BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

367 BIOCs match the current filters.

Download CSV Show ATT&CK heatmap
  • Suspicious debug file created in a temporary folder High Credential Access

    SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin.

    Indicator:

    File file path =~ \\temp\\debug[0-9]*\.bin AND action type = create

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious executable created in a .NET directory High Evasion

    Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe.

    Indicator:

    File file path = *windows\microsoft.net*.exe AND action type = create Process initiated by = cmd.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution (T1127)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious file created in AppData directory Informational Execution

    A suspicious executable file was created in the AppData directory.

    Indicator:

    File file name = *.scr , *.docm , *.uue , *.sh , *.cpl , *.jse , *.ws , *.wsf , *.elf AND file path = *\AppData\* AND action type = create

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious lock screen image file written to disk Low Execution

    Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.

    Indicator:

    File action type = create , write , rename AND file path = *personalization\lockscreenimage* Process os parent name = desktopimgdownldr.exe , svchost.exe AND cgo name != omadmprc.exe AND CcmExec.exe AND GoogleUpdate.exe AND ServiceShell.exe AND os parent cmd != *svchost.exe*-k*gpsvc*

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Ingress Tool Transfer (T1105)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer driver installation Low Privilege Escalation

    A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

    Indicator:

    Registry registry data = Generic / Text Only AND registry key name = *windows nt\currentversion\print\printers* AND action type = set_registry_value Process initiator signature = Unsigned , Invalid Signature Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer port creation via Registry Medium Privilege Escalation

    An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

    Indicator:

    Registry registry value name = *.exe , *.dll , *.bat , *.com , *.cmd , *.ps1 , *.hta , *.vba , *.vbs , *.vbe , *.js AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious process loads AMSI DLL Informational Execution

    Amsi.dll is expected to be loaded from a few known processes (e.g. PowerShell). An image load from an unrelated LOLBIN may indicate PowerShell execution.

    Indicator:

    Image Load module path = *\amsi.dll Process initiated by = rundll32.exe , regasm.exe , installutil.exe , regsvcs.exe , regsvr32.exe AND initiator cmd != *printui.dll* AND *lenovo\* AND *\program files*\common files\vmware\* AND *\program files*\NVIDIA Corporation\* AND *PolicyAgentProvider.dll* AND *\windows\ccm\* AND *\windows\installer\* AND *GeneralTel.dll* AND *LogiLDA.dll* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious process spawns MSBuild.exe Medium Execution

    The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.

    Indicator:

    Process action type = execution AND target process name = msbuild.exe Process initiated by = explorer.exe , wmiprvse.exe , wscript.exe , cscript.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious usage of cytool.exe Informational Evasion

    The Cortex XDR agent can be controlled by a command-line tool named cytool.exe. Attackers may use it to disable the Cortex XDR agent.

    Indicator:

    Process action type = execution AND target process name = cytool.exe , cytool Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != *palo alto networks* AND cgo signer != *palo alto networks* AND initiator cmd != *zzzzInvokeManagedCustomActionOutOfProc* AND cgo cmd != *zzzzInvokeManagedCustomActionOutOfProc* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SyncAppvPublishingServer used to run PowerShell code Informational Evasion

    SyncAppvPublishingServer is part of Microsoft Application Virtualization (App-V), which may be used by an attacker to run PowerShell code.

    Indicator:

    Process action type = execution AND target process name = SyncAppvPublishingServer.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution (T1218)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • System information discovery Informational Discovery

    System information discovery using one of these bash utilities - lshw -short, uptime, uname -a.

    Indicator:

    Process action type = execution AND target process name = lshw , uptime , uname AND target process cmd = *-a* , *-short* , *uptime* Process initiated by =~ (ba|z|fi|tc|c|k)?sh , cgo name =~ (ba|z|fi|tc|c|k)?sh , os parent name =~ (ba|z|fi|tc|c|k)?sh Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Information Discovery (T1082)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • System network configuration discovery Informational Discovery XQL

    System network configuration discovery using Linux command-line utilities.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"arp","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-a","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ip","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"OR":[{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"addr","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ifconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"netstat","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":"netstat\\s(\\s*-\\w*[rnat]+\\s?)+","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-n","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$actor_process_image_name","OPERATOR":"REGEX","RIGHT":"(ba|z|fi|tc|c|k)?sh","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • System owner/user discovery Informational Discovery

    System owner/user discovery using bash utilities.

    Indicator:

    Process action type = execution AND target process name = whoami , users , w , who Process initiated by =~ (ba|z|fi|tc|c|k)?sh , cgo name =~ (ba|z|fi|tc|c|k)?sh , os parent name =~ (ba|z|fi|tc|c|k)?sh Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Owner/User Discovery (T1033)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Tampering with Windows Control Panel configuration Informational Evasion

    DLLs with .cpl suffix are executed when accessing the Control Panel. Malicious code may run this way even if AppLocker enabled.

    Indicator:

    Registry action type = all AND registry key name = *software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with Windows Security Support Provider DLLs Informational Persistence

    Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002.

    Indicator:

    Registry action type = all AND registry key name = *\SYSTEM\*ControlSet*\Control\Lsa\OSConfig , *\SYSTEM\*ControlSet*\Control\Lsa AND registry value name = *Security Packages* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with Windows certificate blocking configuration Informational Evasion

    Adding subkeys of the certificates to block disallows a security vendor's certificate on the affected computer, so that Windows would not allow the program to run.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with the Windows System Restore configuration Low Tampering

    System Restore was disabled on the endpoint. In such a case, one may not be able to recover files in case of disaster. This may be initiated by the IT department, but also may indicate malicious activity such as ransomware.

    Indicator:

    Registry action type = set_registry_value , create_registry_key , delete_registry_value AND registry data = 1 AND registry key name = *Software\Microsoft\Windows Nt\SystemRestore\DisableSR Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Rootkit (T1014) Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Task scheduled by commonly abused host process Informational Persistence

    Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use.

    Indicator:

    Process action type = execution AND target process name = schtasks.exe , at.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process initiated by = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe , cgo name = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • The scripting engine executed code from an Alternate Data Stream (ADS) Informational Evasion

    Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file.

    Indicator:

    Process action type = execution AND target process name = rundll32.exe , mavinject.exe , forfiles.exe , wscript.exe , cscript.exe , mshta.exe , control.exe , sc.exe , regedit.exe , bitsadmin.exe , appvlp.exe , cmd.exe , ftp.exe , bash.exe , regsvr32.exe , regini.exe AND target process cmd =~ :[A-Za-z0-9]{1,}\.(exe|dll|vbs|js|hta|reg|bat|txt|sh|ini|ps1) Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • UAC bypass using the changepk.exe Registry key Medium Privilege Escalation

    Attackers may use the changepk.exe built-in Windows tool to bypass Windows UAC by modifying Registry keys.

    Indicator:

    Registry registry key name = *Launcher.SystemSettings\Shell\Open\Command* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • UDP protocol scanner execution Low Discovery

    The UDP Protocol Scanner performs UDP service discovery. Attackers may use it to enumerate UDP services in their target's environment.

    Indicator:

    Process action type = execution AND target process cmd = *udp-proto-scanner.pl* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Service Discovery (T1046)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned integer Sudo privilege escalation Medium Privilege Escalation

    Fixed in CVE-2019-14287, this known command line is used to exploit a bug in sudo to gain root privileges.

    Indicator:

    Process action type = execution AND target process cmd = * -u#-1 * , * -u#4294967295 *

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unsigned process accessed a Thunderbird Mail profiles folder Informational Credential Access

    An attacker may access the Thunderbird Mail profiles folder to extract users' credentials.

    Indicator:

    File action type = all AND file path = *\appdata\*thunderbird\profile* Process initiator signature = Unsigned , cgo signature = Unsigned , os parent signature = Unsigned AND initiator path != *Program Files* AND cgo path != *Program Files* AND os parent path != *Program Files* Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores (T1555)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process accessed a credential locker file Informational Credential Access

    The credential manager stores credentials for logging in to websites, applications and devices in encrypted Windows Vault Credential Files which can be accessed and decrypted by an attacker.

    Indicator:

    File action type = all AND file path = *.vcrd , *policy.vpol Process initiator signature = Unsigned , cgo signature = Unsigned , os parent signature = Unsigned Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Windows Credential Manager (T1555.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process creates an Alternate Data Stream (ADS) Informational Evasion

    Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS.

    Indicator:

    File file name = *:* AND action type = create Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process injects code into a process Informational Execution

    An unsigned process injected code into a process. This can be done to leverage a legitimate running process for an attack.

    Indicator:

    Process action type = injection Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash AND initiator path != *\program files* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unsigned process makes connections over DNS ports Informational Exfiltration

    An unsigned process makes connections over DNS ports should not happen, as DNS traffic is typically managed by svchost and sometimes the browsers. Attackers are known to use DNS traffic to exfiltrate data and avoid detection.

    Indicator:

    Network action type = outgoing , failed AND remote port = 53 Process os parent signature = Unsigned , N/A , Weak Hash , Invalid Signature Host host os = windows

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process reads Chromium credentials file Informational Credential Access

    Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

    Indicator:

    File file path = *\users\*\appdata\local\7star\7star\user data\* , *\users\*\appdata\local\amigo\user data\* , *\users\*\appdata\local\bravesoftware\brave-browser\user data\* , *\users\*\appdata\local\centbrowser\user data\* , *\users\*\appdata\local\chedot\user data\* , *\users\*\appdata\local\google chrome sxs\user data\* , *\users\*\appdata\local\chromium\user data\* , *\users\*\appdata\local\coccoc\browser\user data\* , *\users\*\appdata\local\elements browser\user data\* , *\users\*\appdata\local\epic privacy browser\user data\* , *\users\*\appdata\local\google\chrome\user data\* , *\users\*\appdata\local\kometa\user data\* , *\users\*\appdata\local\orbitum\user data\* , *\users\*\appdata\local\sputnik\sputnik\user data\* , *\users\*\appdata\local\torch\user data\* , *\users\*\appdata\local\ucozmedia\uran\user data\* , *\users\*\appdata\local\vivaldi\user data\* , *\users\*\appdata\local\yandex\yandexbrowser\user data\* , *\users\*\appdata\local\microsoft\edge\user data\* AND file name = *login data AND action type = read Process initiated by != chrome.exe AND chromedriver.exe AND amigo.exe AND brave.exe AND centbrowser.exe AND chedot.exe AND browser.exe AND epic.exe AND kometa.exe AND orbitum.exe AND torch.exe AND uran.exe AND vivaldi.exe AND msedge.exe AND cgo name != svchost.exe AND system AND cgo signature = Unsigned , Invalid Signature AND initiator signature = Unsigned , Invalid Signature Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process running from a temporary directory Informational Evasion

    Malware often runs from a temporary folder.

    Indicator:

    Process action type = execution AND process execution signature = N/A , Unsigned , Invalid Signature AND target process path = *temp* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unusual process spawned by changepk.exe Informational Privilege Escalation

    Attackers may use the changepk.exe built-in Windows tool to bypass UAC using an unusual initiator.

    Indicator:

    Process action type = execution AND target process name != sppsvc.exe AND clipup.exe AND genvalobj.exe AND dllhost.exe AND trustedinstaller.exe AND sppextcomobj.exe AND dismhost.exe Process initiated by = changepk.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unusual process spawned by fontdrvhost.exe Informational Execution

    A remote code execution vulnerability (CVE-2020-1020) exists in the Windows Adobe Type Manager Library. An unusual process spawned by fontdrvhost.exe can be a possible indicator of exploitation.

    Indicator:

    Process action type = execution AND target process name != werfault.exe AND winlogon.exe AND wininit.exe AND csrss.exe AND fontdrvhost.exe Process initiated by = fontdrvhost.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Exploitation for Client Execution (T1203)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Usage of tracing tool Informational Evasion

    An attacker may be trying to use a known tracing tool to gather information from other processes.

    Indicator:

    Process action type = execution AND target process name = strace , xtrace , dtrace , ltrace , ftrace , truss , sysdig , systemtap

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • User account flagged as hidden Informational Evasion

    Look for unsigned processes that add an entry to the hidden users Registry key.

    Indicator:

    Registry action type = all AND registry data = 0 AND registry key name = *SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Valid Accounts (T1078)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • User added to local administrator group using a PowerShell command Medium Persistence

    Adding a new user to the local admin group may or may not be malicious, but it is an outstanding action worth considering, as it shouldn't happen too often. A malware may add a new malicious user to the administrators group as a way of maintaining high privileges after the system was compromised.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe AND target process cmd = *Add-LocalGroupMember*Group*Administrators*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • User creation or modification via /etc file Informational Persistence

    Attackers may create new users or modify existing users by directly modifying /etc/passwd and /etc/shadow.

    Indicator:

    File file path = /etc/shadow , /etc/passwd AND action type = write

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create Account (T1136)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • VBScript execution from the command line Informational Execution

    Attackers may run VBScript code from the command line using signed processes such as Mshta.

    Indicator:

    Process action type = execution AND target process cmd = *createobject(*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Visual Basic (T1059.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VMware enumeration attempt Informational Discovery

    An attacker may check for virtualization by searching for local vmx (VMware configuration) files.

    Indicator:

    Process action type = execution AND target process cmd =~ (find|locate).*\.vmx

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Virtual Directory configuration access via PowerShell Medium Discovery

    PowerShell was used to dump Exchange Web Service (EWS) Virtual Directories, which may indicate malicious behavior, for example, SolarStorm campaign.

    Indicator:

    Process action type = execution AND target process cmd =~ .*PSConsoleFile.*Get-WebServicesVirtualDirectory.* AND target process name = powershell.exe Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Service Discovery (T1007)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VirtualBox enumeration Informational Discovery

    VBoxManage can be used to enumerate local VirtualBox machines.

    Indicator:

    Process action type = execution AND target process cmd =~ list\s+ AND target process name = vboxmanage

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WMI access to shadow copy interface Informational Credential Access

    An attacker may be trying to modify and/or delete shadow copies via WMI for disabling system backups or extracting NTDS.dit.

    Indicator:

    Process action type = execution AND target process cmd = *win32_shadowcopy*

    ATT&CK tactics: Credential Access (TA0006) Impact (TA0040)
    ATT&CK techniques: OS Credential Dumping (T1003) Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WMI terminated a process Informational Execution

    The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = *process*where*call terminate AND target process name = wmic.exe Process initiated by != msiexec.exe , cgo name != msiexec.exe

    ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WSL Feature Installation Informational Evasion

    Detecting installation of Windows Subsystem for Linux feature.

    Indicator:

    File file name = *.vhdx.gz AND file path = *_microsoft-windows-lxss-vm-mode_* AND action type = create Process initiated by = TiWorker.exe , cgo name = TiWorker.exe , os parent name = TiWorker.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indirect Command Execution (T1202)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WSReset.exe UAC bypass Low Privilege Escalation

    Attackers may use WSReset.exe to bypass User Account Control (UAC).

    Indicator:

    Process action type = execution AND target process name != conhost.exe AND mmc.exe Process initiated by = wsreset.exe , cgo name = wsreset.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Web browser cookie and credential access Informational Credential Access

    Detect attempt to acquire cookies or credentials from a Safari browser.

    Indicator:

    Process action type = execution AND target process cmd =~ .*(Cookies.binarycookies|[/]Safari[/]LocalStorage[/]).* AND target process name = grep

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Web server process drops an executable to disk Informational Dropper

    Web server processes should not normally write executable files out to the local filesystem. This may have legitimate uses in certain web applications, yet check for possible exploitation of the hosted web application.

    Indicator:

    File file name = *.exe , *.scr , *.dll , *.sys , *.com , *.bin , *.msi AND action type = create Process initiated by = w3wp.exe , httpd.exe , nginx.exe , php-cgi.exe , initiated by = *apache* , *tomcat*

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Exploit Public-Facing Application (T1190)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Web server spawns an unsigned process Informational Infiltration

    Web server processes should normally only carry out tasks related to serving web applications. This instance has spawned an unsigned process, which may indicate a successful exploitation attempt of the associated web application.

    Indicator:

    Process action type = execution AND process execution signature = Unsigned , Invalid Signature , N/A Process initiated by = w3wp.exe , httpd.exe , nginx.exe , php-cgi.exe , initiated by = *apache* , *tomcat* Host host os = windows

    ATT&CK tactics: Initial Access (TA0001)
    ATT&CK techniques: Exploit Public-Facing Application (T1190)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WerFault ReflectDebugger key set in Registry Medium Execution

    The WerFault.exe signed Windows process may be tricked into running a malicious executable by setting the ReflectDebugger key in the Registry.

    Indicator:

    Registry action type = create_registry_key , delete_registry_key , rename_registry_key , set_registry_value AND registry value name = *reflectdebugger* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution (T1218)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Wget connection to an external network Informational Exfiltration

    Wget is a command-line utility used to transfer data. Attackers may use wget to exfiltrate data outside your organization.

    Indicator:

    Network action type = outgoing , failed AND remote ip != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* AND remote port != 53 AND 0 Process initiated by = wget

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WinPmem Forensics Tool Informational Collection XQL

    The WinPmem Forensics Tool has been run.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"AND":[{"LEFT":"$action_process_signature_vendor","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_signature_product","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"winpmem.exe","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) Automated Collection (T1119)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Windows 10 Developer Mode enabled Informational Evasion

    Enabling developer mode allows for app sideloading and starts the Windows SSH services, which may be used to install Linux Bash on Windows.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = 1 AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution (T1127)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows File Protection being disabled via Registry Low Tampering

    Windows File Protection (WFP) prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and by other programs. Protecting these files prevents problems with programs and the operating system.

    Indicator:

    Registry action type = all AND registry data = 1 AND registry key name = *SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable Host host os = windows

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows Firewall disabled via Registry Informational Tampering

    An attacker may disable the Windows Firewall via the Registry to bypass network controls.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry value name = donotallowexceptions , enablefirewall AND registry data = 0 AND registry key name = *system\*\services\sharedaccess\parameters\firewallpolicy\* Process initiated by != svchost.exe AND dllhost.exe AND mmc.exe AND sihost.exe AND cgo name != svchost.exe AND dllhost.exe AND mmc.exe AND sihost.exe AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Symantec Corporation AND CyberArk Software Ltd. AND McAfee, Inc. AND Kaspersky Lab AND Avira Operations GmbH & Co. KG AND F-Secure Corporation AND IBM Corporation AND cgo signer != Symantec Corporation AND CyberArk Software Ltd. AND McAfee, Inc. AND Kaspersky Lab AND Avira Operations GmbH & Co. KG AND F-Secure Corporation AND IBM Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows Firewall notifications disabled via Registry Informational Tampering

    These Registry keys control the Windows Firewall notifications. Malware may turn notifications off before editing the firewall settings.

    Indicator:

    Registry registry data = 1 AND registry key name = *system\*\services\sharedaccess\parameters\firewallpolicy\* AND registry value name = disablenotifications AND action type = set_registry_value Process initiator path != *leverit* AND *kaspersky* AND *f-secure* AND cgo path != *leverit* AND *kaspersky* AND *f-secure* AND initiated by != svchost.exe AND dllhost.exe AND cgo name != svchost.exe AND dllhost.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Impair Defenses: Disable or Modify System Firewall (T1562.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows PowerShell Logging being disabled via Registry Informational Evasion

    Tampering of the key can disable event logging by the PowerShell, allowing the adversary to evade being detected using PowerShell.

    Indicator:

    Registry action type = set_registry_value , delete_registry_value AND registry data = 0 , None AND registry key name = *Policies\Microsoft\Windows\PowerShell\ModuleLogging* AND registry value name = EnableModuleLogging Process initiator cmd != *gpsvc* AND *netsvcs* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows Registry Editor being disabled via Registry Informational Evasion

    Registry Editor may be enabled / disabled using this key. This could indicate either IT policy applied or malicious activity preventing the user from altering the Registry.

    Indicator:

    Registry action type = all AND registry data != 0 AND registry key name = *\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System AND registry value name = DisableRegistryTools Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows Security audit log was cleared Informational Evasion

    Event ID 1102 was generated when the Windows Security audit log was cleared. Attackers may clear events from Windows event logs to remove traces of their malicious activity.

    Indicator:

    Event Log event log id = 1102 AND event log provider name = Microsoft-Windows-Eventlog Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows Task Manager being disabled via Registry Informational Tampering

    Task manager may be disabled to tamper with the user experience and with the response to a malicious incident.

    Indicator:

    Registry action type = all AND registry data = 1 AND registry key name = *\Software\Microsoft\Windows\CurrentVersion\Policies\System AND registry value name = DisableTaskMgr Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows event logs cleared using wmic.exe Medium Evasion

    Attackers may clear events from Windows event logs to remove traces of their malicious activity.

    Indicator:

    Process action type = execution AND target process cmd = * cleareventlog* AND target process name = wmic.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows hosts file written to Informational Collection

    Check for hosts file redirection, overriding the system's default hosts file to manipulate DNS.

    Indicator:

    File file name = hosts AND file path = *:\Windows\System32\drivers\etc\* AND action type = write

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data from Information Repositories (T1213)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows process masquerading by an unsigned process Informational Evasion

    A process is trying to disguise itself as a legitimate Windows process, but is unsigned. This usually indicates malicious activity.

    Indicator:

    Process action type = execution AND target process name = explorer.exe , svchost.exe , winlogon.exe , csrss.exe , lsass.exe , smss.exe , lsm.exe , taskhost.exe , rundll32.exe , dwm.exe , dllhost.exe , services.exe , Taskmgr.exe , wininit.exe AND process execution signer != Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows set to permit unsigned drivers (Test Mode) Medium Tampering

    This host has been set into 'Test Mode' which allows loading of unsigned drivers. It has legitimate uses, but can be leveraged by malware to load malicious untrusted drivers.

    Indicator:

    Process action type = execution AND target process cmd = */set*testsigning*on* AND target process name = bcdedit.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WptsExtensions.dll created to disk Medium Privilege Escalation

    The Task Scheduler service attempts to load the missing WptsExtensions.dll. As a result, the creation of this file may be indicative of DLL hijacking.

    Indicator:

    File action type = create , read , rename , write AND file name = wptsExtensions.dll

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Write to .bash_profile Informational Persistence

    Commands in ~/.bash_profile are executed on every user shell login with a username and password.

    Indicator:

    File file name = .bash_profile AND action type = write

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Unix Shell Configuration Modification (T1546.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Write to /etc/hosts file Informational Discovery

    An attacker may add an entry to the hosts file, so they can route traffic to the added IP.

    Indicator:

    File file path = /etc/hosts AND action type = write

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Wscript / Cscript executed from a temporary directory Informational Collection

    An attacker may try to avoid detection by executing wscript/cscript scripts from a temporary directory.

    Indicator:

    Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.* [\/]{1,2}([bisx] |[eh]:(.script|.*script)?|job:|t:\d{1,5})).* Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Wscript.exe connects to an external network Informational Execution

    It may be due to local IT or administrative tools used on endpoints, but it could also indicate exfiltration of data between hosts in the local network, malware droppers, beaconing and so on. The execution chain should be reviewed to determine the context of the activity.

    Indicator:

    Network action type = incoming , outgoing , failed AND remote ip != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* Process initiated by = wscript.exe , cgo name = wscript.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Wzzip.exe execution with password protection parameters Informational Collection

    Wzzip.exe was executed with parameters indicating password protection of the output file.

    Indicator:

    Process action type = execution AND target process cmd = *-s* AND target process name = wzzip.exe Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23