Which type of BIOC rule is currently available in Cortex XDR?

The correct answer is D. Dropper. BIOC (Behavioral Indicators of Compromise) rules in Cortex XDR categorize malicious behaviors into defined types. 'Dropper' is one of the officially supported BIOC rule types, describing malware behavior that downloads or writes additional malicious payloads to disk. The other op

Submitted by krish.m· Apr 18, 2026Detection and Alert Management

Question

Options

AThreat Actor
BDiscovery
CNetwork
DDropper

How the community answered

(38 responses)

A
3% (1)
B
5% (2)
D
92% (35)

Explanation

BIOC (Behavioral Indicators of Compromise) rules in Cortex XDR categorize malicious behaviors into defined types. 'Dropper' is one of the officially supported BIOC rule types, describing malware behavior that downloads or writes additional malicious payloads to disk. The other options-Threat Actor (A), Discovery (B), and Network (C)-are not current BIOC rule type categories within the Cortex XDR BIOC framework. BIOC types are distinct from MITRE ATT&CK tactic names, which can cause confusion; the available BIOC categories map to specific Cortex XDR behavioral rule classifications rather than ATT&CK terminology.

Topics

#BIOC rules#Cortex XDR#Detection capabilities

Community Discussion

No community discussion yet for this question.

Full PCDRA Practice