BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

4 BIOCs match the current filters. technique: T1135 ✕

Download CSV Show ATT&CK heatmap
  • Linux network share discovery Informational Discovery XQL

    A Linux network share discovery command was executed.

    XQL query: 
    {"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"df","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":".*((-aH)|(-a.*-H)|(-H.*-a)|(-Ha)).*","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"smbutil","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"view","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-g","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"showmount","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    No
    Source:
    Palo Alto Networks
    Updated:
    2026-02-17
  • Mounted NFS share discovery Informational Discovery

    Attackers may use the showmount command to list mount Network File Sharing shares.

    Indicator:

    Process action type = execution AND target process name = showmount

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Network share discovery via command-line tool Low Discovery

    Attackers may use command-line tools to discover mapped shares on the host.

    Indicator:

    Process action type = execution AND target process name = df , smbutil AND target process cmd = *view -g* , *-aH

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • SMB enumeration via command-line tool Informational Discovery

    Attackers may use SMB enumeration to retrieve information about network shares, printers, and other resources.

    Indicator:

    Process action type = execution AND target process name = nmblookup , rpcclient , smbclient , nbtscan Host host os = linux

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Network Share Discovery (T1135)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11