Security Operations · Advanced

Behavioral Indicator of Compromise (BIOC)

A Cortex XDR rule that detects malicious behavior based on endpoint activity patterns rather than static indicators.

Definition

BIOC rules define behaviors such as a process creating a file in a startup folder or Office launching scripting engines, and are often mapped to MITRE ATT&CK. Cortex XDR also supports IOC rules for static indicators and correlation rules across data sources. Analysts can create custom BIOCs from XQL queries.

Related terms