attack flow and cacao patch (#107) (#108)

* Update README.md

fix link

* Update README.md

* add Attack Flow content for two corpus malware

* add info about attack flow and cacao

* add info about attack flow and cacao

* info about cacao playbook

* update readme for cacao and attack flow

* add text for cacao

* update readme for cacao and attack flow

Co-authored-by: Desiree Beck <dbeck@mitre.org>

README.md

@@ -1,12 +1,17 @@
 # <a name="mbc"></a>Malware Behavior Catalog v2.3 #
 The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions, and read the [newsletters](./ynewsletters/README.md) for information on the most recent MBC updates and activity.
 
-Two open-source malware analysis tools map their output to MBC and ATT&CK:
+Open-source malware analysis tools map their output to MBC and ATT&CK:
 
 * [capa](https://github.com/fireeye/capa-rules) - see the [capa rule mapping distribution](./capa.md)
 * [CAPE](https://github.com/kevoreilly/community/tree/master/modules/signatures) - see the [CAPE signature mapping distribution](./cape.md)
 
-Check out the MBC presentations:
+MBC supports other community efforts:
+
+* [CACAO](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cacao) - a [playbook](https://github.com/oasis-tcs/cacao/tree/master/Examples/CACAO-2.0) for the MBC corpus malware [Locky Bart](./xample-malware/locky-bart.md) shows how CACAO can reference MBC behaviors.
+* [Attack Flow](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/corpus) - flow diagrams for the MBC corpus malware [Shamoon](./xample-malware/shamoon.md) and [SearchAwesome](./xample-malware/searchawesome.md) illustrate how Attack Flow can reference MBC behaviors.
+
+Check out MBC presentations:
 
 * [Standardized Reporting with the Malware Behavior Catalog](https://youtu.be/qZef-SoREdY), VB2020 localhost (October 2020)
 * [Malware Behavior Catalog](https://youtu.be/KY8Ty-0sdVU), BSides DC (October 2019)
@@ -56,6 +61,9 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**.
 
 Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.
 
+### STIX 2.1 Representation ###
+A refined STIX 2.1 [Malware Behavior Extension](https://docs.google.com/document/d/1azr8ewNXhWyLt1a2wE2cG964QuFSPdIBSqCJFJrwEVo/) includes new STIX domain objects for MBC objectives, behaviors, and methods.
+
 ### Navigator View ###
 This visual representation of the MBC Matrix is based on the ATT&CK Navigator. Two views are available: 
 

xample-malware/AttackFlow/SearchAwesome_Adware.json

@@ -0,0 +1,293 @@
+{
+  "type": "bundle",
+  "id": "bundle--b4272574-e283-4c91-9718-44c6f7caa333",
+  "spec_version": "2.1",
+  "created": "2023-04-21T19:56:39.762Z",
+  "modified": "2023-04-21T19:56:39.762Z",
+  "objects": [
+    {
+      "type": "extension-definition",
+      "id": "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "name": "Attack Flow",
+      "description": "Extends STIX 2.1 with features to create Attack Flows.",
+      "created_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "schema": "https://center-for-threat-informed-defense.github.io/attack-flow/stix/attack-flow-schema-2.0.0.json",
+      "version": "2.0.0",
+      "extension_types": [
+        "new-sdo"
+      ],
+      "external_references": [
+        {
+          "source_name": "Documentation",
+          "description": "Documentation for Attack Flow",
+          "url": "https://center-for-threat-informed-defense.github.io/attack-flow"
+        },
+        {
+          "source_name": "GitHub",
+          "description": "Source code repository for Attack Flow",
+          "url": "https://github.com/center-for-threat-informed-defense/attack-flow"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "spec_version": "2.1",
+      "created": "2022-08-02T19:34:35.143Z",
+      "modified": "2022-08-02T19:34:35.143Z",
+      "create_by_ref": "identity--fb9c968a-745b-4ade-9b25-c324172197f4",
+      "name": "MITRE Engenuity Center for Threat-Informed Defense",
+      "identity_class": "organization"
+    },
+    {
+      "type": "attack-flow",
+      "id": "attack-flow--e312fa60-4316-4433-a6eb-81e4c3111324",
+      "spec_version": "2.1",
+      "created": "2023-04-21T17:46:00.235Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "created_by_ref": "identity--a81efa8a-7cfd-4aef-8ae0-6d562d552cad",
+      "start_refs": [
+        "attack-action--cb85f8b2-a64d-49a3-beca-c307558fe4cb"
+      ],
+      "name": "SearchAwesome Adware",
+      "description": "SearchAwesome adware intercepts encrypted web traffic to inject ads",
+      "scope": "incident",
+      "external_references": [
+        {
+          "source_name": "Malwarebytes Labs",
+          "description": "Blog",
+          "url": "https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection"
+        },
+        {
+          "source_name": "Malware Behavior Catalogue",
+          "description": "GitHub",
+          "url": "https://github.com/MBCProject/mbc-markdown/blob/main/xample-malware/searchawesome.md"
+        }
+      ]
+    },
+    {
+      "type": "identity",
+      "id": "identity--a81efa8a-7cfd-4aef-8ae0-6d562d552cad",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "name": "Lauren Parker",
+      "identity_class": "individual",
+      "contact_information": "lparker@mitre.org"
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--cb85f8b2-a64d-49a3-beca-c307558fe4cb",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "User Execution",
+      "technique_id": "E1204",
+      "description": "The user opens a disk image file which invisibly installs its components",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--91742a64-73d0-4302-9b43-5ae374a7516a"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--638fbd7e-e680-4360-86d5-29454f354071",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Install Certificate",
+      "technique_id": "E1608",
+      "description": "The malware installs a certificate",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--912ab340-e636-4742-8333-f692368ef2ee"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--912ab340-e636-4742-8333-f692368ef2ee",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Adversary-in-the-Middle",
+      "technique_id": "T1557",
+      "description": "Malware inserts itself into a chain of custody, typically within network packets",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--f6677d9d-1c87-43bf-9b55-88099a820d4d"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f6677d9d-1c87-43bf-9b55-88099a820d4d",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Subvert Trust Controls",
+      "technique_id": "T1553",
+      "description": "The malware uses certificates to gain access to HTTPS traffic",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--ef2455bc-724f-4abf-9b1d-6883128ae328"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--ef2455bc-724f-4abf-9b1d-6883128ae328",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Install Additional Program",
+      "technique_id": "B0023",
+      "description": "Malware installs an open-source program called mitmproxy",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--f829939a-e8cf-4d78-891c-35135405e046"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--f829939a-e8cf-4d78-891c-35135405e046",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Proxy ",
+      "technique_id": "T1090",
+      "description": "Malware uses mitmproxy to intercept and modify web traffic",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--d545cf7c-c227-49e8-b3ef-6836f9431513"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--d545cf7c-c227-49e8-b3ef-6836f9431513",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Manipulate Network Traffic",
+      "technique_id": "B0019",
+      "description": "Malware intercepts encrypted web traffic to inject ads",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--5fb732fb-80d7-4815-ba89-44d18484ed94"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--3ab0e565-c92d-40c0-a0d8-5795cd1fd6a2",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Browser Session Hijacking",
+      "technique_id": "T1185",
+      "description": "Malware can modify web traffic for the purpose of injecting Javascript",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--9701d9a7-0c9b-4f07-b565-b01ffd871a36"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--5fb732fb-80d7-4815-ba89-44d18484ed94",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Command and Scripting Interpreter",
+      "technique_id": "E1059",
+      "description": "Malware installs a script to inject a JavaScript script and modify web traffic",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--3ab0e565-c92d-40c0-a0d8-5795cd1fd6a2"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--91742a64-73d0-4302-9b43-5ae374a7516a",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "C2 Communication: Receive Data",
+      "technique_id": "B0030.002",
+      "description": "Malware receives data from the C2 server",
+      "confidence": 100,
+      "effect_refs": [
+        "attack-action--638fbd7e-e680-4360-86d5-29454f354071"
+      ]
+    },
+    {
+      "type": "attack-action",
+      "id": "attack-action--9701d9a7-0c9b-4f07-b565-b01ffd871a36",
+      "spec_version": "2.1",
+      "created": "2023-04-21T19:56:39.763Z",
+      "modified": "2023-04-21T19:56:39.763Z",
+      "extensions": {
+        "extension-definition--fb9c968a-745b-4ade-9b25-c324172197f4": {
+          "extension_type": "new-sdo"
+        }
+      },
+      "name": "Self Deletion",
+      "technique_id": "F0007",
+      "description": "Malware will monitor if a specific file gets deleted and then will delete itself",
+      "confidence": 100
+    }
+  ]
+}

xample-malware/README.md

@@ -10,7 +10,7 @@ The MBC malware corpus comprises a variety of malware where each entry is decomp
 
 Please see [Poison-Ivy X0014](../xample-malware/poison-ivy.md) and [Kovter X0009](../xample-malware/kovter.md) for examples of malware entries included and *not* included in ATT&CK's collection, respectively.
 
-* **Adwind jRAT** [X0048](../xample-malware/adwindjrat.md)
+* **Adwind jRAT** [X0048](../xample-malware/adwind-jrat.md)
 * **Attor** [X0049](../xample-malware/attor.md)
 * **BadUSB** [X0046](../xample-malware/badusb.md)
 * **Bagle** [X0001](../xample-malware/bagle.md)

xample-malware/locky-bart.md

@@ -26,6 +26,7 @@
 
 Locky Bart is ransomware.  [[1]](#1)
 
+The OASIS Collaborative Automated Course of Action Operations [(CACAO)](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cacao) is a standard to implement the course of action playbook model for cybersecurity operations. An example [Locky Bart playbook](https://github.com/oasis-tcs/cacao/tree/master/Examples/CACAO-2.0) illustrates how CACAO can reference MBC behaviors.
 
 ## ATT&CK Techniques
 

xample-malware/searchawesome.md

@@ -63,6 +63,11 @@ SearchAwesome adware intercepts encrypted web traffic to inject ads.
 - ~/Library/SPI/
 - ~/.mitmproxy/
 
+## Attack Flow
+
+Attack flow for SearchAwesome based on [[1]](#1).
+
+![Screenshot of Attack Flow for SearchAwesome based on Malwarebytes article.](/xample-malware/AttackFlow/SearchAwesome_Adware.png)
 
 ## References
 

xample-malware/shamoon.md

@@ -84,6 +84,11 @@ SHA256 Hashes
 - c617120895646f73bc880c0aca18990deda3db9be03f6b3564013e26dedfa3f9
 - 4f02a9fcd2deb3936ede8ff009bd08662bdb1f365c0f4a78b3757a98c2f40400
 
+## Attack Flow
+
+Attack flow for Shamoon based on [[3]](#3).
+
+![Screenshot of Attack Flow for Shamoon based on McAfee article.](/xample-malware/AttackFlow/Shamoon.png)
 
 ## References