BIOCs
Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.
3 BIOCs match the current filters. technique: T1014 ✕
Download CSV Show ATT&CK heatmapDriver written to a temporary directory Informational Evasion
Drivers are highly unlikely to be written or moved to a temp directory. Check whether this driver is legitimate.
Indicator:File action type = create , write AND file path = *\temp\* , *\tmp\* AND file name = *.sys
ATT&CK tactics: Defense Evasion (TA0005)ATT&CK techniques: Rootkit (T1014)- Preventable:
- Yes
- Source:
- Palo Alto Networks
- Updated:
- 2026-02-11
Modification of Windows boot configuration using bcdedit.exe Informational Tampering
BCDEdit is a Microsoft Windows utility that can modify boot parameters. It is usually used as part of an attack to prevent repair of the affected system by disabling booting in recovery mode. It can also be used to stop Windows' Patchguard from objecting to the unsigned and insecure nature of a driver being loaded.
Indicator:Process action type = execution AND target process cmd = *set* AND target process name = bcdedit.exe
ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)ATT&CK techniques: Rootkit (T1014) Inhibit System Recovery (T1490)- Preventable:
- Yes
- Source:
- Palo Alto Networks
- Updated:
- 2026-08-23
Tampering with the Windows System Restore configuration Low Tampering
System Restore was disabled on the endpoint. In such a case, one may not be able to recover files in case of disaster. This may be initiated by the IT department, but also may indicate malicious activity such as ransomware.
Indicator:Registry action type = set_registry_value , create_registry_key , delete_registry_value AND registry data = 1 AND registry key name = *Software\Microsoft\Windows Nt\SystemRestore\DisableSR Host host os = windows
ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)ATT&CK techniques: Rootkit (T1014) Inhibit System Recovery (T1490)- Preventable:
- Yes
- Source:
- Palo Alto Networks
- Updated:
- 2026-02-11