BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0003 ✕ technique: T1021 ✕

Download CSV Show ATT&CK heatmap
  • Multiple RDP sessions enabled via Registry Medium Persistence

    Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does.

    Indicator:

    Registry registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fSingleSessionsPerUser AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003) Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001) Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23