BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

367 BIOCs match the current filters.

Download CSV Show ATT&CK heatmap
  • ISO mounted manually Informational Evasion

    A user manually mounted an ISO file.

    Indicator:

    File file name = *.iso.lnk AND file path = *\appdata\roaming\microsoft\windows\recent\* AND action type = create Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Impersonation using Rubeus tool Medium Evasion

    User authentication should not be impersonated, since this is considered a malicious behavior.

    Indicator:

    Process action type = execution AND target process cmd = * /ticket:* /impersonateuser:* , * /impersonateuser:* /ticket:*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Access Token Manipulation (T1134)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Injection into ping.exe Informational Evasion

    A process injected into an instance of ping.exe.

    Indicator:

    Process action type = injection AND remote process name = ping.exe Process cgo name != csrss.exe AND wmiprvse.exe AND vmstoold.exe AND ctskmstr.exe AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Sentinel Labs, Inc. AND Dell inc. AND cgo signature = Weak Hash , Invalid Signature , N/A , Unsigned , Signed AND cgo signer != Sentinel Labs, Inc. AND Dell inc. AND initiated by != ctskmstr.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Installation of Cain & Abel password recovery tool Low Credential Access

    A process created a Registry key associated with the common password cracking tool Cain & Abel.

    Indicator:

    Registry action type = set_registry_value , create_registry_key AND registry key name = *\software\cain* Host host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Installation of networking security tools Informational Discovery

    A security or penetration testing tool such as wireshark and nmap is being installed.

    Indicator:

    Process action type = execution AND target process name = *Wireshark-* , *WiresharkPortable* , *WinPcap_* , *nmap*setup* , *NPFInstall.exe*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Service Discovery (T1046)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Interface enumeration using netsh Informational Discovery

    Attackers may enumerate existing network interfaces using netsh.exe.

    Indicator:

    Process action type = execution AND target process cmd = *netsh* interface* show*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Internet Explorer home page modification Low Tampering

    The Internet Explorer home page could be changed to a malicious page.

    Indicator:

    Registry action type = all AND registry key name = *\Software\Microsoft\Internet Explorer\Main\* AND registry value name = *Start Page* Process initiated by != iexplore.exe AND cgo name != iexplore.exe Host host os = windows

    ATT&CK tactics: Impact (TA0040) Credential Access (TA0006)
    ATT&CK techniques: Defacement (T1491) Input Capture: GUI Input Capture (T1056.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Internet Explorer security settings modification Informational Evasion

    The Security Settings Check feature, which checks Internet Explorer security settings to determine risk, was disabled.

    Indicator:

    Registry registry key name = *SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Kerberos brute-force attack using Kerbrute Informational Credential Access

    This is a known Kerbrute tool command, used to conduct Kerberos authentication brute-force attacks.

    Indicator:

    Process action type = execution AND target process cmd = *kerbrute* -domain * -users * -passwords * , *kerbrute* -domain * -passwords * -users * , *kerbrute* -users * -domain * -passwords * , *kerbrute* -users * -passwords * -domain * , *kerbrute* -passwords * -users * -domain * , *kerbrute* -passwords * -domain * -users * , *passwordspray * , *bruteforce * , *bruteuser *

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Brute Force (T1110)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Kerberos service ticket request in PowerShell command High Credential Access

    Asking for a specific Kerberos service ticket can indicate an attacker's attempt to "Kerberoast" or use the ticket directly.

    Indicator:

    Process action type = execution AND target process cmd = * KerberosRequestorSecurityToken* , *Invoke-Kerberoast*

    ATT&CK tactics: Credential Access (TA0006) Lateral Movement (TA0008)
    ATT&CK techniques: Use Alternate Authentication Material: Pass the Ticket (T1550.003) Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Kerberos ticket forging using Impacket ticketer Medium Evasion

    Suspected execution of Impacket's ticketer.py script for forging TGT/TGS Kerberos tickets.

    Indicator:

    Process action type = execution AND target process cmd = *ticketer.py*

    ATT&CK tactics: Defense Evasion (TA0005) Privilege Escalation (TA0004)
    ATT&CK techniques: Access Token Manipulation (T1134)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Kernel modules loaded via command-line tool Informational Persistence

    The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.

    Indicator:

    Process action type = execution AND target process cmd != *ksplice* AND target process name = insmod Process initiated by != ds_am AND ds_agent AND ds_agent.init AND initiated by != savd* AND gpfsrunlevel AND runmmfs AND cgo name != ds_am AND ds_agent AND ds_agent.init AND cgo name != savd* AND gpfsrunlevel AND runmmfs AND initiator cmd != *sophos-av* AND *McAfee* AND *cisco* AND cgo cmd != *sophos-av* AND *McAfee* AND *cisco*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Kernel modules loaded via compiled loader and .ko file Informational Persistence

    Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits.

    Indicator:

    Process action type = execution AND target process cmd = *.ko * , *.ko

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Key Certificate Search And Exfiltrate Informational Credential Access

    Possible attempt to search for key certificates and exfiltrate them.

    Indicator:

    Process action type = execution AND target process cmd =~ .*(id_rsa|[.]key|[.]pgp|[.]gpg|[.]ppk|[.]p12|[.]pem|[.]pfx|[.]cer|[.]p7b|[.]asc).*-exec[[:blank:]]+cp[[:blank:]]+.* AND target process name = find

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Keychain Certificate Access Informational Credential Access

    Detected access to Keychain certificates.

    Indicator:

    Process action type = execution AND target process cmd =~ .*find-certificate.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Keychain (T1555.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Keychain Import Item Informational Credential Access

    An item was imported from the Keychain.

    Indicator:

    Process action type = execution AND target process cmd =~ .*import.*[.]pem.*(-k)?.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Keychain (T1555.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Keychain Unlock Informational Credential Access

    Detected Keychain unlocking.

    Indicator:

    Process action type = execution AND target process cmd =~ .*unlock-keychain.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Securityd Memory (T1555.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • LOLBAS reading a Windows credential manager file Informational Credential Access

    Encrypted files under the path AppData\Roaming\Microsoft\Credentials are associated with saved passwords in the Windows system.

    Indicator:

    File file path = *\appdata\roaming\microsoft\credentials\* AND action type = read Process initiated by = regsvcs.exe , schtasks.exe , xwizard.exe , findstr.exe , esentutl.exe , reg.exe , csc.exe , atbroker.exe , print.exe , pcwrun.exe , rpcping.exe , wsreset.exe , replace.exe , mshta.exe , bitsadmin.exe , ieexec.exe , cmd.exe , microsoft.workflow.compiler.exe , runscripthelper.exe , makecab.exe , forfiles.exe , control.exe , msbuild.exe , register-cimprovider.exe , ie4uinit.exe , sc.exe , bash.exe , hh.exe , jsc.exe , scriptrunner.exe , odbcconf.exe , extexport.exe , msdt.exe , diskshadow.exe , extrac32.exe , eventvwr.exe , mavinject.exe , regasm.exe , gpscript.exe , rundll32.exe , regsvr32.exe , regedit.exe , msiexec.exe , presentationhost.exe , wmic.exe , runonce.exe , syncappvpublishingserver.exe , verclsid.exe , infdefaultinstall.exe , expand.exe , installutil.exe , wab.exe , dnscmd.exe , at.exe , pcalua.exe , msconfig.exe , powershell.exe , powershell_ise.exe , python.exe , certutil.exe , cmstp.exe , wscript.exe , cscript.exe , perl.exe , ruby.exe AND cgo name != amazonassistantservice.exe AND venm.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Linux network share discovery Informational Discovery XQL

    A Linux network share discovery command was executed.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"df","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":".*((-aH)|(-a.*-H)|(-H.*-a)|(-Ha)).*","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"smbutil","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"view","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-g","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"showmount","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Log deletion in known log file directories Informational Evasion

    Deletion of log files in known log directories.

    Indicator:

    File file path = /var/log/* , /private/var/log/* , /private/var/audit/* AND action type = delete Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Log deletion using the truncate command Informational Tampering

    Usage of the truncate utility using "-s 0" argument to clear log files.

    Indicator:

    Process action type = execution AND target process cmd = truncate*-s 0*log* AND target process cmd != */tmp/* AND target process name = truncate Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Log deletion via command-line tool Informational Tampering

    An attacker may use the rm command to remove traces of their activities.

    Indicator:

    Process action type = execution AND target process cmd = */var/log/* , */var/audit* , */var/spool/mail* AND target process name = rm

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • MSBuild execution Informational Evasion

    Attackers may use MSBuild.exe to proxy execution of code through a trusted Windows utility.

    Indicator:

    Process action type = execution AND target process name = msbuild.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • MacOS firewall manipulation Informational Evasion

    An attacker may modify a firewall via command line to bypass network controls.

    Indicator:

    Process action type = execution AND target process name = socketfilterfw , launchctl , kextunload AND target process cmd = *unblockapp* , *--setglobalstate off* , *unload*com.apple.alf.useragent.plist* , *com.apple.nke.applicationfirewall* Host host os = macos

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses (T1562) Impair Defenses: Disable or Modify System Firewall (T1562.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Malicious NetSetupSvc.dll loaded into svchost.exe Informational Dropper

    A module tied to SolarStorm (TEARDROP NetSetupSvc.dll) was loaded from a malicious location into svchost.exe.

    Indicator:

    Image Load module path = *\SysWOW64\NetSetupSvc.dll Process initiated by = svchost.exe , cgo name = svchost.exe , os parent name = svchost.exe Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services (T1569)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of 'BootExecute' Registry run key Informational Persistence

    Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence.

    Indicator:

    Registry action type = all AND registry key name = *\Control\Session Manager AND registry value name = BootExecute Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of AppInit DLL loading list Informational Persistence

    The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on.

    Indicator:

    Registry action type = all AND os actor process signature vendor != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND registry data != *system32\SophosAV\* AND *\Citrix\* AND registry data = *.dll AND registry key name = *Software\Microsoft\Windows NT\CurrentVersion\Windows* AND registry value name = AppInit_DLLs Process initiator signer != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND cgo signer != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , os parent signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: AppInit DLLs (T1546.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Application Verifier custom providers Informational Persistence

    The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application.

    Indicator:

    Registry action type = all AND registry key name = *software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Image File Execution Options Injection (T1546.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Crypto Subject Interface Package (SIP) Provider Informational Evasion

    Malicious modification of crypto subject interface package (SIP) provider Registry keys can be leveraged to trick the OS into incorrectly validating invalid signing certificates. May have legitimate uses, but check for malicious activity.

    Indicator:

    Registry action type = all AND registry key name = *SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\* , *SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\* , *\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\* , *\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\* Process initiator path != *\microsoft office\root\integration\integrator.exe AND cgo path != *\microsoft office\root\integration\integrator.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: SIP and Trust Provider Hijacking (T1553.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Firefox plugins and extensions via the Registry Medium Persistence

    Plugins and extensions are loaded from all of these Registry keys.

    Indicator:

    Registry action type = set_registry_value AND registry key name = *SOFTWARE\Mozilla\Firefox\Extensions , *SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions , *software\wow6432node\mozillaplugins\ , *software\mozillaplugins\ Process initiated by != appvclient.exe AND initiator signer != mozilla corporation Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Software Extensions: Browser Extensions (T1176.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of MMC Registry configuration Informational Privilege Escalation

    Creation or modification of these Microsoft Management Console related entries can cause the execution of the specified programs, bypassing UAC.

    Indicator:

    Registry action type = all AND registry key name = *mscfile\shell\open\command* , *\folder\shell\open\command* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of RDP settings Informational Persistence

    Possible modification of Terminal Services/RDP settings.

    Indicator:

    Registry registry value name = *Terminal Server* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Volume Shadow Copy configuration Informational Tampering

    Modifying this key might remove VSS privileges from user accounts, possibly disabling Volume Shadow Copy.

    Indicator:

    Registry action type = delete_registry_key , rename_registry_key , set_registry_value , delete_registry_value AND registry key name = *\Services\VSS\VssAccessControl Host host os = windows

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Windows DNS configuration using WMIC Low Tampering

    This command can be leveraged by attackers to change the way DNS requests are sent, bypassing the corporate DNS servers.

    Indicator:

    Process action type = execution AND target process cmd = *call*SetDNSServerSearchOrder* AND target process name = wmic.exe Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Citrix Systems, Inc. AND cgo signer != Citrix Systems, Inc. AND initiator cmd != *Nutanix* AND cgo cmd != *Nutanix* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Windows Defender configuration Informational Tampering

    Commands used to bypass, disable or harm Windows Defender.

    Indicator:

    Process action type = execution AND target process name = net.exe , powershell.exe , reg.exe , cmd.exe AND target process cmd = *windefend* , *DisableRealtimeMonitoring* , *stop*Windows Defender*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Windows Event Log auto-backup via Registry Informational Tampering

    This key enables/disables the automatic backups of event logs when they are full.

    Indicator:

    Registry action type = all AND registry key name = *\services\eventlog\* AND registry value name = autobackuplogfiles Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Windows Safe Boot configuration Medium Tampering

    Safe-boot Registry settings deletion.

    Indicator:

    Registry registry key name = *Control\SafeBoot AND action type = delete_registry_value Host host os = windows

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Winlogon 'Notify' autostart Registry key Informational Persistence

    Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs.

    Indicator:

    Registry action type = all AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Winlogon 'UserInit' autostart Registry key Medium Persistence

    Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon.

    Indicator:

    Registry action type = all AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of autostart related system files Informational Persistence

    May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows.

    Indicator:

    File action type = create , delete , write AND file name = system.ini , win.ini , wininit.ini , winstart.bat , autoexec.bat , config.sys , system autoexec.nt , system config.nt , dosstart.bat Process initiated by != wuauclt.exe AND cgo name != wuauclt.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Pre-OS Boot: Bootkit (T1542.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of default file association configuration Informational Persistence

    When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened.

    Indicator:

    Registry action type = all AND registry data = * AND registry key name = *Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Change Default File Association (T1546.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of default file extension configuration Low Tampering

    Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions.

    Indicator:

    Registry registry value name = .exe , .dll , .sys , .lnk , .ps1 , .rar , .cmd , .bat , .zip AND registry key name = *\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Change Default File Association (T1546.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of permissions for the Application Event Log Informational Tampering

    Removing read/write permissions from this key may result in errors in the Application event log, and may cause certain VSS diagnostic tools to not function correctly. https://technet.microsoft.com/en-us/library/cc734219(v=ws.10).aspx.

    Indicator:

    Registry action type = delete_registry_key , rename_registry_key , set_registry_value , delete_registry_value AND registry key name = *\Services\VSS\Diag Host host os = windows

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of service imagepath configuration Informational Persistence

    This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *\services\*\imagepath Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003) Hijack Execution Flow: Services Registry Permissions Weakness (T1574.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of the MonitorProcess Registry key Medium Persistence

    Entries added under the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit can be used to run malicious code and help attackers gain persistence.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *silentprocessexit* AND registry value name = monitorprocess Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Image File Execution Options Injection (T1546.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of the sticky keys file Medium Privilege Escalation

    Possible login bypass attack.

    Indicator:

    File action type = create , write AND file path = *:\Windows\System32 , *:\Windows\Syswow64 AND file name = sethc.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Event Triggered Execution: Accessibility Features (T1546.008)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Connection Manager Profile Installer loads a file from the users to temporary folder Low Evasion

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Process action type = execution AND target process cmd = *temp* , *users* AND target process name = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Connection Manager Profile Installer makes connections to the network Low Dropper

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Network action type = outgoing , failed Process initiated by = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Connection Manager Profile Installer runs command line or PowerShell Low Execution

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , cmd.exe Process initiated by = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft HTML Application Host spawns from CMD or PowerShell Informational Execution

    Microsoft HTML Application Host is a program whose source code consists of HTML, Dynamic HTML and a few scripting languages compatible with Internet Explorer such as VBScript or JScript. It does not typically spawn from PowerShell or CMD.

    Indicator:

    Process action type = execution AND target process name = mshta.exe Process initiated by = cmd.exe , powershell.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Mshta (T1218.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft HTML Application Host spawns from Explorer.exe Informational Evasion

    Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host.

    Indicator:

    Process action type = execution AND target process name = mshta.exe Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Office Equation Editor spawns a commonly abused process Medium Execution

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. CVE-2017-11882 Microsoft Office Memory Corruption Vulnerability.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , mshta.exe , wscript.exe , cscript.exe , regsvr32.exe Process initiated by = EQNEDT32.EXE , cgo name = EQNEDT32.EXE

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Exploitation for Client Execution (T1203)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Office executes an unsigned process in a suspicious directory Informational Execution

    Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.

    Indicator:

    Process action type = execution AND target process path = *\appdata\* , *\programdata\* , *$recycle.bin* , *\temp\* , *\tmp\* , *\users*public\* AND process execution signature = Unsigned , Invalid Signature AND target process name != DriveForOffice.SyncHelper.exe AND CefSharp.BrowserSubprocess.exe AND Ifs.Fnd.Explorer.exe AND BAReportUpgradeUtilityLauncher.exe AND TSTPFLTK.exe AND 7zFM.exe AND notepad++.exe AND gpgme-w32spawn.exe AND python.exe AND target process name != F7-Zip*.exe AND pollev_browsers.exe AND SafeSendFileUploader-6.3.0.exe AND merrillhtmlfilter.exe AND dotnetbrowser-chromium32.exe AND fspublisher.exe AND validatehtml.exe Process initiated by = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe , cgo name = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe , os parent name = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Visual Basic (T1059.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Office process spawns a commonly abused process Informational Execution

    Common weaponized office document behavior.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe AND target process cmd != *\spool\DRIVERS* AND *C:\Windows\system32\shell32.dll,OpenAs_RunDLL* AND *ServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793}* Process initiated by = outlook.exe , excel.exe , winword.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Office process spawns an unsigned process Informational Execution

    Common weaponized office document behavior.

    Indicator:

    Process action type = execution AND process execution signature = Unsigned , Invalid Signature , N/A , Weak Hash Process initiated by = outlook.exe , excel.exe , winword.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Office spawns curl/wget on a macOS device Informational Exfiltration

    Microsoft Office Word/Excel/PowerPoint/Outlook spawn wget/curl on a macOS device.

    Indicator:

    Process action type = execution AND target process name = curl , wget Process initiated by = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook , cgo name = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook , os parent name = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of Windows boot configuration using bcdedit.exe Informational Tampering

    BCDEdit is a Microsoft Windows utility that can modify boot parameters. It is usually used as part of an attack to prevent repair of the affected system by disabling booting in recovery mode. It can also be used to stop Windows' Patchguard from objecting to the unsigned and insecure nature of a driver being loaded.

    Indicator:

    Process action type = execution AND target process cmd = *set* AND target process name = bcdedit.exe

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Rootkit (T1014) Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of default Windows startup path via Registry Informational Persistence

    An attacker may modify the startup path to the location of the malware.

    Indicator:

    Registry registry key name = *microsoft\windows\currentversion\explorer\user shell folders* , *microsoft\windows\currentversion\explorer\shell folders* AND registry data != *Microsoft\Windows\Start Menu\Programs\Startup* AND *\users\*\start Menu\Programs\Startup* AND *%USERPROFILE%\start Menu\Programs\Startup* AND registry value name = startup AND action type = set_registry_value Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Citrix Systems, Inc. AND VMware, Inc. AND initiator cmd != *regsvr32.exe*/s*/n*/i:u*shell32.dll* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of logon scripts via Registry Medium Persistence

    Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence.

    Indicator:

    Registry registry key name = *\Environment AND registry value name = UserInitMprLogonScript AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Initialization Scripts: Logon Script (Windows) (T1037.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of systemd service files Informational Persistence

    An attacker may create or modify systemd service unit files to establish persistence between reboots.

    Indicator:

    File action type = write , create AND file path =~ (^/etc/systemd/system/|^/usr/lib/systemd/system/|^/run/systemd/system/|/lib/systemd/system/|\.config/systemd/user/|^/etc/systemd/user/|\.local/share/systemd/user/|^/run/systemd/user/|^/usr/lib/systemd/user/).*\.service Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Systemd Service (T1543.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of the Winlogon\Shell Registry key Informational Persistence

    Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell.

    Indicator:

    Registry registry data != explorer.exe AND registry key name = *\software\microsoft\windows nt\currentversion\winlogon* AND registry value name = shell AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modifying ELF file capabilities via setcap Informational File Privilege Manipulation

    An attacker may attempt to gain privileges by setting the capabilities of a file.

    Indicator:

    Process action type = execution AND target process name = setcap

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Exploitation for Privilege Escalation (T1068)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Mounted NFS share discovery Informational Discovery

    Attackers may use the showmount command to list mount Network File Sharing shares.

    Indicator:

    Process action type = execution AND target process name = showmount

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Multiple RDP sessions enabled via Registry Medium Persistence

    Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does.

    Indicator:

    Registry registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fSingleSessionsPerUser AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003) Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001) Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • NTLM Credential dumping via RpcPing.exe Medium Credential Access

    RpcPing.exe can be used to gain network NTLM hash for offline cracking.

    Indicator:

    Process action type = execution AND target process cmd = *-u *NTLM* , *-u *10* AND target process name = rpcping.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Nagios enumeration Low Credential Access

    A Nagios XI database may be enumerated for the credentials of the hosts monitored.

    Indicator:

    Process action type = execution AND target process cmd =~ mysql.*nagios\.nagios_(hosts|services|commands)

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Netcat shell via named pipe Informational Execution

    Attackers may create a Netcat shell using a named pipe to remotely access the endpoint.

    Indicator:

    Process action type = execution AND target process name = mkfifo , mknod Process initiated by = *sh

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Netrc file enumeration Informational Credential Access

    Enumeration commands such as test and cat were executed on .netrc file paths that contain credentials.

    Indicator:

    Process action type = execution AND target process cmd = *test*.netrc* , *cat*.netrc* Host host os = linux

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Netsh.exe modifies allowed firewall port/program lists Informational Evasion

    Malware will often modify local firewall settings to permit untrusted software to communicate with the Internet for C2. Check for malicious use.

    Indicator:

    Process action type = execution AND target process cmd = *allowedprogram* , *portopening* AND target process name = netsh.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Network Packet Capture: tshark/tcpdump Informational Discovery

    Network packet capture using tshark\tcpdump utility.

    Indicator:

    Process action type = execution AND target process name = tcpdump , tshark Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Sniffing (T1040)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Network scanning tool executed Informational Discovery

    This rule looks for the string nmap in the command line, which indicates that the nmap scanning tool is used to scan a network or a machine.

    Indicator:

    Process action type = execution AND target process cmd = *nmap*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Network share discovery via command-line tool Low Discovery

    Attackers may use command-line tools to discover mapped shares on the host.

    Indicator:

    Process action type = execution AND target process name = df , smbutil AND target process cmd = *view -g* , *-aH

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • New certificate added to the trusted root store Informational Evasion

    Untrusted certificates could be used to install untrusted drivers and malicious code.

    Indicator:

    Process action type = execution AND target process cmd = *addstore*root* AND target process name = certutil.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: Install Root Certificate (T1553.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • New entry added to startup related Registry keys by unsigned process Informational Persistence

    Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level.

    Indicator:

    Registry action type = create_registry_key , rename_registry_key , set_registry_value AND registry key name = *software\Microsoft\Windows*CurrentVersion\run* , *Wow6432Node\Microsoft\Windows*CurrentVersion\Run* , *Software\Microsoft\Windows*CurrentVersion\Winlogon\Userinit* Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • New local user created via PowerShell command line Medium Persistence

    Attackers may create new local users to persist access to machines.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe AND target process cmd = *New-LocalUser*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • New service created via command line Informational Persistence

    Attackers may leverage services to gain persistence on an endpoint.

    Indicator:

    Process action type = execution AND target process cmd = *create*binpath* AND target process name = sc.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Non-browser process downloads content from GitHub Informational Evasion

    Check for possible attempts to use GitHub as a malicious payload deployment mechanism. This technique is known to be used frequently by threat actors to serve malicious scripts/payloads.

    Indicator:

    Network action type = outgoing , failed AND remote host = *githubusercontent.com* , *github.com , *gitlab.com Process initiated by != iexplore.exe AND chrome.exe AND firefox.exe AND opera.exe AND msedge.exe AND microsoftedge.exe AND microsoftedgecp.exe AND brave.exe AND vivaldi.exe AND chrome AND google chrome helper AND chromium AND firefox AND opera AND safari AND brave AND vivaldi AND initiated by != microsoft edge* AND git* AND grafana-server* AND initiator path != *\microsoft vs code\code.exe AND /Applications/Visual Studio Code.app/* AND *Sisense*java.exe* AND cgo cmd != *puppetlabs* AND *TeamCity\bin*

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Web Service (T1102)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Notepad process makes a network connection Low Exfiltration

    Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.

    Indicator:

    Network action type = incoming , outgoing , failed Process os parent name = notepad.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Ntdsutil.exe accessing ntds.dit file High Credential Access

    Attackers may attempt to dump ntds.dit, which stores all Active Directory account information, to later extract passwords and hashes from it.

    Indicator:

    File action type = all AND file name = ntds.dit Process initiated by = ntdsutil.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Office document embeds a .LNK file Informational Execution

    An Office process spawned a process with an argument indicating that the document contains an embedded .LNK file.

    Indicator:

    Process action type = execution AND target process cmd = *{00021401-0000-0000-C000-000000000046}* Process initiated by = winword.exe , excel.exe , powerpnt.exe Host host os = windows

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Office process spawns verclsid.exe Informational Execution

    A Microsoft Office process launching verclsid.exe may be a sign of phishing.

    Indicator:

    Process action type = execution AND target process name = verclsid.exe Process initiated by = winword.exe , excel.exe , powerpnt.exe

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Office process writes an executable file to disk Informational Execution

    An executable file was written by a Microsoft Office application to disk.

    Indicator:

    File file name = *.exe , *.bat , *.ps1 , *.sys , *.dll , *.vb , *.vbs AND action type = create Process initiated by = winword.exe , excel.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Out of band testing domain connection Low Infiltration

    Connection from web service process to out-of-band-testing domain.

    Indicator:

    Network action type = outgoing , failed , raw_packet AND remote host =~ burpcollabat\.net|canarytokens\.com|dnslog\.cn|interact\.sh|interactsh\.com|oast\.fun|oast\.live|oast\.me|oast\.online|oast\.pro|oast\.site|oastify\.com|ptst\.io|r87\.me|requestbin\.net Process initiated by = apache.exe , apache2.exe , caddy.exe , httpd.exe , jsvc.exe , lighthttpd.exe , lighttpd.exe , lshttpd.exe , nginx.exe , nhttpd.exe , node.exe , php-cgi.exe , php.exe , tomcat.exe , tomcat7.exe , w3wp.exe , cgo name = apache.exe , apache2.exe , caddy.exe , httpd.exe , jsvc.exe , lighthttpd.exe , lighttpd.exe , lshttpd.exe , nginx.exe , nhttpd.exe , node.exe , php-cgi.exe , php.exe , tomcat.exe , tomcat7.exe , w3wp.exe , os parent name = apache.exe , apache2.exe , caddy.exe , httpd.exe , jsvc.exe , lighthttpd.exe , lighttpd.exe , lshttpd.exe , nginx.exe , nhttpd.exe , node.exe , php-cgi.exe , php.exe , tomcat.exe , tomcat7.exe , w3wp.exe

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Exploit Public-Facing Application (T1190)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Outlook creates an executable file on disk Informational Dropper

    Common weaponized Office document behavior, as Outlook should not create binary files at all.

    Indicator:

    File file name = *.exe , *.scr , *.dll , *.sys , *.msi AND file path != *\AppData\Local\assembly\tmp\*.DLL AND *\AppData\Roaming\Microsoft\UProof\CMA*.bin AND *\AppData\Roaming\Microsoft\UProof\MSIP.Office.*.DLL AND *\AppData\Roaming\Microsoft\UProof\CMA*.bin AND *\AppData\Roaming\Microsoft\UProof\SIP.Office.*.DLL AND *\AppData\Local\Temp\*.DLL AND *:\TEMP\*\IntResource64.dll AND action type = create Process initiated by = outlook.exe

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Password complexity enumeration Informational Discovery

    Attackers may read system files containing password complexity requirements.

    Indicator:

    Process action type = execution AND target process cmd = */etc/login.defs* , */etc/pam.d/common-password* , */etc/security/pwquality.conf* , */etc/pam.d/system-auth* AND target process name = grep , head , tail , less , cat Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Password Policy Discovery (T1201)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Password policy discovery via command-line tool Informational Discovery

    Attackers may use chage to list the password policy and the user's last access time.

    Indicator:

    Process action type = execution AND target process cmd = *-l* AND target process name = chage

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Password Policy Discovery (T1201)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Password-related Mozilla files were read by a non-Mozilla process Informational Credential Access

    Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

    Indicator:

    File file path = *\mozilla\firefox\* , *\netgate technologies\blackhawk\* , *\8pecxstudios\cyberfox\* , *\comodo\icedragon\* , *\k-meleon\* , *\mozilla\icecat\* AND file name = *.sqlite , *.db , *.json AND action type = read Process initiated by != firefox.exe AND blackhawk.exe AND cyberfox.exe AND icedragon.exe AND k-meleon.exe AND icecat

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Perl script connecting to network Medium Execution

    Perl scripts may be used by attackers to connect to their command-and-control infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *socket*connect*sock_stream* , *socket*sock_stream*connect* AND target process name = perl

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Unix Shell (T1059.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Permission groups discovery via ldapsearch Informational Discovery

    Attackers may use the ldapsearch command-line tool to gather information about domain groups and their permissions.

    Indicator:

    Process action type = execution AND target process cmd =~ objectClass|=\*|objectCategory|servicePrincipalName|adminCount|samAccountType AND target process name = ldapsearch Process cgo name != adclient Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Permission Groups Discovery (T1069)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Permissive file privileges were granted Informational Evasion

    Setting readable, writable, and executable permissions for all users may pose a major security risk.

    Indicator:

    Process action type = execution AND target process cmd = *chmod*777* , *chmod*a+*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: File and Directory Permissions Modification (T1222)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence through service registration Informational Persistence

    An attacker may add or modify system services to persist on a host.

    Indicator:

    File action type = write , create , rename AND file path =~ /etc/(init.d/|rc|systemd|inetd.conf|modules|modprobe.conf|inittab).*|/lib/systemd.* Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Systemd Service (T1543.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence using bashrc files Informational Persistence

    Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution.

    Indicator:

    File action type = write , rename , create AND file path =~ (/home/[^/]+/\.(bashrc|profile|bash_profile))|(/etc/profile|/etc/bash.bashrc|/etc/csh.cshrc|/etc/csh.login) Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Unix Shell Configuration Modification (T1546.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence using cron jobs Informational Persistence

    Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware.

    Indicator:

    File action type = create , write AND file path = /var/spool/cron/crontabs/* , /etc/crontab* , /etc/cron.hourly/* , /etc/cron.daily/* , /etc/cron.weekly/* , /etc/cron.monthly/* , /etc/cron.d* , /var/spool/cron/atjobs* , /var/spool/at* , /etc/at.allow* , /etc/at.deny* , /etc/cron.allow* , /etc/cron.deny* , /etc/anacrontab* Process initiator cmd != *atd -f* AND *puppet* AND cgo cmd != *atd -f* AND *puppet* AND initiated by != *zabbix_server* AND initiated by != puppet AND yum AND cgo name != *zabbix_server* AND cgo name != puppet AND yum

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job: Cron (T1053.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence via Registry screensaver key change Informational Persistence

    Attackers may install their malware persistently by modifying the value of the screensaver Registry key.

    Indicator:

    Registry registry key name = *\Control Panel\Desktop AND registry value name = SCRNSAVE.EXE AND action type = set_registry_value Process initiator cmd != * shell32.dll,Control_RunDLL desk.cpl,ScreenSaver,* AND initiated by != rundll32.exe AND cgo name != explorer.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Screensaver (T1546.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Ping executed with loopback address Informational Evasion

    This seemingly strange "wait" mechanism is often used by malware to stall command execution.

    Indicator:

    Process action type = execution AND target process cmd = *127.0.0.1* , *localhost* AND target process name = ping.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Ping to a known external IP address Informational Evasion

    Pinging a known external IP address is often used by malware to check internet connectivity.

    Indicator:

    Process action type = execution AND target process name = ping.exe , ping AND target process cmd = *8.8.8.8* , *8.8.4.4* , *9.9.9.9* , *149.112.112.112* , *208.67.222.222* , *208.67.220.220* , *1.1.1.1* , *1.0.0.1* , *185.228.168.9* , *185.228.169.9* , *64.6.64.6* , *64.6.65.6* , *198.101.242.72* , *23.253.163.53* , *176.103.130.130* , *176.103.130.131* Process cgo name != cmd.exe AND thorium.exe AND 4nt.exe AND cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND cgo signer != BeyondTrust Software Inc AND HP Inc. Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Plink/SSH reverse tunnel Low Exfiltration

    PuTTY link (Plink) / SSH can be used to create encrypted tunnels to communicate back to an attacker's C2 server.

    Indicator:

    Process action type = execution AND target process cmd =~ \s+-R\s+((\d{1,3}\.){3}\d{1,3}:)?(\d+:)?(localhost|127\.0\.0\.1):(3389|445|135|139|389|636)

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Protocol Tunneling (T1572)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Pluggable Authentication Modules Access Informational Credential Access

    Access to Pluggable Authentication Modules.

    Indicator:

    Process action type = execution AND target process name = vi , vim , nano AND target process cmd =~ .*/etc/pam[.]d/.+

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Modify Authentication Process: Pluggable Authentication Modules (T1556.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Pluggable Authentication Modules Modification Informational Credential Access

    Modification of Pluggable Authentication Modules.

    Indicator:

    File action type = write , delete , rename AND file path =~ ^/private/etc/pam[.]d/.*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Modify Authentication Process: Pluggable Authentication Modules (T1556.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Port Monitor added in Registry Low Persistence

    Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.

    Indicator:

    Registry registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Monitors\ART AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23