Privilege Escalation
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1497.001 antivm_hyperv_keys: Attempts to detect Hyper-V
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1497.001 antivm_hyperv_keys: Attempts to detect Hyper-V
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1518 recon_programs: Collects information about installed programs
Other
only_exec_in_archive: The archive contains only an executable file
process_crashed: One of the processes has failed
create_rpc_bindings: Creates RPC connection
suspicious_network_port: Performs TCP or UDP request to non-standard port