Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
16 detectors match the current filters. tactic: TA0007 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics | An internal Cloud resource performed port scan on external networks An internal cloud resource attempted to connect to the same destination port of multiple external IP addresses. This may be a result of the cloud resource being hijacked by an attacker. Attackers perform port scans on a specific destination port for reconnaissance purposes, to detect known vulnerable services that accept connections in the specific port, and perform targeted attacks against them. | Medium | Cortex Cloud | XDR Agent | Discovery, Impact |
| Analytics BIOC | Discovery of misconfigured certificate templates using LDAP An LDAP query searching for misconfigured certificate templates was executed. | Medium | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Discovery |
| BIOC | DNS reconnaissance or enumeration via DNSRecon DNSRecon enables DNS reconnaissance and enumeration, and may be used by attackers to learn about targets' network infrastructure. | Medium | Platform Analytics | Process execution | Discovery |
| BIOC | Execution of Fsociety tool pack The Fsociety tool pack is an array of tools for information gathering, password attacks, exploitation, and more. | Medium | Platform Analytics | Process execution | Discovery, Credential Access |
| Analytics BIOC | Kerberos Traffic from Non-Standard Process The endpoint had a non-standard process communicating over ports normally used by Kerberos. An attacker might be using malicious tools to move laterally. | Medium | Platform Analytics | XDR Agent | Discovery |
| Analytics | Kerberos User Enumeration A high amount of Kerberos principal unknown errors were generated on users in the last hour. This may be indicative of Kerberos user enumeration. | Medium | Identity Analytics | Palo Alto Networks Firewall traffic Logs, XDR Agent | Discovery |
| Analytics BIOC | Kubernetes vulnerability scanner activity A Kubernetes cluster was scanned by a known vulnerability scanner. | Medium | Platform Analytics | XDR Agent | Execution, Discovery |
| Analytics BIOC | Kubernetes vulnerability scanning tool usage A known vulnerability scanning tool was used within a Kubernetes cluster. | Medium | Cortex Cloud | AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs | Execution, Discovery |
| BIOC | Possible Firefox browser history and bookmarks collection via command-line tool Attackers may collect history and bookmarks details by accessing the Firefox database. | Medium | Platform Analytics | Process execution | Discovery |
| BIOC | Possible ping sweep Ping sweeps are useful tools that can detect which machines are up in the network and can be the step before lateral movement. | Medium | Platform Analytics | Process execution | Discovery |
| BIOC | PowerShell dumps users and roles from Exchange server PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign). | Medium | Platform Analytics | Process execution | Discovery |
| BIOC | SharpHound LDAP query SharpHound is a BloodHound ingestor that performs LDAP queries to enumerate Active Directory. | Medium | Platform Analytics | Windows event log | Discovery |
| Analytics | Suspicious Azure enumeration activity An Azure identity performed resource enumeration across multiple services using Microsoft Graph. | Medium | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Discovery |
| Analytics BIOC | Suspicious PowerSploit's recon module (PowerView) net function was executed An attacker may use PowerSploit to reconnaissance the network. | Medium | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Discovery |
| Analytics BIOC | Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts An attacker may use PowerSploit to reconnaissance the network for exposed hosts to move laterally to. | Medium | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Discovery |
| BIOC | Virtual Directory configuration access via PowerShell PowerShell was used to dump Exchange Web Service (EWS) Virtual Directories, which may indicate malicious behavior, for example, SolarStorm campaign. | Medium | Platform Analytics | Process execution | Discovery |