BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

18 BIOCs match the current filters. technique: T1218 ✕

Download CSV Show ATT&CK heatmap
  • Browser downloads an .hta or .application file Informational Execution

    .hta and .application files are Windows applications that may serve as an attack vector by executing code maliciously using trusted Windows applications.

    Indicator:

    File action type = create , write AND file name = *.hta , *.application Process initiated by = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe , cgo name = iexplore.exe , chrome.exe , firefox.exe , opera.exe , microsoftedge.exe , microsoftedgecp.exe , safari.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Mshta (T1218.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Commonly abused process spawns out of rundll32.exe Informational Execution

    This type of execution happens in .dll based attacks.

    Indicator:

    Process action type = execution AND target process name = cmd.exe , powershell.exe , powershell_ise.exe , wsmprovhost.exe , cscript.exe , wscript.exe , mshta.exe , wmic.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , odbcconf.exe , regasm.exe , pcalua.exe , sdiagnhost.exe , bginfo.exe , dcomcnfg.exe , dbghost.exe , cdb.exe , dnx.exe , rcsi.exe , csi.exe , windbg.exe , cdb.exe , kd.exe , cmstp.exe , fsi.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Process initiated by = rundll32.exe , cgo name = rundll32.exe AND initiator signature = Signed , cgo signature = Signed AND initiator signer = *Microsoft Corporation* , cgo signer = *Microsoft Corporation* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Compiled HTML (help file) makes network connections Informational Execution

    Compiled HTML (help files) should not normally need to connect to the network. This may have limited legitimate uses, yet this behavior is often observed by malware leveraging malicious CHM files to deliver a 2nd stage payload.

    Indicator:

    Network action type = outgoing , failed Process os parent name = hh.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Execution of regsvcs/regasm with uncommon paths Informational Execution

    The regasm.exe/regsvcs.exe commands are used to register .NET COM assemblies, which are typically located in specific paths. Uncommon paths may indicate malicious code is being registered.

    Indicator:

    Process action type = execution AND target process name = regasm.exe , regsvcs.exe AND target process cmd = *appdata\*dll* , *programdata\*dll* , *temp\*dll* , *tmp\*dll* , *documents\*dll , *$recycle.bin\*dll* AND target process cmd != *program files*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Regsvcs/Regasm (T1218.009)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Connection Manager Profile Installer loads a file from the users to temporary folder Low Evasion

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Process action type = execution AND target process cmd = *temp* , *users* AND target process name = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Microsoft Connection Manager Profile Installer makes connections to the network Low Dropper

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Network action type = outgoing , failed Process initiated by = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft Connection Manager Profile Installer runs command line or PowerShell Low Execution

    The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. CMSTP.exe may be abused to load and execute DLLs and/or COM scriptlets (SCT) from remote servers. This execution may also bypass AppLocker and other whitelisting defenses since CMSTP.exe is a legitimate, signed Microsoft application.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , cmd.exe Process initiated by = CMSTP.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: CMSTP (T1218.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft HTML Application Host spawns from CMD or PowerShell Informational Execution

    Microsoft HTML Application Host is a program whose source code consists of HTML, Dynamic HTML and a few scripting languages compatible with Internet Explorer such as VBScript or JScript. It does not typically spawn from PowerShell or CMD.

    Indicator:

    Process action type = execution AND target process name = mshta.exe Process initiated by = cmd.exe , powershell.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Mshta (T1218.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Microsoft HTML Application Host spawns from Explorer.exe Informational Evasion

    Mshta allows execution of .hta files, an attacker can use mshta to execute malicious hta files on the victim's host.

    Indicator:

    Process action type = execution AND target process name = mshta.exe Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Compiled HTML File (T1218.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • PowerShell is used to execute a CPL file Informational Evasion

    Attackers may use PowerShell.exe to execute a CPL file to achieve Control Panel proxy execution.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = * control.exe *.cpl*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Regsvr32 may have run code from an untrusted source High Execution

    Regsvr32 may be used to run arbitrary code by passing the '/i' parameter. The code may also be hosted on a remote host.

    Indicator:

    Process action type = execution AND target process cmd = * /i:*http* , * /i*scrobj.dll* AND target process name = regsvr32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Regsvr32 (T1218.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Rundll32 loads a known abused DLL Informational Execution

    Rundll32.exe is called to execute an arbitrary binary, this execution may also bypass whitelisting defenses as a signed Microsoft application.

    Indicator:

    Process action type = execution AND target process cmd != *control_rundll*cscui.dll* AND *control_rundll*srchadmin.dll* AND *control_rundll*keymgr.dll* AND *control_rundll*input.dll* AND *fileprotocolhandler*.zip* AND *fileprotocolhandler*.htm* AND *fileprotocolhandler*.png* AND *fileprotocolhandler*.pdf* AND *fileprotocolhandler*.dbk* AND target process cmd = *advpack.dll*registerocx*.dll* , *advpack.dll*registerocx*.exe* , *ieadvpack.dll*launchinfsection*.inf* , *ieframe.dll*openurl*.url* , *Mshtml.dll*printhtml*.hta* , *pcwutl.dll*launchapplication*.exe* , *setupapi.dll*installhinfsection*defaultInstall*.inf* , *shdocvw.dll*openurl*.url , *shell32.dll*control_rundll*.dll* , *shell32.dll*shellexec_rundll*.exe* , *syssetup.dll*setupinfobjectinstallaction*.inf* , *url.dll*openurl*.hta* , *url.dll*openurl*.url* , *url.dll*openurl*file* , *url.dll*fileprotocolhandler*.hta* , *url.dll*fileprotocolhandler*.url* , *url.dll*fileprotocolhandler*file:* , *zipfldr.dll*routethecall*.exe* , *zipfldr.dll*routethecall*file:* AND target process name = rundll32.exe Process initiated by != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe AND cgo name != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe AND os parent name != ie4uinit.exe AND msdt.exe AND bomgar-scc.exe AND control.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Rundll32.exe launches an executable using ordinal numbers argument Medium Evasion

    Rundll32.exe launches an executable using ordinal numbers argument, this behavior may be used by attackers to evade detection.

    Indicator:

    Process action type = execution AND target process cmd =~ dll.*?#[-+]?[0-9]+.*?\.exe AND target process name = rundll32.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Rundll32.exe with 'main' as EntryPoint Medium Execution

    Rundll32.exe ran with 'main' as EntryPoint. Attackers may leverage rundll32.exe to execute malicious functions and DLLs.

    Indicator:

    Process action type = execution AND target process cmd =~ rundll32.*dll[\s]*,[\s]*main

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious DLL load using Control.exe Medium Execution

    This execution mechanism is known to be used by malware to load malicious DLLs.

    Indicator:

    Process action type = execution AND target process cmd != *Shell32.dll* AND target process name = rundll32.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Process os parent name = control.exe Host host os != linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution: Rundll32 (T1218.011) System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SyncAppvPublishingServer used to run PowerShell code Informational Evasion

    SyncAppvPublishingServer is part of Microsoft Application Virtualization (App-V), which may be used by an attacker to run PowerShell code.

    Indicator:

    Process action type = execution AND target process name = SyncAppvPublishingServer.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution (T1218)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with Windows Control Panel configuration Informational Evasion

    DLLs with .cpl suffix are executed when accessing the Control Panel. Malicious code may run this way even if AppLocker enabled.

    Indicator:

    Registry action type = all AND registry key name = *software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WerFault ReflectDebugger key set in Registry Medium Execution

    The WerFault.exe signed Windows process may be tricked into running a malicious executable by setting the ReflectDebugger key in the Registry.

    Indicator:

    Registry action type = create_registry_key , delete_registry_key , rename_registry_key , set_registry_value AND registry value name = *reflectdebugger* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: System Binary Proxy Execution (T1218)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11