Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
3 detectors match the current filters. technique: T1053 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Persistence using cron jobs Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware. | Informational | Platform Analytics | File | Persistence |
| BIOC | Scheduled task created with HTTP or FTP reference Scheduled tasks don't normally include web URLs and may indicate malware activity. | Low | Platform Analytics | Process execution | Execution |
| BIOC | Task scheduled by commonly abused host process Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use. | Informational | Platform Analytics | Process execution | Persistence |