BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

7 BIOCs match the current filters. technique: T1036 ✕

Download CSV Show ATT&CK heatmap
  • Common Apple process name missing Apple digital signature Informational File Type Obfuscation

    These common Apple process names should normally be signed with the Apple Inc. digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

    Indicator:

    Process action type = execution AND target process name = safari.exe , itunes.exe , ituneshelper.exe , ipodservice.exe , applemobiledeviceservice.exe , applemobiledevicehelper.exe AND process execution signer != *Apple Inc.* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Common Mozilla process name missing Mozilla digital certificate Informational File Type Obfuscation

    These common Mozilla process names should normally be signed with the Mozilla Corporation digital signature. Naming processes with common names is a common way attackers obfuscate their activities.

    Indicator:

    Process action type = execution AND target process name = firefox.exe AND process execution signer != *Mozilla Corporation* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • File renamed to have a script extension Informational Execution

    Adversaries may create 'benign-looking' files, which are later used as malicious scripts by changing their extension.

    Indicator:

    File file previous name = *.tmp , *._new , *.rra , *.txt , *.j , *.rbf , *.jpg , *.png , *.jpeg , *.gif , *.tiff , *.psd , *.pdf , *.eps , *.ai , *.indd , *.raw , *.bmp , *.ico , *.svg , *.tif , *.odt , *.rtf , *.tex , *.wpd AND file name = *.pyi , *.mof , *.hta , *.vbs , *.bat , *.aspx , *.pptm , *.pyd , *.pyc , *.php , *.py , *.js , *.ps1 , *.ps , *.crx , *.sct , *.tcl , *.dotm AND file path != *config.msi* AND *ccm* AND *trend micro* AND *adobe* AND *dell* AND *sessionstore* AND *browser-extension-data* AND *cortana* AND *microsoftedge* AND *microsoft vs code* AND *inetcache* AND file previous path != *prf* AND *set* AND *jds* AND *bit* AND *~$* AND *~w* AND action type = rename Process cgo name != suservice.exe AND wuauclt.exe AND besclient.exe AND tiworker.exe AND fwcld.exe AND svchost.exe AND tortoiseproc.exe AND emcoreservice.exe AND initiated by != 1e.client.exe AND expand.exe AND trustedinstaller.exe AND wuauclt.exe AND setup.exe AND setupsup_la31.exe AND ssms-setup-enu.exe AND lmirtechconsole.exe AND initiated by != git-*.tmp AND *.tmp

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shell binary copied to another location Informational Tampering

    Attackers may try to evade detection by copying the shell binary to an innocent-looking name.

    Indicator:

    Process action type = execution AND target process cmd =~ /bin/(ba|z|fi|tc|c|k)?sh AND target process name = cp

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Space after filename creation Informational Evasion

    An attacker may append a space to the end of a filename to change how it's processed by the operating system.

    Indicator:

    File action type = create , rename AND file name =~ \.[a-z]+\s+ Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading: Space after Filename (T1036.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious .NET process spawns csc.exe Low Evasion

    A suspicious process in the Microsoft .NET directory spawned the C# compiler. This may occur if an attacker masquerades a process like MSBuild (e.g. PowerLessShell).

    Indicator:

    Process action type = execution AND target process name = csc.exe Process initiated by != ieexec.exe AND msbuild.exe AND aspnet_compiler.exe AND servicemodelreg.exe AND webdev.webserver.exe AND installutil.exe AND microsoft.workflow.compiler.exe AND regasm.exe AND initiator path = *windows\microsoft.net* AND cgo name != werfault.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036) Obfuscated Files or Information: Compile After Delivery (T1027.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows process masquerading by an unsigned process Informational Evasion

    A process is trying to disguise itself as a legitimate Windows process, but is unsigned. This usually indicates malicious activity.

    Indicator:

    Process action type = execution AND target process name = explorer.exe , svchost.exe , winlogon.exe , csrss.exe , lsass.exe , smss.exe , lsm.exe , taskhost.exe , rundll32.exe , dwm.exe , dllhost.exe , services.exe , Taskmgr.exe , wininit.exe AND process execution signer != Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Masquerading (T1036)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23