BIOCs

Browse the Cortex behavioral indicator of compromise (BIOC) detection rules.

Severity ▾
Category ▾

4 BIOCs match the current filters. technique: T1574 ✕

Download CSV Show ATT&CK heatmap
  • DLL sideloading attack using Xwizard Low Evasion

    Xwizard has a known DLL-sideloading vulnerability, which involves moving the legitimate Xwizard.exe file into a new directory along with a malicious Xwizard.dll file. This is a possible indicator of an attacker preparing to execute a DLL-sideloading attack.

    Indicator:

    Process action type = execution AND target process path != *\windows\system32\xwizard.exe AND *\windows\syswow64\xwizard.exe AND *\windows\winsxs\ AND target process name = xwizard.exe

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Manipulation of service imagepath configuration Informational Persistence

    This key specifies the location of the executable file for the driver or service. Malicious executables might be installed in these paths.

    Indicator:

    Registry action type = create_registry_key , set_registry_value AND registry key name = *\services\*\imagepath Host host os = windows

    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Create or Modify System Process: Windows Service (T1543.003) Hijack Execution Flow: Services Registry Permissions Weakness (T1574.011)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11
  • Suspicious AMSI DLL load location Low Evasion

    An attacker may attempt to load a malicious copy of amsi.dll to bypass Microsoft's Antimalware Scan Interface (AMSI).

    Indicator:

    Image Load module path != *windows\system32* AND *windows\syswow64* AND *windows\winSxS* AND *kaspersky lab* AND module path = *\amsi.dll Host host os = windows

    ATT&CK tactics: Defense Evasion (TA0005)
    ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001) Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-08-23
  • WptsExtensions.dll created to disk Medium Privilege Escalation

    The Task Scheduler service attempts to load the missing WptsExtensions.dll. As a result, the creation of this file may be indicative of DLL hijacking.

    Indicator:

    File action type = create , read , rename , write AND file name = wptsExtensions.dll

    ATT&CK tactics: Privilege Escalation (TA0004)
    ATT&CK techniques: Hijack Execution Flow: DLL (T1574.001)
    Preventable:
    Yes
    Source:
    Palo Alto Networks
    Updated:
    2026-02-11