Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type (1) ▾

Analytics BIOC 1 BIOC 4

Severity ▾

Informational 3 Low 1

Module / licence ▾

Platform Analytics 4

Agent event type ▾

BIOCs only

Process execution 4

Category ▾

BIOCs and correlation rules

Discovery 4

Status ▾

BIOCs only

Enabled 4

4 detectors match the current filters. technique: T1135 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
BIOC	Linux network share discovery A Linux network share discovery command was executed.	Informational	Platform Analytics	Process execution	Discovery
BIOC	Mounted NFS share discovery Attackers may use the showmount command to list mount Network File Sharing shares.	Informational	Platform Analytics	Process execution	Discovery
BIOC	Network share discovery via command-line tool Attackers may use command-line tools to discover mapped shares on the host.	Low	Platform Analytics	Process execution	Discovery
BIOC	SMB enumeration via command-line tool Attackers may use SMB enumeration to retrieve information about network shares, printers, and other resources.	Informational	Platform Analytics	Process execution	Discovery