Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type (1) ▾

Analytics 2 Analytics BIOC 5 BIOC 2

Severity ▾

Informational 1 Low 1

Module / licence ▾

Platform Analytics 2

Data source ▾

Analytics and correlation rules

XDR Agent with eXtended Threat Hunting (XTH) 2

Detector tag ▾

Analytics only

Webshell Analytics 2

2 detectors match the current filters. technique: T1505 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics	An executable was written and executed by a web server Web server process had written an executable file that was executed shortly after.	Low	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence
Analytics	Web server CGO executed a process following a potential Webshell dropped A process was executed by a web server CGO following a potential drop of a webshell file.	Informational	Platform Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence