Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
10 detectors match the current filters. technique: T1053 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A Kubernetes Cronjob was created A Kubernetes CronJob was created. | Informational | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs | Persistence |
| Analytics BIOC | An AWS Lambda Function was created An AWS Lambda Function was created. | Informational | Cortex Cloud | AWS Audit Log | Execution, Persistence |
| Analytics BIOC | An uncommon lolbin execution by scheduled task A lolbin was executed with uncommon commandline by a scheduled task. | Informational | Platform Analytics | XDR Agent | Persistence |
| BIOC | Persistence using cron jobs Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware. | Informational | Platform Analytics | File | Persistence |
| Analytics BIOC | Rare scheduled task created A new rare scheduled task was created with a rare path and a rare command line. | Informational | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence |
| Analytics BIOC | Rare Scheduled Task RPC activity The endpoint performed abnormal Scheduled Task RPC activity to a remote host. | Informational | Platform Analytics | Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH) | Lateral Movement, Persistence |
| Analytics BIOC | Signed process creates a scheduled task via file access A signed process created a scheduled task via file access. Attackers may create scheduled tasks for execution and to establish persistence. | Informational | Platform Analytics | XDR Agent | Execution, Persistence |
| BIOC | Task scheduled by commonly abused host process Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use. | Informational | Platform Analytics | Process execution | Persistence |
| Analytics BIOC | Uncommon local scheduled task creation via schtasks.exe The schtasks.exe command enables creating, deleting, querying, changing, running, and ending scheduled tasks on a local or remote computer. Adversaries may attempt to use the command to gain persistence on this host using scheduled tasks. | Informational | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Uncommon signed process execution by scheduled task An uncommon process was executed by a scheduled task. | Informational | Platform Analytics | XDR Agent | Persistence |