Execution
T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)
Credential Access
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
Collection
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
Command and Control
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
Other
yara_rules: Static rules
test_check_service: Starts services