Initial Access
T1192 downloader_ms_word: Suspicious link to an external file (Microsoft Word)
Execution
T1203 exploit_CVE_2017_0199: Possible exploitation of CVE-2017-0199
T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests
Privilege Escalation
T1055 injection_failed: The attempt to inject into a process has failed
Defense Evasion
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1055 injection_failed: The attempt to inject into a process has failed
Credential Access
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager
Discovery
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1082 has_wmi: Executes one or several WMI requests
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
Other
creates_suspended_process: Creates suspended process
test_check_service: Starts services