BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

109 BIOCs match the current filters. tactic: TA0005 ✕

Download CSV Show ATT&CK heatmap
  • AMSI Bypass Medium Lateral Movement

    AMSI (Antimalware Scan Interface) provides enhanced malware protection on Windows 10 machines. Attackers may try to bypass this mechanism and run malicious code.

    Indicator:

    Process action type = execution AND target process cmd = *system.management.automation.amsiutils*amsiinitfailed*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Accessing bash history file Low Evasion

    Clearing bash history file is a known procedure of attackers to delete traces.

    Indicator:

    Process action type = execution AND target process cmd = *.bash_history * , *.bash_history , *histfile * , *histfile AND target process name = rm , touch , ln AND target process path != /Applications/OnyX.app/Contents/MacOS/OnyX

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Accessing bash history file using bash commands Low Evasion

    Clearing bash history files is a known attacker procedure for covering their tracks.

    Indicator:

    Process action type = execution AND target process cmd = *set histfile* , *set history* , *export histfile* , *export histignore* , *history -c* , *history -d* AND target process name = bash , sh

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Administrator obtains access rights to a file using icacls.exe Informational File Privilege Manipulation

    Grant an administrator file access privileges.

    Indicator:

    Process action type = execution AND target process cmd = *grant*admin* AND target process name = icacls.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: File and Directory Permissions Modification (T1222)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Base64 decoding using the base64 utility Informational File Type Obfuscation

    Base64 decoding using the base64 utility with the -d argument provided.

    Indicator:

    Process action type = execution AND target process cmd = *-d* AND target process name = base64 Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Bitsadmin.exe used to upload data High Exfiltration

    Some attacks are known to abuse BITSAdmin to hide how data upload using legitimate Windows tools.

    Indicator:

    Process action type = execution AND target process cmd = */transfer * AND */upload * AND target process name = bitsadmin.exe

    ATT&CK tactics: Exfiltration (TA0010) Defense Evasion (TA0005)
    ATT&CK techniques: Exfiltration Over Alternative Protocol (T1048) BITS Jobs (T1197)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Browser downloads an .hta or .application file Informational Execution

    .hta and .application files are Windows applications that may serve as an attack vector by executing code maliciously using trusted Windows applications.

    Indicator:

    File action type = create , write AND file name = *.hta , *.application Process initiated by = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe , cgo name = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Mshta (T1218.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Changing permissions or ownership of a file or folder Informational Evasion

    Changing the permissions or ownership of a file or folder can be done to get access to sensitive data.

    Indicator:

    Process action type = execution AND target process name = attrib.exe , cacls.exe , takeown.exe AND target process cmd = *-r* , *grant* , */f*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: File and Directory Permissions Modification (T1222)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Chrome launched in Incognito mode Informational Evasion

    May be used to cover up malware or malicious insider activity.

    Indicator:

    Process action type = execution AND target process cmd = *incognito* AND target process name = chrome.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Clear event logging policy using auditpol.exe Informational Evasion

    Attackers may clear Windows Event Logging policies using auditpol.exe.

    Indicator:

    Process action type = execution AND target process cmd = */clear* AND target process name = auditpol.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable Windows Event Logging (T1562.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clear logs - using dd and /dev/null Medium Tampering

    Usage of the dd utility to clear the contents of a file using /dev/null.

    Indicator:

    Process action type = execution AND target process cmd = *if=/dev/null*of=*log* AND target process name = dd Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clearing logs by copying /dev/null to a log file Informational Tampering

    Usage of the cp command to copy /dev/null to a file and clear its content.

    Indicator:

    Process action type = execution AND target process cmd = cp*/dev/null*log* AND target process name = cp Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clearing logs by executing cat /dev/null Informational Tampering

    Usage of cat /dev/null to clear the contents of a log file.

    Indicator:

    Process action type = execution AND target process cmd = cat*/dev/null* AND target process name = cat Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Common Apple process name missing Apple digital signature Informational File Type Obfuscation

    These common Apple process names should normally be signed with the Apple Inc. digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

    Indicator:

    Process action type = execution AND target process name = safari.exe , itunes.exe , ituneshelper.exe , ipodservice.exe , applemobiledeviceservice.exe , applemobiledevicehelper.exe AND process execution signer != *Apple Inc.* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Common Mozilla process name missing Mozilla digital certificate Informational File Type Obfuscation

    These common Mozilla process names should normally be signed with the Mozilla Corporation digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

    Indicator:

    Process action type = execution AND target process name = firefox.exe AND process execution signer != *Mozilla Corporation* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused process executed with obfuscated characters Informational Evasion

    Commonly abused process executed with obfuscated characters.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe AND target process cmd = *^* , *`* AND target process cmd != *regex* AND *find*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Commonly abused process spawns out of rundll32.exe Informational Execution

    This type of execution happens in .dll based attacks.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = rundll32.exe , cgo name = rundll32.exe AND initiator signature = Signed , cgo signature = Signed AND initiator signer = *Microsoft Corporation* , cgo signer = *Microsoft Corporation* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Compiled HTML (help file) makes network connections Informational Execution

    Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload.

    Indicator:

    Network action type = outgoing , failed Process os parent name = hh.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Compiler process started by an Office process Informational Evasion

    The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine.

    Indicator:

    Process action type = execution AND target process name = csc.exe , vbc.exe Process initiated by = excel.exe , powerpnt.exe , winword.exe , outlook.exe , cgo name = excel.exe , powerpnt.exe , winword.exe , outlook.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • DLL sideloading attack using Xwizard Low Evasion

    Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.

    Indicator:

    Process action type = execution AND target process path != *\windows\system32\xwizard.exe AND *\windows\syswow64\xwizard.exe AND *\windows\winsxs\ AND target process name = xwizard.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Data destruction using sdelete.exe Informational Evasion

    Attackers may use sdelete.exe to delete files from the target host.

    Indicator:

    Process action type = execution AND target process cmd = * -nobanner* AND target process name = sdelete.exe

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Data Destruction (T1485) Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Delete Volume USN Journal with fsutil Medium Evasion

    This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.

    Indicator:

    Process action type = execution AND target process cmd = * usn *deletejournal* AND target process name = fsutil.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Disable outlook security via Registry Informational Tampering

    Attackers may try to disable outlook security features by modifying the Registry.

    Indicator:

    Registry registry data = 2 , 3 AND registry value name = PromptOOMSend , AdminSecurityMode , ObjectModelGuard AND registry key name = *Outlook* AND action type = set_registry_value Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Relativity ODA LLC AND Pearson PLC AND cgo signer != Relativity ODA LLC AND Pearson PLC AND initiated by != svchost.exe AND cgo name != svchost.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Disabling Windows Defender via Registry Informational Evasion

    Windows Defender stores its configuration in the Registry. By modifying these values, an attacker can disable security features.

    Indicator:

    Registry registry data = 1 AND registry key name = *Windows Defender* AND registry value name = *disable* AND action type = set_registry_value Process initiator signature = Signed , Unsigned , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , Invalid Signature , Weak Hash AND initiator signer != Symantec Corporation AND AVG Technologies USA, LLC AND Akeo Consulting AND Avast Software s.r.o. AND BeyondTrust Software Inc AND Bromium, Inc. AND Digital Communications Inc AND FireEye, Inc. AND Forcepoint LLC AND Google Inc AND Google LLC AND HP Inc. AND Invincea, Inc. AND Kaspersky Lab AND Netwrix Corporation AND OPSWAT, Inc. AND Palo Alto Networks (Netherlands) B.V. AND Rapid7 LLC AND Sangfor Technologies Co.,Ltd AND Snow Software AB AND Tanium Inc. AND Teradici Corporation AND Trend Micro, Inc. AND Websense, Inc. AND ZOHO Corporation private Limited AND Zoom Video Communications, Inc. AND Zscaler, Inc. AND Barracuda Networks, Inc. AND LiveQoS Incorporated AND cgo signer != Symantec Corporation AND AVG Technologies USA, LLC AND Akeo Consulting AND Avast Software s.r.o. AND BeyondTrust Software Inc AND Bromium, Inc. AND Digital Communications Inc AND FireEye, Inc. AND Forcepoint LLC AND Google Inc AND Google LLC AND HP Inc. AND Invincea, Inc. AND Kaspersky Lab AND Netwrix Corporation AND OPSWAT, Inc. AND Palo Alto Networks (Netherlands) B.V. AND Rapid7 LLC AND Sangfor Technologies Co.,Ltd AND Snow Software AB AND Tanium Inc. AND Teradici Corporation AND Trend Micro, Inc. AND Websense, Inc. AND ZOHO Corporation private Limited AND Zoom Video Communications, Inc. AND Zscaler, Inc. AND Barracuda Networks, Inc. AND LiveQoS Incorporated AND initiated by != msmpeng.exe AND svchost.exe AND mpcmdrun.exe AND mpsigstub.exe AND deviceenroller.exe AND securityhealthservice.exe AND mssense.exe AND taniumclient.exe AND setupplatform.exe AND ccmexec.exe AND configsecuritypolicy.exe AND securityhealthsystray.exe AND securityhealthhost.exe AND msiexec.exe AND omadmclient.exe AND monitoringhost.exe AND logonui.exe AND cgo name != msmpeng.exe AND svchost.exe AND mpcmdrun.exe AND mpsigstub.exe AND deviceenroller.exe AND securityhealthservice.exe AND mssense.exe AND taniumclient.exe AND setupplatform.exe AND ccmexec.exe AND configsecuritypolicy.exe AND securityhealthsystray.exe AND securityhealthhost.exe AND msiexec.exe AND omadmclient.exe AND monitoringhost.exe AND logonui.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Driver written to a temporary directory Informational Evasion

    Drivers are highly unlikely to be written or moved to a temp directory. Check whether this driver is legitimate.

    Indicator:

    File action type = create , write AND file path = *\temp\* , *\tmp\* AND file name = *.sys

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Rootkit (T1014)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Encoded VBScript executed High Execution

    Attackers tend to hide their malicious behavior in many ways, one of which is obfuscating their code via encoding.

    Indicator:

    Process action type = execution AND target process cmd = *vbscript.encode*

    ATT&CK tactics: Execution (TA0002) Defense Evasion (TA0005)
    ATT&CK techniques: Command and Scripting Interpreter: JavaScript (T1059.007) Deobfuscate/Decode Files or Information (T1140)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Evasion using time-based properties Informational Evasion

    Attackers may check Event Log to evade virtualized environments.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *get-winevent*6005*

    ATT&CK tactics: Defense Evasion (TA0005) Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion: Time Based Checks (T1497.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • EventLog service disabled by a Registry operation High Tampering

    A Registry set-value operation that disables the EventLog service was executed on the machine.

    Indicator:

    Registry registry data = 4 , 3 AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\EventLog AND registry value name = Start AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable Windows Event Logging (T1562.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Execution of WSL Distro Informational Evasion

    Detecting a new instance execution of Windows Subsystem for Linux distro.

    Indicator:

    File file path = *\drivers\etc\hosts AND action type = read Process initiated by = wsl.exe AND os parent cmd = *LxssManager AND os parent name = svchost.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indirect Command Execution (T1202)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Execution of commonly abused AutoIT script Informational Execution

    AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

    Indicator:

    Process action type = execution AND process execution signature = Signed , Weak Hash AND process execution signer = Autoit Consulting* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution (T1216)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Execution of regsvcs/regasm with uncommon paths Informational Execution

    The regasm.exe/regsvcs.exe commands are used to register .NET COM assemblies, which are typically located in specific paths. Uncommon paths may indicate malicious code is being registered.

    Indicator:

    Process action type = execution AND target process name = regasm.exe , regsvcs.exe AND target process cmd = *appdata\*dll* , *programdata\*dll* , *temp\*dll* , *tmp\*dll* , *documents\*dll , *$recycle.bin\*dll* AND target process cmd != *program files*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Regsvcs/Regasm (T1218.009)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • File renamed to have a script extension Informational Execution

    Adversaries may create 'benign-looking' files, which are later used as malicious scripts by changing their extension.

    Indicator:

    File file previous name = *.tmp , *._new , *.rra , *.txt , *.j , *.rbf , *.jpg , *.png , *.jpeg , *.gif , *.tiff , *.psd , *.pdf , *.eps , *.ai , *.indd , *.raw , *.bmp , *.ico , *.svg , *.tif , *.odt , *.rtf , *.tex , *.wpd AND file name = *.pyi , *.mof , *.hta , *.vbs , *.bat , *.aspx , *.pptm , *.pyd , *.pyc , *.php , *.py , *.js , *.ps1 , *.ps , *.crx , *.sct , *.tcl , *.dotm AND file path != *config.msi* AND *ccm* AND *trend micro* AND *adobe* AND *dell* AND *sessionstore* AND *browser-extension-data* AND *cortana* AND *microsoftedge* AND *microsoft vs code* AND *inetcache* AND file previous path != *prf* AND *set* AND *jds* AND *bit* AND *~$* AND *~w* AND action type = rename Process cgo name != suservice.exe AND wuauclt.exe AND besclient.exe AND tiworker.exe AND fwcld.exe AND svchost.exe AND tortoiseproc.exe AND emcoreservice.exe AND initiated by != 1e.client.exe AND expand.exe AND trustedinstaller.exe AND wuauclt.exe AND setup.exe AND setupsup_la31.exe AND ssms-setup-enu.exe AND lmirtechconsole.exe AND initiated by != git-*.tmp AND *.tmp

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • File timestamp tampering Informational Tampering

    An attacker may modify file timestamps by running the touch command to hide their activities.

    Indicator:

    Process action type = execution AND target process cmd = *-t* , *-acmr* , *-cmra* , *-rcma* , *-macr* AND target process name = touch

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Timestomp (T1070.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Fltmc.exe used to unload filter driver Informational Evasion

    Attackers can abuse the Filter Manager Control Program (fltMC.exe) to unload MiniFilter drivers, some of which may be used for activity monitoring.

    Indicator:

    Process action type = execution AND target process cmd = * unload * AND target process name = fltmc.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Hidden directory creation Informational Evasion

    Attackers may create hidden directories to hide malware or staged files.

    Indicator:

    Process action type = execution AND target process cmd = *.* AND target process name = mkdir

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Hidden file and directory creation Informational Evasion

    Creation of a hidden file inside a hidden directory.

    Indicator:

    File action type = create , rename AND file name = .* AND file path =~ .*/\.[^/]+/\.[^/]+ Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • ISO mounted manually Informational Evasion

    A user manually mounted an ISO file.

    Indicator:

    File file name = *.iso.lnk AND file path = *\appdata\roaming\microsoft\windows\recent\* AND action type = create Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Impersonation using Rubeus tool Medium Evasion

    User authentication should not be impersonated, since this is considered a malicious behavior.

    Indicator:

    Process action type = execution AND target process cmd = * /ticket:* /impersonateuser:* , * /impersonateuser:* /ticket:*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Access Token Manipulation (T1134)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Injection into ping.exe Informational Evasion

    A process injected into an instance of ping.exe.

    Indicator:

    Process action type = injection AND remote process name = ping.exe Process cgo name != csrss.exe AND wmiprvse.exe AND vmstoold.exe AND ctskmstr.exe AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Sentinel Labs, Inc. AND Dell inc. AND cgo signature = Weak Hash , Invalid Signature , N/A , Unsigned , Signed AND cgo signer != Sentinel Labs, Inc. AND Dell inc. AND initiated by != ctskmstr.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Internet Explorer security settings modification Informational Evasion

    The Security Settings Check feature, which checks Internet Explorer security settings to determine risk, was disabled.

    Indicator:

    Registry registry key name = *SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Kerberos ticket forging using Impacket ticketer Medium Evasion

    Suspected execution of Impacket's ticketer.py script for forging TGT/TGS Kerberos tickets.

    Indicator:

    Process action type = execution AND target process cmd = *ticketer.py*

    ATT&CK tactics: Defense Evasion (TA0005) Privilege Escalation (TA0004)
    ATT&CK techniques: Access Token Manipulation (T1134)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Log deletion in known log file directories Informational Evasion

    Deletion of log files in known log directories.

    Indicator:

    File file path = /var/log/* , /private/var/log/* , /private/var/audit/* AND action type = delete Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Log deletion using the truncate command Informational Tampering

    Usage of the truncate utility using "-s 0" argument to clear log files.

    Indicator:

    Process action type = execution AND target process cmd = truncate*-s 0*log* AND target process cmd != */tmp/* AND target process name = truncate Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Log deletion via command-line tool Informational Tampering

    An attacker may use the rm command to remove traces of their activities.

    Indicator:

    Process action type = execution AND target process cmd = */var/log/* , */var/audit* , */var/spool/mail* AND target process name = rm

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • MSBuild execution Informational Evasion

    Attackers may use MSBuild.exe to proxy execution of code through a trusted Windows utility.

    Indicator:

    Process action type = execution AND target process name = msbuild.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • MacOS firewall manipulation Informational Evasion

    An attacker may modify a firewall via command line to bypass network controls.

    Indicator:

    Process action type = execution AND target process name = socketfilterfw , launchctl , kextunload AND target process cmd = *unblockapp* , *--setglobalstate off* , *unload*com.apple.alf.useragent.plist* , *com.apple.nke.applicationfirewall* Host host os = macos

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses (T1562) Impair Defenses: Disable or Modify System Firewall (T1562.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Crypto Subject Interface Package (SIP) Provider Informational Evasion

    Malicious modification of crypto subject interface package (SIP) provider Registry keys can be leveraged to trick the OS into incorrectly validating invalid signing certificates. May have legitimate uses, but check for malicious activity.

    Indicator:

    Registry action type = all AND registry key name = *SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\* , *SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\* , *\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\* , *\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\* Process initiator path != *\microsoft office\root\integration\integrator.exe AND cgo path != *\microsoft office\root\integration\integrator.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: SIP and Trust Provider Hijacking (T1553.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Windows Defender configuration Informational Tampering

    Commands used to bypass, disable or harm Windows Defender.

    Indicator:

    Process action type = execution AND target process name = net.exe , powershell.exe , reg.exe , cmd.exe AND target process cmd = *windefend* , *DisableRealtimeMonitoring* , *stop*Windows Defender*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Windows Event Log auto-backup via Registry Informational Tampering

    This key enables/disables the automatic backups of event logs when they are full.

    Indicator:

    Registry action type = all AND registry key name = *\services\eventlog\* AND registry value name = autobackuplogfiles Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Connection Manager Profile Installer loads a file from the users to temporary folder Low Evasion

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Process action type = execution AND target process cmd = *temp* , *users* AND target process name = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Connection Manager Profile Installer makes connections to the network Low Dropper

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Network action type = outgoing , failed Process initiated by = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Connection Manager Profile Installer runs command line or PowerShell Low Execution

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , cmd.exe Process initiated by = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft HTML Application Host spawns from CMD or PowerShell Informational Execution

    Microsoft HTML Application Host is a program whose source code consists of HTML, Dynamic HTML and a few scripting languages compatible with Internet Explorer such as VBScript or JScript. It does not typically spawn from PowerShell or CMD.

    Indicator:

    Process action type = execution AND target process name = mshta.exe Process initiated by = cmd.exe , powershell.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Mshta (T1218.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft HTML Application Host spawns from Explorer.exe Informational Evasion

    Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host.

    Indicator:

    Process action type = execution AND target process name = mshta.exe Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of Windows boot configuration using bcdedit.exe Informational Tampering

    BCDEdit is a Microsoft Windows utility that can modify boot parameters. It is usually used as part of an attack to prevent repair of the affected system by disabling booting in recovery mode. It can also be used to stop Windows' Patchguard from objecting to the unsigned and insecure nature of a driver being loaded.

    Indicator:

    Process action type = execution AND target process cmd = *set* AND target process name = bcdedit.exe

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Rootkit (T1014) Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Netsh.exe modifies allowed firewall port/program lists Informational Evasion

    Malware will often modify local firewall settings to permit untrusted software to communicate with the Internet for C2. Check for malicious use.

    Indicator:

    Process action type = execution AND target process cmd = *allowedprogram* , *portopening* AND target process name = netsh.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • New certificate added to the trusted root store Informational Evasion

    Untrusted certificates could be used to install untrusted drivers and malicious code.

    Indicator:

    Process action type = execution AND target process cmd = *addstore*root* AND target process name = certutil.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: Install Root Certificate (T1553.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Notepad process makes a network connection Low Exfiltration

    Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.

    Indicator:

    Network action type = incoming , outgoing , failed Process os parent name = notepad.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Permissive file privileges were granted Informational Evasion

    Setting readable, writable, and executable permissions for all users may pose a major security risk.

    Indicator:

    Process action type = execution AND target process cmd = *chmod*777* , *chmod*a+*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: File and Directory Permissions Modification (T1222)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Ping executed with loopback address Informational Evasion

    This seemingly strange "wait" mechanism is often used by malware to stall command execution.

    Indicator:

    Process action type = execution AND target process cmd = *127.0.0.1* , *localhost* AND target process name = ping.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Ping to a known external IP address Informational Evasion

    Pinging a known external IP address is often used by malware to check internet connectivity.

    Indicator:

    Process action type = execution AND target process name = ping.exe , ping AND target process cmd = *8.8.8.8* , *8.8.4.4* , *9.9.9.9* , *149.112.112.112* , *208.67.222.222* , *208.67.220.220* , *1.1.1.1* , *1.0.0.1* , *185.228.168.9* , *185.228.169.9* , *64.6.64.6* , *64.6.65.6* , *198.101.242.72* , *23.253.163.53* , *176.103.130.130* , *176.103.130.131* Process cgo name != cmd.exe AND thorium.exe AND 4nt.exe AND cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND cgo signer != BeyondTrust Software Inc AND HP Inc. Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible log destruction using the dd command Informational Tampering

    Possible destruction of system log files using the dd command.

    Indicator:

    File action type = rename , write , create AND file path = /var/log/* Process initiated by = dd , cgo name = dd , os parent name = dd AND initiator cmd = *of=/var/log/* , cgo cmd = *of=/var/log/* , os parent cmd = *of=/var/log/* Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell is used to execute a CPL file Informational Evasion

    Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = * control.exe *.cpl*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell is used to modify a timestamp Informational Evasion

    Attackers may use PowerShell.exe to modify the timestamp of a file.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *.creationtime*=*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Timestomp (T1070.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Process attempts to kill a known security/AV tool Medium Evasion

    This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = * nwscmon.exe* , * fortisslvpndaemon.exe* , * bullguardbhvscanner.exe* , * rawshark.exe* , * fcdblog.exe* , * bullguard.exe* , * adawaredesktop.exe* , * consctlx.exe* , * sastask.exe* , * scanwscs.exe* , * k7tsecurity.exe* , * filwscc.exe* , * littlehook.exe* , * bullguarscanner.exe* , * nvcod.exe* , * ptwatchdog.exe* , * mbamservice.exe* , * unthreat.exe* , * twsscan.exe* , * schmgr.exe* , * escanmon.exe* , * uiwinmgr.exe* , * bgscan.exe* , * forticlient_diagnostic_tool.exe* , * nnf.exe* , * v3sp.exe* , * sdwelcome.exe* , * clamtray.exe* , * nvoy.exe* , * sbpimsvc.exe* , * v3main.exe* , * fcappdb.exe* , * mergecap.exe* , * mwaser.exe* , * bavtray.exe* , * filup.exe* , * v3up.exe* , * avktray.exe* , * msmpeng.exe* , * onlinent.exe* , * avpmapp.exe* , * taskmgr.exe* , * k7fwsrvc.exe* , * clamscan.exe* , * ptsessionagent.exe* , * nissrv.exe* , * v3proxy.exe* , * mbam.exe* , * webcompanion.exe* , * k7tsmngr.exe* , * mcshieldrtm.exe* , * fprottray.exe* , * fortifw.exe* , * procexp64.exe* , * avkwctlx64.exe* , * opssvc.exe* , * superantispyware.exe* , * escanpro.exe* , * nprosec.exe* , * quamgr.exe* , * bullguardupdate.exe* , * avkproxy.exe* , * psuaservice.exe* , * k7pssrvc.exe* , * acs.exe* , * clamwin.exe* , * fortitray.exe* , * k7crvsvc.exe* , * bavupdater.exe* , * certreg.exe* , * fpavserver.exe* , * filmsg.exe* , * k7sysmon.exe* , * econser.exe* , * zlh.exe* , * uiupdatetray.exe* , * fshoster32.exe* , * psview.exe* , * sapissvc.exe* , * quamgr.exe* , * k7rtscan.exe* , * schmgr.exe* , * fsma32.exe* , * zlhh.exe* , * k7fwsrvc.exe* , * twssrv.exe* , * nanoav.exe* , * fpwin.exe* , * useraccountcontrolsettings.exe* , * freshclam.exe* , * wireshark.exe* , * ns.exe* , * coreframeworkhost.exe* , * sbamtray.exe* , * scproxysrv.exe* , * viewtcp.exe* , * sdfssvc.exe* , * fshdll64.exe* , * avkservice.exe* , * nfservice.exe* , * utsvc.exe* , * traysser.exe* , * nvcsvc.exe* , * sdscan.exe* , * ptsvchost.exe* , * k7sysmon.exe* , * procexp.exe* , * mpuxsrv.exe* , * quhlpsvc.exe* , * superdelete.exe* , * guardxservice.exe* , * msascui.exe* , * mcshieldds.exe* , * k7tsmain.exe* , * trigger.exe* , * econceal.exe* , * fsgk32.exe* , * adawareservice.exe* , * mbamscheduler.exe* , * mcs-uninstall.exe* , * fortiesnac.exe* , * k7avscan.exe* , * nbrowser.exe* , * nseupdatesvc.exe* , * guardxkickoff_x64.exe* , * bavhm.exe* , * cistray.exe* , * agentsvc.exe* , * adawaretray.exe* , * av_task.exe* , * njeeves2.exe* , * coreserviceshell.exe* , * k7tsmain.exe* , * uiwatchdog.exe* , * freshclamwrap.exe* , * k7avscan.exe* , * psuamain.exe* , * sdtray.exe* , * gdscan.exe* , * mcshieldccc.exe* , * cmdagent.exe* , * dragon_updater.exe* , * cis.exe* , * forticlient.exe* , * sascore64.exe* , * bav.exe* , * ssupdate64.exe* , * scanner.exe* , * v3svc.exe* , * bavsvc.exe* , * psanhost.exe* , * gdbginx64.exe* , * k7emlpxy.exe* , * gdsc.exe* , * avk.exe* , * text2pcap.exe* , * fssm32.exe* , * userreg.exe* , * iptray.exe* , * emlproxy.exe* , * processhacker.exe* , * k7tsmngr.exe* , * filwscc.exe* , * mpcmdrun.exe* , * k7emlpxy.exe* , * virusutilities.exe* , * k7tsecurity.exe* , * fchelper64.exe* , * k7crvsvc.exe* , * capinfos.exe* , * v3medic.exe* , * fsm32.exe* , * k7pssrvc.exe* , * fmon.exe* , * gdkbfl.exe* , * op_mon.exe* , * vipreui.exe* , * uiseagnt.exe* , * zanda.exe* , * cavwp.exe* , * bdssvc.exe* , * nanosvc.exe* , * mwagent.exe* , * k7rtscan.exe* , * editcap.exe* , * bavwebclient.exe* , * fsorsp.exe* , * scsecsvc.exe* , * fortiproxy.exe* , * configsecuritypolicy.exe* , * trayicos.exe* , * sbamsvc.exe* , * cyserver.exe* AND target process name = taskkill.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Process runs from the recycle bin Low Evasion

    Process running from the recycle bin.

    Indicator:

    Process action type = execution AND target process path = *:\$recycle.bin\* Process cgo name != ECSSoftwareAutoUpdater.exe AND ECSManager.exe AND Sapstartsrv.exe AND ECSMonitor.exe AND ECSPlayer.exe AND Chrome.exe AND cgo path != *Microsoft VS Code* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Pubprn.vbs signed script proxy execution High Execution

    Pubprn.vbs is a standard script that is installed with Windows that can be abused to run malicious scripts. This behavior may bypass signature validation restrictions and application whitelisting solutions.

    Indicator:

    Process action type = execution AND target process cmd = *pubprn.vbs*script:*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution: PubPrn (T1216.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Regsvr32 may have run code from an untrusted source High Execution

    Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host.

    Indicator:

    Process action type = execution AND target process cmd = * /i:*http* , * /i*scrobj.dll* AND target process name = regsvr32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Regsvr32 (T1218.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Root certificate installed Informational Evasion

    Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

    Indicator:

    Registry registry key name = *\Software\Microsoft\SystemCertificates*\root\* , *\Software\Microsoft\SystemCertificates*\authroot\* , *\Software\Microsoft\SystemCertificates*\certificationauthority\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\root\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\authroot\* , *\Software\Microsoft\Cryptography\Services\ServiceName\SystemCertificates*\certificationauthority\* , *\Software\Policy\Microsoft\SystemCertificates*\root\* , *\Software\Policy\Microsoft\SystemCertificates*\authroot\* , *\Software\Policy\Microsoft\SystemCertificates*\certificationauthority\* , *\Software\Microsoft\EnterpriseCertificates*\root\* , *\Software\Microsoft\EnterpriseCertificates*\authroot\* , *\Software\Microsoft\EnterpriseCertificates*\certificationauthority\* AND registry key name != *disallowed* AND *protectedroots AND *certificates AND *crls* AND *ctls AND *autoupdate* AND *appcontainer* AND action type = create_registry_key Process initiated by != svchost.exe AND aexnsagent.exe AND dgwip.exe AND consent.exe AND inteltechnologyaccessservice.exe AND ecagent.exe AND loadstate.exe AND avp.exe AND setupplatform.exe AND cgo name != svchost.exe AND aexnsagent.exe AND dgwip.exe AND consent.exe AND inteltechnologyaccessservice.exe AND ecagent.exe AND loadstate.exe AND avp.exe AND setupplatform.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: Install Root Certificate (T1553.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Root certificate installed Informational Evasion

    Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

    Indicator:

    Process action type = execution AND target process cmd = *add-trusted-cert* , *update-ca-certificates* , *update-ca-trust*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Subvert Trust Controls: Install Root Certificate (T1553.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32 loads a known abused DLL Informational Execution

    Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application.

    Indicator:

    Process action type = execution AND target process cmd != *control_rundll*cscui.dll* AND *control_rundll*srchadmin.dll* AND *control_rundll*keymgr.dll* AND *control_rundll*input.dll* AND *fileprotocolhandler*.zip* AND *fileprotocolhandler*.htm* AND *fileprotocolhandler*.png* AND *fileprotocolhandler*.pdf* AND *fileprotocolhandler*.dbk* AND target process cmd = *advpack.dll*registerocx*.dll* , *advpack.dll*registerocx*.exe* , *ieadvpack.dll*launchinfsection*.inf* , *ieframe.dll*openurl*.url* , *Mshtml.dll*printhtml*.hta* , *pcwutl.dll*launchapplication*.exe* , *setupapi.dll*installhinfsection*defaultInstall*.inf* , *shdocvw.dll*openurl*.url , *shell32.dll*control_rundll*.dll* , *shell32.dll*shellexec_rundll*.exe* , *syssetup.dll*setupinfobjectinstallaction*.inf* , *url.dll*openurl*.hta* , *url.dll*openurl*.url* , *url.dll*openurl*file* , *url.dll*fileprotocolhandler*.hta* , *url.dll*fileprotocolhandler*.url* , *url.dll*fileprotocolhandler*file:* , *zipfldr.dll*routethecall*.exe* , *zipfldr.dll*routethecall*file:* AND target process name = rundll32.exe Process initiated by != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe AND cgo name != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe AND os parent name != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32.exe launches an executable using ordinal numbers argument Medium Evasion

    Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection.

    Indicator:

    Process action type = execution AND target process cmd =~ dll.*?#[-+]?[0-9]+.*?\.exe AND target process name = rundll32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Rundll32.exe was used to run JavaScript Medium Execution

    Attackers may execute malicious JavaScript code (either remotely or locally) using rundll32.exe.

    Indicator:

    Process action type = execution AND target process cmd = * javascript:* AND target process name = rundll32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Script Proxy Execution (T1216)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32.exe with 'main' as EntryPoint Medium Execution

    Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs.

    Indicator:

    Process action type = execution AND target process cmd =~ rundll32.*dll[\s]*,[\s]*main

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SELinux was set to permissive mode Informational Tampering

    SELinux was set to permissive mode using the "setenforce 0" command.

    Indicator:

    Process action type = execution AND target process cmd =~ .*\s+0($|\s+.*) AND target process name = setenforce Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scripting engine creates an Alternate Data Stream (ADS) Informational Evasion

    Malware may hide data inside alternate data streams instead of inside a file.

    Indicator:

    File action type = create , delete AND file name = *:* Process initiated by = wscript.exe , cscript.exe , cmd.exe , powershell.exe , mshta.exe , psw.exe , python.exe , java.exe , javaw.exe , regsvr32.exe , expand.exe , lua.exe , ruby.exe , cgo name = wscript.exe , cscript.exe , cmd.exe , powershell.exe , mshta.exe , psw.exe , python.exe , java.exe , javaw.exe , regsvr32.exe , expand.exe , lua.exe , ruby.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Security services stopped Informational Tampering

    Attackers may stop security critical services to avoid possible detection of their activities.

    Indicator:

    Process action type = execution AND target process name = service , systemctl AND target process cmd = *stop*iptables* , *iptables*stop* , *firewalld*stop* , *stop*firewalld* , *stop*rsyslog* , *rsyslog*stop* , *stop*cbdaemon* , *cbdaemon*stop* , *disable*rsyslog* , *rsyslog*disable* , *stop*falcon-sensor* , *falcon-sensor*stop* , *falcon-sensor*disable* , *disable*falcon-sensor* Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell binary copied to another location Informational Tampering

    Attackers may try to evade detection by copying the shell binary to an innocent-looking name.

    Indicator:

    Process action type = execution AND target process cmd =~ /bin/(ba|z|fi|tc|c|k)?sh AND target process name = cp

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SmartScreen disabled via Registry Informational Evasion

    These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality.

    Indicator:

    Registry os actor process signature vendor != Bromium, Inc. AND registry data = 0 AND registry value name = EnableSmartScreen AND action type = set_registry_value Process initiator path != *windows defender* AND cgo path != *windows defender* AND os parent path != *windows defender* AND initiated by != svchost.exe AND ccmexec.exe AND mmc.exe AND cgo name != svchost.exe AND ccmexec.exe AND mmc.exe AND os parent name != svchost.exe AND ccmexec.exe AND mmc.exe AND initiator signer != Bromium, Inc. AND cgo signer != Bromium, Inc. AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , os parent signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Space after filename creation Informational Evasion

    An attacker may append a space to the end of a filename to change how it's processed by the operating system.

    Indicator:

    File action type = create , rename AND file name =~ \.[a-z]+\s+ Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading: Space after Filename (T1036.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious .NET process spawns csc.exe Low Evasion

    A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).

    Indicator:

    Process action type = execution AND target process name = csc.exe Process initiated by != ieexec.exe AND msbuild.exe AND aspnet_compiler.exe AND servicemodelreg.exe AND webdev.webserver.exe AND installutil.exe AND microsoft.workflow.compiler.exe AND regasm.exe AND initiator path = *windows\microsoft.net* AND cgo name != werfault.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious AMSI DLL load location Low Evasion

    An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

    Indicator:

    Image Load module path != *windows\system32* AND *windows\syswow64* AND *windows\winSxS* AND *kaspersky lab* AND module path = *\amsi.dll Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious DLL load using Control.exe Medium Execution

    This execution mechanism is known to be used by malware to load malicious DLLs.

    Indicator:

    Process action type = execution AND target process cmd != *Shell32.dll* AND target process name = rundll32.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process os parent name = control.exe Host host os != linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011) System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious executable created in a .NET directory High Evasion

    Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe.

    Indicator:

    File file path = *windows\microsoft.net*.exe AND action type = create Process initiated by = cmd.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution (T1127)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious process spawns MSBuild.exe Medium Execution

    The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.

    Indicator:

    Process action type = execution AND target process name = msbuild.exe Process initiated by = explorer.exe , wmiprvse.exe , wscript.exe , cscript.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious usage of cytool.exe Informational Evasion

    The Cortex XDR agent can be controlled by a command-line tool named cytool.exe. Attackers may use it to disable the Cortex XDR agent.

    Indicator:

    Process action type = execution AND target process name = cytool.exe , cytool Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != *palo alto networks* AND cgo signer != *palo alto networks* AND initiator cmd != *zzzzInvokeManagedCustomActionOutOfProc* AND cgo cmd != *zzzzInvokeManagedCustomActionOutOfProc* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SyncAppvPublishingServer used to run PowerShell code Informational Evasion

    SyncAppvPublishingServer is part of Microsoft Application Virtualization (App-V), which may be used by an attacker to run PowerShell code.

    Indicator:

    Process action type = execution AND target process name = SyncAppvPublishingServer.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution (T1218)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with Windows Control Panel configuration Informational Evasion

    DLLs with .cpl suffix are executed when accessing the Control Panel. Malicious code may run this way even if AppLocker enabled.

    Indicator:

    Registry action type = all AND registry key name = *software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with Windows certificate blocking configuration Informational Evasion

    Adding subkeys of the certificates to block disallows a security vendor's certificate on the affected computer, so that Windows would not allow the program to run.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with the Windows System Restore configuration Low Tampering

    System Restore was disabled on the endpoint. In such a case, one may not be able to recover files in case of disaster. This may be initiated by the IT department, but also may indicate malicious activity such as ransomware.

    Indicator:

    Registry action type = set_registry_value , create_registry_key , delete_registry_value AND registry data = 1 AND registry key name = *Software\Microsoft\Windows Nt\SystemRestore\DisableSR Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Rootkit (T1014) Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • The scripting engine executed code from an Alternate Data Stream (ADS) Informational Evasion

    Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file.

    Indicator:

    Process action type = execution AND target process name = rundll32.exe , mavinject.exe , forfiles.exe , wscript.exe , cscript.exe , mshta.exe , control.exe , sc.exe , regedit.exe , bitsadmin.exe , appvlp.exe , cmd.exe , ftp.exe , bash.exe , regsvr32.exe , regini.exe AND target process cmd =~ :[A-Za-z0-9]{1,}\.(exe|dll|vbs|js|hta|reg|bat|txt|sh|ini|ps1) Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process creates an Alternate Data Stream (ADS) Informational Evasion

    Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS.

    Indicator:

    File file name = *:* AND action type = create Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process injects code into a process Informational Execution

    An unsigned process injected code into a process. This can be done to leverage a legitimate running process for an attack.

    Indicator:

    Process action type = injection Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash AND initiator path != *\program files* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unsigned process running from a temporary directory Informational Evasion

    Malware often runs from a temporary folder.

    Indicator:

    Process action type = execution AND process execution signature = N/A , Unsigned , Invalid Signature AND target process path = *temp* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Usage of tracing tool Informational Evasion

    An attacker may be trying to use a known tracing tool to gather information from other processes.

    Indicator:

    Process action type = execution AND target process name = strace , xtrace , dtrace , ltrace , ftrace , truss , sysdig , systemtap

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • User account flagged as hidden Informational Evasion

    Look for unsigned processes that add an entry to the hidden users Registry key.

    Indicator:

    Registry action type = all AND registry data = 0 AND registry key name = *SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Valid Accounts (T1078)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WMI terminated a process Informational Execution

    The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = *process*where*call terminate AND target process name = wmic.exe Process initiated by != msiexec.exe , cgo name != msiexec.exe

    ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WSL Feature Installation Informational Evasion

    Detecting installation of Windows Subsystem for Linux feature.

    Indicator:

    File file name = *.vhdx.gz AND file path = *_microsoft-windows-lxss-vm-mode_* AND action type = create Process initiated by = TiWorker.exe , cgo name = TiWorker.exe , os parent name = TiWorker.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indirect Command Execution (T1202)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WerFault ReflectDebugger key set in Registry Medium Execution

    The WerFault.exe signed Windows process may be tricked into running a malicious executable by setting the ReflectDebugger key in the Registry.

    Indicator:

    Registry action type = create_registry_key , delete_registry_key , rename_registry_key , set_registry_value AND registry value name = *reflectdebugger* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution (T1218)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows 10 Developer Mode enabled Informational Evasion

    Enabling developer mode allows for app sideloading and starts the Windows SSH services, which may be used to install Linux Bash on Windows.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = 1 AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution (T1127)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11