BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

15 BIOCs match the current filters. technique: T1070 ✕

Download CSV Show ATT&CK heatmap
  • Accessing bash history file Low Evasion

    Clearing bash history file is a known procedure of attackers to delete traces.

    Indicator:

    Process action type = execution AND target process cmd = *.bash_history * , *.bash_history , *histfile * , *histfile AND target process name = rm , touch , ln AND target process path != /Applications/OnyX.app/Contents/MacOS/OnyX

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Accessing bash history file using bash commands Low Evasion

    Clearing bash history files is a known attacker procedure for covering their tracks.

    Indicator:

    Process action type = execution AND target process cmd = *set histfile* , *set history* , *export histfile* , *export histignore* , *history -c* , *history -d* AND target process name = bash , sh

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Command History (T1070.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clear logs - using dd and /dev/null Medium Tampering

    Usage of the dd utility to clear the contents of a file using /dev/null.

    Indicator:

    Process action type = execution AND target process cmd = *if=/dev/null*of=*log* AND target process name = dd Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clearing logs by copying /dev/null to a log file Informational Tampering

    Usage of the cp command to copy /dev/null to a file and clear its content.

    Indicator:

    Process action type = execution AND target process cmd = cp*/dev/null*log* AND target process name = cp Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Clearing logs by executing cat /dev/null Informational Tampering

    Usage of cat /dev/null to clear the contents of a log file.

    Indicator:

    Process action type = execution AND target process cmd = cat*/dev/null* AND target process name = cat Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Data destruction using sdelete.exe Informational Evasion

    Attackers may use sdelete.exe to delete files from the target host.

    Indicator:

    Process action type = execution AND target process cmd = * -nobanner* AND target process name = sdelete.exe

    ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
    ATT&CK techniques: Data Destruction (T1485) Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Delete Volume USN Journal with fsutil Medium Evasion

    This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.

    Indicator:

    Process action type = execution AND target process cmd = * usn *deletejournal* AND target process name = fsutil.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • File timestamp tampering Informational Tampering

    An attacker may modify file timestamps by running the touch command to hide their activities.

    Indicator:

    Process action type = execution AND target process cmd = *-t* , *-acmr* , *-cmra* , *-rcma* , *-macr* AND target process name = touch

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Timestomp (T1070.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Log deletion in known log file directories Informational Evasion

    Deletion of log files in known log directories.

    Indicator:

    File file path = /var/log/* , /private/var/log/* , /private/var/audit/* AND action type = delete Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Log deletion using the truncate command Informational Tampering

    Usage of the truncate utility using "-s 0" argument to clear log files.

    Indicator:

    Process action type = execution AND target process cmd = truncate*-s 0*log* AND target process cmd != */tmp/* AND target process name = truncate Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Log deletion via command-line tool Informational Tampering

    An attacker may use the rm command to remove traces of their activities.

    Indicator:

    Process action type = execution AND target process cmd = */var/log/* , */var/audit* , */var/spool/mail* AND target process name = rm

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible log destruction using the dd command Informational Tampering

    Possible destruction of system log files using the dd command.

    Indicator:

    File action type = rename , write , create AND file path = /var/log/* Process initiated by = dd , cgo name = dd , os parent name = dd AND initiator cmd = *of=/var/log/* , cgo cmd = *of=/var/log/* , os parent cmd = *of=/var/log/* Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Clear Linux or Mac System Logs (T1070.002)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell is used to modify a timestamp Informational Evasion

    Attackers may use PowerShell.exe to modify the timestamp of a file.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *.creationtime*=*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal: Timestomp (T1070.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows Security audit log was cleared Informational Evasion

    Event ID 1102 was generated when the Windows Security audit log was cleared. Attackers may clear events from Windows event logs to remove traces of their malicious activity.

    Indicator:

    Event Log event log id = 1102 AND event log provider name = Microsoft-Windows-Eventlog Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows event logs cleared using wmic.exe Medium Evasion

    Attackers may clear events from Windows event logs to remove traces of their malicious activity.

    Indicator:

    Process action type = execution AND target process cmd = * cleareventlog* AND target process name = wmic.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Indicator Removal (T1070)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11