BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

6 BIOCs match the current filters. technique: T1497 ✕

Download CSV Show ATT&CK heatmap
  • Container enumeration Informational Discovery

    An attacker may run a command to enumerate containers on a machine.

    Indicator:

    Process action type = execution AND target process name = docker , lxc , rkt AND target process cmd =~ ls(\s+|$)|list(\s+|$)

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Evasion using time-based properties Informational Evasion

    Attackers may check Event Log to evade virtualized environments.

    Indicator:

    Process action type = execution AND target process name = powershell.exe , powershell_ise.exe , pwsh.exe AND target process cmd = *get-winevent*6005*

    ATT&CK tactics: Defense Evasion (TA0005) Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion: Time Based Checks (T1497.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Ping executed with loopback address Informational Evasion

    This seemingly strange "wait" mechanism is often used by malware to stall command execution.

    Indicator:

    Process action type = execution AND target process cmd = *127.0.0.1* , *localhost* AND target process name = ping.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Ping to a known external IP address Informational Evasion

    Pinging a known external IP address is often used by malware to check internet connectivity.

    Indicator:

    Process action type = execution AND target process name = ping.exe , ping AND target process cmd = *8.8.8.8* , *8.8.4.4* , *9.9.9.9* , *149.112.112.112* , *208.67.222.222* , *208.67.220.220* , *1.1.1.1* , *1.0.0.1* , *185.228.168.9* , *185.228.169.9* , *64.6.64.6* , *64.6.65.6* , *198.101.242.72* , *23.253.163.53* , *176.103.130.130* , *176.103.130.131* Process cgo name != cmd.exe AND thorium.exe AND 4nt.exe AND cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND cgo signer != BeyondTrust Software Inc AND HP Inc. Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VMware enumeration attempt Informational Discovery

    An attacker may check for virtualization by searching for local vmx (VMware configuration) files.

    Indicator:

    Process action type = execution AND target process cmd =~ (find|locate).*\.vmx

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • VirtualBox enumeration Informational Discovery

    VBoxManage can be used to enumerate local VirtualBox machines.

    Indicator:

    Process action type = execution AND target process cmd =~ list\s+ AND target process name = vboxmanage

    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23