Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
109 detectors match the current filters. tactic: TA0005 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Windows Firewall notifications disabled via Registry These Registry keys control the Windows Firewall notifications. Malware may turn notifications off before editing the firewall settings. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows PowerShell Logging being disabled via Registry Tampering of the key can disable event logging by the PowerShell, allowing the adversary to evade being detected using PowerShell. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows process masquerading by an unsigned process A process is trying to disguise itself as a legitimate Windows process, but is unsigned. This usually indicates malicious activity. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Windows Registry Editor being disabled via Registry Registry Editor may be enabled / disabled using this key. This could indicate either IT policy applied or malicious activity preventing the user from altering the Registry. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Windows Security audit log was cleared Event ID 1102 was generated when the Windows Security audit log was cleared. Attackers may clear events from Windows event logs to remove traces of their malicious activity. | Informational | Platform Analytics | Windows event log | Defense Evasion |
| BIOC | Windows set to permit unsigned drivers (Test Mode) This host has been set into 'Test Mode' which allows loading of unsigned drivers. It has legitimate uses, but can be leveraged by malware to load malicious untrusted drivers. | Medium | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Windows Task Manager being disabled via Registry Task manager may be disabled to tamper with the user experience and with the response to a malicious incident. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | WMI terminated a process The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection. | Informational | Platform Analytics | Process execution | Defense Evasion, Execution |
| BIOC | WSL Feature Installation Detecting installation of Windows Subsystem for Linux feature. | Informational | Platform Analytics | File | Defense Evasion |