Persistence
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
Privilege Escalation
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1564.001 hides_original_file: Makes original executable file hidden
T1564.001 stealth_file: Creates hidden or system files
T1497.001 antivm_network_adapters: Checks NIC addresses
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Discovery
T1497.001 antivm_network_adapters: Checks NIC addresses
T1497.001 antivm_queries_computername: Retrieves the computer name
Impact
T1486 modifies_files2: Cryptolocker indicators detected (50 or more files are modified)
T1486 ransomware_message: Ransomware indicators detected (possible ransom message creation)
Other
yara_rules: Static rules
creates_exe: Creates executable files in the file system
process_crashed: One of the processes has failed
unsigned_driver_drop: Sample is not signed and drops a device driver
telegram_api: Telegram Messenger API is used
dotnet_suspicious_resources_names: Dotnet program has suspicious resources names
has_pdb: This executable file has a PDB path
dotnet_import_unmanaged_code: Dotnet program statically imports unmanaged functions/modules
access_recyclebin: Manipulation with recyclebin detected
dotnet_obfuscated: Dotnet program is potentially obfuscated
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
dotnet_suspicious_module_name: Dotnet program has suspicious module name