BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0003 ✕ technique: T1137 ✕

Download CSV Show ATT&CK heatmap
  • Creation of a new Microsoft Office default template Informational Persistence

    Microsoft Office contains default templates that open whenever you start Word or Excel. Attackers may create them to establish persistence.

    Indicator:

    File file path = *Roaming\Microsoft\*\Normal.dotm , *\XLSTART\*.xltm , *\XLSTART\*.xlsb AND file path != *Windows\Recent\* AND action type = create Process initiated by != winword.exe AND excel.exe AND svchost.exe AND winlogon.exe AND scanstate.exe AND userprofilemanager.exe AND xcopy.exe AND loadstate.exe AND System AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Ivanti, Inc. AND VMware, Inc. AND Digital Guardian, Inc. AND Citrix Systems, Inc. AND AppSense AND Liquidware Labs, Inc. Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Office Application Startup (T1137)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23