Execution
T1204 suspicious_lnk: LNK file with suspicious content
Persistence
T1543.003 creates_service: Creates a service, that will start automatically
Privilege Escalation
T1543.003 creates_service: Creates a service, that will start automatically
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1218 suspicious_cmdline_keywords: Cmdline with suspicious keywords
Credential Access
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
Collection
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
T1560.001 archive_via_utility: Detected archiving data via utility
Impact
T1529 shutdown_system: Shuts the system down
Other
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object