Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

474 detectors match the current filters.

Download CSV
Type Name Severity Module Data source / event ATT&CK
BIOC 7z.exe execution with password protection parameters 7z.exe was executed with parameters indicating password protection of the output file. Informational Platform Analytics Process execution Collection
Analytics BIOC A browser extension was installed or loaded in an uncommon way A browser extension was installed or loaded in an uncommon way. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC A compressed file was exfiltrated over SSH Exfiltration of a compressed file over SSH. Informational Platform Analytics XDR Agent Exfiltration
Analytics A compromised process accessed a rare cloud resource A compromised process accessed a rare cloud resource. Informational Platform Analytics XDR Agent, XDR Agent with eXtended Threat Hunting (XTH) Command and Control
Analytics BIOC A LOLBIN was copied to a different location To evade detection, attackers may copy a LOLBIN executable to a different location. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC A non-browser process accessed a website UI An uncommon network communication between a non-browser process and a website UI. Informational Platform Analytics Palo Alto Networks Url Logs Command and Control
Analytics BIOC A process connected to a rare cloud resource A process connected to a rare cloud resource. Informational Platform Analytics XDR Agent Command and Control, Exfiltration
Analytics BIOC A process connected to a rare external host A process connected to an external host name or directly to an IP address, which is rarely connected to from the organization. Informational Platform Analytics XDR Agent Command and Control
Analytics BIOC A process connected to rare external host A process connected to a rare external host. Informational Platform Analytics XDR Agent Command and Control
Analytics BIOC A process is masquerading as a common Microsoft product An attacker might leverage common Microsoft software image names to run malicious processes without being caught. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC A process modified an SSH authorized_keys file A process modified an SSH authorized_keys file, which is used in SSH authentication. An attack can add or remove an SSH key to gain access to a targeted host. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
BIOC A scripting engine was called to run in command line Scripting engines that are called to run in command line are used by attackers to run a script payload without a UI. Informational Platform Analytics Process execution Execution
Analytics BIOC A service was disabled A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality. Informational Platform Analytics XDR Agent Impact
Analytics BIOC A third-party utility was copied to a different location To evade detection, attackers may copy a third-party utility executable to a different location. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC A Torrent client was detected on a host The host produced traffic consistent with the BitTorrent protocol. Torrent usage may expose the organization to malware or enable attackers or malicious insiders to exfiltrate data. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls Exfiltration, Initial Access
Analytics BIOC A WMI subscriber was created A WMI subscriber was created. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence, Privilege Escalation
Analytics BIOC Abnormal Communication to a Rare Domain An abnormal communication was seen from an internal entity to a rare domain. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls Command and Control
Analytics Abnormal connections to a dormant host from a newly seen endpoint The endpoint has performed multiple connections to an endpoint that is relatively inactive on the network. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Discovery
Analytics BIOC Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server to an external address. Informational Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Command and Control, Exfiltration
Analytics BIOC Abnormal process connection to default Meterpreter port This process has probably been compromised by Meterpreter and is now used by it to run malicious commands. Informational Platform Analytics XDR Agent Command and Control
Analytics Abnormal RDP connections to multiple hosts The endpoint attempted to initiate rare RDP connections to multiple hosts. Informational Platform Analytics XDR Agent Lateral Movement
Analytics BIOC Abnormal Recurring Communications to a Rare Domain Abnormal communications were seen from an internal entity to a rare external domain. This could be a case of beaconing to a C2 Server. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls Command and Control
Analytics Abnormal SMB scanning activity to multiple hosts An endpoint performed a new, unfamiliar SMB scanning activity to multiple hosts on the network. Informational Platform Analytics XDR Agent Reconnaissance
Analytics BIOC Access to kubelet credentials file A process accessed a kubelet credentials file. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Credential Access
Analytics BIOC Access to Kubernetes CA certificate file A process accessed a Kubernetes CA certificate file. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Credential Access
Analytics BIOC Access to Kubernetes configuration file A process accessed a Kubernetes node configuration file. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Credential Access
Analytics BIOC Access to sensitive host files from within a Kubernetes pod A process accessed sensitive host files inside a Kubernetes pod, indicating a potential container escape or privilege escalation attempt. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Privilege Escalation
BIOC Account creation via command-line tool The useradd/adduser command could be used to create user accounts or to add users to existing groups. Informational Platform Analytics Process execution Persistence
BIOC Active directory enumeration using built-in nltest.exe Nltest.exe is a command-line tool used for network administrative tasks, and can be used to gather information about domain controllers and users. Informational Platform Analytics Process execution Discovery
Analytics BIOC Adding execution privileges A script was granted execution privileges using chmod before being run. Informational Platform Analytics XDR Agent Execution
BIOC ADFind queries Active Directory for Exchange groups A process executed with ADFind parameters and used to extract data on built-in groups for the Exchange server (e.g. "Organization Management"). Informational Platform Analytics Process execution Discovery
Analytics BIOC Administrator groups enumerated via LDAP An LDAP search query that collects information about administrators was executed. This may be indicative of Active Directory domain enumeration, which can be used to perform attacks against the organization. Informational Platform Analytics Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) Discovery
BIOC Administrator obtains access rights to a file using icacls.exe Grant an administrator file access privileges. Informational Platform Analytics Process execution Defense Evasion
BIOC Adobe Acrobat Reader drops an executable file to disk The Acrobat Reader process dropped a new executable file to the disk. Unusual activity, possibly indicative of exploitation or social engineering attempt. Informational Platform Analytics File Initial Access
BIOC Adobe reader spawns a browser If a user clicks a URL link contained in a PDF document, it will cause the Adobe Reader process to spawn a browser process. It has legitimate uses, but check for possible phishing attempts. Informational Platform Analytics Process execution Initial Access
Analytics AI-determined combination of risky alerts under the same actor process Multiple alerts likely to be associated with an incident were identified under the same actor process. Informational Platform Analytics Palo Alto Networks Platform Alerts, Third-Party Alerts Execution
Analytics AI-determined combination of risky alerts under the same causality Multiple alerts likely to be associated with an incident were identified under the same causality. Informational Platform Analytics Palo Alto Networks Platform Alerts, Third-Party Alerts Execution
BIOC An executable compiled with a py2exe-like program was executed A py2exe-like program DLL file dropped to disk. Informational Platform Analytics File Execution
Analytics BIOC An uncommon file added to startup-related Registry keys An attacker may add a file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC An uncommon file was created in the startup folder An uncommon file was created in the startup folder. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC An uncommon RDP session from a managed host An RDP session was established with uncommon parameters from a managed host. Informational Platform Analytics XDR Agent Lateral Movement
Analytics BIOC An uncommon RDP session was established An RDP session was established with uncommon parameters. Informational Platform Analytics XDR Agent Lateral Movement
Analytics BIOC Analytics enhanced NGFW Threat Alert - Rare Internal Firewall Vulnerability Threat Alert An internal host triggered an NGFW (Next-Generation Firewall) vulnerability threat alert targeting another internal host. This activity is highly anomalous as it deviates from the source host's historical behavior and is rarely seen targeting this specific destination across the organization. Informational Platform Analytics Palo Alto Networks Firewall threat Logs, XDR Agent Reconnaissance
Analytics BIOC AppleScript executed a shell script An uncommon shell script has been executed by the AppleScript interpreter process. Informational Platform Analytics XDR Agent Execution
Analytics BIOC AppleScript interpreter dynamic library loaded into a process The AppleScript interpreter dynamic library was loaded into a process. Informational Platform Analytics XDR Agent Execution
Analytics BIOC AppleScript process executed with a rare command line The AppleScript interpreter process was executed with an uncommon command line. Informational Platform Analytics XDR Agent Execution
Analytics BIOC Authentication Attempt From a Dormant Account A dormant user account tried to authenticate to a service using a TGS after having been unused for a year or more. This may indicate the account is misused by an attacker. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Defense Evasion
BIOC Base64 decoding using the base64 utility Base64 decoding using the base64 utility with the -d argument provided. Informational Platform Analytics Process execution Defense Evasion
BIOC Base64 encoding used Attackers may use the base64 built-in binary to encode data into base64. Informational Platform Analytics Process execution Command and Control
BIOC Bitsadmin.exe used to download data Some attacks were known for abusing BITSAdmin in the past to hide how data was downloaded using legitimate Windows tools. Informational Platform Analytics Process execution Persistence
BIOC BitTorrent P2P file sharing The host used BitTorrent for P2P file sharing (according to the App-ID), which is typically not allowed in corporate networks and may be used to exfiltrate information. Informational Platform Analytics Dml connection Exfiltration
Analytics BIOC Broker Collection Error A collection error was detected on a broker VM. Informational Platform Analytics Health Monitoring Data Impact
Analytics BIOC Browser bookmark files accessed by a rare non-browser process Browser bookmark files accessed by a rare non-browser process. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Discovery
BIOC Browser downloads an .hta or .application file .hta and .application files are Windows applications that may serve as an attack vector by executing code maliciously using trusted Windows applications. Informational Platform Analytics File Defense Evasion
Analytics BIOC Browser Extension Installed Uncommon browser extension installed. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
BIOC Built-in SoundRecorder tool capturing audio SoundRecorder is a built-in voice recording tool. Besides benign usage, it may be used to discreetly record a user. Informational Platform Analytics Process execution Collection
BIOC Bypassing Windows UAC using sysprep Attackers may use the sysprep.exe built-in Windows tools to bypass Windows UAC. Informational Platform Analytics Process execution Privilege Escalation
BIOC Changing permissions or ownership of a file or folder Changing the permissions or ownership of a file or folder can be done to get access to sensitive data. Informational Platform Analytics Process execution Defense Evasion
BIOC Chrome launched in Incognito mode May be used to cover up malware or malicious insider activity. Informational Platform Analytics Process execution Defense Evasion
BIOC Clear event logging policy using auditpol.exe Attackers may clear Windows Event Logging policies using auditpol.exe. Informational Platform Analytics Process execution Defense Evasion
BIOC Clearing logs by copying /dev/null to a log file Usage of the cp command to copy /dev/null to a file and clear its content. Informational Platform Analytics Process execution Defense Evasion
BIOC Clearing logs by executing cat /dev/null Usage of cat /dev/null to clear the contents of a log file. Informational Platform Analytics Process execution Defense Evasion
BIOC Cleartext password harvesting using find tools On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords. Informational Platform Analytics Process execution Credential Access
BIOC Command enumeration via sudo The 'sudo -l' command was executed to enumerate commands that can be executed by a user. Informational Platform Analytics Process execution Privilege Escalation
Analytics BIOC Command execution in a Kubernetes pod Container administration commands were executed within a Kubernetes pod. Informational Platform Analytics XDR Agent Execution
Analytics BIOC Command execution via wmiexec Attackers may use WMI to execute commands on the target host. Informational Platform Analytics XDR Agent Execution
BIOC Command-line creation of a RAR archive Compression of data into a RAR archive using the rar.exe utility. Informational Platform Analytics Process execution Collection
BIOC Common Apple process name missing Apple digital signature These common Apple process names should normally be signed with the Apple Inc. digital signature. Naming processes with common names is a common way attackers obfuscate their activities. Informational Platform Analytics Process execution Defense Evasion
BIOC Common Mozilla process name missing Mozilla digital certificate These common Mozilla process names should normally be signed with the Mozilla Corporation digital signature. Naming processes with common names is a common way attackers obfuscate their activities. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Common third-party software name masquerading An attacker might leverage common third-party software image names to run malicious processes without being caught. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Commonly abused AutoIT script drops an executable file to disk AutoIT scripts have legitimate uses but are often abused by malware to execute in a signed process context. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Execution
BIOC Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique. Informational Platform Analytics Process execution Persistence
BIOC Commonly abused process executed with obfuscated characters Commonly abused process executed with obfuscated characters. Informational Platform Analytics Process execution Defense Evasion
BIOC Commonly abused process executes by a remote host using PsExec This commonly abused shell/host process was spawned by psexesvc.exe, indicating it was called by a remote host via PsExec. Informational Platform Analytics Process execution Lateral Movement, Execution
Analytics BIOC Commonly abused process launched as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism. Informational Platform Analytics XDR Agent Execution
BIOC Commonly abused process launches as a system service This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism. Informational Platform Analytics Process execution Execution
BIOC Commonly abused process spawns from Scripted Diagnostics Host This Scripted Diagnostics Host (sdiagnhost.exe) process has been observed launching a commonly abused host process. This behavior is known to be associated with an exploitation technique designed to deliver a malicious payload, often via a weaponized document. https://www.proofpoint.com/us/threat-insight/post/windows-troubleshooting-platform-leveraged-deliver-malware. Informational Platform Analytics Process execution Execution
BIOC Commonly abused process spawns out of rundll32.exe This type of execution happens in .dll based attacks. Informational Platform Analytics Process execution Defense Evasion
BIOC Compiled HTML (help file) makes network connections Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload. Informational Platform Analytics Network Defense Evasion
BIOC Compiler process started by an Office process The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine. Informational Platform Analytics Process execution Defense Evasion
BIOC Compressed archive created using tar Attackers may use the tar built-in tool to stage a file for exfiltration. Informational Platform Analytics Process execution Collection
BIOC Container enumeration An attacker may run a command to enumerate containers on a machine. Informational Platform Analytics Process execution Discovery
BIOC Creation of a new Microsoft Office default template Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence. Informational Platform Analytics File Persistence
BIOC Creation of volume shadow copy using vssadmin.exe An attacker may create volume shadow copies to gain access to protected or locked files, whereas backup is the common legitimate use. Informational Platform Analytics Process execution Credential Access
Analytics BIOC Creation or modification of the default command executed when opening an application Creation or modification of these registry keys can cause the execution of the specified programs, bypassing UAC. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Privilege Escalation
BIOC Credentials from Web Browsers Detects attempt to copy browser files to acquire credentials. Informational Platform Analytics Process execution Credential Access
BIOC Curl connects to an external network Curl is a command-line utility used to transfer data. Attackers may use curl to exfiltrate data outside your organization. Informational Platform Analytics Network Exfiltration
BIOC Data destruction using sdelete.exe Attackers may use sdelete.exe to delete files from the target host. Informational Platform Analytics Process execution Defense Evasion, Impact
BIOC Direct access to free online DNS servers Online DNS servers are often used to bypass the company's internal DNS servers and evade detection. Informational Platform Analytics Network Command and Control
BIOC Disable outlook security via Registry Attackers may try to disable outlook security features by modifying the Registry. Informational Platform Analytics Registry Defense Evasion
BIOC Disabling Windows Defender via Registry Windows Defender stores its configuration in the Registry. By modifying these values, an attacker can disable security features. Informational Platform Analytics Registry Defense Evasion
BIOC Discovery of files with setgid or setuid bits Attackers may try to locate files with setgid or setuid bits set to escalate privileges. Informational Platform Analytics Process execution Privilege Escalation
Analytics BIOC Discovery of host users via WMIC Attackers may use wmic.exe to list the users of a host, and potentially its owner. Informational Platform Analytics XDR Agent Discovery
BIOC DNS resolution to the Palo Alto Networks sinkhole DNS resolution to the Palo Alto Networks sinkhole. Informational Platform Analytics Network Command and Control
BIOC Document discovery Attackers may use the find command to look for documents. Informational Platform Analytics Process execution Discovery
Analytics Download pattern that resembles Peer to Peer traffic A possible P2P protocol was spotted from an internal host. Informational Platform Analytics Palo Alto Networks Firewall traffic Logs, XDR Agent Command and Control, Initial Access
BIOC Driver written to a temporary directory Drivers are highly unlikely to be written or moved to a temp directory. Check whether this driver is legitimate. Informational Platform Analytics File Defense Evasion
Analytics BIOC DSC (Desired State Configuration) lateral movement using PowerShell An attacker is using the DSC feature with PowerShell to remotely modify / execute content / components on the machine. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Lateral Movement, Execution