BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

3 BIOCs match the current filters. tactic: TA0004 ✕ technique: T1547 ✕

Download CSV Show ATT&CK heatmap
  • Security Support Provider (SSP) registered via a registry key Informational Privilege Escalation

    Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords.

    Indicator:

    Registry action type = create_registry_key , delete_registry_key , set_registry_value , delete_registry_value AND registry key name =~ .*HKEY_LOCAL_MACHINE\\SYSTEM\\(ControlSet00[1,2]|CurrentControlSet)\\Control\\Lsa.* AND registry value name =~ .*Security.* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer driver installation Low Privilege Escalation

    A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

    Indicator:

    Registry registry data = Generic / Text Only AND registry key name = *windows nt\currentversion\print\printers* AND action type = set_registry_value Process initiator signature = Unsigned , Invalid Signature Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer port creation via Registry Medium Privilege Escalation

    An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

    Indicator:

    Registry registry value name = *.exe , *.dll , *.bat , *.com , *.cmd , *.ps1 , *.hta , *.vba , *.vbs , *.vbe , *.js AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23