BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0008 ✕ technique: T1570 ✕

Download CSV Show ATT&CK heatmap
  • Remote file copy Informational Lateral Movement

    Remote copy operation of a file using rsync or scp or sftp.

    Indicator:

    Process action type = execution AND target process name = rsync , scp , sftp Host host os = linux , macos

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Lateral Tool Transfer (T1570)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23