diff --git a/command-and-control/README.md b/command-and-control/README.md index 512e54a..87395a3 100644 --- a/command-and-control/README.md +++ b/command-and-control/README.md @@ -18,7 +18,7 @@ Behaviors malware may use to communicate with systems under its control within a * **Multi-Stage Channels** [T1104](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/multi-stage-channels.md) * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md) * **Remote Access Tools** [T1219](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-access-tools.md) -* **Remote File Copy** [T1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md) +* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md) * **Standard Application Layer Protocol** [T1071](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-app-protocol.md) * **Standard Cryptographic Protocol** [T1032](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-crypto-protocol.md) * **Standard Non-Application Layer Protocol** [T1095](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-non-app-protocol.md) diff --git a/command-and-control/remote-file-copy.md b/command-and-control/remote-file-copy.md index 159538f..92c133e 100644 --- a/command-and-control/remote-file-copy.md +++ b/command-and-control/remote-file-copy.md @@ -1,12 +1,12 @@ ||| |---------|------------------------| -|**ID**|**T1105**| -|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)| +|**ID**|**E1105**| +|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)| |**Related ATT&CK Technique(s)**|[Remote File Copy](https://attack.mitre.org/techniques/T1105/)| Remote File Copy ================ -Malware may copy files from one system to another. +Malware may copy files from one system to another. Note that this behavior is separate from the execution of the file, which is covered by the [Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md) behavior. **See ATT&CK:** [**Remote File Copy**](https://attack.mitre.org/techniques/T1105/). diff --git a/execution/install-prog.md b/execution/install-prog.md index c657364..3066440 100644 --- a/execution/install-prog.md +++ b/execution/install-prog.md @@ -7,12 +7,9 @@ Install Additional Program ========================== -Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps. Malware that installs another component is called a "dropper." +Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps. -Methods -------- -* **Single Stage**: The installed code is contained within the dropper. -* **Two Stage**: The dropper downloads the installed code to the target machine. +Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the [Remote File Copy](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md) behavior). Malware Examples ---------------- diff --git a/lateral-movement/README.md b/lateral-movement/README.md index c6cd614..6ece21c 100644 --- a/lateral-movement/README.md +++ b/lateral-movement/README.md @@ -11,7 +11,7 @@ Behaviors that enable propagation through a compromised system or infected files * **Malicious Network Driver** [M0026](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/malicious-network-drv.md) * **Pass the Hash** [T1075](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/pass-the-hash.md) * **Remote Desktop Protocol** [T1076](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/remote-desktop-protocol.md) -* **Remote File Copy** [T1105](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/remote-file-copy.md) +* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/remote-file-copy.md) * **Replication Through Removable Media** [T1091](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/replicate-remove-media.md) * **Send Email** [M0020](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-email.md) * **Send Poison Text Message** [M0021](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-poison-text-msg.md) diff --git a/persistence/README.md b/persistence/README.md index 998c460..02bdc3c 100644 --- a/persistence/README.md +++ b/persistence/README.md @@ -33,6 +33,7 @@ Malware aims to remain on a system regardless of system events. * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md) * **Redundant Access** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/redundant-access.md) * **Registry Run Keys / Startup Folder** [E1060](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/registry-run-startup.md) +* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md) * **Scheduled Task** [T1053](https://github.com/MBCProject/mbc-markdown/blob/master/execution/scheduled-task.md) * **Setuid and Setgid** [T1166](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/setuid-setgid.md) * **Shortcut Modification** [T1023](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/shortcut-mod.md)