BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

27 BIOCs match the current filters. technique: T1562 ✕

Download CSV Show ATT&CK heatmap
  • AMSI Bypass Medium Lateral Movement

    AMSI (Antimalware Scan Interface) provides enhanced malware protection on Windows 10 machines. Attackers may try to bypass this mechanism and run malicious code.

    Indicator:

    Process action type = execution AND target process cmd = *system.management.automation.amsiutils*amsiinitfailed*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Chrome launched in Incognito mode Informational Evasion

    May be used to cover up malware or malicious insider activity.

    Indicator:

    Process action type = execution AND target process cmd = *incognito* AND target process name = chrome.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Clear event logging policy using auditpol.exe Informational Evasion

    Attackers may clear Windows Event Logging policies using auditpol.exe.

    Indicator:

    Process action type = execution AND target process cmd = */clear* AND target process name = auditpol.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable Windows Event Logging (T1562.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Disable outlook security via Registry Informational Tampering

    Attackers may try to disable outlook security features by modifying the Registry.

    Indicator:

    Registry registry data = 2 , 3 AND registry value name = PromptOOMSend , AdminSecurityMode , ObjectModelGuard AND registry key name = *Outlook* AND action type = set_registry_value Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Relativity ODA LLC AND Pearson PLC AND cgo signer != Relativity ODA LLC AND Pearson PLC AND initiated by != svchost.exe AND cgo name != svchost.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Disabling Windows Defender via Registry Informational Evasion

    Windows Defender stores its configuration in the Registry. By modifying these values, an attacker can disable security features.

    Indicator:

    Registry registry data = 1 AND registry key name = *Windows Defender* AND registry value name = *disable* AND action type = set_registry_value Process initiator signature = Signed , Unsigned , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , Invalid Signature , Weak Hash AND initiator signer != Symantec Corporation AND AVG Technologies USA, LLC AND Akeo Consulting AND Avast Software s.r.o. AND BeyondTrust Software Inc AND Bromium, Inc. AND Digital Communications Inc AND FireEye, Inc. AND Forcepoint LLC AND Google Inc AND Google LLC AND HP Inc. AND Invincea, Inc. AND Kaspersky Lab AND Netwrix Corporation AND OPSWAT, Inc. AND Palo Alto Networks (Netherlands) B.V. AND Rapid7 LLC AND Sangfor Technologies Co.,Ltd AND Snow Software AB AND Tanium Inc. AND Teradici Corporation AND Trend Micro, Inc. AND Websense, Inc. AND ZOHO Corporation private Limited AND Zoom Video Communications, Inc. AND Zscaler, Inc. AND Barracuda Networks, Inc. AND LiveQoS Incorporated AND cgo signer != Symantec Corporation AND AVG Technologies USA, LLC AND Akeo Consulting AND Avast Software s.r.o. AND BeyondTrust Software Inc AND Bromium, Inc. AND Digital Communications Inc AND FireEye, Inc. AND Forcepoint LLC AND Google Inc AND Google LLC AND HP Inc. AND Invincea, Inc. AND Kaspersky Lab AND Netwrix Corporation AND OPSWAT, Inc. AND Palo Alto Networks (Netherlands) B.V. AND Rapid7 LLC AND Sangfor Technologies Co.,Ltd AND Snow Software AB AND Tanium Inc. AND Teradici Corporation AND Trend Micro, Inc. AND Websense, Inc. AND ZOHO Corporation private Limited AND Zoom Video Communications, Inc. AND Zscaler, Inc. AND Barracuda Networks, Inc. AND LiveQoS Incorporated AND initiated by != msmpeng.exe AND svchost.exe AND mpcmdrun.exe AND mpsigstub.exe AND deviceenroller.exe AND securityhealthservice.exe AND mssense.exe AND taniumclient.exe AND setupplatform.exe AND ccmexec.exe AND configsecuritypolicy.exe AND securityhealthsystray.exe AND securityhealthhost.exe AND msiexec.exe AND omadmclient.exe AND monitoringhost.exe AND logonui.exe AND cgo name != msmpeng.exe AND svchost.exe AND mpcmdrun.exe AND mpsigstub.exe AND deviceenroller.exe AND securityhealthservice.exe AND mssense.exe AND taniumclient.exe AND setupplatform.exe AND ccmexec.exe AND configsecuritypolicy.exe AND securityhealthsystray.exe AND securityhealthhost.exe AND msiexec.exe AND omadmclient.exe AND monitoringhost.exe AND logonui.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • EventLog service disabled by a Registry operation High Tampering

    A Registry set-value operation that disables the EventLog service was executed on the machine.

    Indicator:

    Registry registry data = 4 , 3 AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Services\EventLog AND registry value name = Start AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable Windows Event Logging (T1562.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Fltmc.exe used to unload filter driver Informational Evasion

    Attackers can abuse the Filter Manager Control Program (fltMC.exe) to unload MiniFilter drivers, some of which may be used for activity monitoring.

    Indicator:

    Process action type = execution AND target process cmd = * unload * AND target process name = fltmc.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Internet Explorer security settings modification Informational Evasion

    The Security Settings Check feature, which checks Internet Explorer security settings to determine risk, was disabled.

    Indicator:

    Registry registry key name = *SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY AND action type = set_registry_value Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • MacOS firewall manipulation Informational Evasion

    An attacker may modify a firewall via command line to bypass network controls.

    Indicator:

    Process action type = execution AND target process name = socketfilterfw , launchctl , kextunload AND target process cmd = *unblockapp* , *--setglobalstate off* , *unload*com.apple.alf.useragent.plist* , *com.apple.nke.applicationfirewall* Host host os = macos

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses (T1562) Impair Defenses: Disable or Modify System Firewall (T1562.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Manipulation of Windows Defender configuration Informational Tampering

    Commands used to bypass, disable or harm Windows Defender.

    Indicator:

    Process action type = execution AND target process name = net.exe , powershell.exe , reg.exe , cmd.exe AND target process cmd = *windefend* , *DisableRealtimeMonitoring* , *stop*Windows Defender*

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of Windows Event Log auto-backup via Registry Informational Tampering

    This key enables/disables the automatic backups of event logs when they are full.

    Indicator:

    Registry action type = all AND registry key name = *\services\eventlog\* AND registry value name = autobackuplogfiles Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Netsh.exe modifies allowed firewall port/program lists Informational Evasion

    Malware will often modify local firewall settings to permit untrusted software to communicate with the Internet for C2. Check for malicious use.

    Indicator:

    Process action type = execution AND target process cmd = *allowedprogram* , *portopening* AND target process name = netsh.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Process attempts to kill a known security/AV tool Medium Evasion

    This process has attempted to use taskkill.exe to terminate a known AV process or security analysis tool. Likely attempt to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = * nwscmon.exe* , * fortisslvpndaemon.exe* , * bullguardbhvscanner.exe* , * rawshark.exe* , * fcdblog.exe* , * bullguard.exe* , * adawaredesktop.exe* , * consctlx.exe* , * sastask.exe* , * scanwscs.exe* , * k7tsecurity.exe* , * filwscc.exe* , * littlehook.exe* , * bullguarscanner.exe* , * nvcod.exe* , * ptwatchdog.exe* , * mbamservice.exe* , * unthreat.exe* , * twsscan.exe* , * schmgr.exe* , * escanmon.exe* , * uiwinmgr.exe* , * bgscan.exe* , * forticlient_diagnostic_tool.exe* , * nnf.exe* , * v3sp.exe* , * sdwelcome.exe* , * clamtray.exe* , * nvoy.exe* , * sbpimsvc.exe* , * v3main.exe* , * fcappdb.exe* , * mergecap.exe* , * mwaser.exe* , * bavtray.exe* , * filup.exe* , * v3up.exe* , * avktray.exe* , * msmpeng.exe* , * onlinent.exe* , * avpmapp.exe* , * taskmgr.exe* , * k7fwsrvc.exe* , * clamscan.exe* , * ptsessionagent.exe* , * nissrv.exe* , * v3proxy.exe* , * mbam.exe* , * webcompanion.exe* , * k7tsmngr.exe* , * mcshieldrtm.exe* , * fprottray.exe* , * fortifw.exe* , * procexp64.exe* , * avkwctlx64.exe* , * opssvc.exe* , * superantispyware.exe* , * escanpro.exe* , * nprosec.exe* , * quamgr.exe* , * bullguardupdate.exe* , * avkproxy.exe* , * psuaservice.exe* , * k7pssrvc.exe* , * acs.exe* , * clamwin.exe* , * fortitray.exe* , * k7crvsvc.exe* , * bavupdater.exe* , * certreg.exe* , * fpavserver.exe* , * filmsg.exe* , * k7sysmon.exe* , * econser.exe* , * zlh.exe* , * uiupdatetray.exe* , * fshoster32.exe* , * psview.exe* , * sapissvc.exe* , * quamgr.exe* , * k7rtscan.exe* , * schmgr.exe* , * fsma32.exe* , * zlhh.exe* , * k7fwsrvc.exe* , * twssrv.exe* , * nanoav.exe* , * fpwin.exe* , * useraccountcontrolsettings.exe* , * freshclam.exe* , * wireshark.exe* , * ns.exe* , * coreframeworkhost.exe* , * sbamtray.exe* , * scproxysrv.exe* , * viewtcp.exe* , * sdfssvc.exe* , * fshdll64.exe* , * avkservice.exe* , * nfservice.exe* , * utsvc.exe* , * traysser.exe* , * nvcsvc.exe* , * sdscan.exe* , * ptsvchost.exe* , * k7sysmon.exe* , * procexp.exe* , * mpuxsrv.exe* , * quhlpsvc.exe* , * superdelete.exe* , * guardxservice.exe* , * msascui.exe* , * mcshieldds.exe* , * k7tsmain.exe* , * trigger.exe* , * econceal.exe* , * fsgk32.exe* , * adawareservice.exe* , * mbamscheduler.exe* , * mcs-uninstall.exe* , * fortiesnac.exe* , * k7avscan.exe* , * nbrowser.exe* , * nseupdatesvc.exe* , * guardxkickoff_x64.exe* , * bavhm.exe* , * cistray.exe* , * agentsvc.exe* , * adawaretray.exe* , * av_task.exe* , * njeeves2.exe* , * coreserviceshell.exe* , * k7tsmain.exe* , * uiwatchdog.exe* , * freshclamwrap.exe* , * k7avscan.exe* , * psuamain.exe* , * sdtray.exe* , * gdscan.exe* , * mcshieldccc.exe* , * cmdagent.exe* , * dragon_updater.exe* , * cis.exe* , * forticlient.exe* , * sascore64.exe* , * bav.exe* , * ssupdate64.exe* , * scanner.exe* , * v3svc.exe* , * bavsvc.exe* , * psanhost.exe* , * gdbginx64.exe* , * k7emlpxy.exe* , * gdsc.exe* , * avk.exe* , * text2pcap.exe* , * fssm32.exe* , * userreg.exe* , * iptray.exe* , * emlproxy.exe* , * processhacker.exe* , * k7tsmngr.exe* , * filwscc.exe* , * mpcmdrun.exe* , * k7emlpxy.exe* , * virusutilities.exe* , * k7tsecurity.exe* , * fchelper64.exe* , * k7crvsvc.exe* , * capinfos.exe* , * v3medic.exe* , * fsm32.exe* , * k7pssrvc.exe* , * fmon.exe* , * gdkbfl.exe* , * op_mon.exe* , * vipreui.exe* , * uiseagnt.exe* , * zanda.exe* , * cavwp.exe* , * bdssvc.exe* , * nanosvc.exe* , * mwagent.exe* , * k7rtscan.exe* , * editcap.exe* , * bavwebclient.exe* , * fsorsp.exe* , * scsecsvc.exe* , * fortiproxy.exe* , * configsecuritypolicy.exe* , * trayicos.exe* , * sbamsvc.exe* , * cyserver.exe* AND target process name = taskkill.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SELinux was set to permissive mode Informational Tampering

    SELinux was set to permissive mode using the "setenforce 0" command.

    Indicator:

    Process action type = execution AND target process cmd =~ .*\s+0($|\s+.*) AND target process name = setenforce Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Security services stopped Informational Tampering

    Attackers may stop security critical services to avoid possible detection of their activities.

    Indicator:

    Process action type = execution AND target process name = service , systemctl AND target process cmd = *stop*iptables* , *iptables*stop* , *firewalld*stop* , *stop*firewalld* , *stop*rsyslog* , *rsyslog*stop* , *stop*cbdaemon* , *cbdaemon*stop* , *disable*rsyslog* , *rsyslog*disable* , *stop*falcon-sensor* , *falcon-sensor*stop* , *falcon-sensor*disable* , *disable*falcon-sensor* Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • SmartScreen disabled via Registry Informational Evasion

    These Registry keys control the SmartScreen. Malware may turn it off to evade SmartScreen functionality.

    Indicator:

    Registry os actor process signature vendor != Bromium, Inc. AND registry data = 0 AND registry value name = EnableSmartScreen AND action type = set_registry_value Process initiator path != *windows defender* AND cgo path != *windows defender* AND os parent path != *windows defender* AND initiated by != svchost.exe AND ccmexec.exe AND mmc.exe AND cgo name != svchost.exe AND ccmexec.exe AND mmc.exe AND os parent name != svchost.exe AND ccmexec.exe AND mmc.exe AND initiator signer != Bromium, Inc. AND cgo signer != Bromium, Inc. AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , os parent signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious AMSI DLL load location Low Evasion

    An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

    Indicator:

    Image Load module path != *windows\system32* AND *windows\syswow64* AND *windows\winSxS* AND *kaspersky lab* AND module path = *\amsi.dll Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Suspicious usage of cytool.exe Informational Evasion

    The Cortex XDR agent can be controlled by a command-line tool named cytool.exe. Attackers may use it to disable the Cortex XDR agent.

    Indicator:

    Process action type = execution AND target process name = cytool.exe , cytool Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != *palo alto networks* AND cgo signer != *palo alto networks* AND initiator cmd != *zzzzInvokeManagedCustomActionOutOfProc* AND cgo cmd != *zzzzInvokeManagedCustomActionOutOfProc* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Tampering with Windows Control Panel configuration Informational Evasion

    DLLs with .cpl suffix are executed when accessing the Control Panel. Malicious code may run this way even if AppLocker enabled.

    Indicator:

    Registry action type = all AND registry key name = *software\Microsoft\Windows\CurrentVersion\Control Panel\CPLs* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) System Binary Proxy Execution: Control Panel (T1218.002)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Tampering with Windows certificate blocking configuration Informational Evasion

    Adding subkeys of the certificates to block disallows a security vendor's certificate on the affected computer, so that Windows would not allow the program to run.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • WMI terminated a process Informational Execution

    The Windows Management Instrumentation CLI killed another process running on the endpoint or on a remote host. Malware may do this to evade detection.

    Indicator:

    Process action type = execution AND target process cmd = *process*where*call terminate AND target process name = wmic.exe Process initiated by != msiexec.exe , cgo name != msiexec.exe

    ATT&CK tactics: Defense Evasion (TA0005) Execution (TA0002)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Windows Management Instrumentation (T1047)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows Firewall disabled via Registry Informational Tampering

    An attacker may disable the Windows Firewall via the Registry to bypass network controls.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry value name = donotallowexceptions , enablefirewall AND registry data = 0 AND registry key name = *system\*\services\sharedaccess\parameters\firewallpolicy\* Process initiated by != svchost.exe AND dllhost.exe AND mmc.exe AND sihost.exe AND cgo name != svchost.exe AND dllhost.exe AND mmc.exe AND sihost.exe AND initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Symantec Corporation AND CyberArk Software Ltd. AND McAfee, Inc. AND Kaspersky Lab AND Avira Operations GmbH & Co. KG AND F-Secure Corporation AND IBM Corporation AND cgo signer != Symantec Corporation AND CyberArk Software Ltd. AND McAfee, Inc. AND Kaspersky Lab AND Avira Operations GmbH & Co. KG AND F-Secure Corporation AND IBM Corporation Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify System Firewall (T1562.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows Firewall notifications disabled via Registry Informational Tampering

    These Registry keys control the Windows Firewall notifications. Malware may turn notifications off before editing the firewall settings.

    Indicator:

    Registry registry data = 1 AND registry key name = *system\*\services\sharedaccess\parameters\firewallpolicy\* AND registry value name = disablenotifications AND action type = set_registry_value Process initiator path != *leverit* AND *kaspersky* AND *f-secure* AND cgo path != *leverit* AND *kaspersky* AND *f-secure* AND initiated by != svchost.exe AND dllhost.exe AND cgo name != svchost.exe AND dllhost.exe Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Impair Defenses: Disable or Modify System Firewall (T1562.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows PowerShell Logging being disabled via Registry Informational Evasion

    Tampering of the key can disable event logging by the PowerShell, allowing the adversary to evade being detected using PowerShell.

    Indicator:

    Registry action type = set_registry_value , delete_registry_value AND registry data = 0 , None AND registry key name = *Policies\Microsoft\Windows\PowerShell\ModuleLogging* AND registry value name = EnableModuleLogging Process initiator cmd != *gpsvc* AND *netsvcs* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Indicator Blocking (T1562.006)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Windows Registry Editor being disabled via Registry Informational Evasion

    Registry Editor may be enabled / disabled using this key. This could indicate either IT policy applied or malicious activity preventing the user from altering the Registry.

    Indicator:

    Registry action type = all AND registry data != 0 AND registry key name = *\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System AND registry value name = DisableRegistryTools Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows Task Manager being disabled via Registry Informational Tampering

    Task manager may be disabled to tamper with the user experience and with the response to a malicious incident.

    Indicator:

    Registry action type = all AND registry data = 1 AND registry key name = *\Software\Microsoft\Windows\CurrentVersion\Policies\System AND registry value name = DisableTaskMgr Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Windows set to permit unsigned drivers (Test Mode) Medium Tampering

    This host has been set into 'Test Mode' which allows loading of unsigned drivers. It has legitimate uses, but can be leveraged by malware to load malicious untrusted drivers.

    Indicator:

    Process action type = execution AND target process cmd = */set*testsigning*on* AND target process name = bcdedit.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11