BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

22 BIOCs match the current filters. technique: T1003 ✕

Download CSV Show ATT&CK heatmap
  • Command-line arguments match Mimikatz execution High Credential Access

    These command-line arguments are often used by Mimikatz to dump credentials.

    Indicator:

    Process action type = execution AND target process cmd = *privilege::debug* , *sekurlsa* , *kerberos::tgt* , *logonpasswords* , *kerberos::ptt* , *kerberos::golden* , *kerberos::list*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Creation of volume shadow copy using vssadmin.exe Informational Credential Access

    An attacker may create volume shadow copies to gain access to protected or locked files, whereas backup is the common legitimate use.

    Indicator:

    Process action type = execution AND target process cmd = * create* shadow* AND target process name = vssadmin.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential Vault command-line access Medium Credential Access

    The Credential Vault command line was used to enumerate a user's saved credentials.

    Indicator:

    Process action type = execution AND target process cmd = * /list* AND target process name = vaultcmd.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via LaZagne High Credential Access

    LaZagne has been executed. Attackers may use this tool to gather account and password information from credential dumping.

    Indicator:

    Process action type = execution AND target process cmd = *LaZagne.py* Host host os = linux , macos , windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Credential dumping via fgdump.exe Medium Credential Access

    Attackers may use fgdump.exe to perform local credential dumping.

    Indicator:

    Process action type = execution AND target process name = fgdump.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via gsecdump.exe Medium Credential Access

    Attackers may use gsecdump to obtain password hashes and LSA secrets.

    Indicator:

    Process action type = execution AND target process name = gsecdump.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via pwdumpx.exe Medium Credential Access

    Attackers may use pwdumpx.exe to perform local or remote credential dumping.

    Indicator:

    Process action type = execution AND target process name = pwdumpx.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) OS Credential Dumping: Security Account Manager (T1003.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Credential dumping via wce.exe Medium Credential Access

    Attackers may use wce.exe (Windows Credential Editor) to obtain user credentials.

    Indicator:

    Process action type = execution AND target process name = wce.exe , wce32.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Dumping Registry hives with passwords Low Credential Access

    Dumping registry hives can be used to obtain stored credentials/hashes.

    Indicator:

    Process action type = execution AND target process cmd = * save *HKLM\sam* , * save *HKLM\security* , * save *HKLM\system* , * save *HKEY_LOCAL_MACHINE\sam* , * save *HKEY_LOCAL_MACHINE\security* , * save *HKEY_LOCAL_MACHINE\system* Process initiated by != ir_agent.exe AND cgo name != ir_agent.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Dumping lsass.exe memory for credential extraction Medium Credential Access

    Dumping lsass.exe memory to a file allows attackers to later extract credentials from the dumped memory.

    Indicator:

    Process action type = execution AND target process name = procdump.exe , procdump64.exe AND target process cmd = *lsass*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Forensics Driver Loaded Informational Collection XQL

    A forensics driver has been loaded.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$LOAD_IMAGE_PRELOAD","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_vendor","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_module_signature_product","OPERATOR":"EQ","RIGHT":"Binalyze LLC","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: Automated Collection (T1119) OS Credential Dumping (T1003)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Hash cracking using Hashcat tool Medium Credential Access

    Hash cracking allows attackers to collect passwords and use them later on as part of their operation.

    Indicator:

    Process action type = execution AND target process cmd = * -m* , * --hash-type* , * -a* , * --attack-mode* , *.txt* AND target process name = hashcat*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Installation of Cain & Abel password recovery tool Low Credential Access

    A process created a Registry key associated with the common password cracking tool Cain & Abel.

    Indicator:

    Registry action type = set_registry_value , create_registry_key AND registry key name = *\software\cain* Host host os = windows

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • NTLM Credential dumping via RpcPing.exe Medium Credential Access

    RpcPing.exe can be used to gain network NTLM hash for offline cracking.

    Indicator:

    Process action type = execution AND target process cmd = *-u *NTLM* , *-u *10* AND target process name = rpcping.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Nagios enumeration Low Credential Access

    A Nagios XI database may be enumerated for the credentials of the hosts monitored.

    Indicator:

    Process action type = execution AND target process cmd =~ mysql.*nagios\.nagios_(hosts|services|commands)

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Netrc file enumeration Informational Credential Access

    Enumeration commands such as test and cat were executed on .netrc file paths that contain credentials.

    Indicator:

    Process action type = execution AND target process cmd = *test*.netrc* , *cat*.netrc* Host host os = linux

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Ntdsutil.exe accessing ntds.dit file High Credential Access

    Attackers may attempt to dump ntds.dit, which stores all Active Directory account information, to later extract passwords and hashes from it.

    Indicator:

    File action type = all AND file name = ntds.dit Process initiated by = ntdsutil.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible LSASS memory dump High Credential Access

    Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump.

    Indicator:

    Process action type = execution AND target process cmd = *-ma lsass.exe*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping: LSASS Memory (T1003.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • PowerShell runs with known Mimikatz arguments Medium Collection

    These PowerShell arguments are often used to run commands with malicious intent while running Mimikatz, a credential harvesting tool.

    Indicator:

    Process action type = execution AND target process cmd = *privilege::* , *sekurlsa::* , *kerberos::* , *crypto::* , *vault::* , *token::* , *lsadump::* , *-dumpcr* , *-dumpce* AND target process name = powershell.exe

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious debug file created in a temporary folder High Credential Access

    SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin.

    Indicator:

    File file path =~ \\temp\\debug[0-9]*\.bin AND action type = create

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WMI access to shadow copy interface Informational Credential Access

    An attacker may be trying to modify and/or delete shadow copies via WMI for disabling system backups or extracting NTDS.dit.

    Indicator:

    Process action type = execution AND target process cmd = *win32_shadowcopy*

    ATT&CK tactics: Credential Access (TA0006) Impact (TA0040)
    ATT&CK techniques: OS Credential Dumping (T1003) Inhibit System Recovery (T1490)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WinPmem Forensics Tool Informational Collection XQL

    The WinPmem Forensics Tool has been run.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$agent_os_type","OPERATOR":"EQ","RIGHT":"$AGENT_OS_WINDOWS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"AND":[{"LEFT":"$action_process_signature_vendor","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_signature_product","OPERATOR":"EQ","RIGHT":"Velocidex Innovations","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"winpmem.exe","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Collection (TA0009) Credential Access (TA0006)
    ATT&CK techniques: OS Credential Dumping (T1003) Automated Collection (T1119)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17