BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

10 BIOCs match the current filters. tactic: TA0007 ✕ technique: T1087 ✕

Download CSV Show ATT&CK heatmap
  • Active directory enumeration using built-in nltest.exe Informational Discovery

    Nltest.exe is a command-line tool used for network administrative tasks, and can be used to gather information about domain controllers and users.

    Indicator:

    Process action type = execution AND target process name = nltest.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Domain Trust Discovery (T1482)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Enumeration command called by commonly abused CGO Informational Discovery

    Some malware uses these commands for reconnaissance.

    Indicator:

    Process action type = execution AND target process name = net.exe , ping.exe , whoami.exe , arp.exe , nslookup.exe , hostname.exe , ipconfig.exe , systeminfo.exe Process cgo name = cscript.exe , wscript.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087) Remote System Discovery (T1018) System Network Configuration Discovery (T1016)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Enumeration of Windows services from public IP addresses Informational Discovery

    Attackers may enumerate internet-facing services which use Windows protocols; as these services were not meant to be exposed to the internet, they may be attacked by enumerating users, brute-forcing passwords and through exploits.

    Indicator:

    Network Connections Source Local IP != 10.* AND 172.16.* AND 172.17.* AND 172.18.* AND 172.19.* AND 172.20.* AND 172.21.* AND 172.22.* AND 172.23.* AND 172.24.* AND 172.25.* AND 172.26.* AND 172.27.* AND 172.28.* AND 172.29.* AND 172.30.* AND 172.31.* AND 192.168.* AND 127.* AND 169.254.* AND 239.* Destination Remote Port = 445 , 139 , 135 , 138 , 137 AND app id contains *,ms-* AND protocol = tcp

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Network Service Discovery (T1046)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible Oracle enumeration via Oscanner Low Discovery

    The Oscanner Oracle framework performs enumeration of SIDs, account roles, privileges, hashes, and more. Attackers may attempt to gather this information during the reconnaissance phase.

    Indicator:

    Process action type = execution AND target process name = oscanner* Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible user enumeration via /etc/passwd Informational Discovery

    Attackers may enumerate users by reading the /etc/passwd file.

    Indicator:

    Process action type = execution AND target process cmd = */etc/passwd*

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible user enumeration via finger Informational Discovery

    The Linux 'finger' command performs user enumeration, which attackers may attempt to gather during the reconnaissance phase.

    Indicator:

    Process action type = execution AND target process name = finger Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell dumps users and roles from Exchange server Medium Discovery

    PowerShell is used to dump users and roles from Exchange servers, this may indicate malicious behavior (e.g. the SolarStorm campaign).

    Indicator:

    Process action type = execution AND target process cmd =~ .*PSConsoleFile.*(Get-ManagementRoleAssignment|GetEffectiveUsers).*(Name|Role|EffectiveUserName|AssignmentMethod|IsValid).* AND target process name = powershell.exe Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery: Email Account (T1087.003) Permission Groups Discovery: Domain Groups (T1069.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SharpHound LDAP query Medium Discovery

    SharpHound is a BloodHound ingestor that performs LDAP queries to enumerate Active Directory.

    Indicator:

    Event Log event log raw data = *(samaccounttype=268435456)(samaccounttype=268435457)(samaccounttype=536870912)(samaccounttype=536870913)(primarygroupid=*))(&(sAMAccountType=805306369)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)*(samAccountType=805306368)(samAccountType=805306369)(samAccountType=268435456)(samAccountType=268435457)(samAccountType=536870912)(samAccountType=536870913)(objectClass=domain)(&(objectcategory=groupPolicyContainer)(flags=*))(objectcategory=organizationalUnit))(objectclass=domain)*(samaccounttype=268435456)(samaccounttype=268435457)(samaccounttype=536870912)(samaccounttype=536870913)(samaccounttype=805306368)(samaccounttype=805306369)(objectclass=domain)(objectclass=organizationalUnit)(&(objectcategory=groupPolicyContainer)(flags=*)))*(objectcategory=groupPolicyContainer)(flags=*))(name=*)(gpcfilesyspath=*))(objectcategory=organizationalUnit)(objectClass=domain))(&(samaccounttype=805306368)(serviceprincipalname=*)* AND event log id = 30 Host host os = windows

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Sudoers discovery Informational Discovery

    Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges.

    Indicator:

    Process action type = execution AND target process cmd = */etc/sudoers* , *sudo *-l* , *sudo *--list* Process initiator cmd != *chef* AND *puppet* AND *salt-minion* AND cgo cmd != *chef* AND *puppet* AND *salt-minion* AND initiated by != chef-client AND BESClient AND crod AND crond AND cgo name != chef-client AND BESClient AND crod AND crond

    ATT&CK tactics: Discovery (TA0007) Privilege Escalation (TA0004)
    ATT&CK techniques: Account Discovery (T1087) Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious access to /etc/shadow Informational Discovery

    Attackers may enumerate or modify user accounts by accessing the /etc/shadow file.

    Indicator:

    File action type = all AND file path = /etc/shadow Process initiated by = python* , initiated by = cat , ruby , perl , cgo name = python* , cgo name = cat , ruby , perl AND initiated by != cron AND crond AND splunkd AND cgo name != cron AND crond AND splunkd

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23