add_antivirus_exclusion(regex)
|
Returns the number of events of a specific type.
|
In order to make it harder to detect in the operating system, adds anti-virus exclusions using the registry keys. Only the keys that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.add_antivirus_exclusion(/pattern/)
|
add_antivirus_exclusion_num
|
Returns the number of events of a specific type.
|
In order to make it harder to detect in the operating system, adds anti-virus exclusions using the registry keys.
|
dr_sandbox.descr_tech.malicious.add_antivirus_exclusion_num
|
block_cmd
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks the Command Prompt (CMD) system utility.
|
dr_sandbox.descr_tech.malicious.block_cmd
|
block_regedit
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks the Registry Editor (RegEdit) system utility.
|
dr_sandbox.descr_tech.malicious.block_regedit
|
block_system_file_checker
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks System File Checker (SFC).
|
dr_sandbox.descr_tech.malicious.block_system_file_checker
|
block_system_restore
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks System Restore (SR).
|
dr_sandbox.descr_tech.malicious.block_system_restore
|
block_taskmgr
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks the Windows Task Manager (Taskmgr) system utility.
|
dr_sandbox.descr_tech.malicious.block_taskmgr
|
block_user_account_control
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks User Account Control (UAC).
|
dr_sandbox.descr_tech.malicious.block_user_account_control
|
block_windows_action_center
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks Windows Action Center.
|
dr_sandbox.descr_tech.malicious.block_windows_action_center
|
block_windows_defender
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks the Windows Defender system utility.
|
dr_sandbox.descr_tech.malicious.block_windows_defender
|
block_windows_file_protection
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks Windows File Protection (WFP).
|
dr_sandbox.descr_tech.malicious.block_windows_file_protection
|
block_windows_firewall
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks the Windows Firewall system utility.
|
dr_sandbox.descr_tech.malicious.block_windows_firewall
|
block_windows_security_center
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks Windows Security Center.
|
dr_sandbox.descr_tech.malicious.block_windows_security_center
|
block_windows_updates
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, blocks the Windows Update system utility.
|
dr_sandbox.descr_tech.malicious.block_windows_updates
|
bruteforce_os_accounts
|
Returns 1 if the event occurred, 0 otherwise.
|
Brute forces passwords of OS accounts.
|
dr_sandbox.descr_tech.malicious.bruteforce_os_accounts
|
create_and_exec(regex)
|
Returns the number of events of a specific type.
|
Creates and executes. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.create_and_exec(/Total Commander/)
|
create_and_exec_num
|
Returns the number of events of a specific type.
|
Creates and executes.
|
dr_sandbox.descr_tech.malicious.create_and_exec_num > 0
|
create_onion_service
|
Returns the number of events of a specific type.
|
Creates an onion service.
|
dr_sandbox.descr_tech.malicious.create_onion_service
|
delete_volume_shadow_copies
|
Returns the number of events of a specific type.
|
In order to make it harder to detect in the operating system, deletes volume shadow copies.
|
dr_sandbox.descr_tech.malicious.delete_volume_shadow_copies
|
detect_virtual_machine(regex)
|
Returns the number of events of a specific type.
|
Searches for windows to detect virtual machines. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.detect_virtual_machine(/pattern/)
|
detect_virtual_machine_num
|
Returns the number of events of a specific type.
|
Searches for windows to detect virtual machines.
|
dr_sandbox.descr_tech.malicious.detect_virtual_machine_num
|
disable_amsi
|
Returns the number of events of a specific type.
|
Disables AMSI.
|
dr_sandbox.descr_tech.malicious.disable_amsi
|
downloads_and_executes(regex)
|
Returns the number of events of a specific type.
|
Downloads and executes. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.downloads_and_executes(/pattern/)
|
downloads_and_executes_num
|
Returns the number of events of a specific type.
|
Downloads and executes.
|
dr_sandbox.descr_tech.malicious.downloads_and_executes_num
|
downloads_and_executes_files
|
Returns the number of events of a specific type.
|
Downloads and executes the files. Only the files that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.downloads_and_executes_files
|
download_file(regex)
|
Returns the number of events of a specific type.
|
Downloads files. Only the files that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.download_file(/pattern/)
|
download_file_num
|
Returns the number of events of a specific type.
|
Downloads files.
|
dr_sandbox.descr_tech.malicious.download_file_num
|
download_files
|
Returns 1 if the event occurred, 0 otherwise.
|
Downloads files.
|
dr_sandbox.descr_tech.malicious.download_files
|
exec(regex)
|
Returns the number of events of a specific type.
|
Executes. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.exec(/netsh.exe/)
|
exec_num
|
Returns the number of events of a specific type.
|
Executes.
|
dr_sandbox.descr_tech.malicious.exec_num > 0
|
exec_wmi(regex)
|
Returns the number of events of a specific type.
|
Executes WMI operations. Only the operations that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.exec_wmi(/pattern/)
|
exec_wmi_num
|
Returns the number of events of a specific type.
|
Executes WMI operations.
|
dr_sandbox.descr_tech.malicious.exec_wmi_num
|
exploit_create_and_exec(regex)
|
Returns the number of events of a specific type.
|
Creates and executes (an exploit). Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.exploit_create_and_exec(/pattern/)
|
exploit_create_and_exec_num
|
Returns the number of events of a specific type.
|
Creates and executes files (an exploit).
|
dr_sandbox.descr_tech.malicious.exploit_create_and_exec_num
|
exploit_create_and_load_library(regex)
|
Returns the number of events of a specific type.
|
Creates and loads libraries (an exploit). Only the libraries that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.exploit_create_and_load_library(/pattern/)
|
exploit_create_and_load_library_num
|
Returns the number of events of a specific type.
|
Creates and loads libraries (an exploit).
|
dr_sandbox.descr_tech.malicious.exploit_create_and_load_library_num
|
exploit_exec(regex)
|
Returns the number of events of a specific type.
|
Executes (an exploit). Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.exploit_exec(/pattern/)
|
exploit_exec_num
|
Returns the number of events of a specific type.
|
Executes (an exploit).
|
dr_sandbox.descr_tech.malicious.exploit_exec_num
|
force_autorun_for_removable_media
|
Returns 1 if the event occurred, 0 otherwise.
|
Forces autorun for removable media.
|
dr_sandbox.descr_tech.malicious.force_autorun_for_removable_media
|
hide_from_view_file_extensions
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, forces the system to hide file extensions from view.
|
dr_sandbox.descr_tech.malicious.hide_from_view_file_extensions
|
hide_from_view_hidden_files
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, forces the system to hide hidden files from view.
|
dr_sandbox.descr_tech.malicious.hide_from_view_hidden_files
|
hide_processes(regex)
|
Returns the number of events of a specific type.
|
Hides processes. Only the processes that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.hide_processes(/cscript.exe/)
|
hide_processes_num
|
Returns the number of events of a specific type.
|
Hides processes.
|
dr_sandbox.descr_tech.malicious.hide_processes_num > 0
|
hide_taskbar_notifications
|
Returns 1 if the event occurred, 0 otherwise.
|
In order to make it harder to detect in the operating system, disables taskbar notifications.
|
dr_sandbox.descr_tech.malicious.hide_taskbar_notifications
|
hook_in_browser(regex)
|
Returns the number of events of a specific type.
|
Hooks functions in browsers. Only the processes that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.hook_in_browser(/pattern/)
|
hook_in_browser_num
|
Returns the number of events of a specific type.
|
Hooks functions in browsers.
|
dr_sandbox.descr_tech.malicious.hook_in_browser_num
|
hook_keyboard_all_processes(regex)
|
Returns the number of events of a specific type.
|
Installs hooks to intercept notifications on keystrokes.
Handler for all processes (?LibraryPath).
|
dr_sandbox.descr_tech.malicious.hook_keyboard_all_processes(/OQKWHP\BJX.01/)
|
hook_keyboard_all_processes_num
|
Returns the number of events of a specific type.
|
Installs hooks to intercept notifications on keystrokes.
|
dr_sandbox.descr_tech.malicious.hook_keyboard_all_processes_num > 0
|
hook_keyboard_concrete_processes(regex)
|
Returns the number of events of a specific type.
|
Installs hooks to intercept notifications on keystrokes.
Handler for the '(?HookedProcess.Name)' process: (?LibraryPath).
|
dr_sandbox.descr_tech.malicious.hook_keyboard_concrete_processes(/IMDCSC.exe/)
|
hook_keyboard_concrete_processes_num
|
Returns the number of events of a specific type.
|
Installs hooks to intercept notifications on keystrokes.
|
dr_sandbox.descr_tech.malicious.hook_keyboard_concrete_processes_num > 0
|
hook_keyboard_on_window_messages(regex)
|
Returns the number of events of a specific type.
|
Installs hooks to intercept notifications on window messages. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.hook_keyboard_on_window_messages(/pattern/)
|
hook_keyboard_on_window_messages_num
|
Returns the number of events of a specific type.
|
Installs hooks to intercept notifications on window messages.
|
dr_sandbox.descr_tech.malicious.hook_keyboard_on_window_messages_num
|
inject_to_a_lot_of_user_processes
|
Returns 1 if the event occurred, 0 otherwise.
|
Injects code into numerous user processes.
|
dr_sandbox.descr_tech.malicious.inject_to_a_lot_of_user_processes
|
inject_to_system_proc(regex)
|
Returns the number of events of a specific type.
|
Injects code into system processes. Only the processes that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.inject_to_system_proc(/RegAsm.exe/)
|
inject_to_system_proc_num
|
Returns the number of events of a specific type.
|
Injects code into system processes.
|
dr_sandbox.descr_tech.malicious.inject_to_system_proc_num > 0
|
inject_to_user_proc(regex)
|
Returns the number of events of a specific type.
|
Injects code into user processes. Only the processes that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.inject_to_user_proc(/^iexplore.exe$/)
|
inject_to_user_proc_num
|
Returns the number of events of a specific type.
|
Injects code into user processes.
|
dr_sandbox.descr_tech.malicious.inject_to_user_proc_num > 0
|
modify_explorer_settings(regex)
|
Returns the number of events of a specific type.
|
Modifies settings of Windows Explorer. Only the settings that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.modify_explorer_settings(/’NoFolderOptions’ = ‘00000001’/)
|
modify_explorer_settings_num
|
Returns the number of events of a specific type.
|
Modifies settings of Windows Explorer.
|
dr_sandbox.descr_tech.malicious.modify_explorer_settings_num > 0
|
modify_ie_settings(regex)
|
Returns the number of events of a specific type.
|
Modifies settings of Windows Internet Explorer. Only the settings that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.modify_ie_settings(/Zones\1] ‘1206’ = ‘00000000’/)
|
modify_ie_settings_num
|
Returns the number of events of a specific type.
|
Modifies settings of Windows Internet Explorer.
|
dr_sandbox.descr_tech.malicious.modify_ie_settings_num > 0
|
modify_registry_to_bypass_firewall(regex)
|
Returns the number of events of a specific type.
|
To bypass firewall, removes or modifies registry keys. Only the keys that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.modify_registry_to_bypass_firewall(/Enabled:taskmg.exe/)
|
modify_registry_to_bypass_firewall_num
|
Returns the number of events of a specific type.
|
To bypass firewall, removes or modifies registry keys.
|
dr_sandbox.descr_tech.malicious.modify_registry_to_bypass_firewall_num > 0
|
modify_system_dns(regex)
|
Returns the number of events of a specific type.
|
In order to make it harder to detect in the operating system, modifies DNS servers. Only the servers that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.modify_system_dns(/pattern/)
|
modify_system_dns_num
|
Returns the number of events of a specific type.
|
In order to make it harder to detect in the operating system, modifies DNS servers.
|
dr_sandbox.descr_tech.malicious.modify_system_dns_num
|
modify_system_settings(regex)
|
Returns the number of events of a specific type.
|
In order to make it harder to detect in the operating system, modifies system settings. Only the settings that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.modify_system_settings(/pattern/)
|
modify_system_settings_num
|
Returns the number of events of a specific type.
|
In order to make it harder to detect in the operating system, modifies system settings.
|
dr_sandbox.descr_tech.malicious.modify_system_settings_num
|
read_third_party_passwords(regex)
|
Returns the number of events of a specific type.
|
Reads files that store third party app passwords. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.read_third_party_passwords(/pattern/)
|
read_third_party_passwords_num
|
Returns the number of events of a specific type.
|
Reads files that store third party app passwords.
|
dr_sandbox.descr_tech.malicious.read_third_party_passwords_num
|
register_bho(regex)
|
Returns the number of events of a specific type.
|
Registers BHO. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.register_bho(/pattern/)
|
register_com_server(regex)
|
Returns the number of events of a specific type.
|
Registers a COM server. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.register_com_server(/pattern/)
|
register_com_server_num
|
Returns the number of events of a specific type.
|
Registers a COM server.
|
dr_sandbox.descr_tech.malicious.register_com_server_num
|
register_filesystem_filter(regex)
|
Returns the number of events of a specific type.
|
Registers a file system filter. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.register_filesystem_filter(/pattern/)
|
restore_ssdt_hooks
|
Returns 1 if the event occurred, 0 otherwise.
|
Restores hooked functions in the System Service Descriptor Table (SSDT).
|
dr_sandbox.descr_tech.malicious.restore_ssdt_hooks
|
search_password_in_registry(regex)
|
Returns the number of events of a specific type.
|
Searches for registry branches where third party apps store their passwords. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.search_password_in_registry(/MessengerService/)
|
search_password_in_registry_num
|
Returns the number of events of a specific type.
|
Searches for registry branches where third-party apps store their passwords.
|
dr_sandbox.descr_tech.malicious.search_password_in_registry_num > 0
|
search_wnd_for_analyzing_soft(regex)
|
Returns the number of events of a specific type.
|
Searches for windows to detect analytical utilities. Only the objects that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.search_wnd_for_analyzing_soft(/PEiD/)
|
search_wnd_for_analyzing_soft_num
|
Returns the number of events of a specific type.
|
Searches for windows to detect analytical utilities.
|
dr_sandbox.descr_tech.malicious.search_wnd_for_analyzing_soft_num > 0
|
search_wnd_for_programs_and_games(regex)
|
Returns the number of events of a specific type.
|
Searches for windows to detect apps and games. Only the windows that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.search_wnd_for_programs_and_games(/The Wireshark Network Analyzer/)
|
search_wnd_for_programs_and_games_num
|
Returns the number of events of a specific type.
|
Searches for windows to detect apps and games.
|
dr_sandbox.descr_tech.malicious.search_wnd_for_programs_and_games_num > 0
|
search_wnd_to_bypass_av(regex)
|
Returns the number of events of a specific type.
|
Searches for windows to bypass anti-viruses. Only the windows that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.search_wnd_to_bypass_av(/AVP.AlertDialog/)
|
search_wnd_to_bypass_av_num
|
Returns the number of events of a specific type.
|
Searches for windows to bypass anti-viruses.
|
dr_sandbox.descr_tech.malicious.search_wnd_to_bypass_av_num > 0
|
search_wnd_to_bypass_wfp(regex)
|
Returns the number of events of a specific type.
|
Searches for windows to bypass Windows Files Protection (WFP). Only the windows that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.search_wnd_to_bypass_wfp(/Windows File Protection/)
|
search_wnd_to_bypass_wfp_num
|
Returns the number of events of a specific type.
|
Searches for windows to bypass Windows Files Protection (WFP).
|
dr_sandbox.descr_tech.malicious.search_wnd_to_bypass_wfp_num > 0
|
set_concrete_ssdt_hooks(regex)
|
Returns the number of events of a specific type.
|
Hooks functions in System Service Descriptor Table (SSDT). Only the functions that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.set_concrete_ssdt_hooks(/pattern/)
|
set_concrete_ssdt_hooks_num
|
Returns the number of events of a specific type.
|
Hooks functions in System Service Descriptor Table (SSDT).
|
dr_sandbox.descr_tech.malicious.set_concrete_ssdt_hooks_num
|
set_homepage_for_ie
|
Returns 1 if the event occurred, 0 otherwise.
|
Sets a new unauthorized home page for Windows Internet Explorer.
|
dr_sandbox.descr_tech.malicious.set_homepage_for_ie
|
set_ssdt_hooks
|
Returns the number of events of a specific type.
|
Hooks functions in System Service Descriptor Table (SSDT).
|
dr_sandbox.descr_tech.malicious.set_ssdt_hooks
|
try_to_terminate_a_lot_of_user_processes
|
Returns 1 if the event occurred, 0 otherwise.
|
Terminates or attempts to terminate numerous user processes.
|
dr_sandbox.descr_tech.malicious.try_to_terminate_a_lot_of_user_processes
|
try_to_terminate_system_processes(regex)
|
Returns the number of events of a specific type.
|
Terminates or attempts to terminate system processes. Only the processes that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.try_to_terminate_system_processes(/ctfmon.exe/)
|
try_to_terminate_system_processes_num
|
Returns the number of events of a specific type.
|
Terminates or attempts to terminate system processes.
|
dr_sandbox.descr_tech.malicious.try_to_terminate_system_processes_num > 0
|
try_to_terminate_user_processes(regex)
|
Returns the number of events of a specific type.
|
Terminates or attempts to terminate user processes. Only the processes that match the regular expression are counted.
|
dr_sandbox.descr_tech.malicious.try_to_terminate_user_processes(/^AVSYNMGR.EXE$/)
|
try_to_terminate_user_processes_num
|
Returns the number of events of a specific type.
|
Terminates or attempts to terminate user processes.
|
dr_sandbox.descr_tech.malicious.try_to_terminate_user_processes_num > 0
|
