Other
yara_rules: Static rules
lockbit: Detected ransomware Lockbit
accesses_mailslot: Performs a Mailslot ping, possibly used to get Domain Controller information
cryptolocker_wallpaper: Ransomware indicators detected (changes the desktop wallpaper file)
network_bind: Starts servers listening at None
opens_document: Opens office documents
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
creates_in_programdata: Creates files in the ProgramData directory
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk
pe_overlay: PE file contains overlay