BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

14 BIOCs match the current filters. technique: T1546 ✕

Download CSV Show ATT&CK heatmap
  • Commonly abused host process modifies the Windows shim cache Informational Persistence

    Has legitimate usage for Microsoft patches, but check for malicious execution for persistence. Known FIN7/Carbanak technique.

    Indicator:

    Process action type = execution AND process execution signature = Signed , Weak Hash AND target process name = sdbinst.exe AND process execution signer = Microsoft Corporation Process initiated by = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe , cgo name = cscript.exe , wscript.exe , cmd.exe , powershell.exe , mshta.exe , rundll32.exe , regsvr32.exe , certutil.exe , installutil.exe , msbuild.exe , ieexec.exe , dfsvc.exe , presentationhost.exe , msxsl.exe , msdt.exe , forfiles.exe , regsvcs.exe , regasm.exe , javaw.exe , java.exe , javac.exe , javaws.exe , jp2launcher.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of AppInit DLL loading list Informational Persistence

    The AppInit DLLs Registry key contains a list of DLLs that will be loaded when user32.dll is loaded. As most Windows executables use the user32.dll, any DLL that is listed in the AppInit_DLLs Registry key will be loaded also. The user32.dll file is also used by processes that are automatically started by the system when you log on.

    Indicator:

    Registry action type = all AND os actor process signature vendor != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND registry data != *system32\SophosAV\* AND *\Citrix\* AND registry data = *.dll AND registry key name = *Software\Microsoft\Windows NT\CurrentVersion\Windows* AND registry value name = AppInit_DLLs Process initiator signer != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND cgo signer != Malwarebytes Inc AND Symantec Corporation AND AppSense AND Sophos Ltd AND Sophos Limited AND Ivanti, Inc. AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , os parent signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: AppInit DLLs (T1546.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Application Verifier custom providers Informational Persistence

    The Application Verifier assists developers in quickly finding subtle programming errors that can be extremely difficult to identify with normal application testing. Using Application Verifier in Visual Studio makes it easier to create reliable applications by identifying errors caused by heap corruption, incorrect handle and critical section usage. Changing the providers could change handling. An attacker can use this ability to inject a custom verifier into any application. Once the custom verifier has been injected, the attacker now has full control over the application.

    Indicator:

    Registry action type = all AND registry key name = *software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Image File Execution Options Injection (T1546.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of default file association configuration Informational Persistence

    When a file is opened, the default program used to open the file, its handler, is checked. File association selections are stored in the Windows Registry and can be edited by users. Malware can modify or create a file association for a given file extension to call another program when a given extension is opened.

    Indicator:

    Registry action type = all AND registry data = * AND registry key name = *Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Change Default File Association (T1546.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of default file extension configuration Low Tampering

    Alerts when a handler of a known file extension is modified. Applicable to EXE, DLL, SYS, PS1, BAT, CMD, ZIP and LNK extensions.

    Indicator:

    Registry registry value name = .exe , .dll , .sys , .lnk , .ps1 , .rar , .cmd , .bat , .zip AND registry key name = *\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Change Default File Association (T1546.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of the MonitorProcess Registry key Medium Persistence

    Entries added under the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit can be used to run malicious code and help attackers gain persistence.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *silentprocessexit* AND registry value name = monitorprocess Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Image File Execution Options Injection (T1546.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of the sticky keys file Medium Privilege Escalation

    Possible login bypass attack.

    Indicator:

    File action type = create , write AND file path = *:\Windows\System32 , *:\Windows\Syswow64 AND file name = sethc.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Event Triggered Execution: Accessibility Features (T1546.008)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Persistence using bashrc files Informational Persistence

    Possible persistency using shell (bash\csh) profile files. Commands in ~/.bashrc are executed on every new shell execution.

    Indicator:

    File action type = write , rename , create AND file path =~ (/home/[^/]+/\.(bashrc|profile|bash_profile))|(/etc/profile|/etc/bash.bashrc|/etc/csh.cshrc|/etc/csh.login) Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Unix Shell Configuration Modification (T1546.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Persistence via Registry screensaver key change Informational Persistence

    Attackers may install their malware persistently by modifying the value of the screensaver Registry key.

    Indicator:

    Registry registry key name = *\Control Panel\Desktop AND registry value name = SCRNSAVE.EXE AND action type = set_registry_value Process initiator cmd != * shell32.dll,Control_RunDLL desk.cpl,ScreenSaver,* AND initiated by != rundll32.exe AND cgo name != explorer.exe Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Screensaver (T1546.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shim database file access Informational Persistence

    An attacker may install a malicious SDB (shim database) file on disk for privilege escalation and persistence.

    Indicator:

    File action type = create , rename , write AND file path = *\windows\apppatch\custom\*

    ATT&CK tactics: Persistence (TA0003) Privilege Escalation (TA0004)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Shim database registration via Registry Informational Persistence

    Application shim databases may be leveraged for privilege escalation and persistence, and can be installed by modifying the Registry.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *software\microsoft\windows nt\currentversion\appcompatflags\installedsdb* , *software\microsoft\windows nt\currentversion\appcompatflags\custom* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious SDB file written to disk Informational Persistence

    Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files may be indicative of this technique.

    Indicator:

    File action type = create , write AND file name = *.sdb AND file path !=~ [.].[a-zA-Z0-9]{2,3}\.[a-zA-Z0-9]{2,3}$|ApplicationConfigurationFromString|secedit.sdb|appraiser.sdb|sysmain.sdb|Sharegate|Program Files|AppData\\Roaming\\Thunderbird\\Profiles Process initiated by = powershell.exe , wscript.exe , cscript.exe , regsvcs.exe , schtasks.exe , xwizard.exe , findstr.exe , esentutl.exe , reg.exe , csc.exe , atbroker.exe , print.exe , pcwrun.exe , rpcping.exe , wsreset.exe , replace.exe , mshta.exe , bitsadmin.exe , ieexec.exe , cmd.exe , microsoft.workflow.compiler.exe , runscripthelper.exe , makecab.exe , forfiles.exe , control.exe , msbuild.exe , register-cimprovider.exe , ie4uinit.exe , sc.exe , bash.exe , sh.exe , hh.exe , mmc.exe , jsc.exe , scriptrunner.exe , odbcconf.exe , extexport.exe , msdt.exe , diskshadow.exe , extrac32.exe , eventvwr.exe , mavinject.exe , regasm.exe , gpscript.exe , rundll32.exe , regsvr32.exe , regedit.exe , msiexec.exe , presentationhost.exe , wmic.exe , runonce.exe , syncappvpublishingserver.exe , verclsid.exe , infdefaultinstall.exe , expand.exe , installutil.exe , wab.exe , dnscmd.exe , at.exe , pcalua.exe , cmdkey.exe , msconfig.exe AND cgo name != code.exe AND msiexec.exe AND Deploy-Application.exe AND BackendTaskQueueHost64.exe AND cgo cmd != *acmigration.dll,ApplyMigrationShims*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious SDB file written to disk by an unsigned process Informational Persistence

    Application Shims were created to allow backward compatibility of applications, which can be abused to establish persistence or elevate privileges. The creation of SDB (Shim Database) files by an unsigned process may be indicative of this technique.

    Indicator:

    File action type = create , write AND file name = *.sdb AND file path !=~ [.].[a-zA-Z0-9]{2,3}\.[a-zA-Z0-9]{2,3}$ Process initiated by != libero.exe AND heyex.exe AND avevamarinesample2.1.0.exe AND wmiproviders_2.1.5.6002.exe AND initiator path !=~ Xilinx|Flowlink 5.1|CST Studio Suite 2020|Program Files|wish.*exe AND initiator signature = Unsigned Host host os != linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Application Shimming (T1546.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Write to .bash_profile Informational Persistence

    Commands in ~/.bash_profile are executed on every user shell login with a username and password.

    Indicator:

    File file name = .bash_profile AND action type = write

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Event Triggered Execution: Unix Shell Configuration Modification (T1546.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11