Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

7 detectors match the current filters. technique: T1140 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
BIOC Base64 decoding using the base64 utility Base64 decoding using the base64 utility with the -d argument provided. Informational Platform Analytics Process execution Defense Evasion
BIOC Commonly abused process executed with obfuscated characters Commonly abused process executed with obfuscated characters. Informational Platform Analytics Process execution Defense Evasion
Analytics BIOC Encoded information using Windows certificate management tool Encoding/decoding to/from using certutil.exe could be used to evade detection. Medium Platform Analytics XDR Agent Defense Evasion
BIOC Encoded VBScript executed Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding. High Platform Analytics Process execution Execution, Defense Evasion
Analytics BIOC Possible data obfuscation A command that can be used for file obfuscation was executed with an uncommon command line. Informational Platform Analytics XDR Agent Defense Evasion
Analytics Potential extraction of NAA Account Credentials in Microsoft Configuration Manager Possible user attempt to deobfuscate Network Access Account (NAA) credentials in Microsoft Configuration Manager. This may indicate a compromised account. Low Identity Analytics AzureAD Audit Log, Microsoft Graph Logs, Office 365 Audit, Okta, Palo Alto Networks Global Protect, Third-Party VPNs, XDR Agent, XDR Agent with eXtended Threat Hunting (XTH) Credential Access, Defense Evasion
Analytics BIOC Suspicious AMSI decode attempt A script has executed commands that can be used to decode commands or files. Informational Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Defense Evasion