Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
2 detectors match the current filters. technique: T1078 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | PsExec runs with System privileges PsExec.exe is a Windows administrative tool, it can be used to elevate privileges and run other processes with NT/System privilege level. | Informational | Platform Analytics | Process execution | Privilege Escalation |
| BIOC | User account flagged as hidden Look for unsigned processes that add an entry to the hidden users Registry key. | Informational | Platform Analytics | Registry | Defense Evasion |