Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

18 detectors match the current filters. technique: T1218 ✕

Download CSV
Type Name Severity Module Data source / event ATT&CK
BIOC Browser downloads an .hta or .application file .hta and .application files are Windows applications that may serve as an attack vector by executing code maliciously using trusted Windows applications. Informational Platform Analytics File Defense Evasion
BIOC Commonly abused process spawns out of rundll32.exe This type of execution happens in .dll based attacks. Informational Platform Analytics Process execution Defense Evasion
BIOC Compiled HTML (help file) makes network connections Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload. Informational Platform Analytics Network Defense Evasion
BIOC Execution of regsvcs/regasm with uncommon paths The regasm.exe/regsvcs.exe commands are used to register .NET COM assemblies, which are typically located in specific paths. Uncommon paths may indicate malicious code is being registered. Informational Platform Analytics Process execution Defense Evasion
BIOC Microsoft Connection Manager Profile Installer loads a file from the users to temporary folder The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application. Low Platform Analytics Process execution Defense Evasion
BIOC Microsoft Connection Manager Profile Installer makes connections to the network The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application. Low Platform Analytics Network Defense Evasion
BIOC Microsoft Connection Manager Profile Installer runs command line or PowerShell The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application. Low Platform Analytics Process execution Defense Evasion
BIOC Microsoft HTML Application Host spawns from CMD or PowerShell Microsoft HTML Application Host is a program whose source code consists of HTML, Dynamic HTML and a few scripting languages compatible with Internet Explorer such as VBScript or JScript. It does not typically spawn from PowerShell or CMD. Informational Platform Analytics Process execution Defense Evasion
BIOC Microsoft HTML Application Host spawns from Explorer.exe Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host. Informational Platform Analytics Process execution Defense Evasion
BIOC PowerShell is used to execute a CPL file Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution. Informational Platform Analytics Process execution Defense Evasion
BIOC Regsvr32 may have run code from an untrusted source Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host. High Platform Analytics Process execution Defense Evasion
BIOC Rundll32 loads a known abused DLL Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application. Informational Platform Analytics Process execution Defense Evasion
BIOC Rundll32.exe launches an executable using ordinal numbers argument Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection. Medium Platform Analytics Process execution Defense Evasion
BIOC Rundll32.exe with 'main' as EntryPoint Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs. Medium Platform Analytics Process execution Defense Evasion
BIOC Suspicious DLL load using Control.exe This execution mechanism is known to be used by malware to load malicious DLLs. Medium Platform Analytics Process execution Defense Evasion
BIOC SyncAppvPublishingServer used to run PowerShell code SyncAppvPublishingServer is part of Microsoft Application Virtualization (App-V), which may be used by an attacker to run PowerShell code. Informational Platform Analytics Process execution Defense Evasion
BIOC Tampering with Windows Control Panel configuration DLLs with .cpl suffix are executed when accessing the Control Panel. Malicious code may run this way even if AppLocker enabled. Informational Platform Analytics Registry Defense Evasion
BIOC WerFault ReflectDebugger key set in Registry The WerFault.exe signed Windows process may be tricked into running a malicious executable by setting the ReflectDebugger key in the Registry. Medium Platform Analytics Registry Defense Evasion