BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0004 ✕ technique: T1574 ✕

Download CSV Show ATT&CK heatmap
  • WptsExtensions.dll created to disk Medium Privilege Escalation

    The Task Scheduler service attempts to load the missing WptsExtensions.dll. As a result, the creation of this file may be indicative of DLL hijacking.

    Indicator:

    File action type = create , read , rename , write AND file name = wptsExtensions.dll

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11