Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

UAC bypass

Modifies boot configuration data using bcdedit

Blocklisted process makes network request

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Manipulates Digital Signatures

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

Modifies Windows Firewall