Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
10 detectors match the current filters. technique: T1564 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | Hidden directory creation Attackers may create hidden directories to hide malware or staged files. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Hidden file and directory creation Creation of a hidden file inside a hidden directory. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | ISO mounted manually A user manually mounted an ISO file. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file. | Informational | Platform Analytics | File | Defense Evasion |
| Analytics BIOC | Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | The scripting engine executed code from an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file. | Informational | Platform Analytics | Process execution | Defense Evasion |
| Analytics BIOC | Unpopular rsync process execution An unpopular rsync process was executed on the host. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | Unsigned process creates an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | Unsigned process running from a temporary directory Malware often runs from a temporary folder. | Informational | Platform Analytics | Process execution | Defense Evasion |