BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0007 ✕ technique: T1007 ✕

Download CSV Show ATT&CK heatmap
  • Enumeration of services via WMIC Informational Discovery

    Attackers may enumerate existing services using wmic.exe.

    Indicator:

    Process action type = execution AND target process cmd = * service * , * win32_service * AND target process name = wmic.exe

    ATT&CK tactics: Discovery (TA0007) Execution (TA0002)
    ATT&CK techniques: System Service Discovery (T1007) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Virtual Directory configuration access via PowerShell Medium Discovery

    PowerShell was used to dump Exchange Web Service (EWS) Virtual Directories, which may indicate malicious behavior, for example, SolarStorm campaign.

    Indicator:

    Process action type = execution AND target process cmd =~ .*PSConsoleFile.*Get-WebServicesVirtualDirectory.* AND target process name = powershell.exe Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Service Discovery (T1007)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23