Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
17 detectors match the current filters. technique: T1547 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Active Setup Registry Autostart Suspicious modification of the active setup registry for persistence and privilege escalation. | Low | Platform Analytics | Registry | Persistence |
| BIOC | Kernel modules loaded via command-line tool The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits. | Informational | Platform Analytics | Process execution | Persistence |
| BIOC | Kernel modules loaded via compiled loader and .ko file Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits. | Informational | Platform Analytics | Process execution | Persistence |
| BIOC | Manipulation of 'BootExecute' Registry run key Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Manipulation of Winlogon 'Notify' autostart Registry key Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Manipulation of Winlogon 'UserInit' autostart Registry key Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon. | Medium | Platform Analytics | Registry | Persistence |
| BIOC | Modification of default Windows startup path via Registry An attacker may modify the startup path to the location of the malware. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Modification of the Winlogon\Shell Registry key Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | New entry added to startup related Registry keys by unsigned process Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Port Monitor added in Registry Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation. | Low | Platform Analytics | Registry | Persistence |
| BIOC | Possible XDG autostart persistency Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory. | Informational | Platform Analytics | File | Persistence |
| BIOC | Print Processor Registration Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence. | Low | Platform Analytics | Registry | Persistence |
| BIOC | Print spooler set to load new DLL on boot Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Security Support Provider (SSP) registered via a registry key Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords. | Informational | Platform Analytics | Registry | Privilege Escalation |
| BIOC | Suspicious printer driver installation A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS. | Low | Platform Analytics | Registry | Privilege Escalation, Persistence |
| BIOC | Suspicious printer port creation via Registry An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048). | Medium | Platform Analytics | Registry | Privilege Escalation, Persistence |
| BIOC | Tampering with Windows Security Support Provider DLLs Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002. | Informational | Platform Analytics | Registry | Persistence |