Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

247 detectors match the current filters. tactic: TA0005 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Suspicious SPF Result The email has a suspicious SPF result of fail, soft fail, or policy, which may indicate a potential domain misconfiguration or spoofing. Informational Email Security Microsoft 365 Emails Defense Evasion
Analytics BIOC Suspicious Unicode character detected in email Unicode characters can be used for obfuscation, allowing malicious actors to disguise harmful intent, URLs or attachments By embedding non-printing Unicode characters, attackers can bypass security filters and evade detection mechanisms Such characters may also be used for phishing attempts that appear legitimate to both users and security systems. Informational Email Security Microsoft 365 Emails Defense Evasion
BIOC Suspicious usage of cytool.exe The Cortex XDR agent can be controlled by a command-line tool named cytool.exe. Attackers may use it to disable the Cortex XDR agent. Informational Platform Analytics Process execution Defense Evasion
BIOC SyncAppvPublishingServer used to run PowerShell code SyncAppvPublishingServer is part of Microsoft Application Virtualization (App-V), which may be used by an attacker to run PowerShell code. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Tampering with Internet Explorer Protected Mode configuration When an add-on is running inside Protected Mode attempts to launch a broker process (or any other program), the ElevationPolicy Registry key is checked to determine how the process should be launched. Internet Explorer will run a broker process with higher rights that can use the current user's permissions to take actions that would otherwise be prohibited when rendering content inside the Protected Mode sandbox. https://blogs.msdn.microsoft.com/ieinternals/2009/11/30/understanding-the-protected-mode-elevation-dialog/. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Tampering with the Windows User Account Controls (UAC) configuration EnableLUA specifies whether Windows User Account Controls (UAC) notifies the user when programs try to modify the computer. UAC was formerly known as Limited User Account (LUA). Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion
BIOC Tampering with Windows certificate blocking configuration Adding subkeys of the certificates to block disallows a security vendor's certificate on the affected computer, so that Windows would not allow the program to run. Informational Platform Analytics Registry Defense Evasion
BIOC Tampering with Windows Control Panel configuration DLLs with .cpl suffix are executed when accessing the Control Panel. Malicious code may run this way even if AppLocker enabled. Informational Platform Analytics Registry Defense Evasion
BIOC The scripting engine executed code from an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Uncommon DotNet module load relationship A signed process that usually doesn't use DotNet loaded a common DotNet module. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Uncommon kernel module load Loading of a kernel module using the modprobe command. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Unpopular rsync process execution An unpopular rsync process was executed on the host. Informational Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder. Informational Platform Analytics XDR Agent Persistence, Privilege Escalation, Defense Evasion
BIOC Unsigned process creates an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS. Informational Platform Analytics File Defense Evasion
BIOC Unsigned process injects code into a process An unsigned process injected code into a process. This can be done to leverage a legitimate running process for an attack. Informational Platform Analytics Remote code Defense Evasion
BIOC Unsigned process running from a temporary directory Malware often runs from a temporary folder. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Unusual cloud identity impersonation A cloud identity attempted to impersonate another identity for the first time. Informational Cortex Cloud AWS Audit Log, Gcp Audit Log Privilege Escalation, Defense Evasion, Initial Access
Analytics BIOC Unusual Conditional Access operation for an identity An identity attempted to add or update an Azure AD Conditional Access policy. Informational Identity Threat Detection (ITDR), SaaS Threat Detection AzureAD Audit Log Defense Evasion
Analytics BIOC Unusual hostname for the sending mail server in the email headers The detected mail server hostname had not been observed in the organization's emails in the past 30 days. Informational Email Security Microsoft 365 Emails Defense Evasion
Analytics BIOC Unusual sender IP subnet This IP address has not been observed in correlation with the sender's fully qualified domain name within the last 30 days. Informational Email Security Microsoft 365 Emails Defense Evasion
Analytics BIOC Unusual use of a 'SysInternals' tool An attacker may be trying to avoid detection by using an obfuscated copy of SysInternals tools. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion
Analytics BIOC Unusual user-agent for a cloud identity A cloud identity has executed an API call with an unusual user-agent. Informational Cortex Cloud AWS Audit Log, Azure Audit Log, Gcp Audit Log Initial Access, Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC Usage of homograph characters detected in an email Detected characters resembling Latin letters within an email's subject and/or body. This could indicate an attempt to impersonate a well-known brand or impersonate someone's identity. This could also be used as a method to evade text scanners and analyzers. Informational Email Security Microsoft 365 Emails Defense Evasion
Analytics BIOC Usage of homograph characters detected in an email's from header Detected characters resembling Latin letters within an email's From header. This could indicate an attempt to impersonate a well-known brand or impersonate someone's identity. This could also be used as a method to evade text scanners and analyzers. Informational Email Security Microsoft 365 Emails Defense Evasion
BIOC Usage of tracing tool An attacker may be trying to use a known tracing tool to gather information from other processes. Informational Platform Analytics Process execution Defense Evasion
BIOC User account flagged as hidden Look for unsigned processes that add an entry to the hidden users Registry key. Informational Platform Analytics Registry Defense Evasion
Analytics BIOC User added SID History to an account A user added SID history to an account. This may be indicative of a user's migration between domains or a SID injection attack. Informational Identity Analytics Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) Privilege Escalation, Defense Evasion
Analytics User moved Exchange sent messages to deleted items A user moved sent messages to deleted items in Exchange. Informational Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security Office 365 Audit Defense Evasion
Analytics BIOC VM Detection attempt A script has executed commands that can be used to detect VM environments. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion, Discovery
Analytics BIOC VM Detection attempt on Linux A Process executed a command and/or accessed a file that can be used to detect VM environments. Informational Platform Analytics XDR Agent Defense Evasion, Discovery
Analytics BIOC VPN login by a dormant user A dormant user logged on to a VPN service after having been unused for a month or longer. This may indicate the account is misused by an attacker. Informational Identity Analytics Palo Alto Networks Global Protect, Third-Party VPNs Defense Evasion
Analytics BIOC Weakly-Encrypted Kerberos TGT Response A weakly encrypted Kerberos TGT was issued by a domain controller. The encryption type is abnormal for this DC and results in a TGT that is easier to crack. This behavior may indicate a Skeleton Key attack. Informational Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent Credential Access, Defense Evasion, Persistence
Analytics BIOC Well-known brand in sender headers with header inconsistencies Sender headers include a well-known brand with header inconsistencies indicating possible impersonation. Informational Email Security Microsoft 365 Emails Defense Evasion
BIOC Windows 10 Developer Mode enabled Enabling developer mode allows for app sideloading and starts the Windows SSH services, which may be used to install Linux Bash on Windows. Informational Platform Analytics Registry Defense Evasion
Analytics BIOC Windows event logs were cleared with PowerShell Windows event logs were cleared or deleted with PowerShell. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion
BIOC Windows Firewall disabled via Registry An attacker may disable the Windows Firewall via the Registry to bypass network controls. Informational Platform Analytics Registry Defense Evasion
BIOC Windows Firewall notifications disabled via Registry These Registry keys control the Windows Firewall notifications. Malware may turn notifications off before editing the firewall settings. Informational Platform Analytics Registry Defense Evasion
BIOC Windows PowerShell Logging being disabled via Registry Tampering of the key can disable event logging by the PowerShell, allowing the adversary to evade being detected using PowerShell. Informational Platform Analytics Registry Defense Evasion
BIOC Windows process masquerading by an unsigned process A process is trying to disguise itself as a legitimate Windows process, but is unsigned. This usually indicates malicious activity. Informational Platform Analytics Process execution Defense Evasion
BIOC Windows Registry Editor being disabled via Registry Registry Editor may be enabled / disabled using this key. This could indicate either IT policy applied or malicious activity preventing the user from altering the Registry. Informational Platform Analytics Registry Defense Evasion
BIOC Windows Security audit log was cleared Event ID 1102 was generated when the Windows Security audit log was cleared. Attackers may clear events from Windows event logs to remove traces of their malicious activity. Informational Platform Analytics Windows event log Defense Evasion
BIOC Windows Task Manager being disabled via Registry Task manager may be disabled to tamper with the user experience and with the response to a malicious incident. Informational Platform Analytics Registry Defense Evasion
BIOC WMI terminated a process The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection. Informational Platform Analytics Process execution Defense Evasion, Execution
BIOC WSL Feature Installation Detecting installation of Windows Subsystem for Linux feature. Informational Platform Analytics File Defense Evasion
Analytics BIOC X-Forefront-Antispam-Report has flagged this email as a potential threat This email has been categorized by X-Forefront-Antispam-Report as a threat, suggesting it is likely malicious in nature (e.g., spam, phishing, impersonation, etc.). Informational Email Security Microsoft 365 Emails Initial Access, Defense Evasion, Execution