Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
9 detectors match the current filters. technique: T1543 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | An uncommon service was started An uncommon service was started using systemctl or service processes. | Low | Platform Analytics | XDR Agent | Persistence, Privilege Escalation |
| Analytics BIOC | Elevation to SYSTEM via services Services were affected by a non SYSTEM integrity level process. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Execution, Privilege Escalation |
| Analytics BIOC | Installation of a new System-V service Installation of a new System-V service. | Low | Platform Analytics | XDR Agent | Persistence, Privilege Escalation |
| Analytics BIOC | Known service display name with uncommon image-path Service created with a known display name but has an uncommon image-path. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence, Execution |
| Analytics BIOC | Known service name with an uncommon image-path A Service with a known service name has an uncommon image-path. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Persistence, Execution |
| Analytics BIOC | Rare service DLL was added to the registry A service was added as a dll, which will be executed by svchost.exe. This is a stealthy technique attackers use to persist their malware. | Low | Platform Analytics | XDR Agent with eXtended Threat Hunting (XTH) | Defense Evasion, Persistence |
| Analytics BIOC | Svchost.exe loads a rare unsigned module Svchost.exe loads a rare unsigned module, which can indicate an attacker's malicious service execution. | Low | Platform Analytics | XDR Agent | Defense Evasion, Persistence |
| Analytics BIOC | Uncommon Launch Agent persistency was registered or modified An uncommon Launch Agent persistence mechanism was registered/modified on the system. | Informational | Platform Analytics | XDR Agent | Persistence |
| Analytics BIOC | Uncommon Launch Daemon persistency was registered or modified An uncommon Launch Daemon persistence mechanism was registered/modified on the system. | Informational | Platform Analytics | XDR Agent | Persistence |