Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables referencing combination of virtualization drivers

Detects executables referencing virtualization MAC addresses

Enumerates VirtualBox registry keys

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Looks for VMWare drivers on disk