Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

22 detectors match the current filters. tactic: TA0005 ✕ technique: T1564 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks. Informational Identity Threat Detection (ITDR) XDR Agent Defense Evasion
Analytics BIOC Azure application removed An Azure application has been deleted. Informational Cortex Cloud Azure Audit Log Defense Evasion
Analytics BIOC Email containing a redirected link An email with a redirected link has been detected. Informational Email Security Microsoft 365 Emails Defense Evasion, Execution
Analytics BIOC Email with URL shortener detected A URL shortener was detected in the email body. Informational Email Security Microsoft 365 Emails Defense Evasion
Analytics BIOC Exchange email-hiding inbox rule A user configured an Exchange inbox rule that may be used to hide emails. Informational Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security Office 365 Audit Defense Evasion
Analytics BIOC Exchange email-hiding transport rule A user configured an Exchange transport rule that may be used to hide emails in the organization. Informational Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security Office 365 Audit Defense Evasion
Analytics BIOC Hidden Attribute was added to a file using attrib.exe Hidden attribute was added to a file using attrib.exe, adversaries may set files to be hidden to evade detection mechanisms. Informational Platform Analytics XDR Agent Defense Evasion
BIOC Hidden directory creation Attackers may create hidden directories to hide malware or staged files. Informational Platform Analytics Process execution Defense Evasion
BIOC Hidden file and directory creation Creation of a hidden file inside a hidden directory. Informational Platform Analytics File Defense Evasion
BIOC ISO mounted manually A user manually mounted an ISO file. Informational Platform Analytics File Defense Evasion
Analytics BIOC Masquerading as a default local account A user created a new local account with the name of a default local account, such as Guest and DefaultAccount. An attacker may create a user with these known names to evade detection. Low Identity Analytics Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion, Persistence
Analytics BIOC New addition to Windows Defender exclusion list Windows Defender keeps the exclusion list in the registry, and any addition to it will cause it to ignore a process, path or file extension. Low Platform Analytics XDR Agent Defense Evasion
Analytics BIOC Procdump executed from an atypical directory Procdump.exe is a SysInternals tool used to dump process memory; it can be used to dump lsass.exe memory to extract credentials. Medium Platform Analytics XDR Agent Defense Evasion, Credential Access
BIOC Process runs from the recycle bin Process running from the recycle bin. Low Platform Analytics Process execution Defense Evasion
Analytics BIOC Scheduled Task hidden by registry modification Attackers may try to hide a Scheduled Task by deleting the Scheduled Task's software descriptor (SD) value in the registry. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion
BIOC Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file. Informational Platform Analytics File Defense Evasion
Analytics BIOC Suspicious hidden user created A user account was created with a name that mimics a machine account. Medium Identity Analytics Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) Persistence, Defense Evasion
Analytics BIOC Suspicious process execution from tmp folder An unpopular process was executed from the tmp folder. Informational Platform Analytics XDR Agent Defense Evasion
BIOC The scripting engine executed code from an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Unpopular rsync process execution An unpopular rsync process was executed on the host. Informational Platform Analytics XDR Agent Defense Evasion
BIOC Unsigned process creates an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS. Informational Platform Analytics File Defense Evasion
BIOC Unsigned process running from a temporary directory Malware often runs from a temporary folder. Informational Platform Analytics Process execution Defense Evasion