BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0005 ✕ technique: T1574 ✕

Download CSV Show ATT&CK heatmap
  • DLL sideloading attack using Xwizard Low Evasion

    Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.

    Indicator:

    Process action type = execution AND target process path != *\windows\system32\xwizard.exe AND *\windows\syswow64\xwizard.exe AND *\windows\winsxs\ AND target process name = xwizard.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious AMSI DLL load location Low Evasion

    An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

    Indicator:

    Image Load module path != *windows\system32* AND *windows\syswow64* AND *windows\winSxS* AND *kaspersky lab* AND module path = *\amsi.dll Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23