BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

13 BIOCs match the current filters. technique: T1548 ✕

Download CSV Show ATT&CK heatmap
  • Bypass UAC using the IsolatedCommand Registry value Medium Privilege Escalation

    IsolatedCommand is a Registry value known to be altered by attackers to allow themselves to run their malware with elevated privileges.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data != "%1" %* AND registry key name = *\exefile\shell\runas\command* AND registry value name = IsolatedCommand Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bypass UAC using the control.exe Registry key Medium Privilege Escalation

    Control.exe is a Registry key known to be altered by attackers to allow themselves to run their malware with elevated privileges.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry data != "%1" %* AND registry key name = *currentVersion\app paths\control.exe* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Bypassing Windows UAC using sysprep Informational Privilege Escalation

    Attackers may use the sysprep.exe built-in Windows tools to bypass Windows UAC.

    Indicator:

    Process action type = execution AND target process name = sysprep.exe Process initiated by != winlogon.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Command enumeration via sudo Informational Privilege Escalation

    The 'sudo -l' command was executed to enumerate commands that can be executed by a user.

    Indicator:

    Process action type = execution AND target process cmd =~ -l |-l$ AND target process name = sudo Host host os = linux

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Discovery of files with setgid or setuid bits Informational Privilege Escalation

    Attackers may try to locate files with setgid or setuid bits set to escalate privileges.

    Indicator:

    Process action type = execution AND target process cmd = * -perm *-4000* , * -perm *-2000* , * -perm *g+s* , * -perm *u+s* , * -perm *g=s* , * -perm *u=s* AND target process name = find Process initiated by != ir_agent AND cgo name != ir_agent

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of MMC Registry configuration Informational Privilege Escalation

    Creation or modification of these Microsoft Management Console related entries can cause the execution of the specified programs, bypassing UAC.

    Indicator:

    Registry action type = all AND registry key name = *mscfile\shell\open\command* , *\folder\shell\open\command* Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Possible UAC bypass via Event Viewer Medium File Privilege Manipulation

    Eventvwr.exe normally only spawns mmc.exe. Attackers may use it for bypassing UAC (User Account Control) by having it spawn a different process.

    Indicator:

    Process action type = execution AND target process name != mmc.exe Process initiated by = eventvwr.exe , os parent name = eventvwr.exe Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Setuid on file Informational Privilege Escalation

    Setting user identification on an executable file causes it to run with the privileges of the owning user.

    Indicator:

    Process action type = execution AND target process cmd = *u+s* AND target process name = chmod

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Setuid and Setgid (T1548.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Sudoers discovery Informational Discovery

    Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges.

    Indicator:

    Process action type = execution AND target process cmd = */etc/sudoers* , *sudo *-l* , *sudo *--list* Process initiator cmd != *chef* AND *puppet* AND *salt-minion* AND cgo cmd != *chef* AND *puppet* AND *salt-minion* AND initiated by != chef-client AND BESClient AND crod AND crond AND cgo name != chef-client AND BESClient AND crod AND crond

    ATT&CK tactics: Discovery (TA0007) Privilege Escalation (TA0004)
    ATT&CK techniques: Account Discovery (T1087) Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • UAC bypass using the changepk.exe Registry key Medium Privilege Escalation

    Attackers may use the changepk.exe built-in Windows tool to bypass Windows UAC by modifying Registry keys.

    Indicator:

    Registry registry key name = *Launcher.SystemSettings\Shell\Open\Command* AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unsigned integer Sudo privilege escalation Medium Privilege Escalation

    Fixed in CVE-2019-14287, this known command line is used to exploit a bug in sudo to gain root privileges.

    Indicator:

    Process action type = execution AND target process cmd = * -u#-1 * , * -u#4294967295 *

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Unusual process spawned by changepk.exe Informational Privilege Escalation

    Attackers may use the changepk.exe built-in Windows tool to bypass UAC using an unusual initiator.

    Indicator:

    Process action type = execution AND target process name != sppsvc.exe AND clipup.exe AND genvalobj.exe AND dllhost.exe AND trustedinstaller.exe AND sppextcomobj.exe AND dismhost.exe Process initiated by = changepk.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WSReset.exe UAC bypass Low Privilege Escalation

    Attackers may use WSReset.exe to bypass User Account Control (UAC).

    Indicator:

    Process action type = execution AND target process name != conhost.exe AND mmc.exe Process initiated by = wsreset.exe , cgo name = wsreset.exe

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23