Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
22 detectors match the current filters. tactic: TA0040 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Azure account deletion by a non-standard account An Azure AD account deletion was performed by a user that doesn't typically delete users. | Low | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Impact |
| Analytics BIOC | Billing admin role was removed Sensitive Action - Billing admin role was removed. | Low | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Impact |
| Analytics BIOC | Disable encryption operations Encryption was disabled on the servers that host EC2 instances, both for data-at-rest and data-in-transit. | Low | Cortex Cloud | AWS Audit Log | Impact |
| Analytics BIOC | GCP IAM deny policy creation An identity created a GCP IAM deny policy. | Low | Cortex Cloud | Gcp Audit Log | Impact |
| BIOC | Internet Explorer home page modification The Internet Explorer home page could be changed to a malicious page. | Low | Platform Analytics | Registry | Impact, Credential Access |
| Analytics | Logs were not collected from a data source for an abnormally long time Logs were not collected from a data source for an abnormally long time. | Low | Platform Analytics | Health Monitoring Data | Impact |
| Analytics | ML artifacts destruction An identity deleted multiple ML artifacts. | Low | Cortex Cloud | AWS Audit Log, Gcp Audit Log | Impact |
| Analytics | Multiple Azure AD admin role removals An Azure AD identity removed multiple administrators from their roles. | Low | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Impact |
| Analytics | Possible Insider Threat Activity A user was observed performing suspicious activity that might indicate an attempt to use their access to organizational resources for personal gain. | Low | Identity Threat Detection (ITDR) | AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH) | Impact |
| Analytics | Potential denial of wallet abusing AI services An ML model experienced a sudden spike in requests in a short time. MITRE ATLAS Techniques: AML.T0029 - Denial of ML Service, AML.T0034 - Cost Harvesting. OWASP Top 10 LLM Technique: LLM10 - Unbounded Consumption. | Low | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Impact |
| Analytics | Spam Bot Traffic The endpoint connected to an excessive number of external SMTP servers. A spambot may be trying to send spam email using multiple SMTP servers. Spambots can cause your domain to be blacklisted, and can contain other malicious functionality. The same mechanism can also be used for exfiltration. Some VPN clients can also tunnel data over SMTP. Note: This detection model looks for SMTP connections to external servers, but the volume of traffic is not considered. A count is performed based on the number of domains being contacted, as well as the number of unresolved IP addresses. | Low | Platform Analytics | Palo Alto Networks Firewall traffic Logs, XDR Agent, Third-Party Firewalls | Impact |
| Analytics BIOC | Suspicious AI Dataset Download A model dataset was accessed by an identity that typically doesn't interact with dataset files. MITRE ATLAS Technique: AML.T0035 - ML Artifact Collection. | Low | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Impact |
| Analytics BIOC | Suspicious AI Dataset Label Modification AI Dataset labels were modified by an identity that typically doesn't interact with labels. MITRE ATLAS Technique: AML.T0020 - Poison Training Data. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning. | Low | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Impact |
| Analytics BIOC | Suspicious data encryption Known applications were used to encrypt data within a machine's local file system. | Low | Platform Analytics | XDR Agent | Impact, Defense Evasion |
| Analytics | Suspicious EBS snapshots deletion An identity deleted multiple EBS snapshots from the project, considerably more than usual. | Low | Cortex Cloud | AWS Audit Log | Impact |
| Analytics | Suspicious ICMP traffic that resembles smurf attack ICMP smurf attack was used. | Low | Platform Analytics | XDR Agent | Impact |
| BIOC | Tampering with the Windows System Restore configuration System Restore was disabled on the endpoint. In such a case, one may not be able to recover files in case of disaster. This may be initiated by the IT department, but also may indicate malicious activity such as ransomware. | Low | Platform Analytics | Registry | Defense Evasion, Impact |
| Analytics BIOC | Unusual AI dataset modification A cloud identity modified an AI dataset. MITRE ATLAS Techniques: AML.T0059 - Erode Dataset Integrity, AML.T0018.000 - Backdoor ML Model: Poison ML Model. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning. | Low | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log | Impact |
| Analytics BIOC | Unusual AI Knowledge Base Modification An AI knowledge base was modified by an identity that typically doesn't interact with knowledge bases. MITRE ATLAS Technique: AML.T0070 - RAG Poisoning. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning. | Low | Cortex Cloud | AWS Audit Log, Gcp Audit Log | Impact |
| Analytics BIOC | Unusual AI RAG Knowledge Base Modification AI knowledge base was modified by an identity that typically doesn't interact with knowledge bases. MITRE ATLAS Technique: AML.T0070 - RAG Poisoning. OWASP Top 10 LLM Technique: LLM04 - Data and Model Poisoning. | Low | Cortex Cloud | AWS Audit Log, Gcp Audit Log | Impact |
| Analytics BIOC | Windows Event Log was cleared using wevtutil.exe A command-line utility was used to clear the Windows Event Log. It may be used to delete logs to cover the tracks of the malicious activity, making it harder to perform analysis. | Low | Platform Analytics | XDR Agent | Impact |
| BIOC | Windows File Protection being disabled via Registry Windows File Protection (WFP) prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and by other programs. Protecting these files prevents problems with programs and the operating system. | Low | Platform Analytics | Registry | Impact |