Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

BIOC 3

Severity (1) ▾

Informational 3 Low 2 Medium 1

Module / licence ▾

Platform Analytics 3

Agent event type ▾

BIOCs only

Process execution 2 File 1

Category ▾

BIOCs and correlation rules

Credential Access 3

Status ▾

BIOCs only

Enabled 3

3 detectors match the current filters. technique: T1056 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
BIOC	GUI Input Capture Prompt user to supply a password in response to a System Preference dialog pop up message.	Informational	Platform Analytics	Process execution	Credential Access
BIOC	Shell History Access Access to files holding shell history information.	Informational	Platform Analytics	File	Credential Access, Collection
BIOC	Shell History Access Access to files holding shell history information.	Informational	Platform Analytics	Process execution	Credential Access, Collection