Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
24 detectors match the current filters. tactic: TA0042 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A new Azure email domain verification was requested A new Azure email domain verification was requested. | Informational | Cortex Cloud | Azure Audit Log | Resource Development |
| Analytics BIOC | A possible risky login to Azure A risky sign-in attempt was observed in Azure. | Informational | Identity Analytics | AzureAD | Initial Access, Resource Development |
| Analytics BIOC | A user connected from a new country A user connected from an unusual country that the user has not connected from before. This may indicate the account was compromised. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Credential Access, Resource Development |
| Analytics BIOC | A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised. | Informational | Identity Analytics | Palo Alto Networks Global Protect, Third-Party VPNs | Credential Access, Resource Development |
| Analytics BIOC | A user logged in from an abnormal country or ASN A user logged in from an unusual country or ASN. This may indicate that the account was compromised. | Informational | Identity Analytics | XDR Agent | Credential Access, Resource Development |
| Analytics BIOC | An AWS Route 53 domain was transferred to another AWS account An AWS Route 53 domain was transferred to another AWS account. | Informational | Cortex Cloud | AWS Audit Log | Resource Development |
| Analytics BIOC | Cloud email sending was enabled Cloud email sending was enabled for the cloud account. | Informational | Cortex Cloud | AWS Audit Log | Resource Development |
| Analytics BIOC | First connection from a country in organization A user connected to an SSO service from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Credential Access, Resource Development |
| Analytics BIOC | First VPN access attempt from a country in organization A user attempted to connect from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised. | Informational | Identity Analytics | Palo Alto Networks Global Protect, Third-Party VPNs | Credential Access, Resource Development |
| Analytics | IP Rotation Pattern in SSO Spray A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Credential Access, Resource Development |
| Analytics | Multiple Okta MFA requests sent to a user Multiple SSO MFA attempts were sent to the user. This may indicate an MFA fatigue attack. | Informational | Identity Analytics | Okta | Credential Access, Resource Development |
| Analytics BIOC | OneDrive file upload A file was uploaded to OneDrive using Microsoft Graph API. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Resource Development |
| Analytics | Possible Brute Force in universal authentication An abnormally high amount of authentication attempts via universal authentication were seen within a short period of time. This may indicate a brute-force attack. | Informational | Identity Analytics | Credential Access, Resource Development | |
| Analytics | Possible Impossible Travel Pattern - SSO A user logged in from several countries in a short period, including at least one location that is rare for the user or organization. This suspicious activity may be a sign of credential theft. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Initial Access, Resource Development |
| Analytics | Possible Password Spray in universal authentication An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack. | Informational | Identity Analytics | Credential Access, Resource Development | |
| Analytics BIOC | SES Production Access Requested An identity requested to move the SES account from a restricted sandbox mode into production mode. | Informational | Cortex Cloud | AWS Audit Log | Resource Development |
| BIOC | Simulation activity by AttackIQ Simulation activity performed by AttackIQ agent. | Informational | Platform Analytics | File | Execution, Resource Development |
| BIOC | Simulation activity by Cymulate Simulation activity performed by Cymulate agent. | Informational | Platform Analytics | File | Execution, Resource Development |
| BIOC | Simulation activity by SafeBreach Simulation activity performed by a SafeBreach agent. | Informational | Platform Analytics | File | Execution, Resource Development |
| Analytics | SSO Brute Force An abnormally high amount of SSO authentication attempts were seen within a short period of time. This may have resulted from a brute-force attack. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Credential Access, Resource Development |
| Analytics | SSO Password Spray An abnormally high amount of SSO authentication attempts were seen within a short period of time. This may have resulted from a login password spray attack. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Credential Access, Resource Development |
| Analytics BIOC | Untrusted process contacted LLM API An untrusted process contacted an LLM API. | Informational | Platform Analytics | XDR Agent | Resource Development |
| Analytics BIOC | User attempted to connect from a suspicious country A user connected from an unusual country. This may indicate the account was compromised. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Credential Access, Resource Development |
| Analytics | VPN login Brute-Force attempt A user account failed to log in to a VPN service multiple times in a short time period. This may indicate a brute-force attack. | Informational | Identity Analytics | Palo Alto Networks Global Protect, Third-Party VPNs | Credential Access, Resource Development |