Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

367 detectors match the current filters.

Download CSV
Type Name Severity Module Data source / event ATT&CK
BIOC Possible ARP reconnaissance The ARP binary could be used for network mapping (common with malware). Informational Platform Analytics Process execution Discovery
BIOC Possible ARP reconnaissance via netdiscover Netdiscover is an active/passive ARP reconnaissance tool, which attackers may use to learn your network. Informational Platform Analytics Process execution Discovery
BIOC Possible C2 via dnscat2 Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic. High Platform Analytics Process execution Execution
BIOC Possible data destruction via dd Attackers may use dd to zero out or write random data to files. Informational Platform Analytics Process execution Impact
BIOC Possible Firefox browser history and bookmarks collection via command-line tool Attackers may collect history and bookmarks details by accessing the Firefox database. Medium Platform Analytics Process execution Discovery
BIOC Possible log destruction using the dd command Possible destruction of system log files using the dd command. Informational Platform Analytics File Defense Evasion
BIOC Possible LSASS memory dump Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump. High Platform Analytics Process execution Credential Access
BIOC Possible Oracle enumeration via Oscanner The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase. Low Platform Analytics Process execution Discovery
BIOC Possible Oracle enumeration via tnscmd10g The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs. Low Platform Analytics Process execution Discovery
BIOC Possible ping sweep Ping sweeps are useful tools that can detect which machines are up in the network and can be the step before lateral movement. Medium Platform Analytics Process execution Discovery
BIOC Possible UAC bypass via Event Viewer Eventvwr.exe normally only spawns mmc.exe. Attackers may use it for bypassing UAC (User Account Control) by having it spawn a different process. Medium Platform Analytics Process execution Privilege Escalation
BIOC Possible user enumeration via /etc/passwd Attackers may enumerate users by reading the /etc/passwd file. Informational Platform Analytics Process execution Discovery
BIOC Possible user enumeration via finger The Linux 'finger' command performs user enumeration, which attackers may attempt to gather during the reconnaissance phase. Informational Platform Analytics Process execution Discovery
BIOC Possible web shell command execution Possible command execution via a web shell for reconnaissance. Informational Platform Analytics Process execution Persistence
BIOC Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory. Informational Platform Analytics File Persistence
BIOC Potential Network Sniffing Network sniffing related processes were detected. Informational Platform Analytics Process execution Credential Access, Discovery
BIOC Potential web shell installation A web-app script file was installed on a web server. This can indicate an installation of web shell. Informational Platform Analytics File Persistence
BIOC PowerShell calling Invoke-Expression argument These PowerShell arguments are often used to run commands with malicious intent. Informational Platform Analytics Process execution Execution
BIOC PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine. Low Platform Analytics Process execution Persistence
BIOC PowerShell downloads files via BITS This PowerShell argument is often used to run commands with malicious intent. Medium Platform Analytics Process execution Persistence
BIOC PowerShell dumps users and roles from Exchange server PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign). Medium Platform Analytics Process execution Discovery
BIOC PowerShell is used to execute a CPL file Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution. Informational Platform Analytics Process execution Defense Evasion
BIOC PowerShell is used to modify a timestamp Attackers may use PowerShell.exe to modify the timestamp of a file. Informational Platform Analytics Process execution Defense Evasion
BIOC PowerShell possibly attempting to execute as administrator This PowerShell argument is often used to run commands with malicious intent. Informational Platform Analytics Process execution Execution
BIOC PowerShell reverse shell This rule looks for a PowerShell instance that is communicating over known Metasploit ports back to an attacker in cases of reverse shell. Medium Platform Analytics Network Execution
BIOC PowerShell running with download in the command line PowerShell can be used to download malicious content from the internet. Informational Platform Analytics Process execution Execution
BIOC PowerShell runs with known Mimikatz arguments These PowerShell arguments are often used to run commands with malicious intent while running Mimikatz, a credential harvesting tool. Medium Platform Analytics Process execution Credential Access
BIOC PowerShell script executed from a temporary directory An attacker may try to avoid detection by executing a PowerShell script from a temporary directory. Informational Platform Analytics Process execution Collection
BIOC Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence. Low Platform Analytics Registry Persistence
BIOC Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API. Informational Platform Analytics Registry Persistence
BIOC Process attempts to kill a known security/AV tool This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection. Medium Platform Analytics Process execution Defense Evasion
BIOC Process calls ActiveX Object with a shell command This rule looks for ActiveX being used to run commands on a machine, seen in cases of evasive attacks. Medium Platform Analytics Process execution Execution
BIOC Process changes the Windows logon text This registry key is used to display a legal notice when logging on to the computer. This is used by the DXXD ransomware to notify the user. Medium Platform Analytics Registry Impact
BIOC Process requests the deletion of Windows Shadowcopies Ransomware and wipers may use the wmic.exe or vssadmin.exe utilities to delete or modify Shadowcopies (a Windows backup mechanism). High Platform Analytics Process execution Impact
BIOC Process runs from the recycle bin Process running from the recycle bin. Low Platform Analytics Process execution Defense Evasion
BIOC Process runs with a double extension Look for executables with a common double extension. These are often used to disguise malware as some form of user content. Medium Platform Analytics Process execution Execution
BIOC PsExec attempts to execute a command on a remote host PsExec is a SysInternals tool used to execute commands on remote hosts. Informational Platform Analytics Network Lateral Movement, Execution
BIOC PsExec executed with plain-text credentials on the command line PsExec.exe is a Windows administrative tool, which may be used by adversaries to execute remote commands. Informational Platform Analytics Process execution Execution
BIOC PsExec execution EulaAccepted flag added to the Registry PsExec is commonly used by malware for lateral movement, seeing this value in the Registry means that the user ran PsExec and approved the EULA either automatically or manually. Informational Platform Analytics Registry Lateral Movement, Execution
BIOC PsExec runs with System privileges PsExec.exe is a Windows administrative tool, it can be used to elevate privileges and run other processes with NT/System privilege level. Informational Platform Analytics Process execution Privilege Escalation
BIOC Psexesvc.exe executes a command from a remote host Psexesvc.exe executes to run a command received from a remote host via PsExec. Informational Platform Analytics Process execution Execution
BIOC Pubprn.vbs signed script proxy execution Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions. High Platform Analytics Process execution Defense Evasion
BIOC Python script connecting to network Python scripts may be used by attackers to connect to their command-and-control infrastructure. Medium Platform Analytics Process execution Execution
BIOC Query startup programs using wmic.exe Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system. Informational Platform Analytics Process execution Discovery, Execution
BIOC Rar.exe execution with password protection parameters Rar.exe was executed with parameters indicating password protection of the output file. Informational Platform Analytics Process execution Collection
BIOC RDP connections enabled via Registry by unsigned process An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0. Low Platform Analytics Registry Lateral Movement
BIOC RDP connections enabled via Registry from a script host or rundll32.exe An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0. Informational Platform Analytics Registry Lateral Movement
BIOC Reading .ssh files Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers. Informational Platform Analytics Process execution Credential Access
BIOC Reading the contents of /etc/mtab or /etc/fstab File read on /etc/mtab or /etc/fstab using the cat utility. Informational Platform Analytics Process execution Discovery
BIOC Registry credentials extraction Attackers may extract credentials from the Registry using system commands. Informational Platform Analytics Process execution Credential Access
BIOC Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host. High Platform Analytics Process execution Defense Evasion
BIOC Remote command executed from a Linux host This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec. Low Platform Analytics Process execution Execution
BIOC Remote file copy Remote copy operation of a file using rsync or scp or sftp. Informational Platform Analytics Process execution Lateral Movement
BIOC Remote RDP session enumeration via query.exe Attackers may use the built-in query.exe tool to enumerate remote sessions, using the session flag. Informational Platform Analytics Process execution Lateral Movement
BIOC Remote RDP session enumeration via qwinsta.exe Attackers may use the built-in qwinsta.exe tool to enumerate remote sessions. Informational Platform Analytics Process execution Lateral Movement
BIOC Remote system discovery Remote system discovery using a system utility. Informational Platform Analytics Process execution Discovery
BIOC Reverse shell one-liner using a scripting engine An attacker may use scripting engines to execute code from the command line to open a reverse shell. Informational Platform Analytics Process execution Execution
BIOC Reverse shell using PowerShell PowerShell can start a reverse shell console for attackers using these commands and take control of the machine. Informational Platform Analytics Process execution Execution
BIOC Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Informational Platform Analytics Registry Defense Evasion
BIOC Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Informational Platform Analytics Process execution Defense Evasion
BIOC Rubeus tool execution Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity. High Platform Analytics Process execution Execution
BIOC Rundll32 loads a known abused DLL Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application. Informational Platform Analytics Process execution Defense Evasion
BIOC Rundll32.exe launches an executable using ordinal numbers argument Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection. Medium Platform Analytics Process execution Defense Evasion
BIOC Rundll32.exe was used to run JavaScript Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe. Medium Platform Analytics Process execution Defense Evasion
BIOC Rundll32.exe with 'main' as EntryPoint Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs. Medium Platform Analytics Process execution Defense Evasion
BIOC Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity. Low Platform Analytics Process execution Execution
BIOC Screen capture via command-line tool Attackers may use the window system screen capture tool to collect screenshots. Informational Platform Analytics Process execution Collection
BIOC Scripting engine creates a compressed file under a suspicious folder Attackers may compress data before exfiltrating it to reduce network bandwidth consumption; if a compressed file is placed in a suspicious folder, it may be due to malicious activity. Informational Platform Analytics File Collection
BIOC Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file. Informational Platform Analytics File Defense Evasion
BIOC Scripting engine makes connections over DNS ports Scripting engine makes connections over DNS ports should not happen, as DNS traffic is typically managed by svchost and sometimes the browsers. Attackers are known to use DNS traffic to exfiltrate data and avoid detection. Informational Platform Analytics Network Exfiltration
BIOC Scripting process reads Outlook data files Attackers may try to retrieve email data and sensitive information from .ost and .pst files. Informational Platform Analytics File Collection
BIOC Security services stopped Attackers may stop security critical services to avoid possible detection of their activities. Informational Platform Analytics Process execution Defense Evasion
BIOC Security Support Provider (SSP) registered via a registry key Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords. Informational Platform Analytics Registry Privilege Escalation
BIOC SELinux was set to permissive mode SELinux was set to permissive mode using the "setenforce 0" command. Informational Platform Analytics Process execution Defense Evasion
BIOC Setuid on file Setting user identification on an executable file causes it to run with the privileges of the owning user. Informational Platform Analytics Process execution Privilege Escalation
BIOC Shared resource management discovery using wmic.exe Attackers may use wmic.exe to discover shared resource management information. Informational Platform Analytics Process execution Discovery, Execution
BIOC SharpHound LDAP query SharpHound is a BloodHound ingestor that performs LDAP queries to enumerate Active Directory. Medium Platform Analytics Windows event log Discovery
BIOC Shell binary copied to another location Attackers may try to evade detection by copying the shell binary to an innocent-looking name. Informational Platform Analytics Process execution Defense Evasion
BIOC Shell History Access Access to files holding shell history information. Informational Platform Analytics File Credential Access, Collection
BIOC Shell history access Attackers may search historical commands for credentials and information gathering. Informational Platform Analytics Process execution Credential Access
BIOC Shell History Access Access to files holding shell history information. Informational Platform Analytics Process execution Credential Access, Collection
BIOC Shim database file access An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence. Informational Platform Analytics File Persistence, Privilege Escalation
BIOC Shim database registration via Registry Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry. Informational Platform Analytics Registry Persistence
BIOC Shutdown command issued This behavior is often observed by malware attempting to force a machine shutdown after a period of time once file encryption has completed. Informational Platform Analytics Process execution Impact
BIOC Simulation activity by AttackIQ Simulation activity performed by AttackIQ agent. Informational Platform Analytics File Execution, Resource Development
BIOC Simulation activity by Cymulate Simulation activity performed by Cymulate agent. Informational Platform Analytics File Execution, Resource Development
BIOC Simulation activity by SafeBreach Simulation activity performed by a SafeBreach agent. Informational Platform Analytics File Execution, Resource Development
BIOC SmartScreen disabled via Registry These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality. Informational Platform Analytics Registry Defense Evasion
BIOC SMB enumeration via command-line tool Attackers may use SMB enumeration to retrieve information about network shares, printers, and other resources. Informational Platform Analytics Process execution Discovery
BIOC Socat/Netcat connects to TOR domain Unlikely behavior in standard systems. Medium Platform Analytics Network Command and Control
BIOC Space after filename creation An attacker may append a space to the end of a filename to change how it's processed by the operating system. Informational Platform Analytics File Defense Evasion
BIOC SSH key pair discovery Attackers may look for SSH key pairs using the find command. Informational Platform Analytics Process execution Credential Access
BIOC Sudoers discovery Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges. Informational Platform Analytics Process execution Discovery, Privilege Escalation
BIOC SunBurst Module loaded Sunburst malware hash loaded into SolarWinds.BusinessLayerHost.exe. High Platform Analytics Module Initial Access, Command and Control
BIOC Suspicious .NET process spawns csc.exe A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell). Low Platform Analytics Process execution Defense Evasion
BIOC Suspicious access to /etc/shadow Attackers may enumerate or modify user accounts by accessing the /etc/shadow file. Informational Platform Analytics File Discovery
BIOC Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI). Low Platform Analytics Module Defense Evasion
BIOC Suspicious debug file created in a temporary folder SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin. High Platform Analytics File Credential Access
BIOC Suspicious DLL load using Control.exe This execution mechanism is known to be used by malware to load malicious DLLs. Medium Platform Analytics Process execution Defense Evasion
BIOC Suspicious executable created in a .NET directory Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe. High Platform Analytics File Defense Evasion