Initial Access
T1192 html_urls: HTML-document downloads a file
Defense Evasion
T1027.002 packer_entropy: Probably contains compressed or encrypted data
Command and Control
T1071.001 network_http: Performs HTTP requests
Other
steganographic_png: Possible malicious steganographic PNG
suricata_alert: Malicious traffic detected
dead_dotnet_downloader_404: Dotnet downloader attempts to connect to a dead host
dotnet_suspicious_module_name: Dotnet program has suspicious module name
suspicious_network_port: Performs TCP or UDP request to non-standard port
yara_rules: Static rules