BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0007 ✕ technique: T1482 ✕

Download CSV Show ATT&CK heatmap
  • Active directory enumeration using built-in nltest.exe Informational Discovery

    Nltest.exe is a command-line tool used for network administrative tasks, and can be used to gather information about domain controllers and users.

    Indicator:

    Process action type = execution AND target process name = nltest.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Remote System Discovery (T1018) Account Discovery (T1087) Domain Trust Discovery (T1482)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11