BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

22 BIOCs match the current filters. tactic: TA0004 ✕

Download CSV Show ATT&CK heatmap
  • Bypass UAC using the IsolatedCommand Registry value Medium Privilege Escalation

    IsolatedCommand is a Registry value known to be altered by attackers to allow themselves to run their malware with elevated privileges.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data != "%1" %* AND registry key name = *\exefile\shell\runas\command* AND registry value name = IsolatedCommand Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bypass UAC using the control.exe Registry key Medium Privilege Escalation

    Control.exe is a Registry key known to be altered by attackers to allow themselves to run their malware with elevated privileges.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data != "%1" %* AND registry key name = *currentVersion\app paths\control.exe* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bypassing Windows UAC using sysprep Informational Privilege Escalation

    Attackers may use the sysprep.exe built-in Windows tools to bypass Windows UAC.

    Indicator:

    Process action type = execution AND target process name = sysprep.exe Process initiated by != winlogon.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Command enumeration via sudo Informational Privilege Escalation

    The 'sudo -l' command was executed to enumerate commands that can be executed by a user.

    Indicator:

    Process action type = execution AND target process cmd =~ -l |-l$ AND target process name = sudo Host host os = linux

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Discovery of files with setgid or setuid bits Informational Privilege Escalation

    Attackers may try to locate files with setgid or setuid bits set to escalate privileges.

    Indicator:

    Process action type = execution AND target process cmd = * -perm *-4000* , * -perm *-2000* , * -perm *g+s* , * -perm *u+s* , * -perm *g=s* , * -perm *u=s* AND target process name = find Process initiated by != ir_agent AND cgo name != ir_agent

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Kerberos ticket forging using Impacket ticketer Medium Evasion

    Suspected execution of Impacket's ticketer.py script for forging TGT/TGS Kerberos tickets.

    Indicator:

    Process action type = execution AND target process cmd = *ticketer.py*

    ATT&CK tactics: Defense Evasion (TA0005) Privilege Escalation (TA0004)
    ATT&CK techniques: Access Token Manipulation (T1134)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of MMC Registry configuration Informational Privilege Escalation

    Creation or modification of these Microsoft Management Console related entries can cause the execution of the specified programs, bypassing UAC.

    Indicator:

    Registry action type = all AND registry key name = *mscfile\shell\open\command* , *\folder\shell\open\command* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of the sticky keys file Medium Privilege Escalation

    Possible login bypass attack.

    Indicator:

    File action type = create , write AND file path = *:\Windows\System32 , *:\Windows\Syswow64 AND file name = sethc.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Event Triggered Execution: Accessibility Features (T1546.008)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Modifying ELF file capabilities via setcap Informational File Privilege Manipulation

    An attacker may attempt to gain privileges by setting the capabilities of a file.

    Indicator:

    Process action type = execution AND target process name = setcap

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Exploitation for Privilege Escalation (T1068)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible UAC bypass via Event Viewer Medium File Privilege Manipulation

    Eventvwr.exe normally only spawns mmc.exe. Attackers may use it for bypassing UAC (User Account Control) by having it spawn a different process.

    Indicator:

    Process action type = execution AND target process name != mmc.exe Process initiated by = eventvwr.exe , os parent name = eventvwr.exe Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PsExec runs with System privileges Informational Privilege Escalation

    PsExec.exe is a Windows administrative tool, it can be used to elevate privileges and run other processes with NT/System privilege level.

    Indicator:

    Process action type = execution AND target process cmd = * -s* AND target process name = psexec.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Valid Accounts (T1078)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Security Support Provider (SSP) registered via a registry key Informational Privilege Escalation

    Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords.

    Indicator:

    Registry action type = create_registry_key , delete_registry_key , set_registry_value , delete_registry_value AND registry key name =~ .*HKEY_LOCAL_MACHINE\\SYSTEM\\(ControlSet00[1,2]|CurrentControlSet)\\Control\\Lsa.* AND registry value name =~ .*Security.* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Setuid on file Informational Privilege Escalation

    Setting user identification on an executable file causes it to run with the privileges of the owning user.

    Indicator:

    Process action type = execution AND target process cmd = *u+s* AND target process name = chmod

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shim database file access Informational Persistence

    An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence.

    Indicator:

    File action type = create , rename , write AND file path = *\windows\apppatch\custom\*

    ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Sudoers discovery Informational Discovery

    Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges.

    Indicator:

    Process action type = execution AND target process cmd = */etc/sudoers* , *sudo *-l* , *sudo *--list* Process initiator cmd != *chef* AND *puppet* AND *salt-minion* AND cgo cmd != *chef* AND *puppet* AND *salt-minion* AND initiated by != chef-client AND BESClient AND crod AND crond AND cgo name != chef-client AND BESClient AND crod AND crond

    ATT&CK tactics: Discovery (TA0007) Privilege Escalation (TA0004)
    ATT&CK techniques: Account Discovery (T1087) Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer driver installation Low Privilege Escalation

    A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

    Indicator:

    Registry registry data = Generic / Text Only AND registry key name = *windows nt\currentversion\print\printers* AND action type = set_registry_value Process initiator signature = Unsigned , Invalid Signature Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer port creation via Registry Medium Privilege Escalation

    An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

    Indicator:

    Registry registry value name = *.exe , *.dll , *.bat , *.com , *.cmd , *.ps1 , *.hta , *.vba , *.vbs , *.vbe , *.js AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • UAC bypass using the changepk.exe Registry key Medium Privilege Escalation

    Attackers may use the changepk.exe built-in Windows tool to bypass Windows UAC by modifying Registry keys.

    Indicator:

    Registry registry key name = *Launcher.SystemSettings\Shell\Open\Command* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unsigned integer Sudo privilege escalation Medium Privilege Escalation

    Fixed in CVE-2019-14287, this known command line is used to exploit a bug in sudo to gain root privileges.

    Indicator:

    Process action type = execution AND target process cmd = * -u#-1 * , * -u#4294967295 *

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unusual process spawned by changepk.exe Informational Privilege Escalation

    Attackers may use the changepk.exe built-in Windows tool to bypass UAC using an unusual initiator.

    Indicator:

    Process action type = execution AND target process name != sppsvc.exe AND clipup.exe AND genvalobj.exe AND dllhost.exe AND trustedinstaller.exe AND sppextcomobj.exe AND dismhost.exe Process initiated by = changepk.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WSReset.exe UAC bypass Low Privilege Escalation

    Attackers may use WSReset.exe to bypass User Account Control (UAC).

    Indicator:

    Process action type = execution AND target process name != conhost.exe AND mmc.exe Process initiated by = wsreset.exe , cgo name = wsreset.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WptsExtensions.dll created to disk Medium Privilege Escalation

    The Task Scheduler service attempts to load the missing WptsExtensions.dll. As a result, the creation of this file may be indicative of DLL hijacking.

    Indicator:

    File action type = create , read , rename , write AND file name = wptsExtensions.dll

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11