Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
8 detectors match the current filters. technique: T1547 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A contained executable was executed by an unusual process A Docker-contained executable from a mounted share was executed on a host. Running a contained executable is highly dangerous and atypical. | Medium | Platform Analytics | XDR Agent | Privilege Escalation, Persistence |
| BIOC | Manipulation of Winlogon 'UserInit' autostart Registry key Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon. | Medium | Platform Analytics | Registry | Persistence |
| Analytics BIOC | Possible Persistence via group policy Registry keys Group Policy registry keys were read during system startup. This behavior may indicate a persistence mechanism that triggers on reboot to execute malicious code. | Medium | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence |
| Analytics BIOC | Script file added to startup-related Registry keys An attacker may add a script file to the Registry "Run Keys" or the "Winlogon\Userinit" key to cause it to be executed as the user logs in. | Medium | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Suspicious authentication package registered The endpoint registered a suspicious authentication package, which may be used to gain persistence on the host by loading libraries into the time management service. | Medium | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Suspicious print processor registered The endpoint registered a new print processor, which may be used to gain persistence on the host by loading libraries into the time management service. | Medium | Platform Analytics | XDR Agent | Persistence |
| BIOC | Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048). | Medium | Platform Analytics | Registry | Privilege Escalation, Persistence |
| Analytics BIOC | Suspicious time provider registered The endpoint time provider has been tampered, this change may be used to gain persistence on the host by loading libraries into the time management service. | Medium | Platform Analytics | XDR Agent | Persistence |