Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
13 detectors match the current filters.
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A commonly abused process connected to a rare cloud resource A commonly abused process connected to a rare cloud resource. | Low | Platform Analytics | XDR Agent | Command and Control |
| Analytics BIOC | A commonly abused process connected to a rare external host A commonly abused process connected to a rare external host. | Low | Platform Analytics | XDR Agent | Command and Control |
| Analytics | A compromised process accessed a rare cloud resource A compromised process accessed a rare cloud resource. | Informational | Platform Analytics | XDR Agent, XDR Agent with eXtended Threat Hunting (XTH) | Command and Control |
| Analytics | A compromised process accessed a rare external host A compromised process accessed a rare external host. | Low | Platform Analytics | XDR Agent, XDR Agent with eXtended Threat Hunting (XTH) | Command and Control |
| Analytics BIOC | A process connected to a rare cloud resource A process connected to a rare cloud resource. | Informational | Platform Analytics | XDR Agent | Command and Control, Exfiltration |
| Analytics BIOC | A process connected to rare external host A process connected to a rare external host. | Informational | Platform Analytics | XDR Agent | Command and Control |
| Analytics BIOC | Rare binary connected to a rare cloud resource Rare binary connected to a rare cloud resource. | Low | Platform Analytics | XDR Agent | Command and Control |
| Analytics BIOC | Rare binary connected to a rare external host Rare binary connected to a rare external host. | Low | Platform Analytics | XDR Agent | Command and Control |
| Analytics BIOC | Rare communication over email ports to external email server by unsigned process These methods are used by malware and attackers to leak data and remain undetected. | Low | Platform Analytics | XDR Agent | Command and Control |
| Analytics BIOC | Rare process created an SSH session to an uncommon cloud resource A rare process created an SSH session to an uncommon cloud resource. | Low | Platform Analytics | Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls | Command and Control |
| Analytics BIOC | Rare process created an SSH session to an uncommon external host Rare process created an SSH session to an uncommon external host. | Low | Platform Analytics | Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls | Command and Control |
| Analytics BIOC | Scripting engine connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity. | Low | Platform Analytics | XDR Agent | Command and Control, Execution |
| Analytics BIOC | Windows LOLBIN executable connected to a rare external host Scripts connecting to external IP addresses may be sanctioned IT scripts. However, when those external IP addresses are only receiving connections from a few specific endpoints in the organization, these scripts may be an indicator of more suspicious activity. Security testers and adversaries use offensive frameworks that employ forms of scripting which result in this type of network activity. | Medium | Platform Analytics | XDR Agent | Command and Control |