Execution
T1059.001 suspicious_powershell: Creates suspicious powershell process
T1203 office_exploit_creates_cmd: The document exhibits suspicious behaviour (creates a cmd.exe process)
T1059 cmd_vbs: Uses cmd.exe to generate VBS
T1203 chm_run_process: Windows HtmlHelp file runs an application
T1059.001 suspicious_process: Spawns a suspicious process
T1059.003 suspicious_cmd: Executes cmd.exe with a suspicious command line
T1059.003 executes_dropped_cmd: Executes dropped batch files
T1059.005 obfuscated_vbs: Detected obfuscated VBS
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL
T1047 has_wmi: Executes one or several WMI requests
Privilege Escalation
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1070 cmd_vbs: Uses cmd.exe to generate VBS
T1036 copies_utilities: Copies and runs system utility with different name
T1218.001 chm_run_process: Windows HtmlHelp file runs an application
T1027 suspicious_cmd: Executes cmd.exe with a suspicious command line
T1027 obfuscated_vbs: Detected obfuscated VBS
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Credential Access
T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files
Discovery
T1082 uses_windows_utilities: Uses Windows utilities for basic Windows functionality
T1083 crawls_directories: Opens a huge number of directories all over disk C: (possibly, searches for sensitive data)
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1082 reads_csrss: Attempts to read csrss.exe memory
Collection
T1560.001 archive_via_utility: Detected archiving data via utility
Command and Control
T1105 lolbin_extrac32: Download or Copy file with Extrac32
T1071.001 network_cnc_http: Suspicious HTTP traffic
T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet
Other
yara_rules: Static rules
creates_exe: Creates executable files in the file system
executes_dropped_exe: Executes dropped exe files
modifies_certs: Attempts to generate or modify system certificates
unexpected_exception: Unexpected exception
create_rpc_bindings: Creates RPC connection
pdf_compressed_stream: Contains an object with compressed stream
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object
creates_in_programdata: Creates files in the ProgramData directory
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
suricata_alert: Malicious traffic detected