BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0007 ✕ technique: T1518 ✕

Download CSV Show ATT&CK heatmap
  • Enumeration of installed AV or FW products using WMIC Informational Discovery

    Attackers often check for the existence of security tools before launching an attack, and this is one of the methods that can be used.

    Indicator:

    Process action type = execution AND target process cmd = *AntiVirusProduct* , *FirewallProduct* AND target process name = wmic.exe , cmd.exe

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Software Discovery: Security Software Discovery (T1518.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11