Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
10 detectors match the current filters. tactic: TA0005 ✕ technique: T1574 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| BIOC | DLL sideloading attack using Xwizard Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack. | Low | Platform Analytics | Process execution | Defense Evasion |
| Analytics BIOC | Globally uncommon image load from a signed process A signed process loaded a DLL that, on a global level, it usually doesn't load. | Informational | Platform Analytics | XDR Agent | Defense Evasion |
| Analytics BIOC | Modification of the AD FS IdentityServer configuration file The AD FS service configuration file was modified. | Informational | Identity Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence, Defense Evasion |
| Analytics BIOC | Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| Analytics BIOC | Possible DLL Search Order Hijacking An attacker might abuse the Windows DLL search order to trigger known, signed processes to load the attacker's malicious module. | Low | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| BIOC | Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI). | Low | Platform Analytics | Module | Defense Evasion |
| Analytics BIOC | Uncommon DLL-sideloading from a logical CD-ROM (ISO) device A DLL was loaded by an executable from the same folder on a logical CD-ROM device (ISO). | Medium | Platform Analytics | XDR Agent | Execution, Defense Evasion, Privilege Escalation |
| Analytics BIOC | Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |
| Analytics BIOC | Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder. | Informational | Platform Analytics | XDR Agent | Persistence, Privilege Escalation, Defense Evasion |