BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

10 BIOCs match the current filters. technique: T1021 ✕

Download CSV Show ATT&CK heatmap
  • Commonly abused process executes by a remote host using PsExec Informational Lateral Movement

    This commonly abused shell/host process was spawned by psexesvc.exe, indicating it was called by a remote host via PsExec.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = psexesvc.exe , cgo name = psexesvc.exe

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002) Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Executable copied to remote host via admin share Informational Lateral Movement

    An executable file was written to a remote host's shared system folder (such as c:\ or c:\windows) from an unsigned CGO process.

    Indicator:

    File file path = *admin$* , *c$* AND file name = *.exe AND file path != *$NOCSC$* AND action type = write Process cgo name != perl.exe AND cgo signature = Unsigned Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of RDP settings Informational Persistence

    Possible modification of Terminal Services/RDP settings.

    Indicator:

    Registry registry value name = *Terminal Server* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Multiple RDP sessions enabled via Registry Medium Persistence

    Attackers may allow multiple RDP sessions, so they could access the machine at the same time the user does.

    Indicator:

    Registry registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fSingleSessionsPerUser AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003) Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001) Create or Modify System Process: Windows Service (T1543.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PsExec attempts to execute a command on a remote host Informational Lateral Movement

    PsExec is a SysInternals tool used to execute commands on remote hosts.

    Indicator:

    Network action type = outgoing , failed AND remote port = 135 , 445 Process initiated by = psexec.exe AND initiator signature = Signed AND initiator signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002) System Services: Service Execution (T1569.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PsExec execution EulaAccepted flag added to the Registry Informational Execution

    PsExec is commonly used by malware for lateral movement, seeing this value in the Registry means that the user ran PsExec and approved the EULA either automatically or manually.

    Indicator:

    Registry registry key name = *\Software\Sysinternals\PsExec* AND registry value name = *EulaAccepted* AND action type = set_registry_value Process initiated by != ltsvc.exe AND batchpatch.exe AND agentservice.exe AND cgo name != ltsvc.exe AND batchpatch.exe AND agentservice.exe Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
    ATT&CK techniques: System Services: Service Execution (T1569.002) Remote Services: SMB/Windows Admin Shares (T1021.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • RDP connections enabled via Registry by unsigned process Low Persistence

    An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

    Indicator:

    Registry registry data = 0 AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fDenyTSConnections AND action type = set_registry_value Process initiator signature != Signed AND N/A AND cgo signature != Signed AND N/A AND initiated by != SCCService.exe AND ZenworksWindowsService.exe AND DTPlayerMonitor.exe, AND AdisVDIDesktopAgent.exe AND RDPConf.exe AND cgo name != SCCService.exe AND ZenworksWindowsService.exe AND DTPlayerMonitor.exe, AND AdisVDIDesktopAgent.exe AND RDPConf.exe Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • RDP connections enabled via Registry from a script host or rundll32.exe Informational Persistence

    An attacker may enable RDP connections to a machine by setting the fDenyTSConnections Registry key to 0.

    Indicator:

    Registry registry data = 0 AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Terminal Server AND registry value name = fDenyTSConnections AND action type = set_registry_value Process initiated by = cmd.exe , powershell.exe , wscript.exe , cscript.exe , mshta.exe , rundll32.exe , cgo name = cmd.exe , powershell.exe , wscript.exe , cscript.exe , mshta.exe , rundll32.exe AND initiator cmd != *\\*netlogon* AND *\\*sysvol* AND *LiteTouch.wsf* AND *Puppet* AND cgo cmd != system32\osdsetuphook.exe /execute Host host os = windows

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Remote RDP session enumeration via query.exe Informational Lateral Movement

    Attackers may use the built-in query.exe tool to enumerate remote sessions, using the session flag.

    Indicator:

    Process action type = execution AND target process cmd = *session* /server* AND target process name = query.exe

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Remote RDP session enumeration via qwinsta.exe Informational Lateral Movement

    Attackers may use the built-in qwinsta.exe tool to enumerate remote sessions.

    Indicator:

    Process action type = execution AND target process cmd = * /server* AND target process name = qwinsta.exe

    ATT&CK tactics: Lateral Movement (TA0008)
    ATT&CK techniques: Remote Services: Remote Desktop Protocol (T1021.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11