BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. technique: T1033 ✕

Download CSV Show ATT&CK heatmap
  • System owner/user discovery Informational Discovery

    System owner/user discovery using bash utilities.

    Indicator:

    Process action type = execution AND target process name = whoami , users , w , who Process initiated by =~ (ba|z|fi|tc|c|k)?sh , cgo name =~ (ba|z|fi|tc|c|k)?sh , os parent name =~ (ba|z|fi|tc|c|k)?sh Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: System Owner/User Discovery (T1033)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23