shell history information. | Informational | Platform Analytics | File | Credential Access, Collection |
| BIOC | Shell history access Attackers may search historical commands for credentials and information gathering. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Shell History Access Access to files holding shell history information. | Informational | Platform Analytics | Process execution | Credential Access, Collection |
| BIOC | Shim database file access An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence. | Informational | Platform Analytics | File | Persistence, Privilege Escalation |
| BIOC | Shim database registration via Registry Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Shutdown command issued This behavior is often observed by malware attempting to force a machine shutdown after a period of time once file encryption has completed. | Informational | Platform Analytics | Process execution | Impact |
| BIOC | Simulation activity by AttackIQ Simulation activity performed by AttackIQ agent. | Informational | Platform Analytics | File | Execution, Resource Development |
| BIOC | Simulation activity by Cymulate Simulation activity performed by Cymulate agent. | Informational | Platform Analytics | File | Execution, Resource Development |
| BIOC | Simulation activity by SafeBreach Simulation activity performed by a SafeBreach agent. | Informational | Platform Analytics | File | Execution, Resource Development |
| BIOC | SmartScreen disabled via Registry These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | SMB enumeration via command-line tool Attackers may use SMB enumeration to retrieve information about network shares, printers, and other resources. | Informational | Platform Analytics | Process execution | Discovery |
| BIOC | Socat/Netcat connects to TOR domain Unlikely behavior in standard systems. | Medium | Platform Analytics | Network | Command and Control |
| BIOC | Space after filename creation An attacker may append a space to the end of a filename to change how it's processed by the operating system. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | SSH key pair discovery Attackers may look for SSH key pairs using the find command. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Sudoers discovery Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges. | Informational | Platform Analytics | Process execution | Discovery, Privilege Escalation |
| BIOC | SunBurst Module loaded Sunburst malware hash loaded into SolarWinds.BusinessLayerHost.exe. | High | Platform Analytics | Module | Initial Access, Command and Control |
| BIOC | Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell). | Low | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Suspicious access to /etc/shadow Attackers may enumerate or modify user accounts by accessing the /etc/shadow file. | Informational | Platform Analytics | File | Discovery |
| BIOC | Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI). | Low | Platform Analytics | Module | Defense Evasion |
| BIOC | Suspicious debug file created in a temporary folder SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin. | High | Platform Analytics | File | Credential Access |
| BIOC | Suspicious DLL load using Control.exe This execution mechanism is known to be used by malware to load malicious DLLs. | Medium | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Suspicious executable created in a .NET directory Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe. | High | Platform Analytics | File | Defense Evasion |