BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

22 BIOCs match the current filters. tactic: TA0002 ✕ technique: T1059 ✕

Download CSV Show ATT&CK heatmap
  • 64-bit PowerShell spawning a 32-bit PowerShell Low Execution

    Malware typically spawns 32-bit processes to work on as many hosts as possible. This case is therefore suspicious when it happens on a 64-bit host.

    Indicator:

    Process action type = execution AND target process cmd != *noprofile -nologo -noninteractive -executionpolicy allsigned -command set-executionpolicy allsigned AND target process name = powershell.exe AND target process path = *syswow64* AND target process path != *windows\\ccm\\systemtemp\\* Process initiated by = powershell.exe AND initiator path = *system32* AND initiator path != *\\windows\\ccmcache\\*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • A scripting engine was called to run in command line Informational Execution

    Scripting engines that are called to run in command line are used by attackers to run a script payload without a UI.

    Indicator:

    Process action type = execution AND target process cmd = */H:cscript* , */H:wscript* , */E:vbscript* , */E:jscript*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • An executable compiled with a py2exe-like program was executed Informational Execution

    A py2exe-like program DLL file dropped to disk.

    Indicator:

    File action type = create , write AND file name = python*.dll AND file path = *\_mei* AND file sha256 = *

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Python (T1059.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Commonly abused process spawns from Scripted Diagnostics Host Informational Execution

    This Scripted Diagnostics Host (sdiagnhost.exe) process has been observed launching a commonly abused host process. This behavior is known to be associated with an exploitation technique designed to deliver a malicious payload, often via a weaponized document. https://www.proofpoint.com/us/threat-insight/post/windows-troubleshooting-platform-leveraged-deliver-malware.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = sdiagnhost.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Encoded VBScript executed High Execution

    Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding.

    Indicator:

    Process action type = execution AND target process cmd = *vbscript.encode*

    ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)
    ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007) Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Office executes an unsigned process in a suspicious directory Informational Execution

    Microsoft Office executed an unsigned process in a suspicious directory. This behavior is common with malicious macros.

    Indicator:

    Process action type = execution AND target process path = *\appdata\* , *\programdata\* , *$recycle.bin* , *\temp\* , *\tmp\* , *\users*public\* AND process execution signature = Unsigned , Invalid Signature AND target process name != DriveForOffice.SyncHelper.exe AND CefSharp.BrowserSubprocess.exe AND Ifs.Fnd.Explorer.exe AND BAReportUpgradeUtilityLauncher.exe AND TSTPFLTK.exe AND 7zFM.exe AND notepad++.exe AND gpgme-w32spawn.exe AND python.exe AND target process name != F7-Zip*.exe AND pollev_browsers.exe AND SafeSendFileUploader-6.3.0.exe AND merrillhtmlfilter.exe AND dotnetbrowser-chromium32.exe AND fspublisher.exe AND validatehtml.exe Process initiated by = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe , cgo name = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe , os parent name = winword.exe , excel.exe , powerpnt.exe , outlook.exe , visio.exe , winproj.exe , onenote.exe Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Visual Basic (T1059.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Netcat shell via named pipe Informational Execution

    Attackers may create a Netcat shell using a named pipe to remotely access the endpoint.

    Indicator:

    Process action type = execution AND target process name = mkfifo , mknod Process initiated by = *sh

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Perl script connecting to network Medium Execution

    Perl scripts may be used by attackers to connect to their command-and-control infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *socket*connect*sock_stream* , *socket*sock_stream*connect* AND target process name = perl

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Unix Shell (T1059.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible C2 via dnscat2 High Evasion

    Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic.

    Indicator:

    Process action type = execution AND target process name = dnscat2 Host host os = linux

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell calling Invoke-Expression argument Informational Execution

    These PowerShell arguments are often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *iex * , *invoke-expression * AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = *Microsoft Corporation* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell possibly attempting to execute as administrator Informational Execution

    This PowerShell argument is often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *administrator* AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell reverse shell Medium Execution

    This rule looks for a PowerShell instance that is communicating over known Metasploit ports back to an attacker in cases of reverse shell.

    Indicator:

    Network action type = outgoing , failed AND remote port = 4444 Process initiator cmd = *web*downloadstring*.ps1* , *web*downloadstring*.exe* AND initiated by = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell running with download in the command line Informational Dropper

    PowerShell can be used to download malicious content from the internet.

    Indicator:

    Process action type = execution AND target process cmd = *download* AND target process name = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Process calls ActiveX Object with a shell command Medium Execution

    This rule looks for ActiveX being used to run commands on a machine, seen in cases of evasive attacks.

    Indicator:

    Process action type = execution AND target process cmd = *ActiveXObject*WScript.Shell*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Python script connecting to network Medium Execution

    Python scripts may be used by attackers to connect to their command-and-control infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *socket*connect*sock_stream* , *socket*sock_stream*connect* AND target process name = python

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Python (T1059.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Reverse shell one-liner using a scripting engine Informational Execution

    An attacker may use scripting engines to execute code from the command line to open a reverse shell.

    Indicator:

    Process action type = execution AND target process cmd = * -c *socket* , * -c */bin/bash* , * -c */bin/sh* , * -c *cmd.exe* , * -c *powershell.exe* , * -e *socket* , * -e */bin/bash* , * -e */bin/sh* , * -e *cmd.exe* , * -e *powershell.exe* , * -r *fsockopen* , * -r */bin/bash* , * -r */bin/sh* , * -r *cmd.exe* , * -r *powershell.exe* AND target process name = python , python.exe , perl , perl.exe , php , php.exe , ruby , ruby.exe , lua , lua.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Unix Shell (T1059.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Reverse shell using PowerShell Informational Execution

    PowerShell can start a reverse shell console for attackers using these commands and take control of the machine.

    Indicator:

    Process action type = execution AND target process cmd = *Sockets.TcpClient* , *reverse_http* AND target process name = powershell.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rubeus tool execution High Execution

    Rubeus is a tool for abusing Kerberos, inspired by Kekeo; its usage may indicate malicious activity.

    Indicator:

    Process action type = execution AND target process name = rubeus.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter (T1059)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious file created in AppData directory Informational Execution

    A suspicious executable file was created in the AppData directory.

    Indicator:

    File file name = *.scr , *.docm , *.uue , *.sh , *.cpl , *.jse , *.ws , *.wsf , *.elf AND file path = *\AppData\* AND action type = create

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious process loads AMSI DLL Informational Execution

    Amsi.dll is expected to be loaded from a few known processes (e.g. PowerShell). An image load from an unrelated LOLBIN may indicate PowerShell execution.

    Indicator:

    Image Load module path = *\amsi.dll Process initiated by = rundll32.exe , regasm.exe , installutil.exe , regsvcs.exe , regsvr32.exe AND initiator cmd != *printui.dll* AND *lenovo\* AND *\program files*\common files\vmware\* AND *\program files*\NVIDIA Corporation\* AND *PolicyAgentProvider.dll* AND *\windows\ccm\* AND *\windows\installer\* AND *GeneralTel.dll* AND *LogiLDA.dll* Host host os = windows

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VBScript execution from the command line Informational Execution

    Attackers may run VBScript code from the command line using signed processes such as Mshta.

    Indicator:

    Process action type = execution AND target process cmd = *createobject(*

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: Visual Basic (T1059.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Wscript.exe connects to an external network Informational Execution

    It may be due to local IT or administrative tools used on endpoints, but it could also indicate exfiltration of data between hosts in the local network, malware droppers, beaconing and so on. The execution chain should be reviewed to determine the context of the activity.

    Indicator:

    Network action type = incoming , outgoing , failed AND remote ip != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* Process initiated by = wscript.exe , cgo name = wscript.exe

    ATT&CK tactics: Execution (TA0002)
    ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11