Monitors specific registry key for changesĪdversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.Ĭontains ability to lookup the windows account nameĪn adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.Ĭontains ability to query the machine versionĪdversaries may target user email to collect sensitive information from a target.įound API call directly followed by "cmp dword ptr, 06h" and "je 0000000140014407h" ( Show Stream)įound API call directly followed by "cmp eax, FFFFFFFFh" and "je 00000001400353D1h" ( Show Stream)įound API call directly followed by "cmp dword ptr, 06h" and "je 3F314407h" from tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe (PID: 2832) ( Show Stream)įound API call directly followed by "cmp eax, FFFFFFFFh" and "je 3F3353D1h" from tinyumbrella_windows-圆4_9_3_4_InstalledJRE.exe (PID: 2832) ( Show Stream)įound API call directly followed by "cmp eax, FFFFFFFFh" and "je 3F0C9C89h" from java.exe (PID: 3112) ( Show Stream)įound API call directly followed by "cmp al, 06h" and "jnc 3F0C01ACh" from java.exe (PID: 3112) ( Show Stream) Reads information about supported languages The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.Ĭontains ability to query the machine timezoneĪdversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how.
Process injection is a method of executing arbitrary code in the address space of a separate live process.
Opens the Kernel Security Device Driver (KsecDD) of Windows Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager.Ĭontains ability to open/control a service