Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
4 detectors match the current filters. technique: T1574 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| BIOC | DLL sideloading attack using Xwizard Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack. | Low | Platform Analytics | Process execution | Defense Evasion |
| BIOC | Manipulation of service imagepath configuration This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths. | Informational | Platform Analytics | Registry | Persistence |
| BIOC | Suspicious AMSI DLL load location An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI). | Low | Platform Analytics | Module | Defense Evasion |
| BIOC | WptsExtensions.dll created to disk The Task Scheduler service attempts to load the missing WptsExtensions.dll. As a result, the creation of this file may be indicative of DLL hijacking. | Medium | Platform Analytics | File | Privilege Escalation |