BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

4 BIOCs match the current filters. tactic: TA0006 ✕ technique: T1056 ✕

Download CSV Show ATT&CK heatmap
  • GUI Input Capture Informational Credential Access

    Prompt user to supply a password in response to a System Preference dialog pop up message.

    Indicator:

    Process action type = execution AND target process cmd =~ .*-e[[:blank:]]+tell app \"System Preferences\" to activate.*tell app \"System Preferences\" to display dialog.*[[:blank:]]+return.*answer.* AND target process name = osascript

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Input Capture: GUI Input Capture (T1056.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Internet Explorer home page modification Low Tampering

    The Internet Explorer home page could be changed to a malicious page.

    Indicator:

    Registry action type = all AND registry key name = *\Software\Microsoft\Internet Explorer\Main\* AND registry value name = *Start Page* Process initiated by != iexplore.exe AND cgo name != iexplore.exe Host host os = windows

    ATT&CK tactics: Impact (TA0040) Credential Access (TA0006)
    ATT&CK techniques: Defacement (T1491) Input Capture: GUI Input Capture (T1056.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    File action type = read , rename , delete , write AND file name = .zsh_history , .bash_history , .sh_history

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    Process action type = execution AND target process name = cat , nano , vim AND target process cmd =~ .*(?:zsh_history|bash_history|sh_history).*

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23