Persistence
T1543.003 creates_service: Creates a service, that will start automatically
Privilege Escalation
T1543.003 creates_service: Creates a service, that will start automatically
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1070.004 deletes_self: Moves to different location or removes the original executable file
T1564.004 removes_zoneid_ads: Attempts to hide the indications that the file was downloaded from the Internet
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
Discovery
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
Other
yara_rules: Static rules
banker_emotet: Emotet banking trojan indicators detected
creates_in_windows: Creates files in the Windows directory
no_graphical_activity: No graphic activity
has_pdb: This executable file has a PDB path
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
pe_overlay: PE file contains overlay