Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
8 detectors match the current filters. technique: T1190 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Exchange process writing aspx files An exchange process is writing to .aspx files. This may be an actor dropping web shells. | High | Platform Analytics | File | Initial Access, Command and Control |
| Analytics BIOC | Failed Login For a Long Username With Special Characters A long username containing special characters failed to log in to the domain. | Informational | Platform Analytics | Palo Alto Networks Firewall EAL Logs, XDR Agent | Initial Access |
| BIOC | Out of band testing domain connection Connection from web service process to out-of-band-testing domain. | Low | Platform Analytics | Network | Initial Access |
| Analytics BIOC | Suspicious failed HTTP request - potential Spring4Shell exploit A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt. | Low | Platform Analytics | Palo Alto Networks Firewall EAL Logs, XDR Agent | Initial Access |
| Analytics BIOC | Unusual DB process spawning a shell A DB related process abnormally spawned a shell. This might indicate an exploitation attempt. | Informational | Platform Analytics | XDR Agent | Initial Access, Lateral Movement |
| Analytics BIOC | Unusual Process Spawned by Nginx in Ingress-Nginx pod Unusual Process Spawned by Nginx in Ingress-Nginx pod. | Low | Platform Analytics | XDR Agent | Execution, Initial Access |
| BIOC | Web server process drops an executable to disk Web server processes should not normally write executable files out to the local filesystem. This may have legitimate uses in certain web applications, yet check for possible exploitation of the hosted web application. | Informational | Platform Analytics | File | Initial Access |
| BIOC | Web server spawns an unsigned process Web server processes should normally only carry out tasks related to serving web applications. This instance has spawned an unsigned process, which may indicate a successful exploitation attempt of the associated web application. | Informational | Platform Analytics | Process execution | Initial Access |