admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

consistency changes for behaviors than had more dependencies

Browse Source
This commit is contained in:
Emmanuelle Vargas-Gonzalez
2020-08-21 15:50:22 -04:00
parent f4af7f5769
commit 1c4eef4c69
4 changed files with 42 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-behavioral-analysis/detect-vm.md
+24 -24
View File
@@ -28,31 +28,31 @@ Methods
|B0009.011|**HTML5 Performance Object Check**|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
|B0009.012|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
|B0009.013|**Modern Specs Check**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.|
|B0009.014|**Total physical memory**|Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
|B0009.015|**Drive size**|Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
|B0009.016|**USB drive**|Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
|B0009.017|**Printer**|Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
|B0009.018|**Processor count**|Checks number of processors; single CPU machines are suspect.|
|B0009.019|**Keyboard layout**|Check keyboard layout.|
|B0009.020|**Window size**|Tiny window size may indicate a VM.|
|B0009.021|**Unique windows**|May check for the presence of known windows from analysis tools running in a VM.|
|B0009.022|**Title bars**|May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
|B0009.023|**Unique Hardware/Firmware Check**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Items checked include:|
|B0009.024|**BIOS**|Characteristics of the BIOS, such as version, can indicate virtualization.|
|B0009.025|**I/O Communication Port**|VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
|B0009.026|**CPU Name**|Checks the CPU name to determine virtualization.|
|B0009.027|**CPU Location**|When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
|B0009.028|**MAC Address**|VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
|B0009.014|**Modern Specs Check - Total physical memory**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
|B0009.015|**Modern Specs Check - Drive size**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
|B0009.016|**Modern Specs Check - USB drive**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
|B0009.017|**Modern Specs Check - Printer**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
|B0009.018|**Modern Specs Check - Processor count**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks number of processors; single CPU machines are suspect.|
|B0009.019|**Modern Specs Check - Keyboard layout**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Check keyboard layout.|
|B0009.020|**Check Windows - Window size**|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.|
|B0009.021|**Check Windows - Unique windows**|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.|
|B0009.022|**Check Windows - Title bars**|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
|B0009.023|**Unique Hardware/Firmware Check**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment.|
|B0009.024|**Unique Hardware/Firmware Check - BIOS**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Characteristics of the BIOS, such as version, can indicate virtualization.|
|B0009.025|**Unique Hardware/Firmware Check - I/O Communication Port**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
|B0009.026|**Unique Hardware/Firmware Check - CPU Name**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Checks the CPU name to determine virtualization.|
|B0009.027|**Unique Hardware/Firmware Check - CPU Location**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
|B0009.028|**Unique Hardware/Firmware Check - MAC Address**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
|B0009.029|**Instruction Testing**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|B0009.030|**SIDT (red pill)**|Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
|B0009.031|**SGDT/SLDT (no pill)**|The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.|
|B0009.032|**SMSW**||
|B0009.033|**STR**||
|B0009.034|**CPUID**|Checking the CPU ID found within the registry can provide information to system type.|
|B0009.035|**IN**||
|B0009.036|**RDTSC**||
|B0009.037|**VMCPUID**||
|B0009.038|**VPCEXT**||
|B0009.030|**Instruction Testing - SIDT (red pill)**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
|B0009.031|**Instruction Testing - SGDT/SLDT (no pill)**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.|
|B0009.032|**Instruction Testing - SMSW**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|B0009.033|**Instruction Testing - STR**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|B0009.034|**Instruction Testing - CPUID**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.|
|B0009.035|**Instruction Testing - IN**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|B0009.036|**Instruction Testing - RDTSC**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|B0009.037|**Instruction Testing - VMCPUID**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|B0009.038|**Instruction Testing - VPCEXT**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
Malware Examples
----------------
defense-evasion/obfuscate-files.md
+8 -8
View File
@@ -18,15 +18,15 @@ Methods
|ID|Name|Description|
|---|---|---|
|E1027.m01|**Encoding**|The malware sample, file, or other information is encoded.|
|E1027.m02|**Standard Encoding**|A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
|E1027.m03|**Custom Encoding**|A custom algorithm is used to encode the malware sample, a file, or other information.|
|E1027.m02|**Encoding - Standard Encoding**|The malware sample, file, or other information is encoded. A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
|E1027.m03|**Encoding - Custom Encoding**|The malware sample, file, or other information is encoded. A custom algorithm is used to encode the malware sample, a file, or other information.|
|E1027.m04|**Encryption**|The malware sample, file, or other information is encrypted.|
|E1027.m05|**Standard Encryption**|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|E1027.m06|**Standard Encryption of Code**|A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|E1027.m07|**Standard Encryption of Data**|A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|E1027.m08|**Custom Encryption**|A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|E1027.m09|**Custom Encryption of Code**|A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|E1027.m10|**Custom Encryption of Data**|A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|E1027.m05|**Encryption - Standard Encryption**|The malware sample, file, or other information is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|E1027.m06|**Encryption - Standard Encryption of Code**|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|E1027.m07|**Encryption - Standard Encryption of Data**|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|E1027.m08|**Encryption - Custom Encryption**|The malware sample, file, or other information is encrypted. A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|E1027.m09|**Encryption - Custom Encryption of Code**|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|E1027.m10|**Encryption - Custom Encryption of Data**|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
Malware Examples
----------------
discovery/analysis-tool-discover.md
+6 -6
View File
@@ -16,11 +16,11 @@ Methods
|ID|Name|Description|
|---|---|---|
|B0013.001|**Process detection**|Malware can scan for the process name associated with common analysis tools.|
|B0013.002|**Debuggers**|OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
|B0013.003|**SysInternals Suite Tools**|Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|
|B0013.004|**PCAP Utilities**|Wireshark / Dumpcap|
|B0013.005|**Process Utilities**|ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
|B0013.006|**PE Utilities**|ImportREC / PETools / LordPE|
|B0013.007|**Sandboxes**|Joe Sandbox, etc.|
|B0013.002|**Process detection - Debuggers**|Malware can scan for the process name associated with common analysis tools. OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
|B0013.003|**Process detection - SysInternals Suite Tools**|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|
|B0013.004|**Process detection - PCAP Utilities**|Malware can scan for the process name associated with common analysis tools. Wireshark / Dumpcap|
|B0013.005|**Process detection - Process Utilities**|Malware can scan for the process name associated with common analysis tools. ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
|B0013.006|**Process detection - PE Utilities**|Malware can scan for the process name associated with common analysis tools. ImportREC / PETools / LordPE|
|B0013.007|**Process detection - Sandboxes**|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.|
|B0013.008|**Known File Location**|Malware may detect an analysis tool by the presence of a file in a known location.|
|B0013.009|**Known Window**|Malware may detect an analysis tool via the presence of a known window.|
exfiltration/data-encrypted.md
+4 -4
View File
@@ -17,7 +17,7 @@ Methods
|---|---|---|
|E1560.m01|**Encoding**|Data is encoded.|
|E1560.m02|**Encryption**|Data is encrypted.|
|E1560.m03|**Standard Encoding**|A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
|E1560.m04|**Custom Encoding**|A custom algorithm is used to encode the exfiltrated data.|
|E1560.m05|**Standard Encryption**|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
|E1560.m06|**Custom Encryption**|A custom algorithm is used to encrypt the exfiltrated data.|
|E1560.m03|**Encoding - Standard Encoding**|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
|E1560.m04|**Encoding - Custom Encoding**|Data is encoded. A custom algorithm is used to encode the exfiltrated data.|
|E1560.m05|**Encryption - Standard Encryption**|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
|E1560.m06|**Encryption - Custom Encryption**|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.|