BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

3 BIOCs match the current filters. tactic: TA0009 ✕ technique: T1074 ✕

Download CSV Show ATT&CK heatmap
  • PowerShell script executed from a temporary directory Informational Collection

    An attacker may try to avoid detection by executing a PowerShell script from a temporary directory.

    Indicator:

    Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.*-(enc|EncodedCommand|ec|en) [A-Za-z0-9]{5,}=|[windowstyle^ ]{1,12}?hidden|(noni|noninteractive)|n(oprofile|op)|e[xecutionpolicy]{1,15} (bypass|unrestricted|hidden)|(eq|noexit)).* AND target process cmd !=~ .*(embedding|comment|wdenable|EnableService|-energy -auto|NetworkDiagnosticsPNI).* Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scripting engine creates a compressed file under a suspicious folder Informational Collection

    Attackers may compress data before exfiltrating it to reduce network bandwidth consumption; if a compressed file is placed in a suspicious folder, it may be due to malicious activity.

    Indicator:

    File file name = *.rar , *.7z , *.tar , *.gz , *.zip , *.zz , *.s7z , *.cab AND file path = *users\*\appdata\* , *\programdata* , *$recycle.bin* , *\temp\* AND action type = create Process initiated by = powershell.exe , wscript.exe , cscript.exe , mshta.exe , regsvr32.exe , cgo name = powershell.exe , wscript.exe , cscript.exe , mshta.exe , regsvr32.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged (T1074)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Wscript / Cscript executed from a temporary directory Informational Collection

    An attacker may try to avoid detection by executing wscript/cscript scripts from a temporary directory.

    Indicator:

    Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.* [\/]{1,2}([bisx] |[eh]:(.script|.*script)?|job:|t:\d{1,5})).* Host host os = windows

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23