BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

1 BIOC match the current filters. technique: T1213 ✕

Download CSV Show ATT&CK heatmap
  • Windows hosts file written to Informational Collection

    Check for hosts file redirection, overriding the system's default hosts file to manipulate DNS.

    Indicator:

    File file name = hosts AND file path = *:\Windows\System32\drivers\etc\* AND action type = write

    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Data from Information Repositories (T1213)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11