Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
5 detectors match the current filters. tactic: TA0043 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics | Abnormal RPC traffic to multiple hosts The endpoint performed unfamiliar RPC activity to multiple hosts. | Low | Platform Analytics | Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH) | Reconnaissance |
| Analytics BIOC | Email was received from an unknown sender using a disposable domain The email was received from an unknown sender using a disposable email provider, first seen in the organization in the past month. | Low | Email Security | Microsoft 365 Emails | Reconnaissance, Initial Access |
| Analytics | Subdomain Fuzzing The root domain within the network is experiencing an unusually high number of access requests to its subdomains, significantly exceeding the typical activity levels for that domain. This anomaly could suggest that someone is attempting to enumerate subdomains or uncover additional virtual hosts associated with the domain, possibly as part of a reconnaissance effort to identify vulnerable or less-secured entry points into the network. | Low | Platform Analytics | Palo Alto Networks Firewall EAL Logs, XDR Agent | Reconnaissance |
| Analytics BIOC | Suspicious access of the System Management Container A user accessed the System Management container, which may be an indication of a reconnaissance for site servers. | Low | Identity Analytics | Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) | Reconnaissance |
| Analytics BIOC | Unusual process accessed a messaging app's files An unusual process has accessed files belonging to a messaging app. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Collection, Reconnaissance |