BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

48 BIOCs match the current filters. tactic: TA0007 ✕

Download CSV Show ATT&CK heatmap
  • ADFind queries Active Directory for Exchange groups Informational Discovery

    A process executed with ADFind parameters and used to extract data on built-in groups for the Exchange server (e.g. "Organization Management").

    Indicator:

    Process action type = execution AND target process cmd =~ .*default.*Organization Management.*objectcategory=\*.* AND target process name != adfind.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Permission Groups Discovery: Domain Groups (T1069.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Active directory enumeration using built-in nltest.exe Informational Discovery

    Nltest.exe is a command-line tool used for network administrative tasks, and can be used to gather information about domain controllers and users.

    Indicator:

    Process action type = execution AND target process name = nltest.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Domain Trust Discovery (T1482)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Container enumeration Informational Discovery

    An attacker may run a command to enumerate containers on a machine.

    Indicator:

    Process action type = execution AND target process name = docker , lxc , rkt AND target process cmd =~ ls(\s+|$)|list(\s+|$)

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • DNS reconnaissance or enumeration via DNSRecon Medium Discovery

    DNSRecon enables DNS reconnaissance and enumeration, and may be used by attackers to learn about targets' network infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *dnsrecon.py* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Document discovery Informational Discovery

    Attackers may use the find command to look for documents.

    Indicator:

    Process action type = execution AND target process cmd = *.pdf* , *.doc* , *.ppt* , *.xls* AND target process name = find

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: File and Directory Discovery (T1083)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration command called by commonly abused CGO Informational Discovery

    Some malware uses these commands for reconnaissance.

    Indicator:

    Process action type = execution AND target process name = net.exe , ping.exe , whoami.exe , arp.exe , nslookup.exe , hostname.exe , ipconfig.exe , systeminfo.exe Process cgo name = cscript.exe , wscript.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087) Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration of Windows services from public IP addresses Informational Discovery

    Attackers may enumerate internet-facing services which use Windows protocols; as these services were not meant to be exposed to the internet, they may be attacked by enumerating users, brute-forcing passwords and through exploits.

    Indicator:

    Network Connections Source Local IP != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* AND 239.* Destination Remote Port = 445 , 139 , 135 , 138 , 137 AND app id contains *,ms-* AND protocol = tcp

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Network Service Discovery (T1046)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration of installed AV or FW products using WMIC Informational Discovery

    Attackers often check for the existence of security tools before launching an attack, and this is one of the methods that can be used.

    Indicator:

    Process action type = execution AND target process cmd = *AntiVirusProduct* , *FirewallProduct* AND target process name = wmic.exe , cmd.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Software Discovery: Security Software Discovery (T1518.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Enumeration of services via WMIC Informational Discovery

    Attackers may enumerate existing services using wmic.exe.

    Indicator:

    Process action type = execution AND target process cmd = * service * , * win32_service * AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: System Service Discovery (T1007) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Evasion using time-based properties Informational Evasion

    Attackers may check Event Log to evade virtualized environments.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *get-winevent*6005*

    ATT&CK tactics: Defense Evasion (TA0005) Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion: Time Based Checks (T1497.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Execution of Fsociety tool pack Medium Discovery

    The Fsociety tool pack is an array of tools for information gathering, password attacks, exploitation, and more.

    Indicator:

    Process action type = execution AND target process cmd = *fsociety.py* , target process name = fsociety Host host os = linux

    ATT&CK tactics: Discovery (TA0007) Credential Access (TA0006)
    ATT&CK techniques: Network Service Discovery (T1046) Brute Force (T1110)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Group policy discovery using gpresult.exe Informational Discovery

    Attackers may use gpresult.exe to gather information on Group Policy settings.

    Indicator:

    Process action type = execution AND target process cmd = */r* AND target process name = gpresult.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Group Policy Discovery (T1615)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Installation of networking security tools Informational Discovery

    A security or penetration testing tool such as wireshark and nmap is being installed.

    Indicator:

    Process action type = execution AND target process name = *Wireshark-* , *WiresharkPortable* , *WinPcap_* , *nmap*setup* , *NPFInstall.exe*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Service Discovery (T1046)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Interface enumeration using netsh Informational Discovery

    Attackers may enumerate existing network interfaces using netsh.exe.

    Indicator:

    Process action type = execution AND target process cmd = *netsh* interface* show*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Linux network share discovery Informational Discovery XQL

    A Linux network share discovery command was executed.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"df","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":".*((-aH)|(-a.*-H)|(-H.*-a)|(-Ha)).*","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"smbutil","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"view","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-g","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"showmount","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Mounted NFS share discovery Informational Discovery

    Attackers may use the showmount command to list mount Network File Sharing shares.

    Indicator:

    Process action type = execution AND target process name = showmount

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Network Packet Capture: tshark/tcpdump Informational Discovery

    Network packet capture using tshark\tcpdump utility.

    Indicator:

    Process action type = execution AND target process name = tcpdump , tshark Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Sniffing (T1040)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Network scanning tool executed Informational Discovery

    This rule looks for the string nmap in the command line, which indicates that the nmap scanning tool is used to scan a network or a machine.

    Indicator:

    Process action type = execution AND target process cmd = *nmap*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Network share discovery via command-line tool Low Discovery

    Attackers may use command-line tools to discover mapped shares on the host.

    Indicator:

    Process action type = execution AND target process name = df , smbutil AND target process cmd = *view -g* , *-aH

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Password complexity enumeration Informational Discovery

    Attackers may read system files containing password complexity requirements.

    Indicator:

    Process action type = execution AND target process cmd = */etc/login.defs* , */etc/pam.d/common-password* , */etc/security/pwquality.conf* , */etc/pam.d/system-auth* AND target process name = grep , head , tail , less , cat Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Password Policy Discovery (T1201)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Password policy discovery via command-line tool Informational Discovery

    Attackers may use chage to list the password policy and the user's last access time.

    Indicator:

    Process action type = execution AND target process cmd = *-l* AND target process name = chage

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Password Policy Discovery (T1201)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Permission groups discovery via ldapsearch Informational Discovery

    Attackers may use the ldapsearch command-line tool to gather information about domain groups and their permissions.

    Indicator:

    Process action type = execution AND target process cmd =~ objectClass|=\*|objectCategory|servicePrincipalName|adminCount|samAccountType AND target process name = ldapsearch Process cgo name != adclient Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Permission Groups Discovery (T1069)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible ARP reconnaissance Informational Discovery

    The ARP binary could be used for network mapping (common with malware).

    Indicator:

    Process action type = execution AND target process name = arp.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible ARP reconnaissance via netdiscover Informational Discovery

    Netdiscover is an active/passive ARP reconnaissance tool, which attackers may use to learn your network.

    Indicator:

    Process action type = execution AND target process name = netdiscover Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible Firefox browser history and bookmarks collection via command-line tool Medium Discovery

    Attackers may collect history and bookmarks details by accessing the Firefox database.

    Indicator:

    Process action type = execution AND target process cmd = *.mozilla/firefox/*/places.sqlite

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Browser Information Discovery (T1217)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible Oracle enumeration via Oscanner Low Discovery

    The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.

    Indicator:

    Process action type = execution AND target process name = oscanner* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible Oracle enumeration via tnscmd10g Low Discovery

    The tnscmd10g command-line utility was executed, allowing the enumeration of Oracle DBs.

    Indicator:

    Process action type = execution AND target process name = tnscmd10g* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Service Discovery (T1046)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible ping sweep Medium Discovery

    Ping sweeps are useful tools that can detect which machines are up in the network and can be the step before lateral movement.

    Indicator:

    Process action type = execution AND target process cmd = *for*254 * ping *%* , *for*254)* ping *%* , *for*254* ping.exe *%* , *for*254)* ping.exe *%*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible user enumeration via /etc/passwd Informational Discovery

    Attackers may enumerate users by reading the /etc/passwd file.

    Indicator:

    Process action type = execution AND target process cmd = */etc/passwd*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible user enumeration via finger Informational Discovery

    The Linux 'finger' command performs user enumeration, which attackers may attempt to gather during the reconnaissance phase.

    Indicator:

    Process action type = execution AND target process name = finger Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Potential Network Sniffing Informational Credential Access

    Network sniffing related processes were detected.

    Indicator:

    Process action type = execution AND target process name = wireshark , tcpdump

    ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)
    ATT&CK techniques: Network Sniffing (T1040)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell dumps users and roles from Exchange server Medium Discovery

    PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign).

    Indicator:

    Process action type = execution AND target process cmd =~ .*PSConsoleFile.*(Get-ManagementRoleAssignment|GetEffectiveUsers).*(Name|Role|EffectiveUserName|AssignmentMethod|IsValid).* AND target process name = powershell.exe Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery: Email Account (T1087.003) Permission Groups Discovery: Domain Groups (T1069.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Query startup programs using wmic.exe Informational Discovery

    Attackers may use wmic.exe to query programs that run automatically when users log onto the computer system.

    Indicator:

    Process action type = execution AND target process cmd = *startup* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Reading the contents of /etc/mtab or /etc/fstab Informational Discovery

    File read on /etc/mtab or /etc/fstab using the cat utility.

    Indicator:

    Process action type = execution AND target process cmd = */etc/mtab* , */etc/fstab* AND target process name = cat Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: File and Directory Discovery (T1083)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Remote system discovery Informational Reconnaissance XQL

    Remote system discovery using a system utility.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"arp","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-a","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ping","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-c","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"iwconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • SMB enumeration via command-line tool Informational Discovery

    Attackers may use SMB enumeration to retrieve information about network shares, printers, and other resources.

    Indicator:

    Process action type = execution AND target process name = nmblookup , rpcclient , smbclient , nbtscan Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Shared resource management discovery using wmic.exe Informational Discovery

    Attackers may use wmic.exe to discover shared resource management information.

    Indicator:

    Process action type = execution AND target process cmd = *share*get*/all* AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: Windows Management Instrumentation (T1047) System Information Discovery (T1082)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SharpHound LDAP query Medium Discovery

    SharpHound is a BloodHound ingestor that performs LDAP queries to enumerate Active Directory.

    Indicator:

    Event Log event log raw data = *(samaccounttype=268435456)(samaccounttype=268435457)(samaccounttype=536870912)(samaccounttype=536870913)(primarygroupid=*))(&(sAMAccountType=805306369)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)*(samAccountType=805306368)(samAccountType=805306369)(samAccountType=268435456)(samAccountType=268435457)(samAccountType=536870912)(samAccountType=536870913)(objectClass=domain)(&(objectcategory=groupPolicyContainer)(flags=*))(objectcategory=organizationalUnit))(objectclass=domain)*(samaccounttype=268435456)(samaccounttype=268435457)(samaccounttype=536870912)(samaccounttype=536870913)(samaccounttype=805306368)(samaccounttype=805306369)(objectclass=domain)(objectclass=organizationalUnit)(&(objectcategory=groupPolicyContainer)(flags=*)))*(objectcategory=groupPolicyContainer)(flags=*))(name=*)(gpcfilesyspath=*))(objectcategory=organizationalUnit)(objectClass=domain))(&(samaccounttype=805306368)(serviceprincipalname=*)* AND event log id = 30 Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Sudoers discovery Informational Discovery

    Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges.

    Indicator:

    Process action type = execution AND target process cmd = */etc/sudoers* , *sudo *-l* , *sudo *--list* Process initiator cmd != *chef* AND *puppet* AND *salt-minion* AND cgo cmd != *chef* AND *puppet* AND *salt-minion* AND initiated by != chef-client AND BESClient AND crod AND crond AND cgo name != chef-client AND BESClient AND crod AND crond

    ATT&CK tactics: Discovery (TA0007) Privilege Escalation (TA0004)
    ATT&CK techniques: Account Discovery (T1087) Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious access to /etc/shadow Informational Discovery

    Attackers may enumerate or modify user accounts by accessing the /etc/shadow file.

    Indicator:

    File action type = all AND file path = /etc/shadow Process initiated by = python* , initiated by = cat , ruby , perl , cgo name = python* , cgo name = cat , ruby , perl AND initiated by != cron AND crond AND splunkd AND cgo name != cron AND crond AND splunkd

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • System information discovery Informational Discovery

    System information discovery using one of these bash utilities - lshw -short, uptime, uname -a.

    Indicator:

    Process action type = execution AND target process name = lshw , uptime , uname AND target process cmd = *-a* , *-short* , *uptime* Process initiated by =~ (ba|z|fi|tc|c|k)?sh , cgo name =~ (ba|z|fi|tc|c|k)?sh , os parent name =~ (ba|z|fi|tc|c|k)?sh Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Information Discovery (T1082)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • System network configuration discovery Informational Discovery XQL

    System network configuration discovery using Linux command-line utilities.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"arp","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-a","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ip","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"OR":[{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"addr","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ifconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"netstat","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":"netstat\\s(\\s*-\\w*[rnat]+\\s?)+","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-n","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$actor_process_image_name","OPERATOR":"REGEX","RIGHT":"(ba|z|fi|tc|c|k)?sh","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • System owner/user discovery Informational Discovery

    System owner/user discovery using bash utilities.

    Indicator:

    Process action type = execution AND target process name = whoami , users , w , who Process initiated by =~ (ba|z|fi|tc|c|k)?sh , cgo name =~ (ba|z|fi|tc|c|k)?sh , os parent name =~ (ba|z|fi|tc|c|k)?sh Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Owner/User Discovery (T1033)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • UDP protocol scanner execution Low Discovery

    The UDP Protocol Scanner performs UDP service discovery. Attackers may use it to enumerate UDP services in their target's environment.

    Indicator:

    Process action type = execution AND target process cmd = *udp-proto-scanner.pl* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Service Discovery (T1046)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VMware enumeration attempt Informational Discovery

    An attacker may check for virtualization by searching for local vmx (VMware configuration) files.

    Indicator:

    Process action type = execution AND target process cmd =~ (find|locate).*\.vmx

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Virtual Directory configuration access via PowerShell Medium Discovery

    PowerShell was used to dump Exchange Web Service (EWS) Virtual Directories, which may indicate malicious behavior, for example, SolarStorm campaign.

    Indicator:

    Process action type = execution AND target process cmd =~ .*PSConsoleFile.*Get-WebServicesVirtualDirectory.* AND target process name = powershell.exe Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Service Discovery (T1007)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VirtualBox enumeration Informational Discovery

    VBoxManage can be used to enumerate local VirtualBox machines.

    Indicator:

    Process action type = execution AND target process cmd =~ list\s+ AND target process name = vboxmanage

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Write to /etc/hosts file Informational Discovery

    An attacker may add an entry to the hosts file, so they can route traffic to the added IP.

    Indicator:

    File file path = /etc/hosts AND action type = write

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11