Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
8 detectors match the current filters. technique: T1552 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Cleartext password harvesting using find tools On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Grepping for passwords Attackers may look for cleartext passwords in files using the grep command. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Key Certificate Search And Exfiltrate Possible attempt to search for key certificates and exfiltrate them. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | LOLBAS reading a Windows credential manager file Encrypted files under the path AppData\Roaming\Microsoft\Credentials are associated with saved passwords in the Windows system. | Informational | Platform Analytics | File | Credential Access |
| BIOC | Reading .ssh files Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Registry credentials extraction Attackers may extract credentials from the Registry using system commands. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | Shell history access Attackers may search historical commands for credentials and information gathering. | Informational | Platform Analytics | Process execution | Credential Access |
| BIOC | SSH key pair discovery Attackers may look for SSH key pairs using the find command. | Informational | Platform Analytics | Process execution | Credential Access |