BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. technique: T1114 ✕

Download CSV Show ATT&CK heatmap
  • Scripting process reads Outlook data files Informational Collection

    Attackers may try to retrieve email data and sensitive information from .ost and .pst files.

    Indicator:

    File file name = *.ost , *.pst AND action type = read Process initiated by = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe , cgo name = cscript.exe , wscript.exe , powershell.exe , mshta.exe , rundll32.exe , cmd.exe

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Email Collection (T1114)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23