Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
3 detectors match the current filters. technique: T1071 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Uncommon Linux process communication to a rare external host An uncommon process is connecting to an external domain that is rarely accessed within the organization. This connection pattern is consistent with malware initiating connection to its command and control server. | Informational | Platform Analytics | XDR Agent | Command and Control |
| Analytics BIOC | Uncommon macOS process communication to a rare external host An uncommon process is connecting to an external host that is rarely accessed within the organization. This connection pattern is consistent with malicious activity such as command and control execution, malware download and so on. | Informational | Platform Analytics | XDR Agent | Command and Control |
| Analytics BIOC | Uncommon recurring rare external host access A process has established recurring connections to an uncommon external host. | Informational | Platform Analytics | XDR Agent | Command and Control, Exfiltration |