BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. technique: T1201 ✕

Download CSV Show ATT&CK heatmap
  • Password complexity enumeration Informational Discovery

    Attackers may read system files containing password complexity requirements.

    Indicator:

    Process action type = execution AND target process cmd = */etc/login.defs* , */etc/pam.d/common-password* , */etc/security/pwquality.conf* , */etc/pam.d/system-auth* AND target process name = grep , head , tail , less , cat Host host os = linux , macos

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Password Policy Discovery (T1201)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Password policy discovery via command-line tool Informational Discovery

    Attackers may use chage to list the password policy and the user's last access time.

    Indicator:

    Process action type = execution AND target process cmd = *-l* AND target process name = chage

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Password Policy Discovery (T1201)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11