Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
8 detectors match the current filters. technique: T1564 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | Hidden directory creation Attackers may create hidden directories to hide malware or staged files. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Hidden file and directory creation Creation of a hidden file inside a hidden directory. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | ISO mounted manually A user manually mounted an ISO file. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | Process runs from the recycle bin Process running from the recycle bin. | Low | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Scripting engine creates an Alternate Data Stream (ADS) Malware may hide data inside alternate data streams instead of inside a file. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | The scripting engine executed code from an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file. | Informational | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Unsigned process creates an Alternate Data Stream (ADS) Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS. | Informational | Platform Analytics | File | Defense Evasion |
| BIOC | Unsigned process running from a temporary directory Malware often runs from a temporary folder. | Informational | Platform Analytics | Process execution | Defense Evasion |