BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0007 ✕ technique: T1217 ✕

Download CSV Show ATT&CK heatmap
  • Possible Firefox browser history and bookmarks collection via command-line tool Medium Discovery

    Attackers may collect history and bookmarks details by accessing the Firefox database.

    Indicator:

    Process action type = execution AND target process cmd = *.mozilla/firefox/*/places.sqlite

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Browser Information Discovery (T1217)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11