Hooking T1179   Hooks security product’s commonly used APIs Privilege Escalation   Process Injection T1055 Injects the decrypts payload into svchost.exe process Hooking T1179   Hooks security products’ commonly used APIs Defense Evasion Binary Padding T1009 Adds junk data to evade anti-virus scan Disabling Security Tools T1089 Targets a specific security product’s process for injection purposes Deobfuscate/Decode Files or Information T1140 Uses TROJ_WATERBEAR to decrypt encrypted payload Execution Guardrails T1480 Targets specific software in the victim’s environment DLL