BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

46 BIOCs match the current filters. tactic: TA0002 ✕

Download CSV Show ATT&CK heatmap
  • 64-bit PowerShell spawning a 32-bit PowerShell Low Execution

    Malware typically spawns 32-bit processes to work on as many hosts as possible. This case is therefore suspicious when it happens on a 64-bit host.

    Indicator:

    Process action type = execution AND target process cmd != *noprofile -nologo -noninteractive -executionpolicy allsigned -command set-executionpolicy allsigned AND target process name = powershell.exe AND target process path = *syswow64* AND target process path != *windows\\ccm\\systemtemp\\* Process initiated by = powershell.exe AND initiator path = *system32* AND initiator path != *\\windows\\ccmcache\\*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • A scripting engine was called to run in command line Informational Execution

    Scripting engines that are called to run in command line are used by attackers to run a script payload without a UI.

    Indicator:

    Process action type = execution AND target process cmd = */H:cscript* , */H:wscript* , */E:vbscript* , */E:jscript*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • An executable compiled with a py2exe-like program was executed Informational Execution

    A py2exe-like program DLL file dropped to disk.

    Indicator:

    File action type = create , write AND file name = python*.dll AND file path = *\_mei* AND file sha256 = *

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Python (T1059.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Commonly abused process executes by a remote host using PsExec Informational Lateral Movement

    This commonly abused shell/host process was spawned by psexesvc.exe, indicating it was called by a remote host via PsExec.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = psexesvc.exe , cgo name = psexesvc.exe

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002) Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Commonly abused process launches as a system service Informational Execution

    This commonly abused host process has been launched by a services.exe parent, indicating it has been installed as a system service. This behavior can have legitimate uses, but often used by malware as a persistence mechanism.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process os parent name = services.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused process spawns from Scripted Diagnostics Host Informational Execution

    This Scripted Diagnostics Host (sdiagnhost.exe) process has been observed launching a commonly abused host process. This behavior is known to be associated with an exploitation technique designed to deliver a malicious payload, often via a weaponized document. https://www.proofpoint.com/us/threat-insight/post/windows-troubleshooting-platform-leveraged-deliver-malware.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = sdiagnhost.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Encoded VBScript executed High Execution

    Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding.

    Indicator:

    Process action type = execution AND target process cmd = *vbscript.encode*

    ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)
    ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007) Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Enumeration of services via WMIC Informational Discovery

    Attackers may enumerate existing services using wmic.exe.

    Indicator:

    Process action type = execution AND target process cmd = * service * , * win32_service * AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: System Service Discovery (T1007) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Fontdrvhost.exe makes network connections Informational Execution

    A remote code execution vulnerability(CVE-2020-1020) exists in the Windows Adobe Type Manager Library. Network activity of the vulnerable process fontdrvhost.exe can be a possible indicator of exploitation.

    Indicator:

    Network action type = incoming , outgoing , failed Process initiated by = fontdrvhost.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Exploitation for Client Execution (T1203)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Malicious NetSetupSvc.dll loaded into svchost.exe Informational Dropper

    A module tied to SolarStorm (TEARDROP NetSetupSvc.dll) was loaded from a malicious location into svchost.exe.

    Indicator:

    Image Load module path = *\SysWOW64\NetSetupSvc.dll Process initiated by = svchost.exe , cgo name = svchost.exe , os parent name = svchost.exe Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services (T1569)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Windows DNS configuration using WMIC Low Tampering

    This command can be leveraged by attackers to change the way DNS requests are sent, bypassing the corporate DNS servers.

    Indicator:

    Process action type = execution AND target process cmd = *call*SetDNSServerSearchOrder* AND target process name = wmic.exe Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Citrix Systems, Inc. AND cgo signer != Citrix Systems, Inc. AND initiator cmd != *Nutanix* AND cgo cmd != *Nutanix* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Office Equation Editor spawns a commonly abused process Medium Execution

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. CVE-2017-11882 Microsoft Office Memory Corruption Vulnerability.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , mshta.exe , wscript.exe , cscript.exe , regsvr32.exe Process initiated by = EQNEDT32.EXE , cgo name = EQNEDT32.EXE

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Exploitation for Client Execution (T1203)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Office executes an unsigned process in a suspicious directory Informational Execution

    Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.

    Indicator:

    Process action type = execution AND target process path = *\appdata\* , *\programdata\* , *$recycle.bin* , *\temp\* , *\tmp\* , *\users*public\* AND process execution signature = Unsigned , Invalid Signature AND target process name != DriveForOffice.SyncHelper.exe AND CefSharp.BrowserSubprocess.exe AND Ifs.Fnd.Explorer.exe AND BAReportUpgradeUtilityLauncher.exe AND TSTPFLTK.exe AND 7zFM.exe AND notepad++.exe AND gpgme-w32spawn.exe AND python.exe AND target process name != F7-Zip*.exe AND pollev_browsers.exe AND SafeSendFileUploader-6.3.0.exe AND merrillhtmlfilter.exe AND dotnetbrowser-chromium32.exe AND fspublisher.exe AND validatehtml.exe Process initiated by = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe , cgo name = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe , os parent name = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Visual Basic (T1059.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Office process spawns a commonly abused process Informational Execution

    Common weaponized office document behavior.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe AND target process cmd != *\spool\DRIVERS* AND *C:\Windows\system32\shell32.dll,OpenAs_RunDLL* AND *ServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793}* Process initiated by = outlook.exe , excel.exe , winword.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Office process spawns an unsigned process Informational Execution

    Common weaponized office document behavior.

    Indicator:

    Process action type = execution AND process execution signature = Unsigned , Invalid Signature , N/A , Weak Hash Process initiated by = outlook.exe , excel.exe , winword.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Netcat shell via named pipe Informational Execution

    Attackers may create a Netcat shell using a named pipe to remotely access the endpoint.

    Indicator:

    Process action type = execution AND target process name = mkfifo , mknod Process initiated by = *sh

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Office process writes an executable file to disk Informational Execution

    An executable file was written by a Microsoft Office application to disk.

    Indicator:

    File file name = *.exe , *.bat , *.ps1 , *.sys , *.dll , *.vb , *.vbs AND action type = create Process initiated by = winword.exe , excel.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Perl script connecting to network Medium Execution

    Perl scripts may be used by attackers to connect to their command-and-control infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *socket*connect*sock_stream* , *socket*sock_stream*connect* AND target process name = perl

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Unix Shell (T1059.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible C2 via dnscat2 High Evasion

    Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic.

    Indicator:

    Process action type = execution AND target process name = dnscat2 Host host os = linux

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell calling Invoke-Expression argument Informational Execution

    These PowerShell arguments are often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *iex * , *invoke-expression * AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = *Microsoft Corporation* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell possibly attempting to execute as administrator Informational Execution

    This PowerShell argument is often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *administrator* AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell reverse shell Medium Execution

    This rule looks for a PowerShell instance that is communicating over known Metasploit ports back to an attacker in cases of reverse shell.

    Indicator:

    Network action type = outgoing , failed AND remote port = 4444 Process initiator cmd = *web*downloadstring*.ps1* , *web*downloadstring*.exe* AND initiated by = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell running with download in the command line Informational Dropper

    PowerShell can be used to download malicious content from the internet.

    Indicator:

    Process action type = execution AND target process cmd = *download* AND target process name = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Process calls ActiveX Object with a shell command Medium Execution

    This rule looks for ActiveX being used to run commands on a machine, seen in cases of evasive attacks.

    Indicator:

    Process action type = execution AND target process cmd = *ActiveXObject*WScript.Shell*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Process runs with a double extension Medium File Type Obfuscation

    Look for executables with a common double extension. These are often used to disguise malware as some form of user content.

    Indicator:

    Process action type = execution AND target process name = *.docx.exe , *.xlsx.exe , *.pptx.exe , *.pdf.exe , *.wav.exe , *.mp3.exe , *.mkv.exe , *.avi.exe , *.mp4.exe , *.gif.exe , *.bmp.exe , *.png.exe , *.jpg.exe , *.jpeg.exe , *.m4a.exe , *.html.exe , *.htm.exe , *.mht.exe , *.doc.exe , *.xls.exe , *.ppt.exe Process cgo name != NewWorld.Services.MobileServer.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: User Execution (T1204)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PsExec attempts to execute a command on a remote host Informational Lateral Movement

    PsExec is a SysInternals tool used to execute commands on remote hosts.

    Indicator:

    Network action type = outgoing , failed AND remote port = 135 , 445 Process initiated by = psexec.exe AND initiator signature = Signed AND initiator signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002) System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PsExec executed with plain-text credentials on the command line Informational Execution

    PsExec.exe is a Windows administrative tool, which may be used by adversaries to execute remote commands.

    Indicator:

    Process action type = execution AND target process cmd = * -u * -p * , * -p * -u * AND target process name = psexec.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PsExec execution EulaAccepted flag added to the Registry Informational Execution

    PsExec is commonly used by malware for lateral movement, seeing this value in the Registry means that the user ran PsExec and approved the EULA either automatically or manually.

    Indicator:

    Registry registry key name = *\Software\Sysinternals\PsExec* AND registry value name = *EulaAccepted* AND action type = set_registry_value Process initiated by != ltsvc.exe AND batchpatch.exe AND agentservice.exe AND cgo name != ltsvc.exe AND batchpatch.exe AND agentservice.exe Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002) Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Psexesvc.exe executes a command from a remote host Informational Execution

    Psexesvc.exe executes to run a command received from a remote host via PsExec.

    Indicator:

    Process action type = execution AND target process name = psexesvc.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Python script connecting to network Medium Execution

    Python scripts may be used by attackers to connect to their command-and-control infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *socket*connect*sock_stream* , *socket*sock_stream*connect* AND target process name = python

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Python (T1059.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Query startup programs using wmic.exe Informational Discovery

    Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system.

    Indicator:

    Process action type = execution AND target process cmd = *startup* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Remote command executed from a Linux host Low Lateral Movement

    This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.

    Indicator:

    Process action type = execution AND target process name = winexesvc.exe , winexe.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Reverse shell one-liner using a scripting engine Informational Execution

    An attacker may use scripting engines to execute code from the command line to open a reverse shell.

    Indicator:

    Process action type = execution AND target process cmd = * -c *socket* , * -c */bin/bash* , * -c */bin/sh* , * -c *cmd.exe* , * -c *powershell.exe* , * -e *socket* , * -e */bin/bash* , * -e */bin/sh* , * -e *cmd.exe* , * -e *powershell.exe* , * -r *fsockopen* , * -r */bin/bash* , * -r */bin/sh* , * -r *cmd.exe* , * -r *powershell.exe* AND target process name = python , python.exe , perl , perl.exe , php , php.exe , ruby , ruby.exe , lua , lua.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Unix Shell (T1059.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Reverse shell using PowerShell Informational Execution

    PowerShell can start a reverse shell console for attackers using these commands and take control of the machine.

    Indicator:

    Process action type = execution AND target process cmd = *Sockets.TcpClient* , *reverse_http* AND target process name = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rubeus tool execution High Execution

    Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity.

    Indicator:

    Process action type = execution AND target process name = rubeus.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Scheduled task created with HTTP or FTP reference Low Execution

    Scheduled tasks don't normally include web URLs and may indicate malware activity.

    Indicator:

    Process action type = execution AND target process name = schtasks.exe , at.exe AND target process cmd = *http://* , *https://* , *ftp://* AND target process cmd != *SmartDraw*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Shared resource management discovery using wmic.exe Informational Discovery

    Attackers may use wmic.exe to discover shared resource management information.

    Indicator:

    Process action type = execution AND target process cmd = *share*get*/all* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Simulation activity by AttackIQ Informational Execution

    Simulation activity performed by AttackIQ agent.

    Indicator:

    File action type = all Process initiator cmd = *AttackIQ*attack_graph.py*

    ATT&CK tactics: Execution (TA0002) Resource Development (TA0042)
    ATT&CK techniques: User Execution (T1204) Obtain Capabilities: Tool (T1588.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Simulation activity by Cymulate Informational Execution

    Simulation activity performed by Cymulate agent.

    Indicator:

    File action type = all Process initiator cmd =~ .*(\\ProgramData\\Cymulate\\Agent\\Temp\\cfd_|\\Cymulate\\EDR_Attacks\\).* AND initiated by =~ (cfd|CymulateEDRScenarioExecutor)\.exe

    ATT&CK tactics: Execution (TA0002) Resource Development (TA0042)
    ATT&CK techniques: User Execution (T1204) Obtain Capabilities: Tool (T1588.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Simulation activity by SafeBreach Informational Execution

    Simulation activity performed by a SafeBreach agent.

    Indicator:

    File action type = all Process initiated by = sbsimulation_sb_*.exe

    ATT&CK tactics: Execution (TA0002) Resource Development (TA0042)
    ATT&CK techniques: User Execution (T1204) Obtain Capabilities: Tool (T1588.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious file created in AppData directory Informational Execution

    A suspicious executable file was created in the AppData directory.

    Indicator:

    File file name = *.scr , *.docm , *.uue , *.sh , *.cpl , *.jse , *.ws , *.wsf , *.elf AND file path = *\AppData\* AND action type = create

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious process loads AMSI DLL Informational Execution

    Amsi.dll is expected to be loaded from a few known processes (e.g. PowerShell). An image load from an unrelated LOLBIN may indicate PowerShell execution.

    Indicator:

    Image Load module path = *\amsi.dll Process initiated by = rundll32.exe , regasm.exe , installutil.exe , regsvcs.exe , regsvr32.exe AND initiator cmd != *printui.dll* AND *lenovo\* AND *\program files*\common files\vmware\* AND *\program files*\NVIDIA Corporation\* AND *PolicyAgentProvider.dll* AND *\windows\ccm\* AND *\windows\installer\* AND *GeneralTel.dll* AND *LogiLDA.dll* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unusual process spawned by fontdrvhost.exe Informational Execution

    A remote code execution vulnerability (CVE-2020-1020) exists in the Windows Adobe Type Manager Library. An unusual process spawned by fontdrvhost.exe can be a possible indicator of exploitation.

    Indicator:

    Process action type = execution AND target process name != werfault.exe AND winlogon.exe AND wininit.exe AND csrss.exe AND fontdrvhost.exe Process initiated by = fontdrvhost.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Exploitation for Client Execution (T1203)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • VBScript execution from the command line Informational Execution

    Attackers may run VBScript code from the command line using signed processes such as Mshta.

    Indicator:

    Process action type = execution AND target process cmd = *createobject(*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Visual Basic (T1059.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WMI terminated a process Informational Execution

    The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = *process*where*call terminate AND target process name = wmic.exe Process initiated by != msiexec.exe , cgo name != msiexec.exe

    ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Wscript.exe connects to an external network Informational Execution

    It may be due to local IT or administrative tools used on endpoints, but it could also indicate exfiltration of data between hosts in the local network, malware droppers, beaconing and so on. The execution chain should be reviewed to determine the context of the activity.

    Indicator:

    Network action type = incoming , outgoing , failed AND remote ip != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* Process initiated by = wscript.exe , cgo name = wscript.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11