BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

17 BIOCs match the current filters. technique: T1547 ✕

Download CSV Show ATT&CK heatmap
  • Active Setup Registry Autostart Low Persistence

    Suspicious modification of the active setup registry for persistence and privilege escalation.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components AND registry value name = StubPath Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Active Setup (T1547.014)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Kernel modules loaded via command-line tool Informational Persistence

    The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.

    Indicator:

    Process action type = execution AND target process cmd != *ksplice* AND target process name = insmod Process initiated by != ds_am AND ds_agent AND ds_agent.init AND initiated by != savd* AND gpfsrunlevel AND runmmfs AND cgo name != ds_am AND ds_agent AND ds_agent.init AND cgo name != savd* AND gpfsrunlevel AND runmmfs AND initiator cmd != *sophos-av* AND *McAfee* AND *cisco* AND cgo cmd != *sophos-av* AND *McAfee* AND *cisco*

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Kernel modules loaded via compiled loader and .ko file Informational Persistence

    Instead of using insmod/depmod, an attacker can build a loader and load a kernel module; attackers may use kernel modules as rootkits.

    Indicator:

    Process action type = execution AND target process cmd = *.ko * , *.ko

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of 'BootExecute' Registry run key Informational Persistence

    Smss.exe will launch anything present in the BootExecute Registry key under HKLM\SYSTEM\ControlSet002\Control\Session Manager. The BootExecute key should only contain "autocheck autochk*". If there are additional values in it, they are probably used for malware persistence.

    Indicator:

    Registry action type = all AND registry key name = *\Control\Session Manager AND registry value name = BootExecute Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Winlogon 'Notify' autostart Registry key Informational Persistence

    Since Winlogon handles the Secure Attention Sequence (SAS) (Ctrl+Alt+Del), notify subkeys found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify are used to notify event handles when SAS happens and load a DLL. This DLL can be edited to launch whenever such a SAS event occurs.

    Indicator:

    Registry action type = all AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Winlogon 'UserInit' autostart Registry key Medium Persistence

    Winlogon process uses the value specified in the UserInit key to launch login scripts etc. This key is location at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Usually, UserInit key points to userinit.exe but if this key can be altered, then that EXE will also launch by Winlogon.

    Indicator:

    Registry action type = all AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Modification of default Windows startup path via Registry Informational Persistence

    An attacker may modify the startup path to the location of the malware.

    Indicator:

    Registry registry key name = *microsoft\windows\currentversion\explorer\user shell folders* , *microsoft\windows\currentversion\explorer\shell folders* AND registry data != *Microsoft\Windows\Start Menu\Programs\Startup* AND *\users\*\start Menu\Programs\Startup* AND *%USERPROFILE%\start Menu\Programs\Startup* AND registry value name = startup AND action type = set_registry_value Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Citrix Systems, Inc. AND VMware, Inc. AND initiator cmd != *regsvr32.exe*/s*/n*/i:u*shell32.dll* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Modification of the Winlogon\Shell Registry key Informational Persistence

    Malware may modify the Winlogon\Shell Registry value to load itself instead of explorer.exe, which is the default system shell.

    Indicator:

    Registry registry data != explorer.exe AND registry key name = *\software\microsoft\windows nt\currentversion\winlogon* AND registry value name = shell AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Winlogon Helper DLL (T1547.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • New entry added to startup related Registry keys by unsigned process Informational Persistence

    Entries added to the "Run Keys" in the Registry or the startup folder will cause the program to be executed when the user logs in. The program will be executed in the context of the user and will have his permissions level.

    Indicator:

    Registry action type = create_registry_key , rename_registry_key , set_registry_value AND registry key name = *software\Microsoft\Windows*CurrentVersion\run* , *Wow6432Node\Microsoft\Windows*CurrentVersion\Run* , *Software\Microsoft\Windows*CurrentVersion\Winlogon\Userinit* Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Port Monitor added in Registry Low Persistence

    Adversaries may use port monitors to run an adversary-supplied DLL during system boot for persistence or privilege escalation.

    Indicator:

    Registry registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Monitors\ART AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Possible XDG autostart persistency Informational Persistence

    Possible persistency gained by writing or creating a desktop file inside the xdg autostart directory.

    Indicator:

    File action type = create , rename , write AND file path =~ (/etc/xdg|.*/\.config)/autostart/.*\.desktop$ Host host os = linux

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: XDG Autostart Entries (T1547.013)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Print Processor Registration Low Persistence

    Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Environments\Windows x64\Print Processors Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Print Processors (T1547.012)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Print spooler set to load new DLL on boot Informational Persistence

    Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API.

    Indicator:

    Registry action type = set_registry_value , create_registry_key AND registry data != BPSLMONITOR.DLL AND registry key name = *Control\Print\Monitors* AND registry value name = driver Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Security Support Provider (SSP) registered via a registry key Informational Privilege Escalation

    Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords.

    Indicator:

    Registry action type = create_registry_key , delete_registry_key , set_registry_value , delete_registry_value AND registry key name =~ .*HKEY_LOCAL_MACHINE\\SYSTEM\\(ControlSet00[1,2]|CurrentControlSet)\\Control\\Lsa.* AND registry value name =~ .*Security.* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer driver installation Low Privilege Escalation

    A suspicious process installed a generic printer driver. This may be a sign of CVE-2020-1048, in which an attacker attempts to overwrite a file on the OS.

    Indicator:

    Registry registry data = Generic / Text Only AND registry key name = *windows nt\currentversion\print\printers* AND action type = set_registry_value Process initiator signature = Unsigned , Invalid Signature Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious printer port creation via Registry Medium Privilege Escalation

    An attacker may create a print job that prints to a file, overwriting any file on the OS (CVE-2020-1048).

    Indicator:

    Registry registry value name = *.exe , *.dll , *.bat , *.com , *.cmd , *.ps1 , *.hta , *.vba , *.vbs , *.vbe , *.js AND registry key name = *\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004) Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Tampering with Windows Security Support Provider DLLs Informational Persistence

    Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002.

    Indicator:

    Registry action type = all AND registry key name = *\SYSTEM\*ControlSet*\Control\Lsa\OSConfig , *\SYSTEM\*ControlSet*\Control\Lsa AND registry value name = *Security Packages* Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11