diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index 1ef954b..33d8714 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -71,7 +71,7 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques |Tool: capa|Mapping|APIs| |---|---|---| |[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)|--| -|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats| +|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|CallWindowProc, EnumCalendarInfo, EnumCalendarInfoEx, EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumFontFamilies, EnumFontFamiliesEx, EnumFonts, EnumProps, EnumPropsEx, EnumResourceTypes, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats| |[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress| |Tool: CAPE|Mapping|APIs| diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md index da8af6c..0857909 100644 --- a/defense-evasion/obfuscated-files-or-information.md +++ b/defense-evasion/obfuscated-files-or-information.md @@ -106,6 +106,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci |[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| |[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt| +|[encrypt data using RC4 via SystemFunction033](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|SystemFunction033| |[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| |[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| |[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 829b71e..4c482fb 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -54,6 +54,7 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 |Tool: capa|Mapping|APIs| |---|---|---| |[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)|--| +|[self delete using alternate data streams](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)|Defense Evasion::Self Deletion (F0007)|SetFileInformationByHandle| |Tool: CAPE|Mapping|APIs| |---|---|---| @@ -69,4 +70,4 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 [3] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection -[4] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file +[4] https://www.mandiant.com/resources/blog/wannacry-malware-profile diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md index 5deb774..84af72c 100644 --- a/discovery/system-information-discovery.md +++ b/discovery/system-information-discovery.md @@ -69,7 +69,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec |---|---|---| |[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables| |[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice| -|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl| +|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx| |[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)|--| |[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname| diff --git a/impact/disk-wipe.md b/impact/disk-wipe.md index 577913a..d6d9de0 100644 --- a/impact/disk-wipe.md +++ b/impact/disk-wipe.md @@ -46,6 +46,7 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001]( |Tool: capa|Mapping|APIs| |---|---|---| |[overwrite Master Boot Record (MBR)](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml)|Disk Wipe (F0014)|kernel32.WriteFile| +|[delete drive layout via IOCTL](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/delete-drive-layout-via-ioctl.yml)|Disk Wipe (F0014)|--| |Tool: CAPE|Mapping|APIs| |---|---|---| diff --git a/micro-behaviors/communication/dns-communication.md b/micro-behaviors/communication/dns-communication.md index 588250d..171f8c0 100644 --- a/micro-behaviors/communication/dns-communication.md +++ b/micro-behaviors/communication/dns-communication.md @@ -52,7 +52,7 @@ The DNS Communication micro-behavior focuses on DNS communication. |Tool: capa|Mapping|APIs| |---|---|---| |[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)|--| -|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, getaddrinfo, GetAddrInfo, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses| +|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, GetAddrInfo, GetAddrInfoW, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses| |Tool: CAPE|Class|Mapping|APIs| |---|---|---|---| diff --git a/micro-behaviors/communication/socket-communication.md b/micro-behaviors/communication/socket-communication.md index 2594518..c67d0bb 100644 --- a/micro-behaviors/communication/socket-communication.md +++ b/micro-behaviors/communication/socket-communication.md @@ -69,19 +69,19 @@ Instead of being listed alphabetically, methods have been grouped to better faci |---|---|---| |[start TCP server](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/serve/start-tcp-server.yml)|Socket Communication::Start TCP Server (C0001.005)|listen, accept, WSAAccept, System.Net.Sockets.TcpListener::Start, System.Net.Sockets.TcpListener::AcceptTcpClient, System.Net.Sockets.TcpListener::BeginAcceptTcpClient, System.Net.Sockets.TcpListener::AcceptTcpClientAsync, System.Net.Sockets.TcpListener::AcceptSocket, System.Net.Sockets.TcpListener::BeginAcceptSocket, System.Net.Sockets.TcpListener::AcceptSocketAsync| |[act as TCP client](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/client/act-as-tcp-client.yml)|Socket Communication::TCP Client (C0001.008)|System.Net.Sockets.TcpClient::ctor| -|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|ws2_32.select| -|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws2_32.WSASocketA| -|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket| +|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|select, ws2_32.select| +|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws32_32.WSASocket, WSASocketA, WSASocketW| +|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket, setsockopt, ioctlsocket| |[create VMCI socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-vmci-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, DeviceIoControl, socket, ioctl| -|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup| -|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, ConnectEx, WSAIoctl, setsockopt, bind| -|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket| +|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup, WSAStartup| +|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, WSAConnect, ConnectEx, ws2_32.WSAIoctl, WSAIoctl, setsockopt, bind| +|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor| |[create TCP socket via raw AFD driver](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml)|Socket Communication::Create TCP Socket (C0001.011)|kernel32.CreateEvent, NtCreateFile, NtDeviceIoControlFile, kernel32.WaitForSingleObject| |[obtain TransmitPackets callback function via WSAIoctl](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml)|Socket Communication::Send TCP Data (C0001.014)|WSAIoctl, WSAGetLastError| |[send TCP data via WFP API](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml)|Socket Communication::Send TCP Data (C0001.014)|fwpkclnt.FwpsStreamInjectAsync0| -|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor| -|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send| -|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom| +|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, WSASocketA, WSASocketW, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor| +|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, sendto, WSASend, WSASendTo, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send| +|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, WSARecv, WSARecvDisconnect, WSARecvFrom, recvmsg, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom| |Tool: CAPE|Class|Mapping|APIs| |---|---|---|---| diff --git a/micro-behaviors/cryptography/encrypt-data.md b/micro-behaviors/cryptography/encrypt-data.md index 4e11083..c958b9b 100644 --- a/micro-behaviors/cryptography/encrypt-data.md +++ b/micro-behaviors/cryptography/encrypt-data.md @@ -86,7 +86,7 @@ Malware may encrypt data. |[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)|--| |[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)|--| |[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)|--| -|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect| +|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect, SystemFunction040, SystemFunction041| |[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)|--| |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Encrypt Data::3DES (C0027.004)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| |[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)|--| diff --git a/micro-behaviors/file-system/set-file-attributes.md b/micro-behaviors/file-system/set-file-attributes.md index cce2780..2bf6eb3 100644 --- a/micro-behaviors/file-system/set-file-attributes.md +++ b/micro-behaviors/file-system/set-file-attributes.md @@ -45,7 +45,7 @@ Malware sets file attributes. |Tool: capa|Mapping|APIs| |---|---|---| -|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat| +|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat, chmod, fchmod, fchmodat| |[set file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/set-file-attributes.yml)|Set File Attributes (C0050)|kernel32.SetFileAttributes, ZwSetInformationFile, NtSetInformationFile, System.IO.File::SetAttributes, System.IO.File::SetCreationTime, System.IO.File::SetCreationTimeUtc, System.IO.File::SetLastAccessTime, System.IO.File::SetLastAccessTimeUtc, System.IO.File::SetLastWriteTime, System.IO.File::SetLastWriteTimeUtc| ### C0050 Snippet diff --git a/micro-behaviors/file-system/writes-file.md b/micro-behaviors/file-system/writes-file.md index be080d7..43c3144 100644 --- a/micro-behaviors/file-system/writes-file.md +++ b/micro-behaviors/file-system/writes-file.md @@ -51,7 +51,7 @@ Malware writes to a file. |Tool: capa|Mapping|APIs| |---|---|---| -|[write file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-linux.yml)|Writes File (C0052)|fputc, fputs, putc, write, fputwc, putwc, fputws, write, fwrite, putwchar| +|[write file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-linux.yml)|Writes File (C0052)|fputc, fputs, putc, write, fputwc, putwc, fputws, fwrite, putwchar, dprintf, vdprnitf, fprintf, vfprintf| |[write file on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-windows.yml)|Writes File (C0052)|kernel32.WriteFile, kernel32.WriteFileEx, NtWriteFile, ZwWriteFile, _fwrite, fwrite, System.IO.File::WriteAllBytes, System.IO.File::WriteAllBytesAsync, System.IO.File::WriteAllLines, System.IO.File::WriteAllLinesAsync, System.IO.File::WriteAllText, System.IO.File::WriteAllTextAsync, System.IO.File::AppendAllLines, System.IO.File::AppendAllLinesAsync, System.IO.File::AppendAllText, System.IO.File::AppendAllTextAsync, System.IO.File::AppendText, System.IO.FileInfo::AppendText| |[create process memory minidump](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/dump/create-process-memory-minidump.yml)|Writes File (C0052)|dbghelp.MiniDumpWriteDump| diff --git a/micro-behaviors/hardware/install-driver.md b/micro-behaviors/hardware/install-driver.md index cbdc21c..e0abcbe 100644 --- a/micro-behaviors/hardware/install-driver.md +++ b/micro-behaviors/hardware/install-driver.md @@ -40,5 +40,5 @@ Malware installs a driver or minifilter. |Tool: capa|Mapping|APIs| |---|---|---| -|[install driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/install-driver.yml)|Install Driver (C0037)|ntdll.NtLoadDriver, ZwLoadDriver| +|[install driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/install-driver.yml)|Install Driver (C0037)|ntdll.NtLoadDriver, ZwLoadDriver, NtSetSystemInformation ZwSetSystemInformation| |[register minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/register-minifilter-driver.yml)|Install Driver::Minifilter (C0037.001)|FltRegisterFilter| diff --git a/micro-behaviors/process/create-process.md b/micro-behaviors/process/create-process.md index 9910ad3..6a7ba59 100644 --- a/micro-behaviors/process/create-process.md +++ b/micro-behaviors/process/create-process.md @@ -62,7 +62,7 @@ Malware creates a process. |Tool: capa|Mapping|APIs| |---|---|---| |[create process on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-windows.yml)|Create Process (C0017)|kernel32.WinExec, kernel32.CreateProcess, shell32.ShellExecute, shell32.ShellExecuteEx, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.CreateProcessInternal, ntdll.NtCreateUserProcess, ntdll.NtCreateProcess, ntdll.NtCreateProcessEx, ntdll.ZwCreateProcess, ZwCreateProcessEx, ntdll.ZwCreateUserProcess, ntdll.RtlCreateUserProcess, System.Diagnostics.Process::Start| -|[create process on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-linux.yml)|Create Process (C0017)|execve, execl, execlp, execle, execv, execvp, execvpe, posix_spawn, posix_spawnp, popen| +|[create process on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-on-linux.yml)|Create Process (C0017)|execve, execl, execlp, execle, execv, execvp, execvpe, posix_spawn, posix_spawnp, popen, fork| |[execute command](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/execute-command.yml)|Create Process (C0017)|system, _system, wsystem, _wsystem| |[create a process with modified I/O handles and window](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml)|Create Process (C0017)|kernel32.CreateProcess, kernel32.CreateProcessInternal, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.GetStartupInfo, System.Diagnostics.Process::Start| |[create process suspended](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-suspended.yml)|Create Process::Create Suspended Process (C0017.003)|kernel32.CreateProcess, advapi32.CreateProcessAsUser|