BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0003 ✕ technique: T1176 ✕

Download CSV Show ATT&CK heatmap
  • Chrome runs with key security features disabled Low Persistence

    This chrome process ran with command line arguments that disabled key security features disabled. It can have legitimate uses, but this technique is often used by malware to load malicious or untrusted browser extensions.

    Indicator:

    Process action type = execution AND target process cmd = *--disable-extensions-file-access-check* , *--always-authorize-plugins* , *--disable-improved-download-protection* AND target process name = chrome.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Software Extensions: Browser Extensions (T1176.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Firefox plugins and extensions via the Registry Medium Persistence

    Plugins and extensions are loaded from all of these Registry keys.

    Indicator:

    Registry action type = set_registry_value AND registry key name = *SOFTWARE\Mozilla\Firefox\Extensions , *SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions , *software\wow6432node\mozillaplugins\ , *software\mozillaplugins\ Process initiated by != appvclient.exe AND initiator signer != mozilla corporation Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Software Extensions: Browser Extensions (T1176.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23