BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

367 BIOCs match the current filters.

Download CSV Show ATT&CK heatmap
  • Possible ARP reconnaissance Informational Discovery

    The ARP binary could be used for network mapping (common with malware).

    Indicator:

    Process action type = execution AND target process name = arp.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible ARP reconnaissance via netdiscover Informational Discovery

    Netdiscover is an active/passive ARP reconnaissance tool, which attackers may use to learn your network.

    Indicator:

    Process action type = execution AND target process name = netdiscover Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible C2 via dnscat2 High Evasion

    Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic.

    Indicator:

    Process action type = execution AND target process name = dnscat2 Host host os = linux

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible Firefox browser history and bookmarks collection via command-line tool Medium Discovery

    Attackers may collect history and bookmarks details by accessing the Firefox database.

    Indicator:

    Process action type = execution AND target process cmd = *.mozilla/firefox/*/places.sqlite

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Browser Information Discovery (T1217)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible LSASS memory dump High Credential Access

    Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump.

    Indicator:

    Process action type = execution AND target process cmd = *-ma lsass.exe*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping: LSASS Memory (T1003.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible Oracle enumeration via Oscanner Low Discovery

    The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.

    Indicator:

    Process action type = execution AND target process name = oscanner* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible Oracle enumeration via tnscmd10g Low Discovery

    The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs.

    Indicator:

    Process action type = execution AND target process name = tnscmd10g* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Service Discovery (T1046)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible UAC bypass via Event Viewer Medium File Privilege Manipulation

    Eventvwr.exe normally only spawns mmc.exe. Attackers may use it for bypassing UAC (User Account Control) by having it spawn a different process.

    Indicator:

    Process action type = execution AND target process name != mmc.exe Process initiated by = eventvwr.exe , os parent name = eventvwr.exe Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible XDG autostart persistency Informational Persistence

    Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory.

    Indicator:

    File action type = create , rename , write AND file path =~ (/etc/xdg|.*/\.config)/autostart/.*\.desktop$ Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: XDG Autostart Entries (T1547.013)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible data destruction via dd Informational Tampering

    Attackers may use dd to zero out or write random data to files.

    Indicator:

    Process action type = execution AND target process cmd = *if=/dev/zero*of=* , *of=*if=/dev/zero* , *if=/dev/*random*of=* , *of=*if=/dev/*random* AND target process cmd != *of=/var/tmp* AND *of=/dev/stdout* AND target process name = dd

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Data Destruction (T1485)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible log destruction using the dd command Informational Tampering

    Possible destruction of system log files using the dd command.

    Indicator:

    File action type = rename , write , create AND file path = /var/log/* Process initiated by = dd , cgo name = dd , os parent name = dd AND initiator cmd = *of=/var/log/* , cgo cmd = *of=/var/log/* , os parent cmd = *of=/var/log/* Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible ping sweep Medium Discovery

    Ping sweeps are useful tools that can detect which machines are up in the network and can be the step before lateral movement.

    Indicator:

    Process action type = execution AND target process cmd = *for*254 * ping *%* , *for*254)* ping *%* , *for*254* ping.exe *%* , *for*254)* ping.exe *%*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible user enumeration via /etc/passwd Informational Discovery

    Attackers may enumerate users by reading the /etc/passwd file.

    Indicator:

    Process action type = execution AND target process cmd = */etc/passwd*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible user enumeration via finger Informational Discovery

    The Linux 'finger' command performs user enumeration, which attackers may attempt to gather during the reconnaissance phase.

    Indicator:

    Process action type = execution AND target process name = finger Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible web shell command execution Informational Persistence XQL

    Possible command execution via a web shell for reconnaissance.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"OR":[{"LEFT":"$actor_process_image_name","OPERATOR":"IN","RIGHT":["w3wp.exe","httpd.exe","php-cgi.exe","nginx.exe","tomcat.exe"],"FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"nslookup","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"whoami","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" hostname","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" arp ","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" net ","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"qwinsta","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"netstat","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"quser","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" powershell","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"tasklist","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"ipconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"ping","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"certutil","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"rundll32","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"vssadmin","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"tracert","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"systeminfo","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"netsh","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Server Software Component: Web Shell (T1505.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Potential Network Sniffing Informational Credential Access

    Network sniffing related processes were detected.

    Indicator:

    Process action type = execution AND target process name = wireshark , tcpdump

    ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)
    ATT&CK techniques: Network Sniffing (T1040)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Potential web shell installation Informational Persistence

    A web-app script file was installed on a web server. This can indicate an installation of web shell.

    Indicator:

    File action type = create , write AND file path = /var/www/html/*.php , /var/www/html/*.asp , /var/www/html/*.aspx , /var/www/html/*.cfm , /var/www/html/*.jsp , /var/www/html/*.pl

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Server Software Component: Web Shell (T1505.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell calling Invoke-Expression argument Informational Execution

    These PowerShell arguments are often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *iex * , *invoke-expression * AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = *Microsoft Corporation* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell creates a new service Low Persistence

    PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.

    Indicator:

    Process action type = execution AND target process cmd = *New-Service* AND target process name = powershell.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell downloads files via BITS Medium Persistence

    This PowerShell argument is often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *start-bitstransfer* , *complete-bitstransfer* AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: BITS Jobs (T1197)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell dumps users and roles from Exchange server Medium Discovery

    PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign).

    Indicator:

    Process action type = execution AND target process cmd =~ .*PSConsoleFile.*(Get-ManagementRoleAssignment|GetEffectiveUsers).*(Name|Role|EffectiveUserName|AssignmentMethod|IsValid).* AND target process name = powershell.exe Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery: Email Account (T1087.003) Permission Groups Discovery: Domain Groups (T1069.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell is used to execute a CPL file Informational Evasion

    Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = * control.exe *.cpl*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell is used to modify a timestamp Informational Evasion

    Attackers may use PowerShell.exe to modify the timestamp of a file.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *.creationtime*=*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Timestomp (T1070.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell possibly attempting to execute as administrator Informational Execution

    This PowerShell argument is often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *administrator* AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell reverse shell Medium Execution

    This rule looks for a PowerShell instance that is communicating over known Metasploit ports back to an attacker in cases of reverse shell.

    Indicator:

    Network action type = outgoing , failed AND remote port = 4444 Process initiator cmd = *web*downloadstring*.ps1* , *web*downloadstring*.exe* AND initiated by = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell running with download in the command line Informational Dropper

    PowerShell can be used to download malicious content from the internet.

    Indicator:

    Process action type = execution AND target process cmd = *download* AND target process name = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell runs with known Mimikatz arguments Medium Collection

    These PowerShell arguments are often used to run commands with malicious intent while running Mimikatz, a credential harvesting tool.

    Indicator:

    Process action type = execution AND target process cmd = *privilege::* , *sekurlsa::* , *kerberos::* , *crypto::* , *vault::* , *token::* , *lsadump::* , *-dumpcr* , *-dumpce* AND target process name = powershell.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell script executed from a temporary directory Informational Collection

    An attacker may try to avoid detection by executing a PowerShell script from a temporary directory.

    Indicator:

    Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.*-(enc|EncodedCommand|ec|en) [A-Za-z0-9]{5,}=|[windowstyle^ ]{1,12}?hidden|(noni|noninteractive)|n(oprofile|op)|e[xecutionpolicy]{1,15} (bypass|unrestricted|hidden)|(eq|noexit)).* AND target process cmd !=~ .*(embedding|comment|wdenable|EnableService|-energy -auto|NetworkDiagnosticsPNI).* Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Print Processor Registration Low Persistence

    Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Environments\Windows x64\Print Processors Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Print Processors (T1547.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Print spooler set to load new DLL on boot Informational Persistence

    Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API.

    Indicator:

    Registry action type = set_registry_value , create_registry_key AND registry data != BPSLMONITOR.DLL AND registry key name = *Control\Print\Monitors* AND registry value name = driver Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Process attempts to kill a known security/AV tool Medium Evasion

    This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = * nwscmon.exe* , * fortisslvpndaemon.exe* , * bullguardbhvscanner.exe* , * rawshark.exe* , * fcdblog.exe* , * bullguard.exe* , * adawaredesktop.exe* , * consctlx.exe* , * sastask.exe* , * scanwscs.exe* , * k7tsecurity.exe* , * filwscc.exe* , * littlehook.exe* , * bullguarscanner.exe* , * nvcod.exe* , * ptwatchdog.exe* , * mbamservice.exe* , * unthreat.exe* , * twsscan.exe* , * schmgr.exe* , * escanmon.exe* , * uiwinmgr.exe* , * bgscan.exe* , * forticlient_diagnostic_tool.exe* , * nnf.exe* , * v3sp.exe* , * sdwelcome.exe* , * clamtray.exe* , * nvoy.exe* , * sbpimsvc.exe* , * v3main.exe* , * fcappdb.exe* , * mergecap.exe* , * mwaser.exe* , * bavtray.exe* , * filup.exe* , * v3up.exe* , * avktray.exe* , * msmpeng.exe* , * onlinent.exe* , * avpmapp.exe* , * taskmgr.exe* , * k7fwsrvc.exe* , * clamscan.exe* , * ptsessionagent.exe* , * nissrv.exe* , * v3proxy.exe* , * mbam.exe* , * webcompanion.exe* , * k7tsmngr.exe* , * mcshieldrtm.exe* , * fprottray.exe* , * fortifw.exe* , * procexp64.exe* , * avkwctlx64.exe* , * opssvc.exe* , * superantispyware.exe* , * escanpro.exe* , * nprosec.exe* , * quamgr.exe* , * bullguardupdate.exe* , * avkproxy.exe* , * psuaservice.exe* , * k7pssrvc.exe* , * acs.exe* , * clamwin.exe* , * fortitray.exe* , * k7crvsvc.exe* , * bavupdater.exe* , * certreg.exe* , * fpavserver.exe* , * filmsg.exe* , * k7sysmon.exe* , * econser.exe* , * zlh.exe* , * uiupdatetray.exe* , * fshoster32.exe* , * psview.exe* , * sapissvc.exe* , * quamgr.exe* , * k7rtscan.exe* , * schmgr.exe* , * fsma32.exe* , * zlhh.exe* , * k7fwsrvc.exe* , * twssrv.exe* , * nanoav.exe* , * fpwin.exe* , * useraccountcontrolsettings.exe* , * freshclam.exe* , * wireshark.exe* , * ns.exe* , * coreframeworkhost.exe* , * sbamtray.exe* , * scproxysrv.exe* , * viewtcp.exe* , * sdfssvc.exe* , * fshdll64.exe* , * avkservice.exe* , * nfservice.exe* , * utsvc.exe* , * traysser.exe* , * nvcsvc.exe* , * sdscan.exe* , * ptsvchost.exe* , * k7sysmon.exe* , * procexp.exe* , * mpuxsrv.exe* , * quhlpsvc.exe* , * superdelete.exe* , * guardxservice.exe* , * msascui.exe* , * mcshieldds.exe* , * k7tsmain.exe* , * trigger.exe* , * econceal.exe* , * fsgk32.exe* , * adawareservice.exe* , * mbamscheduler.exe* , * mcs-uninstall.exe* , * fortiesnac.exe* , * k7avscan.exe* , * nbrowser.exe* , * nseupdatesvc.exe* , * guardxkickoff_x64.exe* , * bavhm.exe* , * cistray.exe* , * agentsvc.exe* , * adawaretray.exe* , * av_task.exe* , * njeeves2.exe* , * coreserviceshell.exe* , * k7tsmain.exe* , * uiwatchdog.exe* , * freshclamwrap.exe* , * k7avscan.exe* , * psuamain.exe* , * sdtray.exe* , * gdscan.exe* , * mcshieldccc.exe* , * cmdagent.exe* , * dragon_updater.exe* , * cis.exe* , * forticlient.exe* , * sascore64.exe* , * bav.exe* , * ssupdate64.exe* , * scanner.exe* , * v3svc.exe* , * bavsvc.exe* , * psanhost.exe* , * gdbginx64.exe* , * k7emlpxy.exe* , * gdsc.exe* , * avk.exe* , * text2pcap.exe* , * fssm32.exe* , * userreg.exe* , * iptray.exe* , * emlproxy.exe* , * processhacker.exe* , * k7tsmngr.exe* , * filwscc.exe* , * mpcmdrun.exe* , * k7emlpxy.exe* , * virusutilities.exe* , * k7tsecurity.exe* , * fchelper64.exe* , * k7crvsvc.exe* , * capinfos.exe* , * v3medic.exe* , * fsm32.exe* , * k7pssrvc.exe* , * fmon.exe* , * gdkbfl.exe* , * op_mon.exe* , * vipreui.exe* , * uiseagnt.exe* , * zanda.exe* , * cavwp.exe* , * bdssvc.exe* , * nanosvc.exe* , * mwagent.exe* , * k7rtscan.exe* , * editcap.exe* , * bavwebclient.exe* , * fsorsp.exe* , * scsecsvc.exe* , * fortiproxy.exe* , * configsecuritypolicy.exe* , * trayicos.exe* , * sbamsvc.exe* , * cyserver.exe* AND target process name = taskkill.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Process calls ActiveX Object with a shell command Medium Execution

    This rule looks for ActiveX being used to run commands on a machine, seen in cases of evasive attacks.

    Indicator:

    Process action type = execution AND target process cmd = *ActiveXObject*WScript.Shell*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Process changes the Windows logon text Medium Tampering

    This registry key is used to display a legal notice when logging on to the computer. This is used by the DXXD ransomware to notify the user.

    Indicator:

    Registry action type = create_registry_key , set_registry_value , rename_registry_key AND registry key name = *SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption* Host host os = windows

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Defacement (T1491)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Process requests the deletion of Windows Shadowcopies High Tampering

    Ransomware and wipers may use the wmic.exe or vssadmin.exe utilities to delete or modify Shadowcopies (a Windows backup mechanism).

    Indicator:

    Process action type = execution AND target process cmd = *delete*shadows*all* , *shadowcopy*delete * AND target process name = vssadmin.exe , wmic.exe

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Process runs from the recycle bin Low Evasion

    Process running from the recycle bin.

    Indicator:

    Process action type = execution AND target process path = *:\$recycle.bin\* Process cgo name != ECSSoftwareAutoUpdater.exe AND ECSManager.exe AND Sapstartsrv.exe AND ECSMonitor.exe AND ECSPlayer.exe AND Chrome.exe AND cgo path != *Microsoft VS Code* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Process runs with a double extension Medium File Type Obfuscation

    Look for executables with a common double extension. These are often used to disguise malware as some form of user content.

    Indicator:

    Process action type = execution AND target process name = *.docx.exe , *.xlsx.exe , *.pptx.exe , *.pdf.exe , *.wav.exe , *.mp3.exe , *.mkv.exe , *.avi.exe , *.mp4.exe , *.gif.exe , *.bmp.exe , *.png.exe , *.jpg.exe , *.jpeg.exe , *.m4a.exe , *.html.exe , *.htm.exe , *.mht.exe , *.doc.exe , *.xls.exe , *.ppt.exe Process cgo name != NewWorld.Services.MobileServer.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PsExec attempts to execute a command on a remote host Informational Lateral Movement

    PsExec is a SysInternals tool used to execute commands on remote hosts.

    Indicator:

    Network action type = outgoing , failed AND remote port = 135 , 445 Process initiated by = psexec.exe AND initiator signature = Signed AND initiator signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002) System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PsExec executed with plain-text credentials on the command line Informational Execution

    PsExec.exe is a Windows administrative tool, which may be used by adversaries to execute remote commands.

    Indicator:

    Process action type = execution AND target process cmd = * -u * -p * , * -p * -u * AND target process name = psexec.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PsExec execution EulaAccepted flag added to the Registry Informational Execution

    PsExec is commonly used by malware for lateral movement, seeing this value in the Registry means that the user ran PsExec and approved the EULA either automatically or manually.

    Indicator:

    Registry registry key name = *\Software\Sysinternals\PsExec* AND registry value name = *EulaAccepted* AND action type = set_registry_value Process initiated by != ltsvc.exe AND batchpatch.exe AND agentservice.exe AND cgo name != ltsvc.exe AND batchpatch.exe AND agentservice.exe Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002) Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PsExec runs with System privileges Informational Privilege Escalation

    PsExec.exe is a Windows administrative tool, it can be used to elevate privileges and run other processes with NT/System privilege level.

    Indicator:

    Process action type = execution AND target process cmd = * -s* AND target process name = psexec.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Valid Accounts (T1078)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Psexesvc.exe executes a command from a remote host Informational Execution

    Psexesvc.exe executes to run a command received from a remote host via PsExec.

    Indicator:

    Process action type = execution AND target process name = psexesvc.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Pubprn.vbs signed script proxy execution High Execution

    Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.

    Indicator:

    Process action type = execution AND target process cmd = *pubprn.vbs*script:*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution: PubPrn (T1216.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Python script connecting to network Medium Execution

    Python scripts may be used by attackers to connect to their command-and-control infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *socket*connect*sock_stream* , *socket*sock_stream*connect* AND target process name = python

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Python (T1059.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Query startup programs using wmic.exe Informational Discovery

    Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system.

    Indicator:

    Process action type = execution AND target process cmd = *startup* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • RDP connections enabled via Registry by unsigned process Low Persistence

    An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

    Indicator:

    Registry registry data = 0 AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fDenyTSConnections AND action type = set_registry_value Process initiator signature != Signed AND N/A AND cgo signature != Signed AND N/A AND initiated by != SCCService.exe AND ZenworksWindowsService.exe AND DTPlayerMonitor.exe, AND AdisVDIDesktopAgent.exe AND RDPConf.exe AND cgo name != SCCService.exe AND ZenworksWindowsService.exe AND DTPlayerMonitor.exe, AND AdisVDIDesktopAgent.exe AND RDPConf.exe Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • RDP connections enabled via Registry from a script host or rundll32.exe Informational Persistence

    An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

    Indicator:

    Registry registry data = 0 AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fDenyTSConnections AND action type = set_registry_value Process initiated by = cmd.exe , powershell.exe , wscript.exe , cscript.exe , mshta.exe , rundll32.exe , cgo name = cmd.exe , powershell.exe , wscript.exe , cscript.exe , mshta.exe , rundll32.exe AND initiator cmd != *\\*netlogon* AND *\\*sysvol* AND *LiteTouch.wsf* AND *Puppet* AND cgo cmd != system32\osdsetuphook.exe /execute Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Rar.exe execution with password protection parameters Informational Collection

    Rar.exe was executed with parameters indicating password protection of the output file.

    Indicator:

    Process action type = execution AND target process cmd = *-hp* , *-p* AND target process name = rar.exe Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Reading .ssh files Informational Credential Access

    Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers.

    Indicator:

    Process action type = execution AND target process cmd = * .ssh , * .ssh * , * .ssh/* , */.ssh * , */.ssh/* AND target process name = cat , grep AND target process cmd != *grep -c* Process initiated by != ssh-copy-id AND rkhunter AND cgo name != nessus-service AND sshd AND electron AND sshd-keygen-wrapper AND ir_agent AND bbedit

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Reading the contents of /etc/mtab or /etc/fstab Informational Discovery

    File read on /etc/mtab or /etc/fstab using the cat utility.

    Indicator:

    Process action type = execution AND target process cmd = */etc/mtab* , */etc/fstab* AND target process name = cat Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: File and Directory Discovery (T1083)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Registry credentials extraction Informational Credential Access

    Attackers may extract credentials from the Registry using system commands.

    Indicator:

    Process action type = execution AND target process cmd = * query* password* AND target process name = reg.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials in Registry (T1552.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Regsvr32 may have run code from an untrusted source High Execution

    Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host.

    Indicator:

    Process action type = execution AND target process cmd = * /i:*http* , * /i*scrobj.dll* AND target process name = regsvr32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Regsvr32 (T1218.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Remote RDP session enumeration via query.exe Informational Lateral Movement

    Attackers may use the built-in query.exe tool to enumerate remote sessions, using the session flag.

    Indicator:

    Process action type = execution AND target process cmd = *session* /server* AND target process name = query.exe

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Remote RDP session enumeration via qwinsta.exe Informational Lateral Movement

    Attackers may use the built-in qwinsta.exe tool to enumerate remote sessions.

    Indicator:

    Process action type = execution AND target process cmd = * /server* AND target process name = qwinsta.exe

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Remote command executed from a Linux host Low Lateral Movement

    This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.

    Indicator:

    Process action type = execution AND target process name = winexesvc.exe , winexe.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Remote file copy Informational Lateral Movement

    Remote copy operation of a file using rsync or scp or sftp.

    Indicator:

    Process action type = execution AND target process name = rsync , scp , sftp Host host os = linux , macos

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Lateral Tool Transfer (T1570)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Remote system discovery Informational Reconnaissance XQL

    Remote system discovery using a system utility.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"arp","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-a","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ping","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-c","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"iwconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Reverse shell one-liner using a scripting engine Informational Execution

    An attacker may use scripting engines to execute code from the command line to open a reverse shell.

    Indicator:

    Process action type = execution AND target process cmd = * -c *socket* , * -c */bin/bash* , * -c */bin/sh* , * -c *cmd.exe* , * -c *powershell.exe* , * -e *socket* , * -e */bin/bash* , * -e */bin/sh* , * -e *cmd.exe* , * -e *powershell.exe* , * -r *fsockopen* , * -r */bin/bash* , * -r */bin/sh* , * -r *cmd.exe* , * -r *powershell.exe* AND target process name = python , python.exe , perl , perl.exe , php , php.exe , ruby , ruby.exe , lua , lua.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Unix Shell (T1059.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Reverse shell using PowerShell Informational Execution

    PowerShell can start a reverse shell console for attackers using these commands and take control of the machine.

    Indicator:

    Process action type = execution AND target process cmd = *Sockets.TcpClient* , *reverse_http* AND target process name = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Root certificate installed Informational Evasion

    Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

    Indicator:

    Registry registry key name = *\Software\Microsoft\SystemCertificates*\root\* , *\Software\Microsoft\SystemCertificates*\authroot\* , *\Software\Microsoft\SystemCertificates*\certificationauthority\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\root\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\authroot\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\certificationauthority\* , *\Software\Policy\Microsoft\SystemCertificates*\root\* , *\Software\Policy\Microsoft\SystemCertificates*\authroot\* , *\Software\Policy\Microsoft\SystemCertificates*\certificationauthority\* , *\Software\Microsoft\EnterpriseCertificates*\root\* , *\Software\Microsoft\EnterpriseCertificates*\authroot\* , *\Software\Microsoft\EnterpriseCertificates*\certificationauthority\* AND registry key name != *disallowed* AND *protectedroots AND *certificates AND *crls* AND *ctls AND *autoupdate* AND *appcontainer* AND action type = create_registry_key Process initiated by != svchost.exe AND aexnsagent.exe AND dgwip.exe AND consent.exe AND inteltechnologyaccessservice.exe AND ecagent.exe AND loadstate.exe AND avp.exe AND setupplatform.exe AND cgo name != svchost.exe AND aexnsagent.exe AND dgwip.exe AND consent.exe AND inteltechnologyaccessservice.exe AND ecagent.exe AND loadstate.exe AND avp.exe AND setupplatform.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: Install Root Certificate (T1553.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Root certificate installed Informational Evasion

    Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

    Indicator:

    Process action type = execution AND target process cmd = *add-trusted-cert* , *update-ca-certificates* , *update-ca-trust*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: Install Root Certificate (T1553.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rubeus tool execution High Execution

    Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity.

    Indicator:

    Process action type = execution AND target process name = rubeus.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32 loads a known abused DLL Informational Execution

    Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application.

    Indicator:

    Process action type = execution AND target process cmd != *control_rundll*cscui.dll* AND *control_rundll*srchadmin.dll* AND *control_rundll*keymgr.dll* AND *control_rundll*input.dll* AND *fileprotocolhandler*.zip* AND *fileprotocolhandler*.htm* AND *fileprotocolhandler*.png* AND *fileprotocolhandler*.pdf* AND *fileprotocolhandler*.dbk* AND target process cmd = *advpack.dll*registerocx*.dll* , *advpack.dll*registerocx*.exe* , *ieadvpack.dll*launchinfsection*.inf* , *ieframe.dll*openurl*.url* , *Mshtml.dll*printhtml*.hta* , *pcwutl.dll*launchapplication*.exe* , *setupapi.dll*installhinfsection*defaultInstall*.inf* , *shdocvw.dll*openurl*.url , *shell32.dll*control_rundll*.dll* , *shell32.dll*shellexec_rundll*.exe* , *syssetup.dll*setupinfobjectinstallaction*.inf* , *url.dll*openurl*.hta* , *url.dll*openurl*.url* , *url.dll*openurl*file* , *url.dll*fileprotocolhandler*.hta* , *url.dll*fileprotocolhandler*.url* , *url.dll*fileprotocolhandler*file:* , *zipfldr.dll*routethecall*.exe* , *zipfldr.dll*routethecall*file:* AND target process name = rundll32.exe Process initiated by != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe AND cgo name != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe AND os parent name != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32.exe launches an executable using ordinal numbers argument Medium Evasion

    Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection.

    Indicator:

    Process action type = execution AND target process cmd =~ dll.*?#[-+]?[0-9]+.*?\.exe AND target process name = rundll32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Rundll32.exe was used to run JavaScript Medium Execution

    Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe.

    Indicator:

    Process action type = execution AND target process cmd = * javascript:* AND target process name = rundll32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution (T1216)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32.exe with 'main' as EntryPoint Medium Execution

    Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs.

    Indicator:

    Process action type = execution AND target process cmd =~ rundll32.*dll[\s]*,[\s]*main

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SELinux was set to permissive mode Informational Tampering

    SELinux was set to permissive mode using the "setenforce 0" command.

    Indicator:

    Process action type = execution AND target process cmd =~ .*\s+0($|\s+.*) AND target process name = setenforce Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SMB enumeration via command-line tool Informational Discovery

    Attackers may use SMB enumeration to retrieve information about network shares, printers, and other resources.

    Indicator:

    Process action type = execution AND target process name = nmblookup , rpcclient , smbclient , nbtscan Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • SSH key pair discovery Informational Credential Access

    Attackers may look for SSH key pairs using the find command.

    Indicator:

    Process action type = execution AND target process name = find , cat AND target process cmd =~ .*(id_dsa|id_rsa|[.]key|[.]pgp|[.]gpg|[.]ppk|[.]p12|[.]pem|[.]pfx|[.]cer|[.]p7b|[.]asc).*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scheduled task created with HTTP or FTP reference Low Execution

    Scheduled tasks don't normally include web URLs and may indicate malware activity.

    Indicator:

    Process action type = execution AND target process name = schtasks.exe , at.exe AND target process cmd = *http://* , *https://* , *ftp://* AND target process cmd != *SmartDraw*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Screen capture via command-line tool Informational Collection

    Attackers may use the window system screen capture tool to collect screenshots.

    Indicator:

    Process action type = execution AND target process name = xwd , xwud , import AND target process cmd = *-root* , *-in* , *-out* , *-window*

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Screen Capture (T1113)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Scripting engine creates a compressed file under a suspicious folder Informational Collection

    Attackers may compress data before exfiltrating it to reduce network bandwidth consumption; if a compressed file is placed in a suspicious folder, it may be due to malicious activity.

    Indicator:

    File file name = *.rar , *.7z , *.tar , *.gz , *.zip , *.zz , *.s7z , *.cab AND file path = *users\*\appdata\* , *\programdata* , *$recycle.bin* , *\temp\* AND action type = create Process initiated by = powershell.exe , wscript.exe , cscript.exe , mshta.exe , regsvr32.exe , cgo name = powershell.exe , wscript.exe , cscript.exe , mshta.exe , regsvr32.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged (T1074)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scripting engine creates an Alternate Data Stream (ADS) Informational Evasion

    Malware may hide data inside alternate data streams instead of inside a file.

    Indicator:

    File action type = create , delete AND file name = *:* Process initiated by = wscript.exe , cscript.exe , cmd.exe , powershell.exe , mshta.exe , psw.exe , python.exe , java.exe , javaw.exe , regsvr32.exe , expand.exe , lua.exe , ruby.exe , cgo name = wscript.exe , cscript.exe , cmd.exe , powershell.exe , mshta.exe , psw.exe , python.exe , java.exe , javaw.exe , regsvr32.exe , expand.exe , lua.exe , ruby.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scripting engine makes connections over DNS ports Informational Exfiltration

    Scripting engine makes connections over DNS ports should not happen, as DNS traffic is typically managed by svchost and sometimes the browsers. Attackers are known to use DNS traffic to exfiltrate data and avoid detection.

    Indicator:

    Network action type = failed , outgoing AND remote port = 53 Process os parent name = cmd.exe , powershell.exe , wscript.exe , cscript.exe , mshta.exe AND os parent signature = Signed Host host os != linux AND host os = windows

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scripting process reads Outlook data files Informational Collection

    Attackers may try to retrieve email data and sensitive information from .ost and .pst files.

    Indicator:

    File file name = *.ost , *.pst AND action type = read Process initiated by = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe , cgo name = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Email Collection (T1114)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Security Support Provider (SSP) registered via a registry key Informational Privilege Escalation

    Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords.

    Indicator:

    Registry action type = create_registry_key , delete_registry_key , set_registry_value , delete_registry_value AND registry key name =~ .*HKEY_LOCAL_MACHINE\\SYSTEM\\(ControlSet00[1,2]|CurrentControlSet)\\Control\\Lsa.* AND registry value name =~ .*Security.* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Security services stopped Informational Tampering

    Attackers may stop security critical services to avoid possible detection of their activities.

    Indicator:

    Process action type = execution AND target process name = service , systemctl AND target process cmd = *stop*iptables* , *iptables*stop* , *firewalld*stop* , *stop*firewalld* , *stop*rsyslog* , *rsyslog*stop* , *stop*cbdaemon* , *cbdaemon*stop* , *disable*rsyslog* , *rsyslog*disable* , *stop*falcon-sensor* , *falcon-sensor*stop* , *falcon-sensor*disable* , *disable*falcon-sensor* Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Setuid on file Informational Privilege Escalation

    Setting user identification on an executable file causes it to run with the privileges of the owning user.

    Indicator:

    Process action type = execution AND target process cmd = *u+s* AND target process name = chmod

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shared resource management discovery using wmic.exe Informational Discovery

    Attackers may use wmic.exe to discover shared resource management information.

    Indicator:

    Process action type = execution AND target process cmd = *share*get*/all* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SharpHound LDAP query Medium Discovery

    SharpHound is a BloodHound ingestor that performs LDAP queries to enumerate Active Directory.

    Indicator:

    Event Log event log raw data = *(samaccounttype=268435456)(samaccounttype=268435457)(samaccounttype=536870912)(samaccounttype=536870913)(primarygroupid=*))(&(sAMAccountType=805306369)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)*(samAccountType=805306368)(samAccountType=805306369)(samAccountType=268435456)(samAccountType=268435457)(samAccountType=536870912)(samAccountType=536870913)(objectClass=domain)(&(objectcategory=groupPolicyContainer)(flags=*))(objectcategory=organizationalUnit))(objectclass=domain)*(samaccounttype=268435456)(samaccounttype=268435457)(samaccounttype=536870912)(samaccounttype=536870913)(samaccounttype=805306368)(samaccounttype=805306369)(objectclass=domain)(objectclass=organizationalUnit)(&(objectcategory=groupPolicyContainer)(flags=*)))*(objectcategory=groupPolicyContainer)(flags=*))(name=*)(gpcfilesyspath=*))(objectcategory=organizationalUnit)(objectClass=domain))(&(samaccounttype=805306368)(serviceprincipalname=*)* AND event log id = 30 Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    File action type = read , rename , delete , write AND file name = .zsh_history , .bash_history , .sh_history

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    Process action type = execution AND target process name = cat , nano , vim AND target process cmd =~ .*(?:zsh_history|bash_history|sh_history).*

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell binary copied to another location Informational Tampering

    Attackers may try to evade detection by copying the shell binary to an innocent-looking name.

    Indicator:

    Process action type = execution AND target process cmd =~ /bin/(ba|z|fi|tc|c|k)?sh AND target process name = cp

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell history access Informational Credential Access

    Attackers may search historical commands for credentials and information gathering.

    Indicator:

    Process action type = execution AND target process name = cat , grep AND target process cmd =~ .*\.(ba|z|fi|tc|c|k)?sh_history* Host host os = linux , macos

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Shell History (T1552.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shim database file access Informational Persistence

    An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence.

    Indicator:

    File action type = create , rename , write AND file path = *\windows\apppatch\custom\*

    ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shim database registration via Registry Informational Persistence

    Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *software\microsoft\windows nt\currentversion\appcompatflags\installedsdb* , *software\microsoft\windows nt\currentversion\appcompatflags\custom* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shutdown command issued Informational Tampering

    This behavior is often observed by malware attempting to force a machine shutdown after a period of time once file encryption has completed.

    Indicator:

    Process action type = execution AND target process cmd = *shutdown.exe*

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: System Shutdown/Reboot (T1529)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Simulation activity by AttackIQ Informational Execution

    Simulation activity performed by AttackIQ agent.

    Indicator:

    File action type = all Process initiator cmd = *AttackIQ*attack_graph.py*

    ATT&CK tactics: Execution (TA0002) Resource Development (TA0042)
    ATT&CK techniques: User Execution (T1204) Obtain Capabilities: Tool (T1588.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Simulation activity by Cymulate Informational Execution

    Simulation activity performed by Cymulate agent.

    Indicator:

    File action type = all Process initiator cmd =~ .*(\\ProgramData\\Cymulate\\Agent\\Temp\\cfd_|\\Cymulate\\EDR_Attacks\\).* AND initiated by =~ (cfd|CymulateEDRScenarioExecutor)\.exe

    ATT&CK tactics: Execution (TA0002) Resource Development (TA0042)
    ATT&CK techniques: User Execution (T1204) Obtain Capabilities: Tool (T1588.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Simulation activity by SafeBreach Informational Execution

    Simulation activity performed by a SafeBreach agent.

    Indicator:

    File action type = all Process initiated by = sbsimulation_sb_*.exe

    ATT&CK tactics: Execution (TA0002) Resource Development (TA0042)
    ATT&CK techniques: User Execution (T1204) Obtain Capabilities: Tool (T1588.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SmartScreen disabled via Registry Informational Evasion

    These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality.

    Indicator:

    Registry os actor process signature vendor != Bromium, Inc. AND registry data = 0 AND registry value name = EnableSmartScreen AND action type = set_registry_value Process initiator path != *windows defender* AND cgo path != *windows defender* AND os parent path != *windows defender* AND initiated by != svchost.exe AND ccmexec.exe AND mmc.exe AND cgo name != svchost.exe AND ccmexec.exe AND mmc.exe AND os parent name != svchost.exe AND ccmexec.exe AND mmc.exe AND initiator signer != Bromium, Inc. AND cgo signer != Bromium, Inc. AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , os parent signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Socat/Netcat connects to TOR domain Medium Evasion

    Unlikely behavior in standard systems.

    Indicator:

    Network action type = incoming , outgoing , failed Process initiated by = socat.exe , nc.exe , cryptcat.exe AND initiator cmd = *onion*

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Proxy: Multi-hop Proxy (T1090.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Space after filename creation Informational Evasion

    An attacker may append a space to the end of a filename to change how it's processed by the operating system.

    Indicator:

    File action type = create , rename AND file name =~ \.[a-z]+\s+ Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading: Space after Filename (T1036.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Sudoers discovery Informational Discovery

    Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges.

    Indicator:

    Process action type = execution AND target process cmd = */etc/sudoers* , *sudo *-l* , *sudo *--list* Process initiator cmd != *chef* AND *puppet* AND *salt-minion* AND cgo cmd != *chef* AND *puppet* AND *salt-minion* AND initiated by != chef-client AND BESClient AND crod AND crond AND cgo name != chef-client AND BESClient AND crod AND crond

    ATT&CK tactics: Discovery (TA0007) Privilege Escalation (TA0004)
    ATT&CK techniques: Account Discovery (T1087) Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SunBurst Module loaded High Infiltration

    Sunburst malware hash loaded into SolarWinds.BusinessLayerHost.exe.

    Indicator:

    Image Load module sha256 = 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 , dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b , eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed , c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77 , ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c , 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 , ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 , a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc , D3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af Process initiated by = *businesslayerhost* , cgo name = *businesslayerhost* , os parent name = *businesslayerhost* Host host os = windows

    ATT&CK tactics: Initial Access (TA0001) Command and Control (TA0011)
    ATT&CK techniques: Supply Chain Compromise (T1195) Application Layer Protocol (T1071)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious .NET process spawns csc.exe Low Evasion

    A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).

    Indicator:

    Process action type = execution AND target process name = csc.exe Process initiated by != ieexec.exe AND msbuild.exe AND aspnet_compiler.exe AND servicemodelreg.exe AND webdev.webserver.exe AND installutil.exe AND microsoft.workflow.compiler.exe AND regasm.exe AND initiator path = *windows\microsoft.net* AND cgo name != werfault.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious AMSI DLL load location Low Evasion

    An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

    Indicator:

    Image Load module path != *windows\system32* AND *windows\syswow64* AND *windows\winSxS* AND *kaspersky lab* AND module path = *\amsi.dll Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious DLL load using Control.exe Medium Execution

    This execution mechanism is known to be used by malware to load malicious DLLs.

    Indicator:

    Process action type = execution AND target process cmd != *Shell32.dll* AND target process name = rundll32.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process os parent name = control.exe Host host os != linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011) System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious SDB file written to disk Informational Persistence

    Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.

    Indicator:

    File action type = create , write AND file name = *.sdb AND file path !=~ [.].[a-zA-Z0-9]{2,3}\.[a-zA-Z0-9]{2,3}$|ApplicationConfigurationFromString|secedit.sdb|appraiser.sdb|sysmain.sdb|Sharegate|Program Files|AppData\\Roaming\\Thunderbird\\Profiles Process initiated by = powershell.exe , wscript.exe , cscript.exe , regsvcs.exe , schtasks.exe , xwizard.exe , findstr.exe , esentutl.exe , reg.exe , csc.exe , atbroker.exe , print.exe , pcwrun.exe , rpcping.exe , wsreset.exe , replace.exe , mshta.exe , bitsadmin.exe , ieexec.exe , cmd.exe , microsoft.workflow.compiler.exe , runscripthelper.exe , makecab.exe , forfiles.exe , control.exe , msbuild.exe , register-cimprovider.exe , ie4uinit.exe , sc.exe , bash.exe , sh.exe , hh.exe , mmc.exe , jsc.exe , scriptrunner.exe , odbcconf.exe , extexport.exe , msdt.exe , diskshadow.exe , extrac32.exe , eventvwr.exe , mavinject.exe , regasm.exe , gpscript.exe , rundll32.exe , regsvr32.exe , regedit.exe , msiexec.exe , presentationhost.exe , wmic.exe , runonce.exe , syncappvpublishingserver.exe , verclsid.exe , infdefaultinstall.exe , expand.exe , installutil.exe , wab.exe , dnscmd.exe , at.exe , pcalua.exe , cmdkey.exe , msconfig.exe AND cgo name != code.exe AND msiexec.exe AND Deploy-Application.exe AND BackendTaskQueueHost64.exe AND cgo cmd != *acmigration.dll,ApplyMigrationShims*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious SDB file written to disk by an unsigned process Informational Persistence

    Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.

    Indicator:

    File action type = create , write AND file name = *.sdb AND file path !=~ [.].[a-zA-Z0-9]{2,3}\.[a-zA-Z0-9]{2,3}$ Process initiated by != libero.exe AND heyex.exe AND avevamarinesample2.1.0.exe AND wmiproviders_2.1.5.6002.exe AND initiator path !=~ Xilinx|Flowlink 5.1|CST Studio Suite 2020|Program Files|wish.*exe AND initiator signature = Unsigned Host host os != linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious access to /etc/shadow Informational Discovery

    Attackers may enumerate or modify user accounts by accessing the /etc/shadow file.

    Indicator:

    File action type = all AND file path = /etc/shadow Process initiated by = python* , initiated by = cat , ruby , perl , cgo name = python* , cgo name = cat , ruby , perl AND initiated by != cron AND crond AND splunkd AND cgo name != cron AND crond AND splunkd

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23