BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

6 BIOCs match the current filters. tactic: TA0007 ✕ technique: T1016 ✕

Download CSV Show ATT&CK heatmap
  • DNS reconnaissance or enumeration via DNSRecon Medium Discovery

    DNSRecon enables DNS reconnaissance and enumeration, and may be used by attackers to learn about targets' network infrastructure.

    Indicator:

    Process action type = execution AND target process cmd = *dnsrecon.py* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Enumeration command called by commonly abused CGO Informational Discovery

    Some malware uses these commands for reconnaissance.

    Indicator:

    Process action type = execution AND target process name = net.exe , ping.exe , whoami.exe , arp.exe , nslookup.exe , hostname.exe , ipconfig.exe , systeminfo.exe Process cgo name = cscript.exe , wscript.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087) Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Interface enumeration using netsh Informational Discovery

    Attackers may enumerate existing network interfaces using netsh.exe.

    Indicator:

    Process action type = execution AND target process cmd = *netsh* interface* show*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible ARP reconnaissance Informational Discovery

    The ARP binary could be used for network mapping (common with malware).

    Indicator:

    Process action type = execution AND target process name = arp.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible ARP reconnaissance via netdiscover Informational Discovery

    Netdiscover is an active/passive ARP reconnaissance tool, which attackers may use to learn your network.

    Indicator:

    Process action type = execution AND target process name = netdiscover Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • System network configuration discovery Informational Discovery XQL

    System network configuration discovery using Linux command-line utilities.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"arp","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-a","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ip","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"OR":[{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"addr","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ifconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"netstat","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":"netstat\\s(\\s*-\\w*[rnat]+\\s?)+","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-n","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$actor_process_image_name","OPERATOR":"REGEX","RIGHT":"(ba|z|fi|tc|c|k)?sh","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Network Configuration Discovery (T1016)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17