BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

2 BIOCs match the current filters. technique: T1556 ✕

Download CSV Show ATT&CK heatmap
  • Pluggable Authentication Modules Access Informational Credential Access

    Access to Pluggable Authentication Modules.

    Indicator:

    Process action type = execution AND target process name = vi , vim , nano AND target process cmd =~ .*/etc/pam[.]d/.+

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Modify Authentication Process: Pluggable Authentication Modules (T1556.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Pluggable Authentication Modules Modification Informational Credential Access

    Modification of Pluggable Authentication Modules.

    Indicator:

    File action type = write , delete , rename AND file path =~ ^/private/etc/pam[.]d/.*

    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Modify Authentication Process: Pluggable Authentication Modules (T1556.003)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23