BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

4 BIOCs match the current filters. tactic: TA0005 ✕ technique: T1127 ✕

Download CSV Show ATT&CK heatmap
  • MSBuild execution Informational Evasion

    Attackers may use MSBuild.exe to proxy execution of code through a trusted Windows utility.

    Indicator:

    Process action type = execution AND target process name = msbuild.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious executable created in a .NET directory High Evasion

    Cmd.exe created an executable file in the Microsoft .NET directory. This behavior is exhibited in the PowerLessShell tool to disguise MSBuild.exe.

    Indicator:

    File file path = *windows\microsoft.net*.exe AND action type = create Process initiated by = cmd.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution (T1127)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious process spawns MSBuild.exe Medium Execution

    The Microsoft Build Engine was started by an abnormal process. MSBuild is normally used for development purposes, so this unusual behavior may be malicious.

    Indicator:

    Process action type = execution AND target process name = msbuild.exe Process initiated by = explorer.exe , wmiprvse.exe , wscript.exe , cscript.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution: MSBuild (T1127.001) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows 10 Developer Mode enabled Informational Evasion

    Enabling developer mode allows for app sideloading and starts the Windows SSH services, which may be used to install Linux Bash on Windows.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = 1 AND registry key name = *SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Trusted Developer Utilities Proxy Execution (T1127)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11