Evasion

ID	Description	Significance / Prevalence
BH12163	Changes settings that enable remote users to run commands on the local computer.
BH12253	Disables Office's macro virus protection capabilities.
BH12281	Disables the Network Inspection service (NIS).
BH12296	Disables the Windows Event Log service.
BH12297	Disables the Windows Firewall service.
BH12302	Disables the Windows Update service.
BH12303	Disables Windows Patchguard.
BH12425	Modifies handler for F11 function key, used to access the macro editor.
BH12426	Modifies handler for F8 function key, used to open the macro dialog box.
BH12462	Overwrites free space and prevents file recovery.
BH12469	Prevents the user from aborting the batch execution.
BH12574	Starts a PowerShell session with execution policy set to 'bypass'.
BH12619	Tampers with debugger.
BH12805	Detects presence of debuggers.
BH12813	Uses JavaScript debugger.
BH12814	Uses ping utility to delay the execution of the application, commonly used as an anti-emulation and anti-tracing technique.
BH12816	Uses VBA anti-emulation techniques.
BH13260	Uses debugging methods.
BH13549	Might start profiling.
BH14101	Attempts to evade UAC by abusing AppInfo command line parser.
BH14102	Attempts to evade UAC by abusing COM entry hijack.
BH14103	Attempts to evade UAC by abusing GetLongPathNameW behavior in Application Information Service.
BH14104	Attempts to evade UAC by combining NTFS reparse point and DLL hijack UAC bypass.
BH14105	Attempts to evade UAC by controlling App Path registry key data.
BH14106	Attempts to evade UAC by DLL hijack of SystemProperties commands.
BH14107	Attempts to evade UAC by hijacking mscfile shell command.
BH14108	Attempts to evade UAC by manipulating current user environment variables.
BH14109	Attempts to evade UAC by obtaining the token of an auto-elevated process.
BH14110	Attempts to evade UAC by overwriting ms-settings shell command.
BH14111	Attempts to evade UAC by reusing token from UIAccess application.
BH14112	Attempts to evade UAC by tricking Clean Manager.
BH14113	Attempts to evade UAC by using AccessibilityCplAdmin elevated launch.
BH14114	Attempts to evade UAC by using BitlockerWizardElev race condition.
BH14115	Attempts to evade UAC by using a Cerber-style UAC bypass.
BH14116	Attempts to evade UAC by using CMLuaUtil interface.
BH14117	Attempts to evade UAC by using ColorDataProxy/CCMLuaUtil undocumented COM interfaces.
BH14118	Attempts to evade UAC by using COM handlers hijacking.
BH14119	Attempts to evade UAC by using COR profiler.
BH14120	Attempts to evade UAC by using CreateNewLink autoelevated interface.
BH14121	Attempts to evade UAC by using DiskCleanup environment variable.
BH14122	Attempts to evade UAC by using EditionUpgradeManager autoelevated interface.
BH14123	Attempts to evade UAC by using FwCplLua undocumented COM interface.
BH14124	Attempts to evade UAC by using IDateTimeStateWriter COM interface.
BH14125	Attempts to evade UAC by using IsolatedCommand UAC bypass.
BH14126	Attempts to evade UAC by using Microsoft Management Console via ALPC.
BH14127	Attempts to evade UAC by using self-defined SystemRoot environment.
BH14128	Attempts to evade UAC by using SLUI elevated launch.
BH14129	Attempts to evade UAC by using SPPLUAObject COM interface.
BH14130	Attempts to evade UAC by using uiAccess UAC bypass.
BH14131	Attempts to evade UAC by using undocumented IARPUninstallStringLauncher interface.
BH14132	Attempts to evade UAC by using whitelisted InfDefaultInstall interface.
BH14133	Attempts to evade UAC by using WOW64 logger DLL.
BH14134	Attempts to evade UAC using AppInfo AutoApproveEXEList UAC bypass.
BH14135	Attempts to evade UAC using AppInfo Manifest UAC bypass.
BH14136	Attempts to evade UAC using AppInfo whitelisting model UAC bypass.
BH14137	Attempts to evade UAC using Application Verifier UAC bypass.
BH14138	Attempts to evade UAC using AutoElevate UAC bypass.
BH14139	Attempts to evade UAC using Deployment Image Servicing and Management UAC bypass.
BH14140	Attempts to evade UAC using generic autoelevation UAC bypass.
BH14141	Attempts to evade UAC using "Get Windows" marketing package UAC bypass.
BH14142	Attempts to evade UAC using IIS InetMgr UAC bypass.
BH14143	Attempts to evade UAC using Microsoft Management Console UAC bypass.
BH14144	Attempts to evade UAC using OOBE AppInfo whitelisting UAC bypass.
BH14145	Attempts to evade UAC using shim patching UAC bypass.
BH14146	Attempts to evade UAC using shim RedirectEXE UAC bypass.
BH14147	Attempts to evade UAC using Simda UAC bypass.
BH14148	Attempts to evade UAC using SXS Local Redirect UAC bypass.
BH14149	Attempts to evade UAC using Wusa Cabinet UAC bypass.
BH15185	The file contains push-obfuscated API strings.
BH15283	Uses hex-obfuscated module import directive.
BH15286	Uses hex-obfuscated import directive of external modules.
BH15356	Contains an uninterrupted sequence of Unicode-escaped characters.
BH15357	Contains Unicode-escaped characters that are otherwise printable.
BH16101	Contains potentially deceptive links.
BH18101	Detects Ad-Aware related security products.
BH18102	Detects Agnitum related security products.
BH18103	Detects AhnLab related security products.
BH18104	Detects Anubis sandbox related virtualized environments.
BH18105	Detects Avast related security products.
BH18106	Detects AVG related security products.
BH18107	Detects Avira related security products.
BH18108	Detects BitDefender related security products.
BH18109	Detects Bochs emulator related virtualized environments.
BH18110	Detects CA related security products.
BH18111	Detects CheckPoint related security products.
BH18113	Detects common security products, firewalls or anti-virus solutions.
BH18114	Detects Comodo related security products.
BH18115	Detects Cuckoo sandbox related virtualized environments.
BH18116	Detects CW sandbox related virtualized environments.
BH18117	Detects ESET related security products.
BH18118	Detects F-Secure related security products.
BH18119	Detects Fortinet related security products.
BH18120	Detects Fortinet sandbox related virtualized environments.
BH18121	Detects G Data related security products.
BH18122	Detects generic virtualized environments.
BH18124	Detects installed security products using WMI.
BH18125	Detects JoeBox sandbox related virtualized environments.
BH18126	Detects K7 Computing related security products.
BH18127	Detects Kaspersky related security products.
BH18128	Detects Kingsoft related security products.
BH18129	Detects KVM related virtualized environments.
BH18130	Detects McAfee related security products.
BH18131	Detects Microsoft Hyper-V related virtualized environments.
BH18132	Detects Microsoft related security products.
BH18133	Detects Microsoft VirtualPC related virtualized environments.
BH18134	Detects Norman related security products.
BH18135	Detects Panda related security products.
BH18136	Detects Parallels related virtualized environments.
BH18137	Detects PCTools related security products.
BH18138	Detects QEMU related virtualized environments.
BH18139	Detects QuickHeal related security products.
BH18140	Detects Rising related security products.
BH18142	Detects Sandboxie sandbox related virtualized environments.
BH18143	Detects Sophos related security products.
BH18144	Detects Sunbelt related security products.
BH18145	Detects SunBelt sandbox related virtualized environments.
BH18146	Detects Sygate related security products.
BH18147	Detects Symantec related security products.
BH18148	Detects TrendMicro related security products.
BH18149	Detects VirtualBox related virtualized environments.
BH18150	Detects VMWare related virtualized environments.
BH18151	Detects Webroot related security products.
BH18152	Detects Wine related virtualized environments.
BH18153	Detects Xen related virtualized environments.
BH18154	Detects ZoneLabs related security products.
BH18155	Disables services related to Ad-Aware security products.
BH18156	Disables services related to Agnitum security products.
BH18157	Disables services related to AhnLab security products.
BH18158	Disables services related to Avast security products.
BH18159	Disables services related to AVG security products.
BH18160	Disables services related to Avira security products.
BH18161	Disables services related to BitDefender security products.
BH18162	Disables services related to CA security products.
BH18163	Disables services related to ClamAV security products.
BH18164	Disables services related to common security products, firewalls or anti-virus solutions.
BH18165	Disables services related to DrWeb security products.
BH18166	Disables services related to Emsisoft security products.
BH18167	Disables services related to ESET security products.
BH18168	Disables services related to F-Secure security products.
BH18169	Disables services related to G Data security products.
BH18170	Disables services related to Ikarus security products.
BH18171	Disables services related to K7 Computing security products.
BH18172	Disables services related to Kaspersky security products.
BH18173	Disables services related to Kingsoft security products.
BH18174	Disables services related to Malwarebytes security products.
BH18175	Disables services related to McAfee security products.
BH18176	Disables services related to Microsoft security products.
BH18177	Disables services related to Norman security products.
BH18178	Disables services related to Panda security products.
BH18179	Disables services related to QuickHeal security products.
BH18180	Disables services related to Rising security products.
BH18181	Disables services related to Sophos security products.
BH18182	Disables services related to Symantec security products.
BH18183	Disables services related to TrendMicro security products.
BH18184	Disables services related to Windows Defender.
BH18185	Disables services related to ZoneLabs security products.
BH18214	Tampers with services related to Ad-Aware security products.
BH18215	Tampers with services related to Agnitum security products.
BH18216	Tampers with services related to AhnLab security products.
BH18217	Tampers with services related to Avast security products.
BH18218	Tampers with services related to AVG security products.
BH18219	Tampers with services related to Avira security products.
BH18220	Tampers with services related to BitDefender security products.
BH18221	Tampers with services related to CA security products.
BH18222	Tampers with services related to ClamAV security products.
BH18223	Tampers with services related to common security products, firewalls or anti-virus solutions.
BH18224	Tampers with services related to DrWeb security products.
BH18225	Tampers with services related to ESET security products.
BH18226	Tampers with services related to F-Secure security products.
BH18227	Tampers with services related to G Data security products.
BH18228	Tampers with services related to Ikarus security products.
BH18229	Tampers with services related to K7 Computing security products.
BH18230	Tampers with services related to Kaspersky security products.
BH18231	Tampers with services related to Kingsoft security products.
BH18232	Tampers with services related to McAfee security products.
BH18233	Tampers with services related to Microsoft security products.
BH18234	Tampers with services related to Norman security products.
BH18235	Tampers with services related to Panda security products.
BH18236	Tampers with services related to QuickHeal security products.
BH18237	Tampers with services related to Rising security products.
BH18238	Tampers with services related to Sophos security products.
BH18239	Tampers with services related to Symantec security products.
BH18240	Tampers with services related to TrendMicro security products.
BH18241	Tampers with services related to ZoneLabs security products.
BH18247	Checks the AppArmor status.
BH18248	Disables AppArmor.
BH18249	Contains strings commonly used for detecting VMs.
BH18250	Detects common security products.
BH18251	Detects ClamAV related security products.
BH18252	Detects DrWeb related security products.
BH19123	Enumerates breakpoints that are set in the current session.
BH19147	Enumerates debugger breakpoints.
BH19375	Gets preferences for the Windows Defender scans and updates.
BH19415	Gets the status of antimalware software on the computer.
BH19565	Might enumerate time related performance information.
BH20104	Uses a Nishang command to bypass UAC using several known methods.
BH20105	Uses a Nishang command to bypass Windows Antimalware Scan Interface.
BH20121	Uses a Nishang command to detect whether it is in a known virtual machine.
BH20236	Uses PowerSploit/Empire command to locate single byte AV signatures.
BH20247	Uses PowerSploit/Empire command to perform a UAC bypass attack by duplicating a High Integrity security access token.
BH20248	Uses PowerSploit/Empire command to perform a UAC bypass attack by abusing the lack of an embedded manifest in wscript.exe.
BH20249	Uses PowerSploit/Empire command to perform a UAC bypass attack by utilizing the trusted publisher certificate through process injection.