BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

4 BIOCs match the current filters. tactic: TA0005 ✕ technique: T1055 ✕

Download CSV Show ATT&CK heatmap
  • Injection into ping.exe Informational Evasion

    A process injected into an instance of ping.exe.

    Indicator:

    Process action type = injection AND remote process name = ping.exe Process cgo name != csrss.exe AND wmiprvse.exe AND vmstoold.exe AND ctskmstr.exe AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Sentinel Labs, Inc. AND Dell inc. AND cgo signature = Weak Hash , Invalid Signature , N/A , Unsigned , Signed AND cgo signer != Sentinel Labs, Inc. AND Dell inc. AND initiated by != ctskmstr.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Notepad process makes a network connection Low Exfiltration

    Notepad.exe processes should not normally make network connections (with the occasional exception of printing documents). This can be a possible indicator of exploitation, e.g. Metasploit Meterpreter injection.

    Indicator:

    Network action type = incoming , outgoing , failed Process os parent name = notepad.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unsigned process injects code into a process Informational Execution

    An unsigned process injected code into a process. This can be done to leverage a legitimate running process for an attack.

    Indicator:

    Process action type = injection Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash AND initiator path != *\program files* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Usage of tracing tool Informational Evasion

    An attacker may be trying to use a known tracing tool to gather information from other processes.

    Indicator:

    Process action type = execution AND target process name = strace , xtrace , dtrace , ltrace , ftrace , truss , sysdig , systemtap

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Process Injection (T1055)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11