Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
14 detectors match the current filters. tactic: TA0003 ✕ technique: T1543 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | An uncommon service was started An uncommon service was started using systemctl or service processes. | Low | Platform Analytics | XDR Agent | Persistence, Privilege Escalation |
| Analytics BIOC | Installation of a new System-V service Installation of a new System-V service. | Low | Platform Analytics | XDR Agent | Persistence, Privilege Escalation |
| Analytics BIOC | Known service display name with uncommon image-path Service created with a known display name but has an uncommon image-path. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence, Execution |
| Analytics BIOC | Known service name with an uncommon image-path A Service with a known service name has an uncommon image-path. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence, Execution |
| BIOC | Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Modification of systemd service files An attacker may create or modify systemd service unit files to establish persistence between reboots. | Informational | Platform Analytics | File | Persistence |
| BIOC | Multiple RDP sessions enabled via Registry Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does. | Medium | Platform Analytics | Registry | Persistence, Lateral Movement |
| BIOC | New service created via command line Attackers may leverage services to gain persistence on an endpoint. | Informational | Platform Analytics | Process execution | Persistence |
| BIOC | Persistence through service registration An attacker may add or modify system services to persist on a host. | Informational | Platform Analytics | File | Persistence |
| BIOC | PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine. | Low | Platform Analytics | Process execution | Persistence |
| Analytics BIOC | Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Defense Evasion, Persistence |
| Analytics BIOC | Svchost.exe loads a rare unsigned module Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution. | Low | Platform Analytics | XDR Agent | Defense Evasion, Persistence |
| Analytics BIOC | Uncommon Launch Agent persistency was registered or modified An uncommon Launch Agent persistence mechanism was registered/modified on the system. | Informational | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Uncommon Launch Daemon persistency was registered or modified An uncommon Launch Daemon persistence mechanism was registered/modified on the system. | Informational | Platform Analytics | XDR Agent | Persistence |