Execution
T1203 office_write_exe: Office document dropped an executable file
Privilege Escalation
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1497.001 antivm_vbox_devices: Detects VirtualBox through the presence of a device
T1497.001 antivm_vmware_devices: Detects VMware through the presence of a certain device
T1497.001 antivm_sandboxie: Attempts to detect Sandboxie
T1497.001 antiemu_wine: Checks for Wine software
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1036 system_filename: Created a file named as a common system file
T1036 system_procname: Created a process named as a common system process
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Credential Access
T1552 cookie_files: Accesses cookie files
T1555.003 cookie_files: Accesses cookie files
Discovery
T1497.001 antivm_vbox_devices: Detects VirtualBox through the presence of a device
T1497.001 antivm_vmware_devices: Detects VMware through the presence of a certain device
T1497.001 antivm_sandboxie: Attempts to detect Sandboxie
T1497.001 antiemu_wine: Checks for Wine software
T1518 antianalysis_detectfile: Attempts to detect analytical applications by presence of certain files
T1518.001 antidbg_devices: Checks for devices typical for debuggers and forensic tools
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
Other
yara_rules: Static rules
executes_dropped_exe: Executes dropped exe files
suspicious_process: Spawns a suspicious process
deepfreeze_mutex: DeepFreeze indicators detected (mutexes)
creates_exe: Creates executable files in the file system
process_crashed: One of the processes has failed
creates_in_programdata: Creates files in the ProgramData directory