BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0011 ✕ technique: T1132 ✕

Download CSV Show ATT&CK heatmap
  • Base64 encoding used Informational Collection

    Attackers may use the base64 built-in binary to encode data into base64.

    Indicator:

    Process action type = execution AND target process cmd != *-d* AND target process cmd != base64 AND base64 /dev/urandom AND base64 -w0 AND base64 --version AND base64 --help AND base64 -h AND *improbable* AND *bootstrap* AND target process name = base64 Process initiator cmd != *build*.sh* AND cgo name != containerd

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Data Encoding (T1132)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23