Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics BIOC 4

Severity (1) ▾

Informational 4 Low 1 Medium 1

Module / licence ▾

Email Security 4

Data source ▾

Analytics and correlation rules

Microsoft 365 Emails 4

Detector tag ▾

Analytics only

Malicious URLs 2

4 detectors match the current filters. tactic: TA0002 ✕ technique: T1036 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Email attachment with multiple extensions The email includes an attachment(s) with two extensions. The first one being an executable extension. This may indicate an attempt at masquerading the true file type through the misuse of multiple extensions in the attachment name.	Informational	Email Security	Microsoft 365 Emails	Execution, Defense Evasion
Analytics BIOC	Email attachment(s) with potentially malicious MIME type The email message contains an attachment(s) with a potentially malicious MIME type.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion, Execution
Analytics BIOC	Email containing a link with an IP address convention was detected A link with IP address convention was detected within the email body.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion, Execution
Analytics BIOC	Punycode characters detected in URL(s) Punycode character(s) detected within URL(s) in email content.	Informational	Email Security	Microsoft 365 Emails	Defense Evasion, Execution