Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type (1) ▾

Analytics BIOC 4 BIOC 6

Severity ▾

Informational 4

Module / licence ▾

Platform Analytics 4

Data source ▾

Analytics and correlation rules

XDR Agent 2 XDR Agent with eXtended Threat Hunting (XTH) 2

4 detectors match the current filters. technique: T1497 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Ping to localhost from an uncommon, unsigned parent process Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Security tools detection attempt A script has executed commands that can be used to detect security tools.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Discovery
Analytics BIOC	VM Detection attempt A script has executed commands that can be used to detect VM environments.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Defense Evasion, Discovery
Analytics BIOC	VM Detection attempt on Linux A Process executed a command and/or accessed a file that can be used to detect VM environments.	Informational	Platform Analytics	XDR Agent	Defense Evasion, Discovery