Detections by tactic

Command and Control

• Suspicious Outbound HTTP UserAgent

Defense Evasion

• System Binary Masquerading via Non-Standard Execution Path

Exfiltration

• Suspicious Outbound HTTP UserAgent

Persistence

• Malicious Browser Extension Installation
• Potential COM Hijacking and Registry-Based Persistence
• Potential Persistence via IFEO and SilentProcessExit Registry Keys
• Suspicious Modifications to Windows Startup Registry Keys
• Suspicious Shortcut and File Creation in Windows Startup Directories

Privilege Escalation

• Guest Account Activated