From 165604327ed75ff4438a5c0f2efd4cc1c0c32d71 Mon Sep 17 00:00:00 2001 From: Desiree Beck Date: Wed, 28 Aug 2019 22:18:18 -0400 Subject: [PATCH] add method --- README.md | 2 +- defense-evasion/README.md | 2 +- impact/remote-access.md | 4 ++++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ae473b2..5e5d68c 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ The Malware Behavior Catalog (MBC) is a catalog of malware Objectives and Behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-markdown/blob/master/yfaq/README.md) page for answers to common questions. ### Objectives ### -As shown below, malware Objectives are based on [ATT&CK Tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known Objectives and Behaviors. Two malware analysis-specific Objectives (Anti-Behavioral Analysis and Anti-Static Analysis) not in ATT&CK are also defined. +As shown below, malware Objectives are based on [ATT&CK Tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known Objectives and Behaviors. Two malware analysis-specific Objectives not in ATT&CK are also defined (Anti-Behavioral Analysis and Anti-Static Analysis). ### Behaviors ### Under each Objective, MBC captures all behaviors and code characteristics discovered during malware analysis, with links to [ATT&CK Techniques](https://attack.mitre.org/techniques/enterprise/) as appropriate. Names of MBC Behaviors may or may not match related ATT&CK Techniques. Any content provided on Behavior pages is *supplemental* to ATT&CK content. In other words, ATT&CK content is not duplicated in MBC, and MBC users will want to reference ATT&CK while capturing malware Behaviors. diff --git a/defense-evasion/README.md b/defense-evasion/README.md index 2d02a2c..2cb5563 100644 --- a/defense-evasion/README.md +++ b/defense-evasion/README.md @@ -37,7 +37,7 @@ Behaviors that evade detection or avoid other defenses. * **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md) * **Polymorphic Code** [M0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md) * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md) -* **Process Hollowing** [T1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-hollow.md) +* **Process Hollowing** [T1093](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-hollow.md) * **Process Injection** [T1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md) * **Redundant Access** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/redundant-access.md) * **Regsvr32** [T1117](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/regsvr32.md) diff --git a/impact/remote-access.md b/impact/remote-access.md index 4dfa1cd..06cb7e1 100644 --- a/impact/remote-access.md +++ b/impact/remote-access.md @@ -13,6 +13,10 @@ Malware may also provide specific commands. Given an "execute" command, the atta This behavior is related to the ATT&CK [**Remote Access Tools**](https://attack.mitre.org/techniques/T1219/) technique which is defined under the ATT&CK Command and Control tactic, but it is not equivalent (reflected by its "M" ID). +Methods +------- +* **reverse shell**: Malware may create a reverse shell by invoking cmd.exe and creating three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary. + Malware Examples ---------------- |Name|Date|Description|