Execution
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1569.002 persistence_service: Starts newly created service
T1047 has_wmi: Executes one or several WMI requests
Persistence
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1543.003 creates_service: Creates a service
Privilege Escalation
T1134.004 ppid_spoofing: Parent pid spoofing detected
T1068 integrity_level: Process privileges have been escalated
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1055.012 injection_runpe: Injects code into another process
T1055 injection_runpe_2: Executes injected code in another process
T1543.003 creates_service: Creates a service
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1134.004 ppid_spoofing: Parent pid spoofing detected
T1055.012 injection_runpe: Injects code into another process
T1055 injection_runpe_2: Executes injected code in another process
T1497.001 antivm_firmware: Attempts to detect VM by firmware
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.001 antivm_network_adapters: Checks NIC addresses
T1497 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1497.001 antivm_firmware: Attempts to detect VM by firmware
T1057 has_wmi: Executes one or several WMI requests
T1497.001 antivm_network_adapters: Checks NIC addresses
T1518 locates_browser: Attempts to identify where browsers are installed
T1497 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1082 reads_csrss: Attempts to read csrss.exe memory
T1082 checks_firmware: Attempts to read firmware information (potentially for evasion)
Impact
T1496 cryptopool_domains: Connects to crypto curency mining pool
T1489 net_stop: Stops services through the use of net stop
T1489 service_control_stop: Stops services via ControlService
Other
suricata_alert: Malicious traffic detected
stealth_mapping: Maps module and removes it from disk
yara_rules: Static rules
critical_process: Makes the process critical to the system (the system shuts down when it's terminated)
copies_self: Creates a copy of itself
creates_exe: Creates executable files in the file system
executes_dropped_exe: Executes dropped exe files
unsigned_driver_drop: Sample is not signed and drops a device driver
driver_load: Loads a driver
no_graphical_activity: No graphic activity
require_administrator: Requests administrator privileges
test_check_service: Starts services