Persistence
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
Privilege Escalation
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
Defense Evasion
T1036 system_procname: Created a process named as a common system process
T1497.003 antisandbox_sleep_utilities: Uses Windows utilities for pausing the execution
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1070.004 self_removal_command: Executes command to delete itself
Credential Access
T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files
Discovery
T1497.003 antisandbox_sleep_utilities: Uses Windows utilities for pausing the execution
Command and Control
T1071.001 network_cnc_http: Suspicious HTTP traffic
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_openurl: Performs HTTP/HTTPS-requests using InternetOpenUrl
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet
Other
yara_rules: Static rules
ip_domains: Identifies an IP address using external resources
dns_without_resolve: DNS query without a response
suspicious_process: Spawns a suspicious process
no_graphical_activity: No graphic activity
suricata_alert: Malicious traffic detected