BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

18 BIOCs match the current filters. tactic: TA0009 ✕

Download CSV Show ATT&CK heatmap
  • 7z.exe execution with password protection parameters Informational Collection

    7z.exe was executed with parameters indicating password protection of the output file.

    Indicator:

    Process action type = execution AND target process cmd = *-p* AND target process name = 7z.exe Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Built-in SoundRecorder tool capturing audio Informational Collection

    SoundRecorder is a built-in voice recording tool. Besides benign usage, it may be used to discreetly record a user.

    Indicator:

    Process action type = execution AND os actor process signature vendor != Zscaler, Inc. AND JAL Information Technology Co.,Ltd. AND LIGHTSPEED SYSTEMS, INC. AND Ivanti, Inc. AND Lightspeed Systems (Lightspeed Solutions, LLC.) AND target process cmd = *soundrecorder* Process initiated by != sihost.exe AND svchost.exe AND explorer.exe AND nssm.exe AND cgo name != sihost.exe AND svchost.exe AND explorer.exe AND nssm.exe AND os parent name != sihost.exe AND svchost.exe AND explorer.exe AND nssm.exe AND initiator signature = Unsigned , Signed , Invalid Signature , Weak Hash , cgo signature = Unsigned , Signed , Invalid Signature , Weak Hash , os parent signature = Unsigned , Signed , Invalid Signature , Weak Hash AND initiator signer != Zscaler, Inc. AND JAL Information Technology Co.,Ltd. AND LIGHTSPEED SYSTEMS, INC. AND Ivanti, Inc. AND Lightspeed Systems (Lightspeed Solutions, LLC.) AND cgo signer != Zscaler, Inc. AND JAL Information Technology Co.,Ltd. AND LIGHTSPEED SYSTEMS, INC. AND Ivanti, Inc. AND Lightspeed Systems (Lightspeed Solutions, LLC.) Host host os != linux

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Audio Capture (T1123)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Collecting audio via PowerShell command Low Collection

    An attacker may collect audio from the microphone using PowerShell.

    Indicator:

    Process action type = execution AND target process cmd = *Get-DefaultAudioDevice* , *Get-AudioDeviceList* , *Set-DefaultAudioDevice* , *Set-DefaultAudioDevice* , *Set-DefaultAudioDevice* , *Set-DefaultAudioDeviceVolume* , *Get-DefaultAudioDeviceVolume* , *Set-DefaultAudioDeviceMute* , *Write-DefaultAudioDeviceValue* AND target process name = powershell.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Audio Capture (T1123)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Command-line creation of a RAR archive Informational Exfiltration

    Compression of data into a RAR archive using the rar.exe utility.

    Indicator:

    Process action type = execution AND target process cmd = * a * AND target process name = rar.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data (T1560)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Compressed archive created using tar Informational Collection

    Attackers may use the tar built-in tool to stage a file for exfiltration.

    Indicator:

    Process action type = execution AND target process cmd = *-cvzf* AND target process name = tar

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data (T1560)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Encrypted zip archive creation Informational Collection

    Attackers may stage information for exfiltration by encrypting it beforehand in a zip archive.

    Indicator:

    Process action type = execution AND target process cmd = * -p* , * -e* , * --password* , * --encrypt* AND target process name = zip Host host os = macos , linux

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Forensics Driver Loaded Informational Collection XQL

    A forensics driver has been loaded.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE_PRELOAD","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_vendor","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_product","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: Automated Collection (T1119) OS Credential Dumping (T1003)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • PowerShell script executed from a temporary directory Informational Collection

    An attacker may try to avoid detection by executing a PowerShell script from a temporary directory.

    Indicator:

    Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.*-(enc|EncodedCommand|ec|en) [A-Za-z0-9]{5,}=|[windowstyle^ ]{1,12}?hidden|(noni|noninteractive)|n(oprofile|op)|e[xecutionpolicy]{1,15} (bypass|unrestricted|hidden)|(eq|noexit)).* AND target process cmd !=~ .*(embedding|comment|wdenable|EnableService|-energy -auto|NetworkDiagnosticsPNI).* Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Rar.exe execution with password protection parameters Informational Collection

    Rar.exe was executed with parameters indicating password protection of the output file.

    Indicator:

    Process action type = execution AND target process cmd = *-hp* , *-p* AND target process name = rar.exe Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Screen capture via command-line tool Informational Collection

    Attackers may use the window system screen capture tool to collect screenshots.

    Indicator:

    Process action type = execution AND target process name = xwd , xwud , import AND target process cmd = *-root* , *-in* , *-out* , *-window*

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Screen Capture (T1113)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Scripting engine creates a compressed file under a suspicious folder Informational Collection

    Attackers may compress data before exfiltrating it to reduce network bandwidth consumption; if a compressed file is placed in a suspicious folder, it may be due to malicious activity.

    Indicator:

    File file name = *.rar , *.7z , *.tar , *.gz , *.zip , *.zz , *.s7z , *.cab AND file path = *users\*\appdata\* , *\programdata* , *$recycle.bin* , *\temp\* AND action type = create Process initiated by = powershell.exe , wscript.exe , cscript.exe , mshta.exe , regsvr32.exe , cgo name = powershell.exe , wscript.exe , cscript.exe , mshta.exe , regsvr32.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged (T1074)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scripting process reads Outlook data files Informational Collection

    Attackers may try to retrieve email data and sensitive information from .ost and .pst files.

    Indicator:

    File file name = *.ost , *.pst AND action type = read Process initiated by = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe , cgo name = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Email Collection (T1114)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    File action type = read , rename , delete , write AND file name = .zsh_history , .bash_history , .sh_history

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    Process action type = execution AND target process name = cat , nano , vim AND target process cmd =~ .*(?:zsh_history|bash_history|sh_history).*

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WinPmem Forensics Tool Informational Collection XQL

    The WinPmem Forensics Tool has been run.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"AND":[{"LEFT":"$action_process_signature_vendor","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_signature_product","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"winpmem.exe","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) Automated Collection (T1119)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Windows hosts file written to Informational Collection

    Check for hosts file redirection, overriding the system's default hosts file to manipulate DNS.

    Indicator:

    File file name = hosts AND file path = *:\Windows\System32\drivers\etc\* AND action type = write

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data from Information Repositories (T1213)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Wscript / Cscript executed from a temporary directory Informational Collection

    An attacker may try to avoid detection by executing wscript/cscript scripts from a temporary directory.

    Indicator:

    Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.* [\/]{1,2}([bisx] |[eh]:(.script|.*script)?|job:|t:\d{1,5})).* Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Wzzip.exe execution with password protection parameters Informational Collection

    Wzzip.exe was executed with parameters indicating password protection of the output file.

    Indicator:

    Process action type = execution AND target process cmd = *-s* AND target process name = wzzip.exe Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Archive Collected Data: Archive via Utility (T1560.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23