Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
14 detectors match the current filters. technique: T1546 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Commonly abused host process modifies the Windows shim cache Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique. | Informational | Platform Analytics | Process execution | Persistence |
| BIOC | Manipulation of AppInit DLL loading list The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Manipulation of Application Verifier custom providers The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Manipulation of default file association configuration When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Manipulation of default file extension configuration Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions. | Low | Platform Analytics | Registry | Persistence |
| BIOC | Manipulation of the MonitorProcess Registry key Entries added under the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit can be used to run malicious code and help attackers gain persistence. | Medium | Platform Analytics | Registry | Persistence |
| BIOC | Manipulation of the sticky keys file Possible login bypass attack. | Medium | Platform Analytics | File | Privilege Escalation |
| BIOC | Persistence using bashrc files Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution. | Informational | Platform Analytics | File | Persistence |
| BIOC | Persistence via Registry screensaver key change Attackers may install their malware persistently by modifying the value of the screensaver Registry key. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Shim database file access An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence. | Informational | Platform Analytics | File | Persistence, Privilege Escalation |
| BIOC | Shim database registration via Registry Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Suspicious SDB file written to disk Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique. | Informational | Platform Analytics | File | Persistence |
| BIOC | Suspicious SDB file written to disk by an unsigned process Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique. | Informational | Platform Analytics | File | Persistence |
| BIOC | Write to .bash_profile Commands in ~/.bash_profile are executed on every user shell login with a username and password. | Informational | Platform Analytics | File | Persistence |