BIOCs
Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.
4 BIOCs match the current filters. tactic: TA0007 ✕ technique: T1497 ✕
Download CSV Show ATT&CK heatmapContainer enumeration Informational Discovery
An attacker may run a command to enumerate containers on a machine.
Indicator:Process action type = execution AND target process name = docker , lxc , rkt AND target process cmd =~ ls(\s+|$)|list(\s+|$)
ATT&CK tactics: Discovery (TA0007)ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)- Preventable:
- Yes
- Source:
- Palo Alto Networks
- Updated:
- 2026-08-23
Evasion using time-based properties Informational Evasion
Attackers may check Event Log to evade virtualized environments.
Indicator:Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *get-winevent*6005*
ATT&CK tactics: Defense Evasion (TA0005) Discovery (TA0007)ATT&CK techniques: Virtualization/Sandbox Evasion: Time Based Checks (T1497.003)- Preventable:
- Yes
- Source:
- Palo Alto Networks
- Updated:
- 2026-08-23
VMware enumeration attempt Informational Discovery
An attacker may check for virtualization by searching for local vmx (VMware configuration) files.
Indicator:Process action type = execution AND target process cmd =~ (find|locate).*\.vmx
ATT&CK tactics: Discovery (TA0007)ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)- Preventable:
- Yes
- Source:
- Palo Alto Networks
- Updated:
- 2026-08-23
VirtualBox enumeration Informational Discovery
VBoxManage can be used to enumerate local VirtualBox machines.
Indicator:Process action type = execution AND target process cmd =~ list\s+ AND target process name = vboxmanage
ATT&CK tactics: Discovery (TA0007)ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)- Preventable:
- Yes
- Source:
- Palo Alto Networks
- Updated:
- 2026-08-23