Detectors

1677 detectors match the current filters.

64-bit PowerShell spawning a 32-bit PowerShell — BIOC, Low, Platform Analytics
7z.exe execution with password protection parameters — BIOC, Informational, Platform Analytics
A Backup vault policy was modified — Analytics BIOC, Low, Cortex Cloud
A browser extension was installed or loaded in an uncommon way — Analytics BIOC, Informational, Platform Analytics
A browser was opened in private mode — Analytics BIOC, Informational, Identity Threat Detection (ITDR)
A Cloud DB instance was exported to an unknown destination — Analytics BIOC, Informational, Cortex Cloud
A cloud function was created with an unusual runtime — Analytics BIOC, Low, Cortex Cloud
A cloud identity created or modified a security group — Analytics BIOC, Informational, Cortex Cloud
A cloud identity executed an API call from an unusual country — Analytics BIOC, Informational, Cortex Cloud
A cloud identity had escalated its permissions — Analytics BIOC, Informational, Cortex Cloud
A cloud identity invoked IAM related persistence operations — Analytics BIOC, Informational, Cortex Cloud
A cloud identity performed multiple unusual activities — Analytics, Medium, Cortex Cloud
A cloud identity started a Cloud Shell session — Analytics BIOC, Informational, Cortex Cloud
A cloud instance was stopped — Analytics BIOC, Informational, Cortex Cloud
A cloud snapshot of AWS database or storage was modified or shared — Analytics BIOC, Informational, Cortex Cloud
A cloud storage configuration was modified — Analytics BIOC, Informational, Cortex Cloud
A cloud storage object was copied to a foreign cloud account — Analytics BIOC, Medium, Cortex Cloud
A Command Line Interface (CLI) command was executed from a GCP serverless compute service — Analytics BIOC, Low, Cortex Cloud
A Command Line Interface (CLI) command was executed from an AWS serverless compute service — Analytics BIOC, Low, Cortex Cloud
A commonly abused process connected to a rare cloud resource — Analytics BIOC, Low, Platform Analytics
A commonly abused process connected to a rare external host — Analytics BIOC, Low, Platform Analytics
A compiled HTML help file wrote a script file to the disk — Analytics BIOC, Low, Platform Analytics
A compressed file was exfiltrated over SSH — Analytics BIOC, Informational, Platform Analytics
A compromised process accessed a rare cloud resource — Analytics, Informational, Platform Analytics
A compromised process accessed a rare external host — Analytics, Low, Platform Analytics
A compute-attached identity executed API calls outside the instance's region — Analytics BIOC, Informational, Cortex Cloud
A computer account was promoted to DC — Analytics BIOC, Low, Identity Analytics
A contained executable from a mounted share initiated a suspicious outbound network connection — Analytics BIOC, Medium, Platform Analytics
A contained executable was executed by an unusual process — Analytics BIOC, Medium, Platform Analytics
A contained process attempted to escape using the 'notify on release' feature — Analytics, Medium, Platform Analytics
A container registry was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A disabled user attempted to authenticate via SSO — Analytics BIOC, Informational, Identity Analytics
A disabled user attempted to log in — Analytics BIOC, Informational, Identity Analytics
A disabled user attempted to log in to a VPN — Analytics BIOC, Low, Identity Analytics
A domain was added to the trusted domains list — Analytics BIOC, Low, Identity Threat Detection (ITDR), SaaS Threat Detection
A GCP Cloud SQL DB instance was exported from a production account — Analytics BIOC, Informational, Cortex Cloud
A GCP service account was delegated domain-wide authority in Google Workspace — Analytics BIOC, Low, Identity Threat Detection (ITDR), SaaS Threat Detection
A Google Workspace identity created, assigned or modified a role — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Google Workspace identity performed an unusual admin console activity — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Google Workspace identity used the security investigation tool — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Google Workspace Role privilege was deleted — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Google Workspace service was configured as unrestricted — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Google Workspace user was added to a group — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Google Workspace user was removed from a group — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Kubernetes API operation was successfully invoked by an anonymous user — Analytics BIOC, Medium, Cortex Cloud
A Kubernetes cluster role binding was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes cluster role was created — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes cluster was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes ConfigMap was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes Cronjob was created — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes DaemonSet was created — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes dashboard service account was used outside the cluster — Analytics BIOC, Medium, Cortex Cloud
A Kubernetes deployment was created — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes ephemeral container was created — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes namespace was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes node service account activity from external IP — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes Pod was created with a sidecar container — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes Pod was deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes ReplicaSet was created — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes role binding was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes secret was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes service account executed an unusual API call — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes service account has enumerated its permissions — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes service account was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes service was created or deleted — Analytics BIOC, Informational, Cortex Cloud
A Kubernetes StatefulSet was created — Analytics BIOC, Informational, Cortex Cloud
A LOLBIN was copied to a different location — Analytics BIOC, Informational, Platform Analytics
A machine certificate was issued with a mismatch — Analytics BIOC, Medium, Identity Analytics
A mail forwarding rule was configured in Google Workspace — Analytics BIOC, Medium, Identity Threat Detection (ITDR), SaaS Threat Detection
A Microsoft Teams application was installed — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A Microsoft Teams bot was added to a team — Analytics BIOC, Informational, Identity Threat Detection (ITDR), SaaS Threat Detection
A new Azure email domain verification was requested — Analytics BIOC, Informational, Cortex Cloud
A new machine attempted Kerberos delegation — Analytics, Medium, Identity Analytics
A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment — Analytics BIOC, Informational, Cortex Cloud
A non-browser process accessed a website UI — Analytics BIOC, Informational, Platform Analytics
A Possible crypto miner was detected on a host — Analytics BIOC, Medium, Platform Analytics
A possible risky login to Azure — Analytics BIOC, Informational, Identity Analytics
A process connected to a rare cloud resource — Analytics BIOC, Informational, Platform Analytics
A process connected to a rare external host — Analytics BIOC, Informational, Platform Analytics
A process connected to rare external host — Analytics BIOC, Informational, Platform Analytics
A process is masquerading as a common Microsoft product — Analytics BIOC, Informational, Platform Analytics
A process modified an SSH authorized_keys file — Analytics BIOC, Informational, Platform Analytics
A process queried the ADFS database decryption key via LDAP — Analytics BIOC, Low, Identity Analytics
A process was executed with a command line obfuscated by Unicode character substitution — Analytics BIOC, Medium, Platform Analytics
A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process — Analytics BIOC, Informational, Platform Analytics
A rare file path was added to the AppInit_DLLs registry value — Analytics BIOC, Low, Platform Analytics
A rare FTP user has been detected on an existing FTP server — Analytics BIOC, Low, Platform Analytics
A rare local administrator login — Analytics BIOC, Informational, Identity Analytics
A remote service was created via RPC over SMB — Analytics BIOC, Low, Platform Analytics
A scripting engine was called to run in command line — BIOC, Informational, Platform Analytics
A Service Principal was created in Azure — Analytics BIOC, Informational, Cortex Cloud
A Service Principal was removed from Azure — Analytics BIOC, Informational, Cortex Cloud
A service was disabled — Analytics BIOC, Informational, Platform Analytics
A Successful login from TOR — Analytics BIOC, High, Identity Analytics
A successful SSO sign-in from TOR — Analytics BIOC, High, Identity Analytics
A Successful VPN connection from TOR — Analytics BIOC, High, Identity Analytics
A suspicious direct syscall was executed — Analytics BIOC, Low, Platform Analytics
A suspicious executable with multiple file extensions was created — Analytics BIOC, Medium, Platform Analytics
A suspicious process enrolled for a certificate — Analytics BIOC, Low, Platform Analytics
A suspicious process queried AD CS objects via LDAP — Analytics BIOC, Informational, Identity Analytics