Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
4 detectors match the current filters. technique: T1553 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Manipulation of Crypto Subject Interface Package (SIP) Provider Malicious modification of crypto subject interface package (SIP) provider Registry keys can be leveraged to trick the OS into incorrectly validating invalid signing certificates. May have legitimate uses, but check for malicious activity. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | New certificate added to the trusted root store Untrusted certificates could be used to install untrusted drivers and malicious code. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. | Informational | Platform Analytics | Registry | Defense Evasion |
| BIOC | Root certificate installed Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. | Informational | Platform Analytics | Process execution | Defense Evasion |