Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
6 detectors match the current filters. technique: T1543 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Modification of systemd service files An attacker may create or modify systemd service unit files to establish persistence between reboots. | Informational | Platform Analytics | File | Persistence |
| BIOC | Multiple RDP sessions enabled via Registry Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does. | Medium | Platform Analytics | Registry | Persistence, Lateral Movement |
| BIOC | New service created via command line Attackers may leverage services to gain persistence on an endpoint. | Informational | Platform Analytics | Process execution | Persistence |
| BIOC | Persistence through service registration An attacker may add or modify system services to persist on a host. | Informational | Platform Analytics | File | Persistence |
| BIOC | PowerShell creates a new service PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine. | Low | Platform Analytics | Process execution | Persistence |