Privilege Escalation
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1497.003 antisandbox_sleep_utilities: Uses Windows utilities for pausing the execution
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1070 stealth_window: A process created a hidden window
T1070.004 self_removal_command: Executes command to delete itself
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Credential Access
T1552.001 infostealer_bitcoin: Attempts to obtain access to Bitcoin/ALTCoin wallets
Discovery
T1497.003 antisandbox_sleep_utilities: Uses Windows utilities for pausing the execution
T1057 process_interest: Enumerates processes
T1083 crawls_directories: Opens a huge number of directories all over disk C: (possibly, searches for sensitive data)
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1016.001 system_network_configuration_discovery: System network configuration discovery detected
Impact
T1490 vssadmin_delete_shadows: Attempt to delete volume shadow copies
T1486 modifies_files2: Cryptolocker indicators detected (100 or more files are modified)
T1486 modifies_files: Cryptolocker indicators detected (renamed 100 or more files)
T1489 service_control_stop: Stops services via ControlService
Other
yara_rules: Static rules
ransomware_shadowcopy: Removes volume shadow copies
cryptolocker_wallpaper: Ransomware indicators detected (changes the desktop wallpaper file)
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
access_recyclebin: Manipulation with recyclebin detected
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call