BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0011 ✕ technique: T1090 ✕

Download CSV Show ATT&CK heatmap
  • Socat/Netcat connects to TOR domain Medium Evasion

    Unlikely behavior in standard systems.

    Indicator:

    Network action type = incoming , outgoing , failed Process initiated by = socat.exe , nc.exe , cryptcat.exe AND initiator cmd = *onion*

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Proxy: Multi-hop Proxy (T1090.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23