T1129 - Shared Modules dropper T1059 - Command and Scripting Interpreter cmdline_terminate T1542.003 - Bootkit suspicious_iocontrol_codes T1547 - Boot or Logon Autostart Execution persistence_autorun T1547.001 - Registry Run Keys / Startup Folder persistence_autorun T1542.003 - Bootkit suspicious_iocontrol_codes T1564 - Hide Artifacts persistence_ads T1202 - Indirect Command Execution uses_windows_utilities T1036 - Masquerading accesses_public_folder T1055 - Process Injection resumethread_remote_process creates_suspended_process T1112 - Modify Registry persistence_autorun T1548 - Abuse Elevation Control Mechanism accesses_public_folder T1497 - Virtualization/Sandbox Evasion mouse_movement_detect T1564.004 - NTFS File Attributes persistence_ads T1547 - Boot or Logon Autostart Execution persistence_autorun see references for the rest