BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

5 BIOCs match the current filters. tactic: TA0002 ✕ technique: T1047 ✕

Download CSV Show ATT&CK heatmap
  • Enumeration of services via WMIC Informational Discovery

    Attackers may enumerate existing services using wmic.exe.

    Indicator:

    Process action type = execution AND target process cmd = * service * , * win32_service * AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: System Service Discovery (T1007) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Windows DNS configuration using WMIC Low Tampering

    This command can be leveraged by attackers to change the way DNS requests are sent, bypassing the corporate DNS servers.

    Indicator:

    Process action type = execution AND target process cmd = *call*SetDNSServerSearchOrder* AND target process name = wmic.exe Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Citrix Systems, Inc. AND cgo signer != Citrix Systems, Inc. AND initiator cmd != *Nutanix* AND cgo cmd != *Nutanix* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Query startup programs using wmic.exe Informational Discovery

    Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system.

    Indicator:

    Process action type = execution AND target process cmd = *startup* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shared resource management discovery using wmic.exe Informational Discovery

    Attackers may use wmic.exe to discover shared resource management information.

    Indicator:

    Process action type = execution AND target process cmd = *share*get*/all* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WMI terminated a process Informational Execution

    The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = *process*where*call terminate AND target process name = wmic.exe Process initiated by != msiexec.exe , cgo name != msiexec.exe

    ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23