BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

8 BIOCs match the current filters. tactic: TA0006 ✕ technique: T1552 ✕

Download CSV Show ATT&CK heatmap
  • Cleartext password harvesting using find tools Informational Credential Access

    On Windows, the find and findstr tools can be used to find content in files on disk. This rule is looking for cases where the find command is looking for the string 'password', which indicates an attempt to find passwords.

    Indicator:

    Process action type = execution AND target process name = find.exe , findstr.exe AND target process cmd = *password*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Grepping for passwords Informational Credential Access

    Attackers may look for cleartext passwords in files using the grep command.

    Indicator:

    Process action type = execution AND target process cmd = *pass* AND target process name = grep

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Key Certificate Search And Exfiltrate Informational Credential Access

    Possible attempt to search for key certificates and exfiltrate them.

    Indicator:

    Process action type = execution AND target process cmd =~ .*(id_rsa|[.]key|[.]pgp|[.]gpg|[.]ppk|[.]p12|[.]pem|[.]pfx|[.]cer|[.]p7b|[.]asc).*-exec[[:blank:]]+cp[[:blank:]]+.* AND target process name = find

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • LOLBAS reading a Windows credential manager file Informational Credential Access

    Encrypted files under the path AppData\Roaming\Microsoft\Credentials are associated with saved passwords in the Windows system.

    Indicator:

    File file path = *\appdata\roaming\microsoft\credentials\* AND action type = read Process initiated by = regsvcs.exe , schtasks.exe , xwizard.exe , findstr.exe , esentutl.exe , reg.exe , csc.exe , atbroker.exe , print.exe , pcwrun.exe , rpcping.exe , wsreset.exe , replace.exe , mshta.exe , bitsadmin.exe , ieexec.exe , cmd.exe , microsoft.workflow.compiler.exe , runscripthelper.exe , makecab.exe , forfiles.exe , control.exe , msbuild.exe , register-cimprovider.exe , ie4uinit.exe , sc.exe , bash.exe , hh.exe , jsc.exe , scriptrunner.exe , odbcconf.exe , extexport.exe , msdt.exe , diskshadow.exe , extrac32.exe , eventvwr.exe , mavinject.exe , regasm.exe , gpscript.exe , rundll32.exe , regsvr32.exe , regedit.exe , msiexec.exe , presentationhost.exe , wmic.exe , runonce.exe , syncappvpublishingserver.exe , verclsid.exe , infdefaultinstall.exe , expand.exe , installutil.exe , wab.exe , dnscmd.exe , at.exe , pcalua.exe , msconfig.exe , powershell.exe , powershell_ise.exe , python.exe , certutil.exe , cmstp.exe , wscript.exe , cscript.exe , perl.exe , ruby.exe AND cgo name != amazonassistantservice.exe AND venm.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials In Files (T1552.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Reading .ssh files Informational Credential Access

    Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers.

    Indicator:

    Process action type = execution AND target process cmd = * .ssh , * .ssh * , * .ssh/* , */.ssh * , */.ssh/* AND target process name = cat , grep AND target process cmd != *grep -c* Process initiated by != ssh-copy-id AND rkhunter AND cgo name != nessus-service AND sshd AND electron AND sshd-keygen-wrapper AND ir_agent AND bbedit

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Registry credentials extraction Informational Credential Access

    Attackers may extract credentials from the Registry using system commands.

    Indicator:

    Process action type = execution AND target process cmd = * query* password* AND target process name = reg.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Credentials in Registry (T1552.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SSH key pair discovery Informational Credential Access

    Attackers may look for SSH key pairs using the find command.

    Indicator:

    Process action type = execution AND target process name = find , cat AND target process cmd =~ .*(id_dsa|id_rsa|[.]key|[.]pgp|[.]gpg|[.]ppk|[.]p12|[.]pem|[.]pfx|[.]cer|[.]p7b|[.]asc).*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell history access Informational Credential Access

    Attackers may search historical commands for credentials and information gathering.

    Indicator:

    Process action type = execution AND target process name = cat , grep AND target process cmd =~ .*\.(ba|z|fi|tc|c|k)?sh_history* Host host os = linux , macos

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials: Shell History (T1552.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23