BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity
Category
  • Container enumeration Informational Discovery

    An attacker may run a command to enumerate containers on a machine.

    Indicator:

    Process action type = execution AND target process name = docker , lxc , rkt AND target process cmd =~ ls(\s+|$)|list(\s+|$)

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Evasion using time-based properties Informational Evasion

    Attackers may check Event Log to evade virtualized environments.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *get-winevent*6005*

    ATT&CK tactics: Defense Evasion (TA0005) Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion: Time Based Checks (T1497.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VMware enumeration attempt Informational Discovery

    An attacker may check for virtualization by searching for local vmx (VMware configuration) files.

    Indicator:

    Process action type = execution AND target process cmd =~ (find|locate).*\.vmx

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VirtualBox enumeration Informational Discovery

    VBoxManage can be used to enumerate local VirtualBox machines.

    Indicator:

    Process action type = execution AND target process cmd =~ list\s+ AND target process name = vboxmanage

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23