BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

9 BIOCs match the current filters. tactic: TA0006 ✕ technique: T1555 ✕

Download CSV Show ATT&CK heatmap
  • Credentials from Web Browsers Informational Credential Access

    Detects attempt to copy browser files to acquire credentials.

    Indicator:

    Process action type = execution AND target process cmd =~ .*[/]Application Support[/](Island|Google)([/]Chrome[/]Default|[/]Chrome[/]User Data[/]Default)?[/].*Login Data.* AND target process name = cp

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Keychain Certificate Access Informational Credential Access

    Detected access to Keychain certificates.

    Indicator:

    Process action type = execution AND target process cmd =~ .*find-certificate.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Keychain (T1555.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Keychain Import Item Informational Credential Access

    An item was imported from the Keychain.

    Indicator:

    Process action type = execution AND target process cmd =~ .*import.*[.]pem.*(-k)?.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Keychain (T1555.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Keychain Unlock Informational Credential Access

    Detected Keychain unlocking.

    Indicator:

    Process action type = execution AND target process cmd =~ .*unlock-keychain.* AND target process name = security

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Securityd Memory (T1555.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Password-related Mozilla files were read by a non-Mozilla process Informational Credential Access

    Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

    Indicator:

    File file path = *\mozilla\firefox\* , *\netgate technologies\blackhawk\* , *\8pecxstudios\cyberfox\* , *\comodo\icedragon\* , *\k-meleon\* , *\mozilla\icecat\* AND file name = *.sqlite , *.db , *.json AND action type = read Process initiated by != firefox.exe AND blackhawk.exe AND cyberfox.exe AND icedragon.exe AND k-meleon.exe AND icecat

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process accessed a Thunderbird Mail profiles folder Informational Credential Access

    An attacker may access the Thunderbird Mail profiles folder to extract users' credentials.

    Indicator:

    File action type = all AND file path = *\appdata\*thunderbird\profile* Process initiator signature = Unsigned , cgo signature = Unsigned , os parent signature = Unsigned AND initiator path != *Program Files* AND cgo path != *Program Files* AND os parent path != *Program Files* Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores (T1555)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process accessed a credential locker file Informational Credential Access

    The credential manager stores credentials for logging in to websites, applications and devices in encrypted Windows Vault Credential Files which can be accessed and decrypted by an attacker.

    Indicator:

    File action type = all AND file path = *.vcrd , *policy.vpol Process initiator signature = Unsigned , cgo signature = Unsigned , os parent signature = Unsigned Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Windows Credential Manager (T1555.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process reads Chromium credentials file Informational Credential Access

    Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

    Indicator:

    File file path = *\users\*\appdata\local\7star\7star\user data\* , *\users\*\appdata\local\amigo\user data\* , *\users\*\appdata\local\bravesoftware\brave-browser\user data\* , *\users\*\appdata\local\centbrowser\user data\* , *\users\*\appdata\local\chedot\user data\* , *\users\*\appdata\local\google chrome sxs\user data\* , *\users\*\appdata\local\chromium\user data\* , *\users\*\appdata\local\coccoc\browser\user data\* , *\users\*\appdata\local\elements browser\user data\* , *\users\*\appdata\local\epic privacy browser\user data\* , *\users\*\appdata\local\google\chrome\user data\* , *\users\*\appdata\local\kometa\user data\* , *\users\*\appdata\local\orbitum\user data\* , *\users\*\appdata\local\sputnik\sputnik\user data\* , *\users\*\appdata\local\torch\user data\* , *\users\*\appdata\local\ucozmedia\uran\user data\* , *\users\*\appdata\local\vivaldi\user data\* , *\users\*\appdata\local\yandex\yandexbrowser\user data\* , *\users\*\appdata\local\microsoft\edge\user data\* AND file name = *login data AND action type = read Process initiated by != chrome.exe AND chromedriver.exe AND amigo.exe AND brave.exe AND centbrowser.exe AND chedot.exe AND browser.exe AND epic.exe AND kometa.exe AND orbitum.exe AND torch.exe AND uran.exe AND vivaldi.exe AND msedge.exe AND cgo name != svchost.exe AND system AND cgo signature = Unsigned , Invalid Signature AND initiator signature = Unsigned , Invalid Signature Host host os != linux AND host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Web browser cookie and credential access Informational Credential Access

    Detect attempt to acquire cookies or credentials from a Safari browser.

    Indicator:

    Process action type = execution AND target process cmd =~ .*(Cookies.binarycookies|[/]Safari[/]LocalStorage[/]).* AND target process name = grep

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23