Execution
T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)
T1106 susp_callbacks: Suspicious usage of some WinAPI with callbacks
Privilege Escalation
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1497 antidbg_windows: Checks for open windows typical for debuggers and forensic tools
T1497 antidbg_setinformationthread: Attempts to evade debugger using NtSetInformationThread
T1497.001 antivm_generic_disk: Checks information on disk, possibly for anti-virtualization or checking privileges
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1027.002 pe_features: Executable file has PE anomalies (may be false positive)
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1480 system_default_lang_id_present: Checks the system language
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1497 antidbg_windows: Checks for open windows typical for debuggers and forensic tools
T1497 antidbg_setinformationthread: Attempts to evade debugger using NtSetInformationThread
T1497.001 antivm_generic_disk: Checks information on disk, possibly for anti-virtualization or checking privileges
T1082 antivm_generic_disk: Checks information on disk, possibly for anti-virtualization or checking privileges
T1518.001 antidbg_devices: Checks for devices typical for debuggers and forensic tools
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
Other
static_pe_anomaly: The PE file structure contains anomalies
creates_exe: Creates executable files in the file system
process_crashed: One of the processes has failed
static_pe_duplicate_sections: The PE file structure contains anomalies: duplicate section names
dotnet_suspicious_resources_names: Dotnet program has suspicious resources names
net_dumps_in_native: .Net dumps have been found in native PE
has_pdb: This executable file has a PDB path
creates_suspended_process: Creates suspended process
message_box: Displays a message
dotnet_obfuscated: Dotnet program is potentially obfuscated
test_check_service: Starts services
office_links: Office file contains external links
checktokenmembership: Checks user token with CheckTokenMembership call
pe_overlay: PE file contains overlay
executes_dropped_exe: Executes dropped exe files
dotnet_suspicious_entrypoint: Dotnet program has suspicious entrypoint
dotnet_downloader_possible_network_problem: Dotnet program possibly has network problem
many_files_in_archive: The archive contains more than 5 files