BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0003 ✕ technique: T1574 ✕

Download CSV Show ATT&CK heatmap
  • Manipulation of service imagepath configuration Informational Persistence

    This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *\services\*\imagepath Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003) Hijack Execution Flow: Services Registry Permissions Weakness (T1574.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11