BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

367 BIOCs match the current filters.

Download CSV Show ATT&CK heatmap
  • 64-bit PowerShell spawning a 32-bit PowerShell Low Execution

    Malware typically spawns 32-bit processes to work on as many hosts as possible. This case is therefore suspicious when it happens on a 64-bit host.

    Indicator:

    Process action type = execution AND target process cmd != *noprofile -nologo -noninteractive -executionpolicy allsigned -command set-executionpolicy allsigned AND target process name = powershell.exe AND target process path = *syswow64* AND target process path != *windows\\ccm\\systemtemp\\* Process initiated by = powershell.exe AND initiator path = *system32* AND initiator path != *\\windows\\ccmcache\\*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • 7z.exe execution with password protection parameters Informational Collection

    7z.exe was executed with parameters indicating password protection of the output file.

    Indicator:

    Process action type = execution AND target process cmd = *-p* AND target process name = 7z.exe Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • A scripting engine was called to run in command line Informational Execution

    Scripting engines that are called to run in command line are used by attackers to run a script payload without a UI.

    Indicator:

    Process action type = execution AND target process cmd = */H:cscript* , */H:wscript* , */E:vbscript* , */E:jscript*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • ADFind queries Active Directory for Exchange groups Informational Discovery

    A process executed with ADFind parameters and used to extract data on built-in groups for the Exchange server (e.g. "Organization Management").

    Indicator:

    Process action type = execution AND target process cmd =~ .*default.*Organization Management.*objectcategory=\*.* AND target process name != adfind.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Permission Groups Discovery: Domain Groups (T1069.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • AMSI Bypass Medium Lateral Movement

    AMSI (Antimalware Scan Interface) provides enhanced malware protection on Windows 10 machines. Attackers may try to bypass this mechanism and run malicious code.

    Indicator:

    Process action type = execution AND target process cmd = *system.management.automation.amsiutils*amsiinitfailed*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Accessing bash history file Low Evasion

    Clearing bash history file is a known procedure of attackers to delete traces.

    Indicator:

    Process action type = execution AND target process cmd = *.bash_history * , *.bash_history , *histfile * , *histfile AND target process name = rm , touch , ln AND target process path != /Applications/OnyX.app/Contents/MacOS/OnyX

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Accessing bash history file using bash commands Low Evasion

    Clearing bash history files is a known attacker procedure for covering their tracks.

    Indicator:

    Process action type = execution AND target process cmd = *set histfile* , *set history* , *export histfile* , *export histignore* , *history -c* , *history -d* AND target process name = bash , sh

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Account creation via command-line tool Informational Persistence

    The useradd/adduser command could be used to create user accounts or to add users to existing groups.

    Indicator:

    Process action type = execution AND target process name = useradd , adduser

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create Account (T1136)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Active Setup Registry Autostart Low Persistence

    Suspicious modification of the active setup registry for persistence and privilege escalation.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components AND registry value name = StubPath Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Active Setup (T1547.014)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Active directory enumeration using built-in nltest.exe Informational Discovery

    Nltest.exe is a command-line tool used for network administrative tasks, and can be used to gather information about domain controllers and users.

    Indicator:

    Process action type = execution AND target process name = nltest.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Domain Trust Discovery (T1482)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Administrator obtains access rights to a file using icacls.exe Informational File Privilege Manipulation

    Grant an administrator file access privileges.

    Indicator:

    Process action type = execution AND target process cmd = *grant*admin* AND target process name = icacls.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: File and Directory Permissions Modification (T1222)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Adobe Acrobat Reader drops an executable file to disk Informational Dropper

    The Acrobat Reader process dropped a new executable file to the disk. Unusual activity, possibly indicative of exploitation or social engineering attempt.

    Indicator:

    File file name = *.exe , *.scr , *.dll , *.sys , *.com , *.bin , *.msi AND file path != *adobe\acrobat\*usercache.bin AND action type = create Process initiated by = acrord32.exe AND initiator signature = Signed AND initiator signer = *adobe systems* Host host os = windows

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Adobe reader spawns a browser Informational Dropper

    If a user clicks a URL link contained in a PDF document, it will cause the Adobe Reader process to spawn a browser process. It has legitimate uses, but check for possible phishing attempts.

    Indicator:

    Process action type = execution AND target process name = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe Process initiated by = acrord32.exe , cgo name = acrord32.exe AND initiator signer = *adobe systems* , cgo signer = *adobe systems* AND initiator signature = Signed , cgo signature = Signed Host host os = windows

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • An executable compiled with a py2exe-like program was executed Informational Execution

    A py2exe-like program DLL file dropped to disk.

    Indicator:

    File action type = create , write AND file name = python*.dll AND file path = *\_mei* AND file sha256 = *

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Python (T1059.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Base64 decoding using the base64 utility Informational File Type Obfuscation

    Base64 decoding using the base64 utility with the -d argument provided.

    Indicator:

    Process action type = execution AND target process cmd = *-d* AND target process name = base64 Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Base64 encoding used Informational Collection

    Attackers may use the base64 built-in binary to encode data into base64.

    Indicator:

    Process action type = execution AND target process cmd != *-d* AND target process cmd != base64 AND base64 /dev/urandom AND base64 -w0 AND base64 --version AND base64 --help AND base64 -h AND *improbable* AND *bootstrap* AND target process name = base64 Process initiator cmd != *build*.sh* AND cgo name != containerd

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Data Encoding (T1132)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • BitTorrent P2P file sharing Informational Exfiltration

    The host used BitTorrent for P2P file sharing (according to the App-ID), which is typically not allowed in corporate networks and may be used to exfiltrate information.

    Indicator:

    Network Connections app id contains *bittorrent*

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bitsadmin.exe used to download data Informational Persistence

    Some attacks were known for abusing BITSAdmin in the past to hide how data was downloaded using legitimate Windows tools.

    Indicator:

    Process action type = execution AND target process cmd = */transfer * AND target process cmd != */upload * AND target process name = bitsadmin.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: BITS Jobs (T1197)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bitsadmin.exe used to upload data High Exfiltration

    Some attacks are known to abuse BITSAdmin to hide how data upload using legitimate Windows tools.

    Indicator:

    Process action type = execution AND target process cmd = */transfer * AND */upload * AND target process name = bitsadmin.exe

    ATT&CK tactics: Exfiltration (TA0010) Defense Evasion (TA0005)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048) BITS Jobs (T1197)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Browser downloads an .hta or .application file Informational Execution

    .hta and .application files are Windows applications that may serve as an attack vector by executing code maliciously using trusted Windows applications.

    Indicator:

    File action type = create , write AND file name = *.hta , *.application Process initiated by = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe , cgo name = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Mshta (T1218.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Built-in SoundRecorder tool capturing audio Informational Collection

    SoundRecorder is a built-in voice recording tool. Besides benign usage, it may be used to discreetly record a user.

    Indicator:

    Process action type = execution AND os actor process signature vendor != Zscaler, Inc. AND JAL Information Technology Co.,Ltd. AND LIGHTSPEED SYSTEMS, INC. AND Ivanti, Inc. AND Lightspeed Systems (Lightspeed Solutions, LLC.) AND target process cmd = *soundrecorder* Process initiated by != sihost.exe AND svchost.exe AND explorer.exe AND nssm.exe AND cgo name != sihost.exe AND svchost.exe AND explorer.exe AND nssm.exe AND os parent name != sihost.exe AND svchost.exe AND explorer.exe AND nssm.exe AND initiator signature = Unsigned , Signed , Invalid Signature , Weak Hash , cgo signature = Unsigned , Signed , Invalid Signature , Weak Hash , os parent signature = Unsigned , Signed , Invalid Signature , Weak Hash AND initiator signer != Zscaler, Inc. AND JAL Information Technology Co.,Ltd. AND LIGHTSPEED SYSTEMS, INC. AND Ivanti, Inc. AND Lightspeed Systems (Lightspeed Solutions, LLC.) AND cgo signer != Zscaler, Inc. AND JAL Information Technology Co.,Ltd. AND LIGHTSPEED SYSTEMS, INC. AND Ivanti, Inc. AND Lightspeed Systems (Lightspeed Solutions, LLC.) Host host os != linux

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Audio Capture (T1123)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Bypass UAC using the IsolatedCommand Registry value Medium Privilege Escalation

    IsolatedCommand is a Registry value known to be altered by attackers to allow themselves to run their malware with elevated privileges.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data != "%1" %* AND registry key name = *\exefile\shell\runas\command* AND registry value name = IsolatedCommand Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bypass UAC using the control.exe Registry key Medium Privilege Escalation

    Control.exe is a Registry key known to be altered by attackers to allow themselves to run their malware with elevated privileges.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data != "%1" %* AND registry key name = *currentVersion\app paths\control.exe* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bypassing Windows UAC using sysprep Informational Privilege Escalation

    Attackers may use the sysprep.exe built-in Windows tools to bypass Windows UAC.

    Indicator:

    Process action type = execution AND target process name = sysprep.exe Process initiated by != winlogon.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Changing permissions or ownership of a file or folder Informational Evasion

    Changing the permissions or ownership of a file or folder can be done to get access to sensitive data.

    Indicator:

    Process action type = execution AND target process name = attrib.exe , cacls.exe , takeown.exe AND target process cmd = *-r* , *grant* , */f*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: File and Directory Permissions Modification (T1222)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Chrome launched in Incognito mode Informational Evasion

    May be used to cover up malware or malicious insider activity.

    Indicator:

    Process action type = execution AND target process cmd = *incognito* AND target process name = chrome.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Chrome runs with key security features disabled Low Persistence

    This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.

    Indicator:

    Process action type = execution AND target process cmd = *--disable-extensions-file-access-check* , *--always-authorize-plugins* , *--disable-improved-download-protection* AND target process name = chrome.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Software Extensions: Browser Extensions (T1176.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Clear event logging policy using auditpol.exe Informational Evasion

    Attackers may clear Windows Event Logging policies using auditpol.exe.

    Indicator:

    Process action type = execution AND target process cmd = */clear* AND target process name = auditpol.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable Windows Event Logging (T1562.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clear logs - using dd and /dev/null Medium Tampering

    Usage of the dd utility to clear the contents of a file using /dev/null.

    Indicator:

    Process action type = execution AND target process cmd = *if=/dev/null*of=*log* AND target process name = dd Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clearing logs by copying /dev/null to a log file Informational Tampering

    Usage of the cp command to copy /dev/null to a file and clear its content.

    Indicator:

    Process action type = execution AND target process cmd = cp*/dev/null*log* AND target process name = cp Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clearing logs by executing cat /dev/null Informational Tampering

    Usage of cat /dev/null to clear the contents of a log file.

    Indicator:

    Process action type = execution AND target process cmd = cat*/dev/null* AND target process name = cat Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Cleartext password harvesting using find tools Informational Credential Access

    On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords.

    Indicator:

    Process action type = execution AND target process name = find.exe , findstr.exe AND target process cmd = *password*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Collecting audio via PowerShell command Low Collection

    An attacker may collect audio from the microphone using PowerShell.

    Indicator:

    Process action type = execution AND target process cmd = *Get-DefaultAudioDevice* , *Get-AudioDeviceList* , *Set-DefaultAudioDevice* , *Set-DefaultAudioDevice* , *Set-DefaultAudioDevice* , *Set-DefaultAudioDeviceVolume* , *Get-DefaultAudioDeviceVolume* , *Set-DefaultAudioDeviceMute* , *Write-DefaultAudioDeviceValue* AND target process name = powershell.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Audio Capture (T1123)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Command enumeration via sudo Informational Privilege Escalation

    The 'sudo -l' command was executed to enumerate commands that can be executed by a user.

    Indicator:

    Process action type = execution AND target process cmd =~ -l |-l$ AND target process name = sudo Host host os = linux

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Command-line arguments match Mimikatz execution High Credential Access

    These command-line arguments are often used by Mimikatz to dump credentials.

    Indicator:

    Process action type = execution AND target process cmd = *privilege::debug* , *sekurlsa* , *kerberos::tgt* , *logonpasswords* , *kerberos::ptt* , *kerberos::golden* , *kerberos::list*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Command-line creation of a RAR archive Informational Exfiltration

    Compression of data into a RAR archive using the rar.exe utility.

    Indicator:

    Process action type = execution AND target process cmd = * a * AND target process name = rar.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data (T1560)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Common Apple process name missing Apple digital signature Informational File Type Obfuscation

    These common Apple process names should normally be signed with the Apple Inc. digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

    Indicator:

    Process action type = execution AND target process name = safari.exe , itunes.exe , ituneshelper.exe , ipodservice.exe , applemobiledeviceservice.exe , applemobiledevicehelper.exe AND process execution signer != *Apple Inc.* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Common Mozilla process name missing Mozilla digital certificate Informational File Type Obfuscation

    These common Mozilla process names should normally be signed with the Mozilla Corporation digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

    Indicator:

    Process action type = execution AND target process name = firefox.exe AND process execution signer != *Mozilla Corporation* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused AutoIT script connects to a remote host Low Exfiltration

    AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

    Indicator:

    Network action type = outgoing , failed Process initiator signature = Signed , Weak Hash AND initiator signer = Autoit* AND Autoit* Host host os = windows

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Automated Exfiltration (T1020)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused host process modifies the Windows shim cache Informational Persistence

    Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique.

    Indicator:

    Process action type = execution AND process execution signature = Signed , Weak Hash AND target process name = sdbinst.exe AND process execution signer = Microsoft Corporation Process initiated by = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe , cgo name = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Commonly abused process executed with obfuscated characters Informational Evasion

    Commonly abused process executed with obfuscated characters.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe AND target process cmd = *^* , *`* AND target process cmd != *regex* AND *find*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused process executes by a remote host using PsExec Informational Lateral Movement

    This commonly abused shell/host process was spawned by psexesvc.exe, indicating it was called by a remote host via PsExec.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = psexesvc.exe , cgo name = psexesvc.exe

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002) Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Commonly abused process launches as a system service Informational Execution

    This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process os parent name = services.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused process spawns from Scripted Diagnostics Host Informational Execution

    This Scripted Diagnostics Host (sdiagnhost.exe) process has been observed launching a commonly abused host process. This behavior is known to be associated with an exploitation technique designed to deliver a malicious payload, often via a weaponized document. https://www.proofpoint.com/us/threat-insight/post/windows-troubleshooting-platform-leveraged-deliver-malware.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = sdiagnhost.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Commonly abused process spawns out of rundll32.exe Informational Execution

    This type of execution happens in .dll based attacks.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = rundll32.exe , cgo name = rundll32.exe AND initiator signature = Signed , cgo signature = Signed AND initiator signer = *Microsoft Corporation* , cgo signer = *Microsoft Corporation* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Compiled HTML (help file) makes network connections Informational Execution

    Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload.

    Indicator:

    Network action type = outgoing , failed Process os parent name = hh.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Compiler process started by an Office process Informational Evasion

    The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine.

    Indicator:

    Process action type = execution AND target process name = csc.exe , vbc.exe Process initiated by = excel.exe , powerpnt.exe , winword.exe , outlook.exe , cgo name = excel.exe , powerpnt.exe , winword.exe , outlook.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Compressed archive created using tar Informational Collection

    Attackers may use the tar built-in tool to stage a file for exfiltration.

    Indicator:

    Process action type = execution AND target process cmd = *-cvzf* AND target process name = tar

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data (T1560)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Container enumeration Informational Discovery

    An attacker may run a command to enumerate containers on a machine.

    Indicator:

    Process action type = execution AND target process name = docker , lxc , rkt AND target process cmd =~ ls(\s+|$)|list(\s+|$)

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Creation of a new Microsoft Office default template Informational Persistence

    Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.

    Indicator:

    File file path = *Roaming\Microsoft\*\Normal.dotm , *\XLSTART\*.xltm , *\XLSTART\*.xlsb AND file path != *Windows\Recent\* AND action type = create Process initiated by != winword.exe AND excel.exe AND svchost.exe AND winlogon.exe AND scanstate.exe AND userprofilemanager.exe AND xcopy.exe AND loadstate.exe AND System AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Ivanti, Inc. AND VMware, Inc. AND Digital Guardian, Inc. AND Citrix Systems, Inc. AND AppSense AND Liquidware Labs, Inc. Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Office Application Startup (T1137)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Creation of volume shadow copy using vssadmin.exe Informational Credential Access

    An attacker may create volume shadow copies to gain access to protected or locked files, whereas backup is the common legitimate use.

    Indicator:

    Process action type = execution AND target process cmd = * create* shadow* AND target process name = vssadmin.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential Vault command-line access Medium Credential Access

    The Credential Vault command line was used to enumerate a user's saved credentials.

    Indicator:

    Process action type = execution AND target process cmd = * /list* AND target process name = vaultcmd.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via LaZagne High Credential Access

    LaZagne has been executed. Attackers may use this tool to gather account and password information from credential dumping.

    Indicator:

    Process action type = execution AND target process cmd = *LaZagne.py* Host host os = linux , macos , windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Credential dumping via fgdump.exe Medium Credential Access

    Attackers may use fgdump.exe to perform local credential dumping.

    Indicator:

    Process action type = execution AND target process name = fgdump.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via gsecdump.exe Medium Credential Access

    Attackers may use gsecdump to obtain password hashes and LSA secrets.

    Indicator:

    Process action type = execution AND target process name = gsecdump.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via pwdumpx.exe Medium Credential Access

    Attackers may use pwdumpx.exe to perform local or remote credential dumping.

    Indicator:

    Process action type = execution AND target process name = pwdumpx.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) OS Credential Dumping: Security Account Manager (T1003.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via wce.exe Medium Credential Access

    Attackers may use wce.exe (Windows Credential Editor) to obtain user credentials.

    Indicator:

    Process action type = execution AND target process name = wce.exe , wce32.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credentials from Web Browsers Informational Credential Access

    Detects attempt to copy browser files to acquire credentials.

    Indicator:

    Process action type = execution AND target process cmd =~ .*[/]Application Support[/](Island|Google)([/]Chrome[/]Default|[/]Chrome[/]User Data[/]Default)?[/].*Login Data.* AND target process name = cp

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Curl connects to an external network Informational Exfiltration

    Curl is a command-line utility used to transfer data. Attackers may use curl to exfiltrate data outside your organization.

    Indicator:

    Network action type = outgoing , failed AND remote ip != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* AND remote port != 53 AND 0 Process initiated by = curl AND cgo signer != *palo alto networks* Host host os = linux , windows

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • DLL sideloading attack using Xwizard Low Evasion

    Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.

    Indicator:

    Process action type = execution AND target process path != *\windows\system32\xwizard.exe AND *\windows\syswow64\xwizard.exe AND *\windows\winsxs\ AND target process name = xwizard.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • DNS reconnaissance or enumeration via DNSRecon Medium Discovery

    DNSRecon enables DNS reconnaissance and enumeration, and may be used by attackers to learn about targets' network infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *dnsrecon.py* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • DNS resolution to the Palo Alto Networks sinkhole Informational Exfiltration

    DNS resolution to the Palo Alto Networks sinkhole.

    Indicator:

    Network action type = incoming , outgoing , failed AND remote ip = 198.135.184.22

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Application Layer Protocol (T1071)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-04-12
  • Data destruction using sdelete.exe Informational Evasion

    Attackers may use sdelete.exe to delete files from the target host.

    Indicator:

    Process action type = execution AND target process cmd = * -nobanner* AND target process name = sdelete.exe

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Data Destruction (T1485) Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Delete Volume USN Journal with fsutil Medium Evasion

    This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.

    Indicator:

    Process action type = execution AND target process cmd = * usn *deletejournal* AND target process name = fsutil.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Direct access to free online DNS servers Informational Exfiltration

    Online DNS servers are often used to bypass the company's internal DNS servers and evade detection.

    Indicator:

    Network action type = outgoing , failed AND remote host = *dynamic-dns.net , *epac.to , *longmusic.com , *compress.to , *wikaba.com , *zzux.com , *dumb1.com , *1dumb.com , *onedumb.com , *wha.la , *youdontcare.com , *yourtrap.com , *2waky.com , *sexidude.com , *mefound.com , *organiccrap.com , *toythieves.com , *justdied.com , *jungleheart.com , *mrbasic.com , *mrbonus.com , *x24hr.com , *dns04.com , *dns05.com , *zyns.com , *my03.com , *fartit.com , *itemdb.com , *instanthq.com , *xxuz.com , *jkub.com , *itsaol.com , *faqserv.com , *jetos.com , *qpoe.com , *qhigh.com , *vizvaz.com , *mrface.com , *isasecret.com , *mrslove.com , *otzo.com , *sellclassics.com , *americanunfinished.com , *serveusers.com , *serveuser.com , *freetcp.com , *ddns.info , *ns01.info , *ns02.info , *myftp.info , *mydad.info , *mymom.info , *mypicture.info , *myz.info , *squirly.info , *toh.info , *xxxy.info , *freewww.info , *freeddns.com , *myddns.com , *dynamicdns.biz , *ns01.biz , *ns02.biz , *xxxy.biz , *sexxxy.biz , *freewww.biz , *www1.biz , *dhcp.biz , *edns.biz , *ftp1.biz , *mywww.biz , *gr8domain.biz , *gr8name.biz , *ftpserver.biz , *wwwhost.biz , *moneyhome.biz , *port25.biz , *esmtp.biz , *sixth.biz , *ninth.biz , *got-game.org , *bigmoney.biz , *dns2.us , *dns1.us , *ns02.us , *ns01.us , *almostmy.com , *ocry.com , *ourhobby.com , *pcanywhere.net , *ygto.com , *ddns.me.uk , *ddns.ms , *dynamicdns.me.uk , *dynamicdns.org.uk , *ddns.us , *gettrials.com , *4mydomain.com , *25u.com , *4dq.com , *4pu.com , *3-a.net , *dsmtp.com , *mynumber.org , *ns1.name , *ns2.name , *ns3.name , *changeip.name , *ddns.name , *rebatesrule.net , *ezua.com , *sendsmtp.com , *trickip.net , *trickip.org , *dnsrd.com , *lflinkup.com , *lflinkup.net , *lflinkup.org , *lflink.com , *dns-dns.com , *proxydns.com , *myftp.name , *dyndns.pro , *changeip.net , *mysecondarydns.com , *changeip.org , *dns-stuff.com , *dynssl.com , *mylftv.com , *mynetav.net , *mynetav.org , *dynamicdns.co.uk , *ikwb.com , *acmetoy.com , *ddns.mobi , *dnset.com , *authorizeddns.net , *authorizeddns.org , *authorizeddns.us , *cleansite.biz , *cleansite.info , *cleansite.us , *https443.net , *https443.org , *mypop3.net , *mypop3.org , *ssl443.org , *iownyour.biz , *iownyour.org , *onmypc.biz , *onmypc.info , *onmypc.net , *onmypc.org , *onmypc.us , *duckdns.org , *3utilities.com , *blogsyte.com , *bounceme.net , *brasilia.me , *cable-modem.org , *ciscofreak.com , *collegefan.org , *couchpotatofries.org , *damnserver.com , *ddns.me , *ddns.net , *ddnsking.com , *ditchyourip.com , *dnsfor.me , *dnsiskinky.com , *dvrcam.info , *dynns.com , *eating-organic.net , *fantasyleague.cc , *geekgalaxy.com , *golffan.us , *health-carereform.com , *homesecuritymac.com , *homesecuritypc.com , *hopto.me , *ilovecollege.info , *ilovecollege.info , *loginto.me , *mlbfan.org , *mmafan.biz , *myactivedirectory.com , *mydissent.net , *myeffect.net , *myftp.biz , *myftp.org , *mymediapc.net , *mypsx.net , *mysecuritycamera.com , *mysecuritycamera.net , *mysecuritycamera.org , *myvnc.com , *net-freaks.com , *nflfan.org , *nhlfan.net , *no-ip.biz , *no-ip.ca , *no-ip.co.uk , *no-ip.info , *noip.me , *no-ip.net , *no-ip.org , *noip.us , *noip.com , *onthewifi.com , *pgafan.net , *point2this.com , *pointto.us , *privatizehealthinsurance.net , *quicksytes.com , *read-books.org , *redirectme.net , *securitytactics.com , *servebeer.com , *serveblog.net , *servecounterstrike.com , *serveexchange.com , *serveftp.com , *servegame.com , *servehalflife.com , *servehttp.com , *servehumour.com , *serveminecraft.net , *servemp3.com , *servep2p.com , *servepics.com , *servequake.com , *servesarcasm.com , *stufftoread.com , *ufcfan.org , *unusualperson.com , *webhop.me , *workisboring.com , *zapto.org , *at-band-camp.net , *barrel-of-knowledge.info , *barrell-of-knowledge.info , *better-than.tv , *blogdns.com , *blogdns.net , *blogdns.org , *blogsite.org , *boldlygoingnowhere.org , *broke-it.net , *buyshouses.net , *cechire.com , *dnsalias.com , *dnsalias.net , *dnsalias.org , *dnsdojo.com , *dnsdojo.net , *dnsdojo.org , *does-it.net , *doesntexist.com , *doesntexist.org , *dontexist.com , *dontexist.net , *dontexist.org , *doomdns.com , *doomdns.org , *dvrdns.org , *dyn-o-saur.com , *dynalias.com , *dynalias.net , *dynalias.org , *dynathome.net , *dyndns-at-home.com , *dyndns-at-work.com , *dyndns-blog.com , *dyndns-free.com , *dyndns-home.com , *dyndns-ip.com , *dyndns-mail.com , *dyndns-office.com , *dyndns-pics.com , *dyndns-remote.com , *dyndns-server.com , *dyndns-web.com , *dyndns-wiki.com , *dyndns-work.com , *dyndns.biz , *dyndns.info , *dyndns.org , *dyndns.tv , *dyndns.ws , *endofinternet.net , *endofinternet.org , *endoftheinternet.org , *est-a-la-maison.com , *est-a-la-masion.com , *est-le-patron.com , *est-mon-blogueur.com , *for-better.biz , *for-more.biz , *for-our.info , *for-some.biz , *for-the.biz , *forgot.her.name , *forgot.his.name , *from-ak.com , *from-al.com , *from-ar.com , *from-az.net , *from-ca.com , *from-co.net , *from-ct.com , *from-dc.com , *from-de.com , *from-fl.com , *from-ga.com , *from-hi.com , *from-ia.com , *from-id.com , *from-il.com , *from-in.com , *from-ks.com , *from-ky.com , *from-la.net , *from-ma.com , *from-md.com , *from-me.org , *from-mi.com , *from-mn.com , *from-mo.com , *from-ms.com , *from-mt.com , *from-nc.com , *from-nd.com , *from-ne.com , *from-nh.com , *from-nj.com , *from-nm.com , *from-nv.com , *from-ny.net , *from-oh.com , *from-ok.com , *from-or.com , *from-pa.com , *from-pr.com , *from-ri.com , *from-sc.com , *from-sd.com , *from-tn.com , *from-tx.com , *from-ut.com , *from-va.com , *from-vt.com , *from-wa.com , *from-wi.com , *from-wv.com , *from-wy.com , *ftpaccess.cc , *fuettertdasnetz.de , *game-host.org , *game-server.cc , *getmyip.com , *gets-it.net , *go.dyndns.org , *gotdns.com , *gotdns.org , *groks-the.info , *groks-this.info , *ham-radio-op.net , *here-for-more.info , *hobby-site.com , *hobby-site.org , *home.dyndns.org , *homedns.org , *homeftp.net , *homeftp.org , *homeip.net , *homelinux.com , *homelinux.net , *homelinux.org , *homeunix.com , *homeunix.net , *homeunix.org , *iamallama.com , *in-the-band.net , *is-a-anarchist.com , *is-a-blogger.com , *is-a-bookkeeper.com , *is-a-bruinsfan.org , *is-a-bulls-fan.com , *is-a-candidate.org , *is-a-caterer.com , *is-a-celticsfan.org , *is-a-chef.com , *is-a-chef.net , *is-a-chef.org , *is-a-conservative.com , *is-a-cpa.com , *is-a-cubicle-slave.com , *is-a-democrat.com , *is-a-designer.com , *is-a-doctor.com , *is-a-financialadvisor.com , *is-a-geek.com , *is-a-geek.net , *is-a-geek.org , *is-a-green.com , *is-a-guru.com , *is-a-hard-worker.com , *is-a-hunter.com , *is-a-knight.org , *is-a-landscaper.com , *is-a-lawyer.com , *is-a-liberal.com , *is-a-libertarian.com , *is-a-linux-user.org , *is-a-llama.com , *is-a-musician.com , *is-a-nascarfan.com , *is-a-nurse.com , *is-a-painter.com , *is-a-patsfan.org , *is-a-personaltrainer.com , *is-a-photographer.com , *is-a-player.com , *is-a-republican.com , *is-a-rockstar.com , *is-a-socialist.com , *is-a-soxfan.org , *is-a-student.com , *is-a-teacher.com , *is-a-techie.com , *is-a-therapist.com , *is-an-accountant.com , *is-an-actor.com , *is-an-actress.com , *is-an-anarchist.com , *is-an-artist.com , *is-an-engineer.com , *is-an-entertainer.com , *is-by.us , *is-certified.com , *is-found.org , *is-gone.com , *is-into-anime.com , *is-into-cars.com , *is-into-cartoons.com , *is-into-games.com , *is-leet.com , *is-lost.org , *is-not-certified.com , *is-saved.org , *is-slick.com , *is-uberleet.com , *is-very-bad.org , *is-very-evil.org , *is-very-good.org , *is-very-nice.org , *is-very-sweet.org , *is-with-theband.com , *isa-geek.com , *isa-geek.net , *isa-geek.org , *isa-hockeynut.com , *issmarterthanyou.com , *isteingeek.de , *istmein.de , *kicks-ass.net , *kicks-ass.org , *knowsitall.info , *land-4-sale.us , *lebtimnetz.de , *leitungsen.de , *likes-pie.com , *likescandy.com , *merseine.nu , *mine.nu , *misconfused.org , *mypets.ws , *myphotos.cc , *neat-url.com , *office-on-the.net , *on-the-web.tv , *podzone.net , *podzone.org , *readmyblog.org , *saves-the-whales.com , *scrapper-site.net , *scrapping.cc , *selfip.biz , *selfip.com , *selfip.info , *selfip.net , *selfip.org , *sells-for-less.com , *sells-for-u.com , *sells-it.net , *sellsyourhome.org , *servebbs.com , *servebbs.net , *servebbs.org , *serveftp.net , *serveftp.org , *servegame.org , *shacknet.nu , *simple-url.com , *space-to-rent.com , *stuff-4-sale.org , *stuff-4-sale.us , *teaches-yoga.com , *thruhere.net , *traeumtgerade.de , *webhop.biz , *webhop.info , *webhop.net , *webhop.org , *worse-than.tv , *writesthisblog.com , *publicvm.com , *linkpc.net

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Application Layer Protocol (T1071)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Disable outlook security via Registry Informational Tampering

    Attackers may try to disable outlook security features by modifying the Registry.

    Indicator:

    Registry registry data = 2 , 3 AND registry value name = PromptOOMSend , AdminSecurityMode , ObjectModelGuard AND registry key name = *Outlook* AND action type = set_registry_value Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Relativity ODA LLC AND Pearson PLC AND cgo signer != Relativity ODA LLC AND Pearson PLC AND initiated by != svchost.exe AND cgo name != svchost.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Disabling Windows Defender via Registry Informational Evasion

    Windows Defender stores its configuration in the Registry. By modifying these values, an attacker can disable security features.

    Indicator:

    Registry registry data = 1 AND registry key name = *Windows Defender* AND registry value name = *disable* AND action type = set_registry_value Process initiator signature = Signed , Unsigned , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , Invalid Signature , Weak Hash AND initiator signer != Symantec Corporation AND AVG Technologies USA, LLC AND Akeo Consulting AND Avast Software s.r.o. AND BeyondTrust Software Inc AND Bromium, Inc. AND Digital Communications Inc AND FireEye, Inc. AND Forcepoint LLC AND Google Inc AND Google LLC AND HP Inc. AND Invincea, Inc. AND Kaspersky Lab AND Netwrix Corporation AND OPSWAT, Inc. AND Palo Alto Networks (Netherlands) B.V. AND Rapid7 LLC AND Sangfor Technologies Co.,Ltd AND Snow Software AB AND Tanium Inc. AND Teradici Corporation AND Trend Micro, Inc. AND Websense, Inc. AND ZOHO Corporation private Limited AND Zoom Video Communications, Inc. AND Zscaler, Inc. AND Barracuda Networks, Inc. AND LiveQoS Incorporated AND cgo signer != Symantec Corporation AND AVG Technologies USA, LLC AND Akeo Consulting AND Avast Software s.r.o. AND BeyondTrust Software Inc AND Bromium, Inc. AND Digital Communications Inc AND FireEye, Inc. AND Forcepoint LLC AND Google Inc AND Google LLC AND HP Inc. AND Invincea, Inc. AND Kaspersky Lab AND Netwrix Corporation AND OPSWAT, Inc. AND Palo Alto Networks (Netherlands) B.V. AND Rapid7 LLC AND Sangfor Technologies Co.,Ltd AND Snow Software AB AND Tanium Inc. AND Teradici Corporation AND Trend Micro, Inc. AND Websense, Inc. AND ZOHO Corporation private Limited AND Zoom Video Communications, Inc. AND Zscaler, Inc. AND Barracuda Networks, Inc. AND LiveQoS Incorporated AND initiated by != msmpeng.exe AND svchost.exe AND mpcmdrun.exe AND mpsigstub.exe AND deviceenroller.exe AND securityhealthservice.exe AND mssense.exe AND taniumclient.exe AND setupplatform.exe AND ccmexec.exe AND configsecuritypolicy.exe AND securityhealthsystray.exe AND securityhealthhost.exe AND msiexec.exe AND omadmclient.exe AND monitoringhost.exe AND logonui.exe AND cgo name != msmpeng.exe AND svchost.exe AND mpcmdrun.exe AND mpsigstub.exe AND deviceenroller.exe AND securityhealthservice.exe AND mssense.exe AND taniumclient.exe AND setupplatform.exe AND ccmexec.exe AND configsecuritypolicy.exe AND securityhealthsystray.exe AND securityhealthhost.exe AND msiexec.exe AND omadmclient.exe AND monitoringhost.exe AND logonui.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Discovery of files with setgid or setuid bits Informational Privilege Escalation

    Attackers may try to locate files with setgid or setuid bits set to escalate privileges.

    Indicator:

    Process action type = execution AND target process cmd = * -perm *-4000* , * -perm *-2000* , * -perm *g+s* , * -perm *u+s* , * -perm *g=s* , * -perm *u=s* AND target process name = find Process initiated by != ir_agent AND cgo name != ir_agent

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Document discovery Informational Discovery

    Attackers may use the find command to look for documents.

    Indicator:

    Process action type = execution AND target process cmd = *.pdf* , *.doc* , *.ppt* , *.xls* AND target process name = find

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: File and Directory Discovery (T1083)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Driver written to a temporary directory Informational Evasion

    Drivers are highly unlikely to be written or moved to a temp directory. Check whether this driver is legitimate.

    Indicator:

    File action type = create , write AND file path = *\temp\* , *\tmp\* AND file name = *.sys

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Rootkit (T1014)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Dumping Registry hives with passwords Low Credential Access

    Dumping registry hives can be used to obtain stored credentials/hashes.

    Indicator:

    Process action type = execution AND target process cmd = * save *HKLM\sam* , * save *HKLM\security* , * save *HKLM\system* , * save *HKEY_LOCAL_MACHINE\sam* , * save *HKEY_LOCAL_MACHINE\security* , * save *HKEY_LOCAL_MACHINE\system* Process initiated by != ir_agent.exe AND cgo name != ir_agent.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Dumping lsass.exe memory for credential extraction Medium Credential Access

    Dumping lsass.exe memory to a file allows attackers to later extract credentials from the dumped memory.

    Indicator:

    Process action type = execution AND target process name = procdump.exe , procdump64.exe AND target process cmd = *lsass*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Encoded VBScript executed High Execution

    Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding.

    Indicator:

    Process action type = execution AND target process cmd = *vbscript.encode*

    ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)
    ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007) Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Encrypted zip archive creation Informational Collection

    Attackers may stage information for exfiltration by encrypting it beforehand in a zip archive.

    Indicator:

    Process action type = execution AND target process cmd = * -p* , * -e* , * --password* , * --encrypt* AND target process name = zip Host host os = macos , linux

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration command called by commonly abused CGO Informational Discovery

    Some malware uses these commands for reconnaissance.

    Indicator:

    Process action type = execution AND target process name = net.exe , ping.exe , whoami.exe , arp.exe , nslookup.exe , hostname.exe , ipconfig.exe , systeminfo.exe Process cgo name = cscript.exe , wscript.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087) Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration of Windows services from public IP addresses Informational Discovery

    Attackers may enumerate internet-facing services which use Windows protocols; as these services were not meant to be exposed to the internet, they may be attacked by enumerating users, brute-forcing passwords and through exploits.

    Indicator:

    Network Connections Source Local IP != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* AND 239.* Destination Remote Port = 445 , 139 , 135 , 138 , 137 AND app id contains *,ms-* AND protocol = tcp

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Network Service Discovery (T1046)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration of installed AV or FW products using WMIC Informational Discovery

    Attackers often check for the existence of security tools before launching an attack, and this is one of the methods that can be used.

    Indicator:

    Process action type = execution AND target process cmd = *AntiVirusProduct* , *FirewallProduct* AND target process name = wmic.exe , cmd.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Software Discovery: Security Software Discovery (T1518.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Enumeration of services via WMIC Informational Discovery

    Attackers may enumerate existing services using wmic.exe.

    Indicator:

    Process action type = execution AND target process cmd = * service * , * win32_service * AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: System Service Discovery (T1007) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Evasion using time-based properties Informational Evasion

    Attackers may check Event Log to evade virtualized environments.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *get-winevent*6005*

    ATT&CK tactics: Defense Evasion (TA0005) Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion: Time Based Checks (T1497.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • EventLog service disabled by a Registry operation High Tampering

    A Registry set-value operation that disables the EventLog service was executed on the machine.

    Indicator:

    Registry registry data = 4 , 3 AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\EventLog AND registry value name = Start AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable Windows Event Logging (T1562.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Excel Web Query file created on disk Informational Infiltration

    Excel uses Excel Web Query (.iqy) files to download data from the internet. There are campaigns in which .iqy files download a PowerShell script, which is launched via Excel and kicks off a chain of malicious downloads.

    Indicator:

    File file name = *.iqy AND action type = create

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Exchange process writing aspx files High Infiltration

    An exchange process is writing to .aspx files. This may be an actor dropping web shells.

    Indicator:

    File action type = create , write AND file path =~ (\\inetpub\\wwwroot\\aspnet_client\\|\\frontend\\httpproxy\\owa\\auth\\|\\frontend\\httpproxy\\ecp\\auth\\).*\.aspx Process initiated by = UMWorkerProcess.exe , w3wp.exe

    ATT&CK tactics: Initial Access (TA0001) Command and Control (TA0011)
    ATT&CK techniques: Exploit Public-Facing Application (T1190) Application Layer Protocol: Web Protocols (T1071.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Executable copied to remote host via admin share Informational Lateral Movement

    An executable file was written to a remote host's shared system folder (such as c:\ or c:\windows) from an unsigned CGO process.

    Indicator:

    File file path = *admin$* , *c$* AND file name = *.exe AND file path != *$NOCSC$* AND action type = write Process cgo name != perl.exe AND cgo signature = Unsigned Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Execution of Fsociety tool pack Medium Discovery

    The Fsociety tool pack is an array of tools for information gathering, password attacks, exploitation, and more.

    Indicator:

    Process action type = execution AND target process cmd = *fsociety.py* , target process name = fsociety Host host os = linux

    ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)
    ATT&CK techniques: Network Service Discovery (T1046) Brute Force (T1110)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Execution of WSL Distro Informational Evasion

    Detecting a new instance execution of Windows Subsystem for Linux distro.

    Indicator:

    File file path = *\drivers\etc\hosts AND action type = read Process initiated by = wsl.exe AND os parent cmd = *LxssManager AND os parent name = svchost.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indirect Command Execution (T1202)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Execution of commonly abused AutoIT script Informational Execution

    AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

    Indicator:

    Process action type = execution AND process execution signature = Signed , Weak Hash AND process execution signer = Autoit Consulting* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution (T1216)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Execution of regsvcs/regasm with uncommon paths Informational Execution

    The regasm.exe/regsvcs.exe commands are used to register .NET COM assemblies, which are typically located in specific paths. Uncommon paths may indicate malicious code is being registered.

    Indicator:

    Process action type = execution AND target process name = regasm.exe , regsvcs.exe AND target process cmd = *appdata\*dll* , *programdata\*dll* , *temp\*dll* , *tmp\*dll* , *documents\*dll , *$recycle.bin\*dll* AND target process cmd != *program files*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Regsvcs/Regasm (T1218.009)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • FTP/SSH client reads office files Low Exfiltration

    Seeing FTP/SSH related software accessing office files could be an indication of data exfiltration.

    Indicator:

    File file name = *.docx , *.doc , *.xlsx , *.xls , *.ppt , *.pptx AND action type = read Process initiated by = ftp.exe , putty.exe , winscp.exe , plink.exe , bash.exe , scp.exe , pscp.exe , psftp.exe

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • File renamed to have a script extension Informational Execution

    Adversaries may create 'benign-looking' files, which are later used as malicious scripts by changing their extension.

    Indicator:

    File file previous name = *.tmp , *._new , *.rra , *.txt , *.j , *.rbf , *.jpg , *.png , *.jpeg , *.gif , *.tiff , *.psd , *.pdf , *.eps , *.ai , *.indd , *.raw , *.bmp , *.ico , *.svg , *.tif , *.odt , *.rtf , *.tex , *.wpd AND file name = *.pyi , *.mof , *.hta , *.vbs , *.bat , *.aspx , *.pptm , *.pyd , *.pyc , *.php , *.py , *.js , *.ps1 , *.ps , *.crx , *.sct , *.tcl , *.dotm AND file path != *config.msi* AND *ccm* AND *trend micro* AND *adobe* AND *dell* AND *sessionstore* AND *browser-extension-data* AND *cortana* AND *microsoftedge* AND *microsoft vs code* AND *inetcache* AND file previous path != *prf* AND *set* AND *jds* AND *bit* AND *~$* AND *~w* AND action type = rename Process cgo name != suservice.exe AND wuauclt.exe AND besclient.exe AND tiworker.exe AND fwcld.exe AND svchost.exe AND tortoiseproc.exe AND emcoreservice.exe AND initiated by != 1e.client.exe AND expand.exe AND trustedinstaller.exe AND wuauclt.exe AND setup.exe AND setupsup_la31.exe AND ssms-setup-enu.exe AND lmirtechconsole.exe AND initiated by != git-*.tmp AND *.tmp

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • File timestamp tampering Informational Tampering

    An attacker may modify file timestamps by running the touch command to hide their activities.

    Indicator:

    Process action type = execution AND target process cmd = *-t* , *-acmr* , *-cmra* , *-rcma* , *-macr* AND target process name = touch

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Timestomp (T1070.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Fltmc.exe used to unload filter driver Informational Evasion

    Attackers can abuse the Filter Manager Control Program (fltMC.exe) to unload MiniFilter drivers, some of which may be used for activity monitoring.

    Indicator:

    Process action type = execution AND target process cmd = * unload * AND target process name = fltmc.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Fontdrvhost.exe makes network connections Informational Execution

    A remote code execution vulnerability(CVE-2020-1020) exists in the Windows Adobe Type Manager Library. Network activity of the vulnerable process fontdrvhost.exe can be a possible indicator of exploitation.

    Indicator:

    Network action type = incoming , outgoing , failed Process initiated by = fontdrvhost.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Exploitation for Client Execution (T1203)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Forensics Driver Loaded Informational Collection XQL

    A forensics driver has been loaded.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE_PRELOAD","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_vendor","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_product","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: Automated Collection (T1119) OS Credential Dumping (T1003)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • GUI Input Capture Informational Credential Access

    Prompt user to supply a password in response to a System Preference dialog pop up message.

    Indicator:

    Process action type = execution AND target process cmd =~ .*-e[[:blank:]]+tell app \"System Preferences\" to activate.*tell app \"System Preferences\" to display dialog.*[[:blank:]]+return.*answer.* AND target process name = osascript

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Input Capture: GUI Input Capture (T1056.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Gost tunneling execution Medium Execution

    Possible use of Gost (tunnel written in Golang) SSH tunnel.

    Indicator:

    Process action type = execution AND target process cmd = *rtcp://*socks5* , *rtcp://*socks4* , *rudp://*socks5* , *rudp://*socks4*

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Protocol Tunneling (T1572)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Grepping for passwords Informational Credential Access

    Attackers may look for cleartext passwords in files using the grep command.

    Indicator:

    Process action type = execution AND target process cmd = *pass* AND target process name = grep

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Group policy discovery using gpresult.exe Informational Discovery

    Attackers may use gpresult.exe to gather information on Group Policy settings.

    Indicator:

    Process action type = execution AND target process cmd = */r* AND target process name = gpresult.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Group Policy Discovery (T1615)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Hash cracking using Hashcat tool Medium Credential Access

    Hash cracking allows attackers to collect passwords and use them later on as part of their operation.

    Indicator:

    Process action type = execution AND target process cmd = * -m* , * --hash-type* , * -a* , * --attack-mode* , *.txt* AND target process name = hashcat*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Hidden directory creation Informational Evasion

    Attackers may create hidden directories to hide malware or staged files.

    Indicator:

    Process action type = execution AND target process cmd = *.* AND target process name = mkdir

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Hidden file and directory creation Informational Evasion

    Creation of a hidden file inside a hidden directory.

    Indicator:

    File action type = create , rename AND file name = .* AND file path =~ .*/\.[^/]+/\.[^/]+ Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23