BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. tactic: TA0040 ✕ technique: T1070 ✕

Download CSV Show ATT&CK heatmap
  • Data destruction using sdelete.exe Informational Evasion

    Attackers may use sdelete.exe to delete files from the target host.

    Indicator:

    Process action type = execution AND target process cmd = * -nobanner* AND target process name = sdelete.exe

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Data Destruction (T1485) Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23