BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0006 ✕ technique: T1119 ✕

Download CSV Show ATT&CK heatmap
  • Forensics Driver Loaded Informational Collection XQL

    A forensics driver has been loaded.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE_PRELOAD","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_vendor","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_product","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: Automated Collection (T1119) OS Credential Dumping (T1003)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • WinPmem Forensics Tool Informational Collection XQL

    The WinPmem Forensics Tool has been run.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"AND":[{"LEFT":"$action_process_signature_vendor","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_signature_product","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"winpmem.exe","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) Automated Collection (T1119)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17