BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0007 ✕ technique: T1083 ✕

Download CSV Show ATT&CK heatmap
  • Document discovery Informational Discovery

    Attackers may use the find command to look for documents.

    Indicator:

    Process action type = execution AND target process cmd = *.pdf* , *.doc* , *.ppt* , *.xls* AND target process name = find

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: File and Directory Discovery (T1083)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Reading the contents of /etc/mtab or /etc/fstab Informational Discovery

    File read on /etc/mtab or /etc/fstab using the cat utility.

    Indicator:

    Process action type = execution AND target process cmd = */etc/mtab* , */etc/fstab* AND target process name = cat Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: File and Directory Discovery (T1083)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23