BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0002 ✕ technique: T1053 ✕

Download CSV Show ATT&CK heatmap
  • Scheduled task created with HTTP or FTP reference Low Execution

    Scheduled tasks don't normally include web URLs and may indicate malware activity.

    Indicator:

    Process action type = execution AND target process name = schtasks.exe , at.exe AND target process cmd = *http://* , *https://* , *ftp://* AND target process cmd != *SmartDraw*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11