Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
6 detectors match the current filters. tactic: TA0003 ✕ technique: T1543 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Modification of systemd service files An attacker may create or modify systemd service unit files to establish persistence between reboots. | Informational | Platform Analytics | File | Persistence |
| BIOC | New service created via command line Attackers may leverage services to gain persistence on an endpoint. | Informational | Platform Analytics | Process execution | Persistence |
| BIOC | Persistence through service registration An attacker may add or modify system services to persist on a host. | Informational | Platform Analytics | File | Persistence |
| Analytics BIOC | Uncommon Launch Agent persistency was registered or modified An uncommon Launch Agent persistence mechanism was registered/modified on the system. | Informational | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Uncommon Launch Daemon persistency was registered or modified An uncommon Launch Daemon persistence mechanism was registered/modified on the system. | Informational | Platform Analytics | XDR Agent | Persistence |