Execution
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1569.002 persistence_service: Starts newly created service
T1047 has_wmi: Executes one or several WMI requests
Persistence
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1543.003 creates_service: Creates a service, that will start automatically
T1546.003 persistence_wmi_event: Creates WMI event subscription
T1574 dropper_dll: Creates DLL, which is then loaded into the process
Privilege Escalation
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1543.003 creates_service: Creates a service, that will start automatically
T1546.003 persistence_wmi_event: Creates WMI event subscription
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1027.002 pe_features: Executable file has PE anomalies (may be false positive)
T1070 stealth_window: A process created a hidden window
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1518 locates_browser: Attempts to identify where browsers are installed
T1049 list_ts_rdp_sessions: Lists ts/rdp sessions
Other
creates_exe: Creates executable files in the file system
creates_in_windows: Creates files in the Windows directory
executes_dropped_exe: Executes dropped exe files
process_crashed: One of the processes has failed
unexpected_exception: Unexpected exception
unsigned_driver_drop: Sample is not signed and drops a device driver
driver_load: Loads a driver
create_rpc_bindings: Creates RPC connection
require_administrator: Requests administrator privileges
creates_suspended_process: Creates suspended process
origin_langid: Unconventional language of the executable file
test_check_service: Starts services