Detects LgoogLoader payload

LgoogLoader

A downloader capable of dropping and executing other malware families.

UAC bypass

Windows security bypass

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

Detects Windows executables referencing non-Windows User-Agents

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding command execution via IExecuteCommand COM object

Detects executables potentially checking for WinJail sandbox window