BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

8 BIOCs match the current filters. tactic: TA0007 ✕ technique: T1018 ✕

Download CSV Show ATT&CK heatmap
  • Active directory enumeration using built-in nltest.exe Informational Discovery

    Nltest.exe is a command-line tool used for network administrative tasks, and can be used to gather information about domain controllers and users.

    Indicator:

    Process action type = execution AND target process name = nltest.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Domain Trust Discovery (T1482)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Enumeration command called by commonly abused CGO Informational Discovery

    Some malware uses these commands for reconnaissance.

    Indicator:

    Process action type = execution AND target process name = net.exe , ping.exe , whoami.exe , arp.exe , nslookup.exe , hostname.exe , ipconfig.exe , systeminfo.exe Process cgo name = cscript.exe , wscript.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087) Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration of Windows services from public IP addresses Informational Discovery

    Attackers may enumerate internet-facing services which use Windows protocols; as these services were not meant to be exposed to the internet, they may be attacked by enumerating users, brute-forcing passwords and through exploits.

    Indicator:

    Network Connections Source Local IP != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* AND 239.* Destination Remote Port = 445 , 139 , 135 , 138 , 137 AND app id contains *,ms-* AND protocol = tcp

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Network Service Discovery (T1046)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Network scanning tool executed Informational Discovery

    This rule looks for the string nmap in the command line, which indicates that the nmap scanning tool is used to scan a network or a machine.

    Indicator:

    Process action type = execution AND target process cmd = *nmap*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible ARP reconnaissance Informational Discovery

    The ARP binary could be used for network mapping (common with malware).

    Indicator:

    Process action type = execution AND target process name = arp.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible ping sweep Medium Discovery

    Ping sweeps are useful tools that can detect which machines are up in the network and can be the step before lateral movement.

    Indicator:

    Process action type = execution AND target process cmd = *for*254 * ping *%* , *for*254)* ping *%* , *for*254* ping.exe *%* , *for*254)* ping.exe *%*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Remote system discovery Informational Reconnaissance XQL

    Remote system discovery using a system utility.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"arp","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-a","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ping","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-c","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"iwconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Write to /etc/hosts file Informational Discovery

    An attacker may add an entry to the hosts file, so they can route traffic to the added IP.

    Indicator:

    File file path = /etc/hosts AND action type = write

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11