Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

68 detectors match the current filters. tactic: TA0003 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC A browser extension was installed or loaded in an uncommon way A browser extension was installed or loaded in an uncommon way. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC A process modified an SSH authorized_keys file A process modified an SSH authorized_keys file, which is used in SSH authentication. An attack can add or remove an SSH key to gain access to a targeted host. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC A WMI subscriber was created A WMI subscriber was created. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence, Privilege Escalation
BIOC Account creation via command-line tool The useradd/adduser command could be used to create user accounts or to add users to existing groups. Informational Platform Analytics Process execution Persistence
Analytics BIOC An uncommon file added to startup-related Registry keys An attacker may add a file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC An uncommon file was created in the startup folder An uncommon file was created in the startup folder. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task. Informational Platform Analytics XDR Agent Persistence
BIOC Bitsadmin.exe used to download data Some attacks were known for abusing BITSAdmin in the past to hide how data was downloaded using legitimate Windows tools. Informational Platform Analytics Process execution Persistence
Analytics BIOC Browser Extension Installed Uncommon browser extension installed. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
BIOC Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique. Informational Platform Analytics Process execution Persistence
BIOC Creation of a new Microsoft Office default template Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence. Informational Platform Analytics File Persistence
Analytics BIOC Execution of an uncommon process at an early startup stage Uncommon execution of an executable found in an early startup stage. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Execution of an uncommon process with a local/domain user SID at an early startup stage Execution of an uncommon process with a local/domain user SID at an early startup stage may be an indication of a persistent mechanism on boot that is being actively abused. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Globally uncommon injection from a signed process A signed process injected into another process that it does not normally target at a global level. Informational Platform Analytics XDR Agent Defense Evasion, Persistence
BIOC Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits. Informational Platform Analytics Process execution Persistence
BIOC Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits. Informational Platform Analytics Process execution Persistence
BIOC Manipulation of 'BootExecute' Registry run key Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence. Informational Platform Analytics Registry Persistence
BIOC Manipulation of AppInit DLL loading list The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on. Informational Platform Analytics Registry Persistence
BIOC Manipulation of Application Verifier custom providers The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application. Informational Platform Analytics Registry Persistence
BIOC Manipulation of autostart related system files May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows. Informational Platform Analytics File Persistence
BIOC Manipulation of default file association configuration When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened. Informational Platform Analytics Registry Persistence
BIOC Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths. Informational Platform Analytics Registry Persistence
BIOC Manipulation of Winlogon 'Notify' autostart Registry key Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs. Informational Platform Analytics Registry Persistence
BIOC Modification of default Windows startup path via Registry An attacker may modify the startup path to the location of the malware. Informational Platform Analytics Registry Persistence
Analytics BIOC Modification of PAM Modification of PAM configuration files. Informational Platform Analytics XDR Agent Persistence, Defense Evasion, Credential Access
BIOC Modification of systemd service files An attacker may create or modify systemd service unit files to establish persistence between reboots. Informational Platform Analytics File Persistence
BIOC Modification of the Winlogon\Shell Registry key Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell. Informational Platform Analytics Registry Persistence
BIOC New entry added to startup related Registry keys by unsigned process Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level. Informational Platform Analytics Registry Persistence
BIOC New service created via command line Attackers may leverage services to gain persistence on an endpoint. Informational Platform Analytics Process execution Persistence
BIOC Persistence through service registration An attacker may add or modify system services to persist on a host. Informational Platform Analytics File Persistence
BIOC Persistence using bashrc files Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution. Informational Platform Analytics File Persistence
BIOC Persistence using cron jobs Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware. Informational Platform Analytics File Persistence
BIOC Persistence via Registry screensaver key change Attackers may install their malware persistently by modifying the value of the screensaver Registry key. Informational Platform Analytics Registry Persistence
Analytics BIOC Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
BIOC Possible web shell command execution Possible command execution via a web shell for reconnaissance. Informational Platform Analytics Process execution Persistence
BIOC Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory. Informational Platform Analytics File Persistence
BIOC Potential web shell installation A web-app script file was installed on a web server. This can indicate an installation of web shell. Informational Platform Analytics File Persistence
BIOC Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API. Informational Platform Analytics Registry Persistence
Analytics Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint. Informational Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Command and Control, Persistence
Analytics BIOC Rare scheduled task created A new rare scheduled task was created with a rare path and a rare command line. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC Rare Scheduled Task RPC activity The endpoint performed abnormal Scheduled Task RPC activity to a remote host. Informational Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH) Lateral Movement, Persistence
Analytics BIOC Scrcons.exe Rare Child Process The Windows Management Instrumentation (WMI) standard event consumer scrcons.exe executed a rare VBScript or PowerShell script. Executing a rare script can be an indication of local or remote code execution abuse by an attacker. Informational Platform Analytics XDR Agent Execution, Persistence
BIOC Shim database file access An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence. Informational Platform Analytics File Persistence, Privilege Escalation
BIOC Shim database registration via Registry Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry. Informational Platform Analytics Registry Persistence
Analytics BIOC Signed process creates a scheduled task via file access A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence. Informational Platform Analytics XDR Agent Execution, Persistence
Analytics BIOC Suspicious active setup registered The endpoint registered a new active setup, which may be used to gain persistence on the host by loading libraries into the time management service. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
BIOC Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique. Informational Platform Analytics File Persistence
BIOC Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique. Informational Platform Analytics File Persistence
BIOC Tampering with Windows Security Support Provider DLLs Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002. Informational Platform Analytics Registry Persistence
BIOC Task scheduled by commonly abused host process Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use. Informational Platform Analytics Process execution Persistence
Analytics BIOC Uncommon browser extension loaded An uncommon browser extension was loaded by a Chromium-based browser. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC Uncommon Launch Agent persistency was registered or modified An uncommon Launch Agent persistence mechanism was registered/modified on the system. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Uncommon Launch Daemon persistency was registered or modified An uncommon Launch Daemon persistence mechanism was registered/modified on the system. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Uncommon local scheduled task creation via schtasks.exe The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Uncommon login item persistency was registered or modified An uncommon login item persistence mechanism was registered/modified on the system. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Uncommon Managed Object Format (MOF) compiler usage The mofcomp.exe WMI MOF compiled is used to compile code into the WMI repository that in turn may enable attackers to run scheduled or triggered code from the context of a Microsoft-signed binary. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Uncommon net group command execution Uncommon net group command execution which may be used for groups and users enumeration and unauthorized user creation. Informational Platform Analytics XDR Agent Discovery, Persistence
Analytics BIOC Uncommon net localgroup command execution Uncommon net localgroup command execution which may be used for group and user enumeration and unauthorized user creation. Informational Platform Analytics XDR Agent Discovery, Persistence
Analytics BIOC Uncommon signed process execution by scheduled task An uncommon process was executed by a scheduled task. Informational Platform Analytics XDR Agent Persistence
Analytics BIOC Uncommon user management via net.exe The net.exe command is used to add, delete, and otherwise manage the users on a computer. Adversaries may attempt to use the command to discover or add local and domain user accounts. Informational Platform Analytics XDR Agent Discovery, Persistence
Analytics BIOC Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
BIOC User creation or modification via /etc file Attackers may create new users or modify existing users by directly modifying /etc/passwd and /etc/shadow. Informational Platform Analytics File Persistence
Analytics BIOC Weakly-Encrypted Kerberos TGT Response A weakly encrypted Kerberos TGT was issued by a domain controller. The encryption type is abnormal for this DC and results in a TGT that is easier to crack. This behavior may indicate a Skeleton Key attack. Informational Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Credential Access, Defense Evasion, Persistence
Analytics Web server CGO executed a process following a potential Webshell dropped A process was executed by a web server CGO following a potential drop of a webshell file. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Persistence
Analytics BIOC Web server CGO executed an uncommon process An uncommon process was executed by a web server CGO, which might indicate a Webshell activity or a web server exploit. Informational Platform Analytics XDR Agent Initial Access, Persistence
BIOC Write to .bash_profile Commands in ~/.bash_profile are executed on every user shell login with a username and password. Informational Platform Analytics File Persistence