BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

3 BIOCs match the current filters. tactic: TA0007 ✕ technique: T1069 ✕

Download CSV Show ATT&CK heatmap
  • ADFind queries Active Directory for Exchange groups Informational Discovery

    A process executed with ADFind parameters and used to extract data on built-in groups for the Exchange server (e.g. "Organization Management").

    Indicator:

    Process action type = execution AND target process cmd =~ .*default.*Organization Management.*objectcategory=\*.* AND target process name != adfind.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Permission Groups Discovery: Domain Groups (T1069.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Permission groups discovery via ldapsearch Informational Discovery

    Attackers may use the ldapsearch command-line tool to gather information about domain groups and their permissions.

    Indicator:

    Process action type = execution AND target process cmd =~ objectClass|=\*|objectCategory|servicePrincipalName|adminCount|samAccountType AND target process name = ldapsearch Process cgo name != adclient Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Permission Groups Discovery (T1069)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell dumps users and roles from Exchange server Medium Discovery

    PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign).

    Indicator:

    Process action type = execution AND target process cmd =~ .*PSConsoleFile.*(Get-ManagementRoleAssignment|GetEffectiveUsers).*(Name|Role|EffectiveUserName|AssignmentMethod|IsValid).* AND target process name = powershell.exe Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery: Email Account (T1087.003) Permission Groups Discovery: Domain Groups (T1069.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23