BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

8 BIOCs match the current filters. technique: T1564 ✕

Download CSV Show ATT&CK heatmap
  • Hidden directory creation Informational Evasion

    Attackers may create hidden directories to hide malware or staged files.

    Indicator:

    Process action type = execution AND target process cmd = *.* AND target process name = mkdir

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Hidden file and directory creation Informational Evasion

    Creation of a hidden file inside a hidden directory.

    Indicator:

    File action type = create , rename AND file name = .* AND file path =~ .*/\.[^/]+/\.[^/]+ Host host os = linux

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • ISO mounted manually Informational Evasion

    A user manually mounted an ISO file.

    Indicator:

    File file name = *.iso.lnk AND file path = *\appdata\roaming\microsoft\windows\recent\* AND action type = create Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Process runs from the recycle bin Low Evasion

    Process running from the recycle bin.

    Indicator:

    Process action type = execution AND target process path = *:\$recycle.bin\* Process cgo name != ECSSoftwareAutoUpdater.exe AND ECSManager.exe AND Sapstartsrv.exe AND ECSMonitor.exe AND ECSPlayer.exe AND Chrome.exe AND cgo path != *Microsoft VS Code* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Scripting engine creates an Alternate Data Stream (ADS) Informational Evasion

    Malware may hide data inside alternate data streams instead of inside a file.

    Indicator:

    File action type = create , delete AND file name = *:* Process initiated by = wscript.exe , cscript.exe , cmd.exe , powershell.exe , mshta.exe , psw.exe , python.exe , java.exe , javaw.exe , regsvr32.exe , expand.exe , lua.exe , ruby.exe , cgo name = wscript.exe , cscript.exe , cmd.exe , powershell.exe , mshta.exe , psw.exe , python.exe , java.exe , javaw.exe , regsvr32.exe , expand.exe , lua.exe , ruby.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • The scripting engine executed code from an Alternate Data Stream (ADS) Informational Evasion

    Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. An attacker may try to evade detection by executing malware from the ADS value of a file.

    Indicator:

    Process action type = execution AND target process name = rundll32.exe , mavinject.exe , forfiles.exe , wscript.exe , cscript.exe , mshta.exe , control.exe , sc.exe , regedit.exe , bitsadmin.exe , appvlp.exe , cmd.exe , ftp.exe , bash.exe , regsvr32.exe , regini.exe AND target process cmd =~ :[A-Za-z0-9]{1,}\.(exe|dll|vbs|js|hta|reg|bat|txt|sh|ini|ps1) Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process creates an Alternate Data Stream (ADS) Informational Evasion

    Alternate Data Streams (ADSs) are NTFS Master File Table (MFT) data entries that relate to a file, but are separate from its contents. Malware may attempt to evade discovery by placing their payload in an ADS.

    Indicator:

    File file name = *:* AND action type = create Process initiator signature = Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Unsigned , N/A , Invalid Signature , Weak Hash Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: NTFS File Attributes (T1564.004)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • Unsigned process running from a temporary directory Informational Evasion

    Malware often runs from a temporary folder.

    Indicator:

    Process action type = execution AND process execution signature = N/A , Unsigned , Invalid Signature AND target process path = *temp* Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11