BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0003 ✕ technique: T1053 ✕

Download CSV Show ATT&CK heatmap
  • Persistence using cron jobs Informational Persistence

    Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware.

    Indicator:

    File action type = create , write AND file path = /var/spool/cron/crontabs/* , /etc/crontab* , /etc/cron.hourly/* , /etc/cron.daily/* , /etc/cron.weekly/* , /etc/cron.monthly/* , /etc/cron.d* , /var/spool/cron/atjobs* , /var/spool/at* , /etc/at.allow* , /etc/at.deny* , /etc/cron.allow* , /etc/cron.deny* , /etc/anacrontab* Process initiator cmd != *atd -f* AND *puppet* AND cgo cmd != *atd -f* AND *puppet* AND initiated by != *zabbix_server* AND initiated by != puppet AND yum AND cgo name != *zabbix_server* AND cgo name != puppet AND yum

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job: Cron (T1053.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Task scheduled by commonly abused host process Informational Persistence

    Attackers will often attempt to abuse shell/host processes to create a persistent payload in the form of a scheduled task. Check for malicious use.

    Indicator:

    Process action type = execution AND target process name = schtasks.exe , at.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process initiated by = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe , cgo name = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Scheduled Task/Job (T1053)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23