Detect binaries embedding considerable number of MFA browser extension IDs.

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Detects executables manipulated with Fody

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

Detects executables referencing many email and collaboration clients. Observed in information steale

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.