Execution
T1059.003 suspicious_process: Spawns a suspicious process
Persistence
T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
Privilege Escalation
T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1562 delete_fw_rule: Disables Firewall rules
T1574.011 persistence_services: Modifies Services registry key
T1070 stealth_window: A process created a hidden window
T1070.004 self_removal_command: Executes command to delete itself
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1057 process_interest: Enumerates processes
T1082 uses_windows_utilities: Uses Windows utilities for basic Windows functionality
T1518 recon_programs: Collects information about installed programs
Impact
T1489 net_stop: Stops services through the use of net stop
Other
creates_in_windows: Creates files in the Windows directory
no_graphical_activity: No graphic activity
has_pdb: This executable file has a PDB path
creates_suspended_process: Creates suspended process
message_box: Displays a message
error_drawtext: An error occured while executing the file
get_policy_info: Retrieves information about a Policy object