BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0003 ✕ technique: T1098 ✕

Download CSV Show ATT&CK heatmap
  • New local user created via PowerShell command line Medium Persistence

    Attackers may create new local users to persist access to machines.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe AND target process cmd = *New-LocalUser*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • User added to local administrator group using a PowerShell command Medium Persistence

    Adding a new user to the local admin group may or may not be malicious, but it is an outstanding action worth considering, as it shouldn't happen too often. A malware may add a new malicious user to the administrators group as a way of maintaining high privileges after the system was compromised.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe AND target process cmd = *Add-LocalGroupMember*Group*Administrators*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11