BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. tactic: TA0040 ✕ technique: T1485 ✕

Download CSV Show ATT&CK heatmap
  • Data destruction using sdelete.exe Informational Evasion

    Attackers may use sdelete.exe to delete files from the target host.

    Indicator:

    Process action type = execution AND target process cmd = * -nobanner* AND target process name = sdelete.exe

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Data Destruction (T1485) Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible data destruction via dd Informational Tampering

    Attackers may use dd to zero out or write random data to files.

    Indicator:

    Process action type = execution AND target process cmd = *if=/dev/zero*of=* , *of=*if=/dev/zero* , *if=/dev/*random*of=* , *of=*if=/dev/*random* AND target process cmd != *of=/var/tmp* AND *of=/dev/stdout* AND target process name = dd

    ATT&CK tactics: Impact (TA0040)
    ATT&CK techniques: Data Destruction (T1485)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23