BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

50 BIOCs match the current filters. tactic: TA0003 ✕

Download CSV Show ATT&CK heatmap
  • Account creation via command-line tool Informational Persistence

    The useradd/adduser command could be used to create user accounts or to add users to existing groups.

    Indicator:

    Process action type = execution AND target process name = useradd , adduser

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create Account (T1136)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Active Setup Registry Autostart Low Persistence

    Suspicious modification of the active setup registry for persistence and privilege escalation.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components AND registry value name = StubPath Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Active Setup (T1547.014)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Bitsadmin.exe used to download data Informational Persistence

    Some attacks were known for abusing BITSAdmin in the past to hide how data was downloaded using legitimate Windows tools.

    Indicator:

    Process action type = execution AND target process cmd = */transfer * AND target process cmd != */upload * AND target process name = bitsadmin.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: BITS Jobs (T1197)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Chrome runs with key security features disabled Low Persistence

    This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.

    Indicator:

    Process action type = execution AND target process cmd = *--disable-extensions-file-access-check* , *--always-authorize-plugins* , *--disable-improved-download-protection* AND target process name = chrome.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Software Extensions: Browser Extensions (T1176.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused host process modifies the Windows shim cache Informational Persistence

    Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique.

    Indicator:

    Process action type = execution AND process execution signature = Signed , Weak Hash AND target process name = sdbinst.exe AND process execution signer = Microsoft Corporation Process initiated by = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe , cgo name = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Creation of a new Microsoft Office default template Informational Persistence

    Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.

    Indicator:

    File file path = *Roaming\Microsoft\*\Normal.dotm , *\XLSTART\*.xltm , *\XLSTART\*.xlsb AND file path != *Windows\Recent\* AND action type = create Process initiated by != winword.exe AND excel.exe AND svchost.exe AND winlogon.exe AND scanstate.exe AND userprofilemanager.exe AND xcopy.exe AND loadstate.exe AND System AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Ivanti, Inc. AND VMware, Inc. AND Digital Guardian, Inc. AND Citrix Systems, Inc. AND AppSense AND Liquidware Labs, Inc. Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Office Application Startup (T1137)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Kernel modules loaded via command-line tool Informational Persistence

    The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.

    Indicator:

    Process action type = execution AND target process cmd != *ksplice* AND target process name = insmod Process initiated by != ds_am AND ds_agent AND ds_agent.init AND initiated by != savd* AND gpfsrunlevel AND runmmfs AND cgo name != ds_am AND ds_agent AND ds_agent.init AND cgo name != savd* AND gpfsrunlevel AND runmmfs AND initiator cmd != *sophos-av* AND *McAfee* AND *cisco* AND cgo cmd != *sophos-av* AND *McAfee* AND *cisco*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Kernel modules loaded via compiled loader and .ko file Informational Persistence

    Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits.

    Indicator:

    Process action type = execution AND target process cmd = *.ko * , *.ko

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of 'BootExecute' Registry run key Informational Persistence

    Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence.

    Indicator:

    Registry action type = all AND registry key name = *\Control\Session Manager AND registry value name = BootExecute Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of AppInit DLL loading list Informational Persistence

    The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on.

    Indicator:

    Registry action type = all AND os actor process signature vendor != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND registry data != *system32\SophosAV\* AND *\Citrix\* AND registry data = *.dll AND registry key name = *Software\Microsoft\Windows NT\CurrentVersion\Windows* AND registry value name = AppInit_DLLs Process initiator signer != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND cgo signer != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , os parent signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: AppInit DLLs (T1546.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Application Verifier custom providers Informational Persistence

    The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application.

    Indicator:

    Registry action type = all AND registry key name = *software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Image File Execution Options Injection (T1546.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Firefox plugins and extensions via the Registry Medium Persistence

    Plugins and extensions are loaded from all of these Registry keys.

    Indicator:

    Registry action type = set_registry_value AND registry key name = *SOFTWARE\Mozilla\Firefox\Extensions , *SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions , *software\wow6432node\mozillaplugins\ , *software\mozillaplugins\ Process initiated by != appvclient.exe AND initiator signer != mozilla corporation Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Software Extensions: Browser Extensions (T1176.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Winlogon 'Notify' autostart Registry key Informational Persistence

    Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs.

    Indicator:

    Registry action type = all AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Winlogon 'UserInit' autostart Registry key Medium Persistence

    Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon.

    Indicator:

    Registry action type = all AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of autostart related system files Informational Persistence

    May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows.

    Indicator:

    File action type = create , delete , write AND file name = system.ini , win.ini , wininit.ini , winstart.bat , autoexec.bat , config.sys , system autoexec.nt , system config.nt , dosstart.bat Process initiated by != wuauclt.exe AND cgo name != wuauclt.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Pre-OS Boot: Bootkit (T1542.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of default file association configuration Informational Persistence

    When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened.

    Indicator:

    Registry action type = all AND registry data = * AND registry key name = *Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Change Default File Association (T1546.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of default file extension configuration Low Tampering

    Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions.

    Indicator:

    Registry registry value name = .exe , .dll , .sys , .lnk , .ps1 , .rar , .cmd , .bat , .zip AND registry key name = *\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Change Default File Association (T1546.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of service imagepath configuration Informational Persistence

    This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *\services\*\imagepath Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003) Hijack Execution Flow: Services Registry Permissions Weakness (T1574.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of the MonitorProcess Registry key Medium Persistence

    Entries added under the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit can be used to run malicious code and help attackers gain persistence.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *silentprocessexit* AND registry value name = monitorprocess Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Image File Execution Options Injection (T1546.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of default Windows startup path via Registry Informational Persistence

    An attacker may modify the startup path to the location of the malware.

    Indicator:

    Registry registry key name = *microsoft\windows\currentversion\explorer\user shell folders* , *microsoft\windows\currentversion\explorer\shell folders* AND registry data != *Microsoft\Windows\Start Menu\Programs\Startup* AND *\users\*\start Menu\Programs\Startup* AND *%USERPROFILE%\start Menu\Programs\Startup* AND registry value name = startup AND action type = set_registry_value Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Citrix Systems, Inc. AND VMware, Inc. AND initiator cmd != *regsvr32.exe*/s*/n*/i:u*shell32.dll* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of logon scripts via Registry Medium Persistence

    Windows logon scripts are stored in ``HKCU\Environment\UserInitMprLogonScript`` and trigger when a user logs in. Attackers may abuse them for persistence.

    Indicator:

    Registry registry key name = *\Environment AND registry value name = UserInitMprLogonScript AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Initialization Scripts: Logon Script (Windows) (T1037.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of systemd service files Informational Persistence

    An attacker may create or modify systemd service unit files to establish persistence between reboots.

    Indicator:

    File action type = write , create AND file path =~ (^/etc/systemd/system/|^/usr/lib/systemd/system/|^/run/systemd/system/|/lib/systemd/system/|\.config/systemd/user/|^/etc/systemd/user/|\.local/share/systemd/user/|^/run/systemd/user/|^/usr/lib/systemd/user/).*\.service Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Systemd Service (T1543.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of the Winlogon\Shell Registry key Informational Persistence

    Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell.

    Indicator:

    Registry registry data != explorer.exe AND registry key name = *\software\microsoft\windows nt\currentversion\winlogon* AND registry value name = shell AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Multiple RDP sessions enabled via Registry Medium Persistence

    Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does.

    Indicator:

    Registry registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fSingleSessionsPerUser AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003) Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001) Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • New entry added to startup related Registry keys by unsigned process Informational Persistence

    Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level.

    Indicator:

    Registry action type = create_registry_key , rename_registry_key , set_registry_value AND registry key name = *software\Microsoft\Windows*CurrentVersion\run* , *Wow6432Node\Microsoft\Windows*CurrentVersion\Run* , *Software\Microsoft\Windows*CurrentVersion\Winlogon\Userinit* Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • New local user created via PowerShell command line Medium Persistence

    Attackers may create new local users to persist access to machines.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe AND target process cmd = *New-LocalUser*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • New service created via command line Informational Persistence

    Attackers may leverage services to gain persistence on an endpoint.

    Indicator:

    Process action type = execution AND target process cmd = *create*binpath* AND target process name = sc.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Persistence through service registration Informational Persistence

    An attacker may add or modify system services to persist on a host.

    Indicator:

    File action type = write , create , rename AND file path =~ /etc/(init.d/|rc|systemd|inetd.conf|modules|modprobe.conf|inittab).*|/lib/systemd.* Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Systemd Service (T1543.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence using bashrc files Informational Persistence

    Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution.

    Indicator:

    File action type = write , rename , create AND file path =~ (/home/[^/]+/\.(bashrc|profile|bash_profile))|(/etc/profile|/etc/bash.bashrc|/etc/csh.cshrc|/etc/csh.login) Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Unix Shell Configuration Modification (T1546.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence using cron jobs Informational Persistence

    Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware.

    Indicator:

    File action type = create , write AND file path = /var/spool/cron/crontabs/* , /etc/crontab* , /etc/cron.hourly/* , /etc/cron.daily/* , /etc/cron.weekly/* , /etc/cron.monthly/* , /etc/cron.d* , /var/spool/cron/atjobs* , /var/spool/at* , /etc/at.allow* , /etc/at.deny* , /etc/cron.allow* , /etc/cron.deny* , /etc/anacrontab* Process initiator cmd != *atd -f* AND *puppet* AND cgo cmd != *atd -f* AND *puppet* AND initiated by != *zabbix_server* AND initiated by != puppet AND yum AND cgo name != *zabbix_server* AND cgo name != puppet AND yum

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job: Cron (T1053.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence via Registry screensaver key change Informational Persistence

    Attackers may install their malware persistently by modifying the value of the screensaver Registry key.

    Indicator:

    Registry registry key name = *\Control Panel\Desktop AND registry value name = SCRNSAVE.EXE AND action type = set_registry_value Process initiator cmd != * shell32.dll,Control_RunDLL desk.cpl,ScreenSaver,* AND initiated by != rundll32.exe AND cgo name != explorer.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Screensaver (T1546.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Port Monitor added in Registry Low Persistence

    Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.

    Indicator:

    Registry registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Monitors\ART AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible XDG autostart persistency Informational Persistence

    Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory.

    Indicator:

    File action type = create , rename , write AND file path =~ (/etc/xdg|.*/\.config)/autostart/.*\.desktop$ Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: XDG Autostart Entries (T1547.013)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible web shell command execution Informational Persistence XQL

    Possible command execution via a web shell for reconnaissance.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"OR":[{"LEFT":"$actor_process_image_name","OPERATOR":"IN","RIGHT":["w3wp.exe","httpd.exe","php-cgi.exe","nginx.exe","tomcat.exe"],"FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"OR":[{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"nslookup","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"whoami","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" hostname","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" arp ","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" net ","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"qwinsta","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"netstat","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"quser","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":" powershell","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"tasklist","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"ipconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"ping","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"certutil","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"rundll32","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"vssadmin","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"tracert","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"systeminfo","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"netsh","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Server Software Component: Web Shell (T1505.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Potential web shell installation Informational Persistence

    A web-app script file was installed on a web server. This can indicate an installation of web shell.

    Indicator:

    File action type = create , write AND file path = /var/www/html/*.php , /var/www/html/*.asp , /var/www/html/*.aspx , /var/www/html/*.cfm , /var/www/html/*.jsp , /var/www/html/*.pl

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Server Software Component: Web Shell (T1505.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell creates a new service Low Persistence

    PowerShell creates a new service via a command line. This can be used by attackers to be persistent on a machine.

    Indicator:

    Process action type = execution AND target process cmd = *New-Service* AND target process name = powershell.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell downloads files via BITS Medium Persistence

    This PowerShell argument is often used to run commands with malicious intent.

    Indicator:

    Process action type = execution AND target process cmd = *start-bitstransfer* , *complete-bitstransfer* AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: BITS Jobs (T1197)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Print Processor Registration Low Persistence

    Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Environments\Windows x64\Print Processors Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Print Processors (T1547.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Print spooler set to load new DLL on boot Informational Persistence

    Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API.

    Indicator:

    Registry action type = set_registry_value , create_registry_key AND registry data != BPSLMONITOR.DLL AND registry key name = *Control\Print\Monitors* AND registry value name = driver Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shim database file access Informational Persistence

    An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence.

    Indicator:

    File action type = create , rename , write AND file path = *\windows\apppatch\custom\*

    ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shim database registration via Registry Informational Persistence

    Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *software\microsoft\windows nt\currentversion\appcompatflags\installedsdb* , *software\microsoft\windows nt\currentversion\appcompatflags\custom* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious SDB file written to disk Informational Persistence

    Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.

    Indicator:

    File action type = create , write AND file name = *.sdb AND file path !=~ [.].[a-zA-Z0-9]{2,3}\.[a-zA-Z0-9]{2,3}$|ApplicationConfigurationFromString|secedit.sdb|appraiser.sdb|sysmain.sdb|Sharegate|Program Files|AppData\\Roaming\\Thunderbird\\Profiles Process initiated by = powershell.exe , wscript.exe , cscript.exe , regsvcs.exe , schtasks.exe , xwizard.exe , findstr.exe , esentutl.exe , reg.exe , csc.exe , atbroker.exe , print.exe , pcwrun.exe , rpcping.exe , wsreset.exe , replace.exe , mshta.exe , bitsadmin.exe , ieexec.exe , cmd.exe , microsoft.workflow.compiler.exe , runscripthelper.exe , makecab.exe , forfiles.exe , control.exe , msbuild.exe , register-cimprovider.exe , ie4uinit.exe , sc.exe , bash.exe , sh.exe , hh.exe , mmc.exe , jsc.exe , scriptrunner.exe , odbcconf.exe , extexport.exe , msdt.exe , diskshadow.exe , extrac32.exe , eventvwr.exe , mavinject.exe , regasm.exe , gpscript.exe , rundll32.exe , regsvr32.exe , regedit.exe , msiexec.exe , presentationhost.exe , wmic.exe , runonce.exe , syncappvpublishingserver.exe , verclsid.exe , infdefaultinstall.exe , expand.exe , installutil.exe , wab.exe , dnscmd.exe , at.exe , pcalua.exe , cmdkey.exe , msconfig.exe AND cgo name != code.exe AND msiexec.exe AND Deploy-Application.exe AND BackendTaskQueueHost64.exe AND cgo cmd != *acmigration.dll,ApplyMigrationShims*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious SDB file written to disk by an unsigned process Informational Persistence

    Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.

    Indicator:

    File action type = create , write AND file name = *.sdb AND file path !=~ [.].[a-zA-Z0-9]{2,3}\.[a-zA-Z0-9]{2,3}$ Process initiated by != libero.exe AND heyex.exe AND avevamarinesample2.1.0.exe AND wmiproviders_2.1.5.6002.exe AND initiator path !=~ Xilinx|Flowlink 5.1|CST Studio Suite 2020|Program Files|wish.*exe AND initiator signature = Unsigned Host host os != linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer driver installation Low Privilege Escalation

    A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

    Indicator:

    Registry registry data = Generic / Text Only AND registry key name = *windows nt\currentversion\print\printers* AND action type = set_registry_value Process initiator signature = Unsigned , Invalid Signature Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer port creation via Registry Medium Privilege Escalation

    An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

    Indicator:

    Registry registry value name = *.exe , *.dll , *.bat , *.com , *.cmd , *.ps1 , *.hta , *.vba , *.vbs , *.vbe , *.js AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Tampering with Windows Security Support Provider DLLs Informational Persistence

    Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002.

    Indicator:

    Registry action type = all AND registry key name = *\SYSTEM\*ControlSet*\Control\Lsa\OSConfig , *\SYSTEM\*ControlSet*\Control\Lsa AND registry value name = *Security Packages* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Task scheduled by commonly abused host process Informational Persistence

    Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use.

    Indicator:

    Process action type = execution AND target process name = schtasks.exe , at.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process initiated by = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe , cgo name = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • User added to local administrator group using a PowerShell command Medium Persistence

    Adding a new user to the local admin group may or may not be malicious, but it is an outstanding action worth considering, as it shouldn't happen too often. A malware may add a new malicious user to the administrators group as a way of maintaining high privileges after the system was compromised.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe AND target process cmd = *Add-LocalGroupMember*Group*Administrators*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • User creation or modification via /etc file Informational Persistence

    Attackers may create new users or modify existing users by directly modifying /etc/passwd and /etc/shadow.

    Indicator:

    File file path = /etc/shadow , /etc/passwd AND action type = write

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create Account (T1136)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Write to .bash_profile Informational Persistence

    Commands in ~/.bash_profile are executed on every user shell login with a username and password.

    Indicator:

    File file name = .bash_profile AND action type = write

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Unix Shell Configuration Modification (T1546.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11