Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
14 detectors match the current filters. tactic: TA0005 ✕ technique: T1564 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | Hidden directory creation Attackers may create hidden directories to hide malware or staged files. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Hidden file and directory creation Creation of a hidden file inside a hidden directory. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | ISO mounted manually A user manually mounted an ISO file. | Informational | Platform Analytics | File | Defense Evasion |
| Analytics BIOC | New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension. | Low | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Procdump executed from an atypical directory Procdump.exe is a SysInternals tool used to dump process memory; it can be used to dump lsass.exe memory to extract credentials. | Medium | Platform Analytics | XDR Agent | Defense Evasion, Credential Access |
| BIOC | Process runs from the recycle bin Process running from the recycle bin. | Low | Platform Analytics | Process execution | Defense Evasion |
| Analytics BIOC | Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Defense Evasion |
| BIOC | Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file. | Informational | Platform Analytics | File | Defense Evasion |
| Analytics BIOC | Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | The scripting engine executed code from an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file. | Informational | Platform Analytics | Process execution | Defense Evasion |
| Analytics BIOC | Unpopular rsync process execution An unpopular rsync process was executed on the host. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| BIOC | Unsigned process creates an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | Unsigned process running from a temporary directory Malware often runs from a temporary folder. | Informational | Platform Analytics | Process execution | Defense Evasion |