BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0009 ✕ technique: T1056 ✕

Download CSV Show ATT&CK heatmap
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    File action type = read , rename , delete , write AND file name = .zsh_history , .bash_history , .sh_history

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell History Access Informational Credential Access

    Access to files holding shell history information.

    Indicator:

    Process action type = execution AND target process name = cat , nano , vim AND target process cmd =~ .*(?:zsh_history|bash_history|sh_history).*

    ATT&CK tactics: Credential Access (TA0006) Collection (TA0009)
    ATT&CK techniques: Input Capture: Keylogging (T1056.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23