Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
17 detectors match the current filters.
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Bitsadmin.exe used to upload data Some attacks are known to abuse BITSAdmin to hide how data upload using legitimate Windows tools. | High | Platform Analytics | Process execution | Exfiltration, Defense Evasion |
| BIOC | Command-line arguments match Mimikatz execution These command-line arguments are often used by Mimikatz to dump credentials. | High | Platform Analytics | Process execution | Credential Access |
| BIOC | Credential dumping via LaZagne LaZagne has been executed. Attackers may use this tool to gather account and password information from credential dumping. | High | Platform Analytics | Process execution | Credential Access |
| BIOC | Encoded VBScript executed Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding. | High | Platform Analytics | Process execution | Execution, Defense Evasion |
| BIOC | EventLog service disabled by a Registry operation A Registry set-value operation that disables the EventLog service was executed on the machine. | High | Platform Analytics | Registry | Defense Evasion |
| BIOC | Exchange process writing aspx files An exchange process is writing to .aspx files. This may be an actor dropping web shells. | High | Platform Analytics | File | Initial Access, Command and Control |
| BIOC | Kerberos service ticket request in PowerShell command Asking for a specific Kerberos service ticket can indicate an attacker's attempt to "Kerberoast" or use the ticket directly. | High | Platform Analytics | Process execution | Credential Access, Lateral Movement |
| BIOC | Ntdsutil.exe accessing ntds.dit file Attackers may attempt to dump ntds.dit, which stores all Active Directory account information, to later extract passwords and hashes from it. | High | Platform Analytics | File | Credential Access |
| BIOC | Possible C2 via dnscat2 Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic. | High | Platform Analytics | Process execution | Execution |
| BIOC | Possible LSASS memory dump Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump. | High | Platform Analytics | Process execution | Credential Access |
| BIOC | Process requests the deletion of Windows Shadowcopies Ransomware and wipers may use the wmic.exe or vssadmin.exe utilities to delete or modify Shadowcopies (a Windows backup mechanism). | High | Platform Analytics | Process execution | Impact |
| BIOC | Pubprn.vbs signed script proxy execution Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions. | High | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host. | High | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Rubeus tool execution Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity. | High | Platform Analytics | Process execution | Execution |
| BIOC | SunBurst Module loaded Sunburst malware hash loaded into SolarWinds.BusinessLayerHost.exe. | High | Platform Analytics | Module | Initial Access, Command and Control |
| BIOC | Suspicious debug file created in a temporary folder SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin. | High | Platform Analytics | File | Credential Access |
| BIOC | Suspicious executable created in a .NET directory Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe. | High | Platform Analytics | File | Defense Evasion |