Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

50 detectors match the current filters. tactic: TA0003 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
BIOC Account creation via command-line tool The useradd/adduser command could be used to create user accounts or to add users to existing groups. Informational Platform Analytics Process execution Persistence
BIOC Active Setup Registry Autostart Suspicious modification of the active setup registry for persistence and privilege escalation. Low Platform Analytics Registry Persistence
BIOC Bitsadmin.exe used to download data Some attacks were known for abusing BITSAdmin in the past to hide how data was downloaded using legitimate Windows tools. Informational Platform Analytics Process execution Persistence
BIOC Chrome runs with key security features disabled This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions. Low Platform Analytics Process execution Persistence
BIOC Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique. Informational Platform Analytics Process execution Persistence
BIOC Creation of a new Microsoft Office default template Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence. Informational Platform Analytics File Persistence
BIOC Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits. Informational Platform Analytics Process execution Persistence
BIOC Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits. Informational Platform Analytics Process execution Persistence
BIOC Manipulation of 'BootExecute' Registry run key Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence. Informational Platform Analytics Registry Persistence
BIOC Manipulation of AppInit DLL loading list The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on. Informational Platform Analytics Registry Persistence
BIOC Manipulation of Application Verifier custom providers The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application. Informational Platform Analytics Registry Persistence
BIOC Manipulation of autostart related system files May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows. Informational Platform Analytics File Persistence
BIOC Manipulation of default file association configuration When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened. Informational Platform Analytics Registry Persistence
BIOC Manipulation of default file extension configuration Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions. Low Platform Analytics Registry Persistence
BIOC Manipulation of Firefox plugins and extensions via the Registry Plugins and extensions are loaded from all of these Registry keys. Medium Platform Analytics Registry Persistence
BIOC Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths. Informational Platform Analytics Registry Persistence
BIOC Manipulation of the MonitorProcess Registry key Entries added under the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit can be used to run malicious code and help attackers gain persistence. Medium Platform Analytics Registry Persistence
BIOC Manipulation of Winlogon 'Notify' autostart Registry key Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs. Informational Platform Analytics Registry Persistence
BIOC Manipulation of Winlogon 'UserInit' autostart Registry key Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon. Medium Platform Analytics Registry Persistence
BIOC Modification of default Windows startup path via Registry An attacker may modify the startup path to the location of the malware. Informational Platform Analytics Registry Persistence
BIOC Modification of logon scripts via Registry Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence. Medium Platform Analytics Registry Persistence
BIOC Modification of systemd service files An attacker may create or modify systemd service unit files to establish persistence between reboots. Informational Platform Analytics File Persistence
BIOC Modification of the Winlogon\Shell Registry key Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell. Informational Platform Analytics Registry Persistence
BIOC Multiple RDP sessions enabled via Registry Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does. Medium Platform Analytics Registry Persistence, Lateral Movement
BIOC New entry added to startup related Registry keys by unsigned process Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level. Informational Platform Analytics Registry Persistence
BIOC New local user created via PowerShell command line Attackers may create new local users to persist access to machines. Medium Platform Analytics Process execution Persistence
BIOC New service created via command line Attackers may leverage services to gain persistence on an endpoint. Informational Platform Analytics Process execution Persistence
BIOC Persistence through service registration An attacker may add or modify system services to persist on a host. Informational Platform Analytics File Persistence
BIOC Persistence using bashrc files Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution. Informational Platform Analytics File Persistence
BIOC Persistence using cron jobs Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware. Informational Platform Analytics File Persistence
BIOC Persistence via Registry screensaver key change Attackers may install their malware persistently by modifying the value of the screensaver Registry key. Informational Platform Analytics Registry Persistence
BIOC Port Monitor added in Registry Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation. Low Platform Analytics Registry Persistence
BIOC Possible web shell command execution Possible command execution via a web shell for reconnaissance. Informational Platform Analytics Process execution Persistence
BIOC Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory. Informational Platform Analytics File Persistence
BIOC Potential web shell installation A web-app script file was installed on a web server. This can indicate an installation of web shell. Informational Platform Analytics File Persistence
BIOC PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine. Low Platform Analytics Process execution Persistence
BIOC PowerShell downloads files via BITS This PowerShell argument is often used to run commands with malicious intent. Medium Platform Analytics Process execution Persistence
BIOC Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence. Low Platform Analytics Registry Persistence
BIOC Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API. Informational Platform Analytics Registry Persistence
BIOC Shim database file access An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence. Informational Platform Analytics File Persistence, Privilege Escalation
BIOC Shim database registration via Registry Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry. Informational Platform Analytics Registry Persistence
BIOC Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS. Low Platform Analytics Registry Privilege Escalation, Persistence
BIOC Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048). Medium Platform Analytics Registry Privilege Escalation, Persistence
BIOC Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique. Informational Platform Analytics File Persistence
BIOC Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique. Informational Platform Analytics File Persistence
BIOC Tampering with Windows Security Support Provider DLLs Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002. Informational Platform Analytics Registry Persistence
BIOC Task scheduled by commonly abused host process Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use. Informational Platform Analytics Process execution Persistence
BIOC User added to local administrator group using a PowerShell command Adding a new user to the local admin group may or may not be malicious, but it is an outstanding action worth considering, as it shouldn't happen too often. A malware may add a new malicious user to the administrators group as a way of maintaining high privileges after the system was compromised. Medium Platform Analytics Process execution Persistence
BIOC User creation or modification via /etc file Attackers may create new users or modify existing users by directly modifying /etc/passwd and /etc/shadow. Informational Platform Analytics File Persistence
BIOC Write to .bash_profile Commands in ~/.bash_profile are executed on every user shell login with a username and password. Informational Platform Analytics File Persistence