Event Triggered Execution: Component Object Model Hijacking

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

Modifies system executable filetype association

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

Legitimate hosting services abused for malware hosting/C2