Execution T1203 exploit_CVE_2017_11882: Exploits CVE-2017-11882 vulnerability
Defense Evasion T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1497.002 async_mouse: Watches for mouse clicks using GetAsyncKeyState to detect human activity
Discovery T1083 checks_recent_files: Attempt to check recently opened files through registry
T1082 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1497.002 async_mouse: Watches for mouse clicks using GetAsyncKeyState to detect human activity
Other yara_rules: Static rules
suspicious_process_network: Unusual process network activity detected
suspicious_process: Spawns a suspicious process
unexpected_exception: Unexpected exception
test_check_service: Starts services