Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

43 detectors match the current filters. technique: T1204 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
Analytics BIOC A Kubernetes service account executed an unusual API call A Kubernetes service account executed an unusual API call. Informational Cortex Cloud AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs Execution
Analytics BIOC A suspicious executable with multiple file extensions was created An executable file with multiple extensions was created. This technique is frequently used to disguise malware as user content. Medium Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Execution, Defense Evasion
Analytics BIOC Bronze-Bit exploit A forwardable Kerberos ticket for delegation of a Protected User was observed. High Platform Analytics Palo Alto Networks Firewall EAL Logs, XDR Agent with eXtended Threat Hunting (XTH) Execution
Analytics BIOC ClickFix - PowerShell executed through the run application An attacker may be trying to trick a user to execute PowerShell through the run application. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Execution, Initial Access
Analytics BIOC Cloud penetration testing tool activity A cloud API was successfully executed using a known cloud penetration testing tool. High Cortex Cloud AWS Audit Log, Azure Audit Log, Gcp Audit Log, Microsoft Graph Logs Execution
Analytics BIOC Contained process execution with a rare GitHub URL A contained process was executed with a suspicious GitHub url in the command line. This may be a legitimate use, but this technique is frequently used by attackers to download malicious payloads. Low Platform Analytics XDR Agent Execution
Analytics BIOC Denied API call by a Kubernetes service account A Kubernetes service account API call was denied. Informational Cortex Cloud AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs Execution
Analytics BIOC Email attachment with a potentially malicious file extension The email message includes attachments with file types that are typically blocked by the email vendor as a precaution due to their suspicious nature. Informational Email Security Microsoft 365 Emails Initial Access, Execution
Analytics BIOC Email attachment with multiple extensions The email includes an attachment(s) with two extensions. The first one being an executable extension. This may indicate an attempt at masquerading the true file type through the misuse of multiple extensions in the attachment name. Informational Email Security Microsoft 365 Emails Execution, Defense Evasion
Analytics BIOC Email attachment with Right-to-Left Override Unicode character The email message contains an attachment with a hidden Right-to-Left Override Unicode character. Low Email Security Microsoft 365 Emails Defense Evasion, Execution
Analytics BIOC Email attachment(s) with potentially malicious MIME type The email message contains an attachment(s) with a potentially malicious MIME type. Informational Email Security Microsoft 365 Emails Defense Evasion, Execution
Analytics BIOC Email containing a link with an IP address convention was detected A link with IP address convention was detected within the email body. Informational Email Security Microsoft 365 Emails Defense Evasion, Execution
Analytics BIOC Email containing a redirected link An email with a redirected link has been detected. Informational Email Security Microsoft 365 Emails Defense Evasion, Execution
Analytics BIOC Email contains URL delivering high-risk file type Emails with URLs linking to file types commonly blocked by email vendors due to their use in malware delivery. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Email with file-sharing link containing auto-download parameter The email contains a link to a file-sharing service that includes parameters likely to trigger automatic download. Low Email Security Microsoft 365 Emails Initial Access, Execution
Analytics BIOC External email with a single internal recipient hidden in BCC External email with mailbox owner hidden in BCC as the only internal recipient. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC First-time attachment exchange Detects when an attachment is sent between individuals for the first time in 30 days. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Globally uncommon process execution from a signed process A signed process has executed a process that, on a global level, it usually doesn't execute. Informational Platform Analytics XDR Agent Execution
Analytics BIOC Initial person-to-person email contact Identifies when a sender initiates contact with individuals with no prior history of interaction in the last 30 days. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Microsoft Office Process Spawning a Suspicious One-Liner A Microsoft Office process spawned a commonly abused process with a full command (not a script), this is a typically malicious behavior. Low Platform Analytics XDR Agent Execution, Initial Access
Analytics BIOC Microsoft Office process spawns a commonly abused process Microsoft Office process spawns a commonly abused process with an uncommon command. Low Platform Analytics XDR Agent Execution, Initial Access
Analytics BIOC Microsoft Office process spawns conhost.exe This unusual parent-child relationship may indicate that a Microsoft Office application executed a console-based application. Low Platform Analytics XDR Agent Execution, Initial Access
Analytics BIOC Moniker link detected in URL(s) A Moniker link was detected within the email's body. The link has the convention of a Moniker link (CVE-2024-21413) correlated to a suspicious URL scheme. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Office process accessed an unusual .LNK file An attacker may embed a .LNK file in an Office document to execute malicious code. Low Platform Analytics XDR Agent with eXtended Threat Hunting (XTH) Execution, Persistence
Analytics BIOC Outbound email contains file-sharing service link sent to external recipient Identifies outbound emails that include links to file-sharing services sent externally. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Outbound email includes an external BCC recipient observed for the first time Internal sender BCC'd an external recipient whose address has not been observed in prior communications. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Outbound email to an address hosted by a public email service provider Internal sender emailed to an address hosted by a public email service provider. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Possible compromised machine account A Kerberos TGT for machine account has been used and does not match the hostname. Medium Platform Analytics XDR Agent Execution
Analytics BIOC Punycode characters detected in URL(s) Punycode character(s) detected within URL(s) in email content. Informational Email Security Microsoft 365 Emails Defense Evasion, Execution
Analytics BIOC Rare LOLBIN Process Execution by User A user executed a living-off-the-land binary (LOLBIN) process that is unusual for this user. This may be indicative of a compromised account. Informational Identity Analytics XDR Agent Execution
Analytics BIOC Rare process execution by user An unusual process was executed by a user. This may be indicative of a compromised account. Informational Identity Analytics XDR Agent Execution
Analytics BIOC Rare process execution in organization An unusual process was executed in the organization. This may be indicative of a compromised account. Informational Identity Analytics XDR Agent Execution
Analytics BIOC Rare Unsigned Process Spawned by Office Process Under Suspicious Directory Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros. Low Platform Analytics XDR Agent Execution
Analytics BIOC Suspicious docker image download from an unusual repository The agent has pulled a docker image from a repository for the first time. Informational Platform Analytics XDR Agent Execution
Analytics BIOC Suspicious SearchProtocolHost.exe parent process SearchProtocolHost.exe has been launched from a process that is different from SearchIndexer.exe This may indicate malicious activity (such as malware later being injected to it, or it being used for phantom DLL hijacking). Medium Platform Analytics XDR Agent Execution, Defense Evasion
Analytics BIOC Uncommon DLL-sideloading from a logical CD-ROM (ISO) device A DLL was loaded by an executable from the same folder on a logical CD-ROM device (ISO). Medium Platform Analytics XDR Agent Execution, Defense Evasion, Privilege Escalation
Analytics BIOC Uncommon URL domain(s) in your organization detected in email We have identified unpopular domain(s) in URL(s) within this email. Informational Email Security Microsoft 365 Emails Initial Access, Execution
Analytics BIOC Unusual file-sharing links for mailbox owner The email contains unusual file-sharing link(s) for mailbox owner. Informational Email Security Microsoft 365 Emails Initial Access, Execution
Analytics BIOC Unusual URL(s) sent by a brand were observed in the email A URL that is not usually associated with the brand has been detected. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Usage of homograph characters detected in an email attachment(s) name Detected characters resembling Latin letters within an email attachment(s) name. This method could be used as a method to evade text or file scanners and analyzers. Informational Email Security Microsoft 365 Emails Execution, Credential Access
Analytics BIOC Windows CGO, actor and action processes with anomalous characteristics Windows CGO, actor and action processes with anomalous characteristics. Informational Platform Analytics XDR Agent Execution
Analytics BIOC Windows CGO, actor process and action module with anomalous characteristics Windows CGO, actor process and action module with anomalous characteristics. Informational Platform Analytics XDR Agent Execution
Analytics BIOC X-Forefront-Antispam-Report has flagged this email as a potential threat This email has been categorized by X-Forefront-Antispam-Report as a threat, suggesting it is likely malicious in nature (e.g., spam, phishing, impersonation, etc.). Informational Email Security Microsoft 365 Emails Initial Access, Defense Evasion, Execution