Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
25 detectors match the current filters. technique: T1562 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Chrome launched in Incognito mode May be used to cover up malware or malicious insider activity. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Clear event logging policy using auditpol.exe Attackers may clear Windows Event Logging policies using auditpol.exe. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Disable outlook security via Registry Attackers may try to disable outlook security features by modifying the Registry. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Disabling Windows Defender via Registry Windows Defender stores its configuration in the Registry. By modifying these values, an attacker can disable security features. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Fltmc.exe used to unload filter driver Attackers can abuse the Filter Manager Control Program (fltMC.exe) to unload MiniFilter drivers, some of which may be used for activity monitoring. | Informational | Platform Analytics | Process execution | Defense Evasion |
| Analytics BIOC | Indicator blocking Auditing or logging configuration changes on Linux host. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | Internet Explorer security settings modification The Security Settings Check feature, which checks Internet Explorer security settings to determine risk, was disabled. | Informational | Platform Analytics | Registry | Defense Evasion |
| Analytics BIOC | Iptables configuration command was executed The iptables process was executed with a command to add or delete rules on the host. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | MacOS firewall manipulation An attacker may modify a firewall via command line to bypass network controls. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Manipulation of Windows Defender configuration Commands used to bypass, disable or harm Windows Defender. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Manipulation of Windows Event Log auto-backup via Registry This key enables/disables the automatic backups of event logs when they are full. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Netsh.exe modifies allowed firewall port/program lists Malware will often modify local firewall settings to permit untrusted software to communicate with the Internet for C2. Check for malicious use. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Security services stopped Attackers may stop security critical services to avoid possible detection of their activities. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | SELinux was set to permissive mode SELinux was set to permissive mode using the "setenforce 0" command. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | SmartScreen disabled via Registry These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Suspicious usage of cytool.exe The Cortex XDR agent can be controlled by a command-line tool named cytool.exe. Attackers may use it to disable the Cortex XDR agent. | Informational | Platform Analytics | Process execution | Defense Evasion |
| Analytics BIOC | Tampering with Internet Explorer Protected Mode configuration When an add-on is running inside Protected Mode attempts to launch a broker process (or any other program), the ElevationPolicy Registry key is checked to determine how the process should be launched. Internet Explorer will run a broker process with higher rights that can use the current user's permissions to take actions that would otherwise be prohibited when rendering content inside the Protected Mode sandbox. https://blogs.msdn.microsoft.com/ieinternals/2009/11/30/understanding-the-protected-mode-elevation-dialog/. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | Tampering with Windows certificate blocking configuration Adding subkeys of the certificates to block disallows a security vendor's certificate on the affected computer, so that Windows would not allow the program to run. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Tampering with Windows Control Panel configuration DLLs with .cpl suffix are executed when accessing the Control Panel. Malicious code may run this way even if AppLocker enabled. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows Firewall disabled via Registry An attacker may disable the Windows Firewall via the Registry to bypass network controls. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows Firewall notifications disabled via Registry These Registry keys control the Windows Firewall notifications. Malware may turn notifications off before editing the firewall settings. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows PowerShell Logging being disabled via Registry Tampering of the key can disable event logging by the PowerShell, allowing the adversary to evade being detected using PowerShell. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows Registry Editor being disabled via Registry Registry Editor may be enabled / disabled using this key. This could indicate either IT policy applied or malicious activity preventing the user from altering the Registry. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows Task Manager being disabled via Registry Task manager may be disabled to tamper with the user experience and with the response to a malicious incident. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | WMI terminated a process The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection. | Informational | Platform Analytics | Process execution | Defense Evasion, Execution |