Execution
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 suspicious_process: Spawns a suspicious process
T1059.003 executes_dropped_cmd: Executes dropped batch files
Persistence
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1136.001 add_user: Creates a new Windows user account
T1098 changes_user_password: Attempts to change user password
T1098 add_user_to_admin: Adds an elevated user to a group
T1098 add_user_to_group: Adds user to a group
T1543.003 creates_service: Creates a service
Privilege Escalation
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1098 changes_user_password: Attempts to change user password
T1098 add_user_to_admin: Adds an elevated user to a group
T1098 add_user_to_group: Adds user to a group
T1543.003 creates_service: Creates a service
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1126 disconnects_mapped_device: Removes network share connection
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1082 has_wmi: Executes one or several WMI requests
T1518 locates_browser: Attempts to identify where browsers are installed
T1016 system_network_configuration_discovery: System network configuration discovery detected
T1082 reads_csrss: Attempts to read csrss.exe memory
T1082 recon_systeminfo: Collects system information (ipconfig, netstat, systeminfo, net)
T1087.001 local_account_discovery: Enumerates local accounts
Lateral Movement
T1021.001 rdp_persistence: Permits remote access to the computer (over RDP)
T1021.001 rdp_persistence3: Modifies Windows password policy (RDP connection)
Command and Control
T1071.001 network_cnc_http: Suspicious HTTP traffic
T1071.001 network_http: Performs HTTP requests
Impact
T1531 changes_user_password: Attempts to change user password
Other
creates_in_windows: Creates files in the Windows directory
hide_user_from_logon: Hide user from log-on screen
driver_load: Loads a driver
suricata_alert: Malicious traffic detected
opens_document: Opens office documents
creates_exe: Creates executable files in the file system
creates_doc: Creates (office) documents in the file system
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object
creates_in_programdata: Creates files in the ProgramData directory
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call