Privilege Escalation
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1218.011 rundll_shell32: Uses Control_RunDLL to run an executable file
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1518 locates_browser: Attempts to identify where browsers are installed
Other
yara_rules: Static rules
create_process_failed: Could not start the process
creates_exe: Creates executable files in the file system
dotnet_suspicious_resources_names: Dotnet program has suspicious resources names
creates_suspended_process: Creates suspended process
dotnet_import_unmanaged_code: Dotnet program statically imports unmanaged functions/modules
origin_langid: Unconventional language of the executable file
dotnet_suspicious_entrypoint: Dotnet program has suspicious entrypoint
dotnet_suspicious_module_name: Dotnet program has suspicious module name