BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

3 BIOCs match the current filters. tactic: TA0005 ✕ technique: T1027 ✕

Download CSV Show ATT&CK heatmap
  • Compiler process started by an Office process Informational Evasion

    The processes (csc.exe & vbc.exe) invoke compilers via command prompt and compile a payload on the fly. This is leveraged by attackers to create a new payload on every machine.

    Indicator:

    Process action type = execution AND target process name = csc.exe , vbc.exe Process initiated by = excel.exe , powerpnt.exe , winword.exe , outlook.exe , cgo name = excel.exe , powerpnt.exe , winword.exe , outlook.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious .NET process spawns csc.exe Low Evasion

    A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).

    Indicator:

    Process action type = execution AND target process name = csc.exe Process initiated by != ieexec.exe AND msbuild.exe AND aspnet_compiler.exe AND servicemodelreg.exe AND webdev.webserver.exe AND installutil.exe AND microsoft.workflow.compiler.exe AND regasm.exe AND initiator path = *windows\microsoft.net* AND cgo name != werfault.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious process spawns MSBuild.exe Medium Execution

    The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.

    Indicator:

    Process action type = execution AND target process name = msbuild.exe Process initiated by = explorer.exe , wmiprvse.exe , wscript.exe , cscript.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11