BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0011 ✕ technique: T1572 ✕

Download CSV Show ATT&CK heatmap
  • Gost tunneling execution Medium Execution

    Possible use of Gost (tunnel written in Golang) SSH tunnel.

    Indicator:

    Process action type = execution AND target process cmd = *rtcp://*socks5* , *rtcp://*socks4* , *rudp://*socks5* , *rudp://*socks4*

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Protocol Tunneling (T1572)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Plink/SSH reverse tunnel Low Exfiltration

    PuTTY link (Plink) / SSH can be used to create encrypted tunnels to communicate back to an attacker's C2 server.

    Indicator:

    Process action type = execution AND target process cmd =~ \s+-R\s+((\d{1,3}\.){3}\d{1,3}:)?(\d+:)?(localhost|127\.0\.0\.1):(3389|445|135|139|389|636)

    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Protocol Tunneling (T1572)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23