Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
3 detectors match the current filters. tactic: TA0004 ✕ technique: T1053 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Interactive at.exe privilege escalation method Detects an interactive AT scheduled task, which may be used as a form of privilege escalation. | Low | Platform Analytics | XDR Agent | Execution, Privilege Escalation |
| Analytics BIOC | Suspicious container orchestration job A suspicious orchestration job ran with a rare command line. | Low | Platform Analytics | XDR Agent | Execution, Persistence, Privilege Escalation |
| Analytics BIOC | Suspicious systemd timer activity Suspicious systemd timer activity, which may indicate an attempt to establish persistence. | Low | Platform Analytics | XDR Agent | Execution, Persistence, Privilege Escalation |