BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0010 ✕ technique: T1020 ✕

Download CSV Show ATT&CK heatmap
  • Commonly abused AutoIT script connects to a remote host Low Exfiltration

    AutoIT scripts have legitimate uses, but are often abused by malware to execute in a signed process context.

    Indicator:

    Network action type = outgoing , failed Process initiator signature = Signed , Weak Hash AND initiator signer = Autoit* AND Autoit* Host host os = windows

    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Automated Exfiltration (T1020)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11