Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
5 detectors match the current filters. tactic: TA0007 ✕ technique: T1016 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics | Multiple discovery commands The alerted causality performed multiple discovery commands in a short timeframe. | Low | Platform Analytics | XDR Agent | Discovery |
| Analytics | Multiple discovery commands on a Windows host by the same process The alerted process performed multiple discovery commands in a short timeframe. | Low | Platform Analytics | XDR Agent | Discovery |
| Analytics BIOC | Uncommon ARP cache listing via arp.exe The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache. Adversaries may attempt to use the command to discover remote systems they could compromise. | Low | Platform Analytics | XDR Agent | Discovery |
| Analytics BIOC | Uncommon IP Configuration Listing via ipconfig.exe The 'ipconfig' command is used to display TCP/IP network configuration information and refresh the Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Adversaries may use the command to discover network configuration details. | Low | Platform Analytics | XDR Agent | Discovery |
| Analytics BIOC | Uncommon routing table listing via route.exe The route.exe command is used to display and modify entries in the local IP routing table. Adversaries may attempt to use the command to discover remote systems they could compromise. | Low | Platform Analytics | XDR Agent | Discovery |