Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
8 detectors match the current filters. tactic: TA0003 ✕ technique: T1176 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A browser extension was installed or loaded in an uncommon way A browser extension was installed or loaded in an uncommon way. | Informational | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence |
| Analytics BIOC | Browser Extension Installed Uncommon browser extension installed. | Informational | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence |
| Correlation Rule | Chrome - Chrome Extension Install Event The extension $xdm.target.resource.name was installed on $xdm.source.host.hostname by $xdm.intermediate.user.username | Low | Platform Analytics | google_workspace_chrome_raw | Persistence |
| Analytics BIOC | Chrome Extension Installed By User A Chrome extension was installed or updated by a Google Workspace user. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Initial Access, Persistence |
| BIOC | Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions. | Low | Platform Analytics | Process execution | Persistence |
| BIOC | Manipulation of Firefox plugins and extensions via the Registry Plugins and extensions are loaded from all of these Registry keys. | Medium | Platform Analytics | Registry | Persistence |
| Analytics | Rare access to known advertising domains The endpoint performed many connections to unpopular advertising domains. This could indicate the presence of adware on the endpoint. | Informational | Platform Analytics | Palo Alto Networks Firewall EAL Logs, XDR Agent | Command and Control, Persistence |
| Analytics BIOC | Uncommon browser extension loaded An uncommon browser extension was loaded by a Chromium-based browser. | Informational | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence |