BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0003 ✕ technique: T1542 ✕

Download CSV Show ATT&CK heatmap
  • Manipulation of autostart related system files Informational Persistence

    May be used as a malware persistence technique, as these files have relevancy to the startup routine of Windows.

    Indicator:

    File action type = create , delete , write AND file name = system.ini , win.ini , wininit.ini , winstart.bat , autoexec.bat , config.sys , system autoexec.nt , system config.nt , dosstart.bat Process initiated by != wuauclt.exe AND cgo name != wuauclt.exe

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Pre-OS Boot: Bootkit (T1542.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11