The following table lists the Cynet 360 alerts that can be triggered when the EPP category is turned on in the Group settings.The information provided in the console for several of the alerts includes information about the associated MITRE ATT&CK tactic and technique. These alerts are marked with the ATT&CK icon.Alert Name TriggerMalicious BinaryA file, flagged as Malicious, is detected. The threat intelligence database includes critical IoCs only.Ransomware HeuristicSuspicious behavior, associated with ransomware, is detected. E.g., file extensions changed. Process MonitoringA malicious command line spawned a process or a process with suspicious ancestry. Based on MITRE tactics and techniques.  Malicious Behavior - Parent ProcessA process spawns a suspicious child process.PowerShell Malicious CommandPowerShell executes a command that contains suspicious arguments or is associated with malicious patterns.Malicious Process CommandA CMD process executes a command that contains suspicious arguments or is associated with malicious patternsMalicious Behavior - Blacklist DLL GroupA combination of DLLs, indicating suspicious activity, were loaded to memory Malicious Binary - Process Create Malicious FileA process creates a file that is flagged as malicious or is associated with malicious patterns.Malicious Behavior - Process Created File on Startup DirectoryA file creates/downloads a file to the startup directory, performed when malware tries to obtain persistency.Unauthorized Registry Operation AttemptA process accesses sensitive keys in the host registryvssadminA command, related to vssadmin activity, is executed. vssadmin can be used to delete backups on a host, and may be related to ransomware activity. Dynamic Injection BehaviorA process is trying to inject code to a legitimate process.Injection Behavior-ReflectiveA process is trying to inject code to a legitimate process. Privilege Escalation - Escalated ProcessA process with a low integrity level (low privileges) spawns a process with a high integrity level Malicious Task RunningA task is scheduled to execute a file that contains malicious indicators or arguments. This alert is meant to detect malware persistency.Malicious Task RegisteredA task containing a file that contains malicious indicators or arguments is registered to the Task Scheduler. This alert is meant to detect malware persistency.Suspicious Task RegisteredA task is scheduled to register a file that contains suspicious indicators or arguments. This alert is meant to detect malware persistency.Malicious Task ExistingA task containing a file that contains malicious indicators or arguments is saved in the Task Scheduler. This alert is meant to detect malware persistency.Malicious Binary - Infected File- File Dumped on the DiskA malicious file is dumped on the disk.Malicious Binary - Infected File- Attempt to RunA malicious file is loaded to the memory.Malicious Binary - Suspicious File- File Dumped on the DiskA suspicious file is dumped on the disk.Malicious Binary -Suspicious File-Attempt to RunA suspicious file is loaded to the memory.Memory PatternA file is loaded to the memory and runs unique,  malware related, strings.Process monitoringA malicious command line spawned a process or a process with suspicious ancestry. Based on MITRE tactics and techniques.Raw disk writeAn attempt to write data to Sector 0 of the disk (MBR – Master Boot Record)Malicious Script CommandA malicious script, originated from a file or process memory (fileless), is run on the host (based on Windows AMSI)Malicious Binary - BlacklistA file, flagged as malicious in Cynet’s internal threat intelligence database, is detected.Threat Intelligence Detection Malicious BinaryA file, flagged as malicious in Cynet’s external threat intelligence database, is detected.Malicious Binary - High Similaritya file hash (SSDEEP) that is highly similar to a file hash that is flagged in Cynet's threat intelligence database as malicious.WormA file, tagged as Worm in Cynet’s threat intelligence database, is detected.AdwareA file, tagged as Adware in Cynet’s threat intelligence database, is detected.TrojanA file, tagged as Trojan in Cynet’s threat intelligence database, is detected.VirusA file, tagged as Virus in Cynet’s threat intelligence database, is detected.MalwareA file, tagged as Malware in Cynet’s threat intelligence database, is detected.Attempt to terminate Cynet processA process opens a Terminate handle for the Cynet processes.Unauthorized memory access attemptA process attempts to access the memory of a different process, in a forbidden manner. The alert details the flags permitted for the process, as well as the requested flags.Unauthorized file operation attempt*From V4.5A process attempts to operate on a monitored file. The File Operation mechanism allows only certain processes to perform specific operations on sensitive files.