Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
11 detectors match the current filters. tactic: TA0001 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Adobe Acrobat Reader drops an executable file to disk The Acrobat Reader process dropped a new executable file to the disk. Unusual activity, possibly indicative of exploitation or social engineering attempt. | Informational | Platform Analytics | File | Initial Access |
| BIOC | Adobe reader spawns a browser If a user clicks a URL link contained in a PDF document, it will cause the Adobe Reader process to spawn a browser process. It has legitimate uses, but check for possible phishing attempts. | Informational | Platform Analytics | Process execution | Initial Access |
| BIOC | Excel Web Query file created on disk Excel uses Excel Web Query (.iqy) files to download data from the internet. There are campaigns in which .iqy files download a PowerShell script, which is launched via Excel and kicks off a chain of malicious downloads. | Informational | Platform Analytics | File | Initial Access |
| BIOC | Exchange process writing aspx files An exchange process is writing to .aspx files. This may be an actor dropping web shells. | High | Platform Analytics | File | Initial Access, Command and Control |
| BIOC | Office document embeds a .LNK file An Office process spawned a process with an argument indicating that the document contains an embedded .LNK file. | Informational | Platform Analytics | Process execution | Initial Access |
| BIOC | Office process spawns verclsid.exe A Microsoft Office process launching verclsid.exe may be a sign of phishing. | Informational | Platform Analytics | Process execution | Initial Access |
| BIOC | Out of band testing domain connection Connection from web service process to out-of-band-testing domain. | Low | Platform Analytics | Network | Initial Access |
| BIOC | Outlook creates an executable file on disk Common weaponized Office document behavior, as Outlook should not create binary files at all. | Informational | Platform Analytics | File | Initial Access |
| BIOC | SunBurst Module loaded Sunburst malware hash loaded into SolarWinds.BusinessLayerHost.exe. | High | Platform Analytics | Module | Initial Access, Command and Control |
| BIOC | Web server process drops an executable to disk Web server processes should not normally write executable files out to the local filesystem. This may have legitimate uses in certain web applications, yet check for possible exploitation of the hosted web application. | Informational | Platform Analytics | File | Initial Access |
| BIOC | Web server spawns an unsigned process Web server processes should normally only carry out tasks related to serving web applications. This instance has spawned an unsigned process, which may indicate a successful exploitation attempt of the associated web application. | Informational | Platform Analytics | Process execution | Initial Access |