BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0005 ✕ technique: T1202 ✕

Download CSV Show ATT&CK heatmap
  • Execution of WSL Distro Informational Evasion

    Detecting a new instance execution of Windows Subsystem for Linux distro.

    Indicator:

    File file path = *\drivers\etc\hosts AND action type = read Process initiated by = wsl.exe AND os parent cmd = *LxssManager AND os parent name = svchost.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indirect Command Execution (T1202)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WSL Feature Installation Informational Evasion

    Detecting installation of Windows Subsystem for Linux feature.

    Indicator:

    File file name = *.vhdx.gz AND file path = *_microsoft-windows-lxss-vm-mode_* AND action type = create Process initiated by = TiWorker.exe , cgo name = TiWorker.exe , os parent name = TiWorker.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indirect Command Execution (T1202)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23