Browse Rules

Search and filter across all detection sources

175 rules

sagan critical other

[CROWDSTRIKE] Machine Learning Tactic Catchall

[CROWDSTRIKE] Machine Learning Tactic Catchall
elastic high kql

Multiple Machine Learning Alerts by Influencer Field

This rule uses alerts data to determine when multiple unique machine learning jobs involving the same influencer field are triggered. Analysts can use this to prioritize triage and response machine learning alerts.

sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML high confidence malware detection - Blocked

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML high confidence malware detection - Blocked
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML high confidence malware detection - Detected

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML high confidence malware detection - Detected
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML high confidence malware detection - Killed

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML high confidence malware detection - Killed
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML medium confidence malware detection - Blocked

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML medium confidence malware detection - Blocked
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML medium confidence malware detection - Detected

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML medium confidence malware detection - Detected
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML medium confidence malware detection - Killed

[CROWDSTRIKE] Machine Learning Analysis: Cloud-based ML medium confidence malware detection - Killed
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML high confidence malware detection - Blocked

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML high confidence malware detection - Blocked
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML high confidence malware detection - Detected

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML high confidence malware detection - Detected
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML high confidence malware detection - Killed

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML high confidence malware detection - Killed
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML medium confidence malware detection - Blocked

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML medium confidence malware detection - Blocked
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML medium confidence malware detection - Detected

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML medium confidence malware detection - Detected
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML medium confidence malware detection - Killed

[CROWDSTRIKE] Machine Learning Analysis: On-sensor ML medium confidence malware detection - Killed
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - Mimikatz Quarantined Files In A Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - Mimikatz Quarantined Files In A Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Quarantined Files In A Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Quarantined Files In A Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - TeamViewer Quarantined Files In A Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - TeamViewer Quarantined Files In A Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - AnyDesk Network Access In An EPP Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - AnyDesk Network Access In An EPP Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - File Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Blocked - File Meets File Analysis ML High-Confidence Malware Threshold
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - Mimikatz Network Access In An EPP Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - Mimikatz Network Access In An EPP Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Network Access In An EPP Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Network Access In An EPP Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Quarantined Files In An EPP Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Quarantined Files In An EPP Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - ScreenConnect Network Access In An EPP Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - ScreenConnect Network Access In An EPP Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Blocked - ScreenConnect Quarantined Files In An EPP Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - ScreenConnect Quarantined Files In An EPP Detection Summary Event
sagan medium other

[CROWDSTRIKE] Machine Learning Analysis Detected - File Meets File Analysis ML High-Confidence Malware Threshold

[CROWDSTRIKE] Machine Learning Analysis Detected - File Meets File Analysis ML High-Confidence Malware Threshold