From 248207bd4b43b1a9e876be42a030b101d6d5bbf1 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Wed, 10 Feb 2021 14:41:55 -0500 Subject: [PATCH] minor link issue in SVG --- yfaq/mbc_matrix_with_ids.svg | 2 +- yfaq/mbc_matrix_without_ids.svg | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/yfaq/mbc_matrix_with_ids.svg b/yfaq/mbc_matrix_with_ids.svg index 75cad42..cc4086f 100644 --- a/yfaq/mbc_matrix_with_ids.svg +++ b/yfaq/mbc_matrix_with_ids.svg @@ -1 +1 @@ -C0003:Interprocess CommunicationC0014: ICMP CommunicationC0002: HTTP CommunicationC0005: WinINetC0001: Socket CommunicationC0004: FTP CommunicationC0012: SMTP CommunicationC0011: DNS CommunicationC0004.002: WinINet::FTPCommunicationC0003.001: CreatePipe::Interprocess CommunicationC0011.003: DDNS DomainConnect::DNS CommunicationC0005.005:InternetWriteFile::WinINetC0001.001: Set SocketConfig::Socket CommunicationC0011.004: ResolveTLD::DNS CommunicationC0002.010: IWebBrowser::HTTPCommunicationC0011.001: Resolve::DNSCommunicationC0003.003: ReadPipe::Interprocess CommunicationC0001.004: ConnectSocket::Socket CommunicationC0001.006: ReceiveData::Socket CommunicationC0001.016: Receive TCPData::Socket CommunicationC0001.002: TCPServer::Socket CommunicationC0003.002: ConnectPipe::Interprocess CommunicationC0004.001: SendFile::FTP CommunicationC0005.003:InternetOpenURL::WinINetC0002.007: WinINet::HTTPCommunicationC0001.015: Send UDPData::Socket CommunicationC0001.010: Create UDPSocket::Socket CommunicationC0001.013: UDPClient::Socket CommunicationC0001.009: Initialize WinsockLibrary::Socket CommunicationC0001.007: SendData::Socket CommunicationC0005.001:InternetConnect::WinINetC0001.005: Start TCPServer::Socket CommunicationC0002.016: SendResponse::HTTP CommunicationC0014.002: EchoRequest::ICMP CommunicationC0001.003: CreateSocket::Socket CommunicationC0002.014: ReadHeader::HTTP CommunicationC0001.011: Create TCPSocket::Socket CommunicationC0002.017: GetResponse::HTTP CommunicationC0001.012: Get SocketStatus::Socket CommunicationC0002.005: SendData::HTTP CommunicationC0002.003: SendRequest::HTTP CommunicationC0005.004:InternetReadFile::WinINetC0002.009: Connect toServer::HTTP CommunicationC0001.014: Send TCPData::Socket CommunicationC0011.002: ServerConnect::DNS CommunicationC0002.006: DownloadURL::HTTP CommunicationC0002.004: OpenURL::HTTP CommunicationC0001.008: TCPClient::Socket CommunicationC0012.001: ServerConnect::SMTP CommunicationC0002.011: ExtractBody::HTTP CommunicationC0002.018: StartServer::HTTP CommunicationC0002.008: WinHTTP::HTTPCommunicationC0002.015: ReceiveRequest::HTTP CommunicationC0001.017: Receive UDPData::Socket CommunicationC0014.001: GenerateTraffic::ICMP CommunicationC0002.002: Client::HTTPCommunicationC0002.001: Server::HTTPCommunicationC0002.013: SetHeader::HTTP CommunicationC0002.012: CreateRequest::HTTP CommunicationC0003.004: WritePipe::Interprocess CommunicationC0011.005: Resolve Free HostingDomain::DNS CommunicationC0012.002: Request::SMTPCommunicationC0005.002:InternetOpen::WinINetCommunicationMicro-objectiveB0023:Install Additional ProgramB0025:Conditional ExecutionE1059: Commandand Scripting InterpreterE1204: User InteractionE1203: Exploitationfor Client ExecutionB0011: Remote CommandsB0024: PreventConcurrent ExecutionB0021:Send Poisoned Text MessageB0020: Send EmailB0025.001: Suicide ExitE1203.m04: Red HatJBoss Enterprise ProductsB0011.002: Download FileB0011.004: ShutdownE1203.m03: File TransferProtocol (FTP) ServersB0011.003: ExecuteB0011.006: UninstallE1203.m02:Java-based Web ServersB0011.005: SleepE1203.m01: RemoteDesktop Protocols (RDP)B0011.007: Upload FileE1203.m06:Windows UtilitiesE1203.m05: SysinternalsExecutionF0001: Software PackingF0003: HookingB0002: Debugger EvasionB0001: Debugger DetectionE1480: Execution GuardrailsB0006: Memory Dump EvasionB0005: Emulator EvasionB0009:Virtual Machine DetectionB0008: ExecutableCode VirtualizationB0003:Dynamic Analysis EvasionB0007: Sandbox DetectionB0036: Capture EvasionB0004: Emulator DetectionB0001.020: Process JobsB0002.019: Pre-DebugF0001.009: ConfuserB0001.033: Timing/DelayCheck QueryPerformanceCounterB0001.008:IsDebuggerPresentB0004.004: FailedNetwork ConnectionsB0003.004: Demo ModeB0036.003: MultipleStages of LoadersB0001.010:Memory Write WatchingB0001.009:Memory BreakpointsB0006.003:Hide virtual memoryB0009.027: Unique Hardware/FirmwareCheck - CPU LocationB0002.021:Return ObfuscationF0001.005:Custom CompressionB0005.002:Undocumented OpcodesB0002.017:Parallel ThreadsB0009.029:Instruction TestingB0004.003: CheckEmulator-related Registry KeysB0002.027:Stolen API CodeB0007.007: Self CheckB0001.021: ProcessHeapB0009.030: InstructionTesting - SIDT (red pill)B0009.035:Instruction Testing - INB0002.003: Byte StealingB0003.001:Alternative ntdll.dllB0002.014:Modify PE HeaderF0003.004: Import AddressHooking (IAT) HookingB0009.001: Check Fileand Directory ArtifactsE1480.m02:Environmental KeysE1480.m01: Deposited KeysB0009.033:Instruction Testing - STRB0009.019: Modern SpecsCheck - Keyboard layoutB0006.007:On-the-Fly APIsB0003.006: Encode FileB0009.024: UniqueHardware/Firmware Check - BIOSB0009.038: InstructionTesting - VPCEXTB0001.031:WudfIsAnyDebuggerPresentB0001.032: Timing/DelayCheck GetTickCountB0001.007: Interrupt 1F0001.001: Nested PackingB0003.008: Hook InterruptB0009.021: CheckWindows - Unique windowsB0002.006:Exception MisdirectionB0009.017: ModernSpecs Check - PrinterB0002.004:Change SizeOfImageB0001.002:CheckRemoteDebuggerPresentB0002.026: Static LinkingB0001.030:UnhandledExceptionFilterB0007.008:Timing/Date CheckB0001.034: Anti-debuggingInstructionsB0006.005: TamperingE1480.m04:Host Fingerprint CheckB0009.020: CheckWindows - Window sizeB0001.026: Stack CanaryB0009.007: Check SoftwareF0003.002:Hook memory mapping APIsB0009.032: InstructionTesting - SMSWB0003.007:Hook File SystemF0001.006: CustomCompression of CodeB0007.002: Check FilesB0009.026: UniqueHardware/Firmware Check - CPU NameB0001.036: ProcessEnvironment Block NtGlobalFlagB0004.001: Check forEmulator-related FilesB0009.023: UniqueHardware/Firmware CheckB0009.022: CheckWindows - Title barsB0009.008:Check Virtual DevicesB0001.018: Parent ProcessB0009.011: HTML5Performance Object CheckB0001.006: Interrupt 0x2dB0009.005:Check Registry KeysB0001.015:NtYieldExecution/SwitchToThreadB0004.002:Check for WINE VersionB0002.024: Self-DebuggingB0002.015: NanomitesB0009.018: Modern SpecsCheck - Processor countB0001.013: NtQueryObjectB0002.022:RtlAdjustPrivilegeB0001.011:Monitoring ThreadB0008.001: Multiple VMsB0003.009: IllusionB0001.025:Software BreakpointsB0001.014:NtSetInformationThreadF0003.001: PatchMmGetPhysicalMemoryRangesF0001.012: ArmadilloB0001.029: TLS CallbacksF0001.008: UPXB0009.013:Modern Specs CheckF0001.013: ASPackB0002.012: Loop EscapesB0009.012:Human User CheckB0002.011: InliningB0001.016:OutputDebugStringB0002.020:Relocate API CodeB0009.010:Guest Process TestingB0006.008:Feed MisinformationB0003.005: Drop CodeB0006.004: SizeOfImageB0009.036: InstructionTesting - RDTSCF0003.005: Inline HookingB0007.006:Screen Resolution TestingB0002.016:Obfuscate Library UseB0001.023:SeDebugPrivilegeB0003.002: Data FloodB0002.007:Get Base IndirectlyF0001.003: StandardCompression of CodeB0001.005:Hardware BreakpointsF0001.004: StandardCompression of DataB0001.028:Timing/Delay CheckE1480.m03:GetVolumeInformationB0036.002:Encrypted PayloadsB0009.031: InstructionTesting - SGDT/SLDT (no pill)B0001.004:Debugger ArtifactsF0001.007: CustomCompression of DataB0001.027: TIB AwareB0002.002:Break Point ClearingB0003.010: RestartB0003.003:Delayed ExecutionB0009.002:Check Memory ArtifactsB0009.003: CheckNamed System ObjectsB0005.001:Different Opcode SetsF0001.002:Standard CompressionB0002.023:Section MisalignmentB0002.030: Use InterruptsB0002.018:Pipeline MisdirectionB0002.025: Self-UnmappingB0001.019:Process Environment BlockF0001.011: ThemidaE1480.m05:Secure TriggersB0006.001:Code Encryption in MemoryB0001.037: ProcessEnvironment Block IsDebuggedB0007.001:Check Clipboard DataE1480.m06: Token CheckB0009.034: InstructionTesting - CPUIDB0006.002:Erase the PE headerB0002.001:Block InterruptsB0006.009:Flow Opcode ObstructionB0009.037: InstructionTesting - VMCPUIDB0009.009: Check WindowsB0005.004:Extra Loops/Time LocksB0036.001:Memory-only PayloadB0002.029: Thread TimeoutB0001.012:NtQueryInformationProcessB0009.004:Check ProcessesB0001.017: Page ExceptionBreakpoint DetectionB0009.015: ModernSpecs Check - Drive sizeB0002.013: Malloc UseB0009.006:Check Running ServicesB0009.025: Unique Hardware/FirmwareCheck - I/O Communication PortB0001.003: CloseHandleE1480.m07:Runs as ServiceF0001.010: VMProtectB0002.010:Import ObfuscationB0009.014: Modern SpecsCheck - Total physical memoryF0003.003:Hook proceduresB0009.028: Unique Hardware/FirmwareCheck - MAC AddressB0009.016: ModernSpecs Check - USB driveB0001.024:SetHandleInformationB0005.003:Unusual/Undocumented API CallsB0007.004:Injected DLL TestingB0001.035: Process EnvironmentBlock BeingDebuggedB0002.005:Code Integrity CheckB0007.005:Product Key/ID TestingB0001.001:API Hook DetectionB0007.009:Timing/Uptime CheckAnti-Behavioral AnalysisC0044: Free MemoryC0009: Stack PivotC0007: Allocate MemoryC0006: Heap SprayC0008:Change Memory ProtectionC0010: Overflow BufferC0008.001: ExecutableStack::Change Memory ProtectionC0008.002: ExecutableHeap::Change Memory ProtectionMemory Micro-objectiveC0037: Install DriverC0023: Load DriverC0057: Simulate HardwareC0057.002: MouseClick::Simulate HardwareC0057.001:Ctrl-Alt-Del::Simulate HardwareHardware Micro-objectiveF0003: HookingF0010: KernelModules and ExtensionsE1112: Modify RegistryB0022: Remote AccessB0035: Shutdown EventE1105: Remote File CopyF0009: Component FirmwareE1478: Install Insecureor Malicious ConfigurationF0011:Modify Existing ServiceF0013: BootkitB0026:Malicious Network DriverF0012: RegistryRun Keys / Startup FolderF0005: HiddenFiles and DirectoriesF0005.003: AttributeF0003.004: Import AddressHooking (IAT) HookingF0010.001: Device DriverF0003.002:Hook memory mapping APIsF0005.001: ExtensionF0005.004: TimestampB0022.001: Reverse ShellF0003.001: PatchMmGetPhysicalMemoryRangesF0003.005: Inline HookingF0005.002: LocationF0003.003:Hook proceduresF0009.001:Router FirmwarePersistenceC0040: AllocateThread Local StorageC0054: Resume ThreadC0022: SynchronizationC0042: Create MutexC0041: SetThread Local Storage ValueC0043: Check MutexC0039: Terminate ThreadC0038: Create ThreadC0017: Create ProcessC0055: Suspend ThreadC0018: Terminate ProcessC0017.003: Create SuspendedProcess::Create ProcessC0022.001: CreateMutex::SynchronizationC0017.001: Create Processvia Shellcode::Create ProcessC0017.002: Create Processvia WMI::Create ProcessProcess Micro-objectiveB0038: Self DiscoveryE1083: Fileand Directory DiscoveryE1082: SystemInformation DiscoveryB0014:SMTP Connection DiscoveryB0013:Analysis Tool DiscoveryB0043: Taskbar DiscoveryE1010: ApplicationWindow DiscoveryE1082.m01: GenerateWindows ExceptionB0013.008:Known File LocationE1010.m01: Window TextB0013.004: Processdetection - PCAP UtilitiesB0013.002: Processdetection - DebuggersE1083.m01: Log FileB0013.005: Process detection- Process UtilitiesB0013.006: Processdetection - PE UtilitiesB0013.003: Process detection- SysInternals Suite ToolsB0013.009: Known WindowB0013.001:Process detectionB0013.007: Processdetection - SandboxesDiscoveryF0001: Software PackingF0004: Disableor Evade Security ToolsB0029: Polymorphic CodeB0040: Covert LocationF0006: Indicator BlockingF0003: HookingE1112: Modify RegistryE1014: RootkitE1027: ObfuscatedFiles or InformationE1480: Execution GuardrailsB0027: AlternativeInstallation LocationF0007: Self DeletionB0037: BypassData Execution PreventionF0009: Component FirmwareE1478: Install Insecureor Malicious ConfigurationF0013: BootkitE1055: Process InjectionF0005: HiddenFiles and DirectoriesF0001.009: ConfuserE1027.m07:Encryption of DataF0006.001: RemoveSMS Warning MessagesE1027.m02:Encoding-Standard AlgorithmE1055.m01: Hook Injectionvia SetWindowsHooksExF0001.005:Custom CompressionE1027.m06:Encryption of CodeF0005.003: AttributeF0004.003: Unhook APIsF0003.004: Import AddressHooking (IAT) HookingE1480.m02:Environmental KeysE1480.m01: Deposited KeysE1014.m01:Hide Kernel ModulesF0004.005: Modify PolicyF0001.001: Nested PackingE1027.m05:Encryption-Standard AlgorithmB0037.001: ROP ChainsE1014.m12: PreventNative API HookingE1055.m03:Injection using ShimsF0004.006:Force Lazy WritingB0027.001:Fileless MalwareF0004.001: DisableKernel Patch ProtectionE1480.m04:Host Fingerprint CheckE1055.m02: Injection and Persistencevia Registry ModificationF0003.002:Hook memory mapping APIsE1014.m02: Hide ServicesF0001.006: CustomCompression of CodeF0005.001: ExtensionE1014.m10:Prevent File DeletionF0005.004: TimestampF0004.002: Disable SystemFile Overwrite ProtectionE1027.m03:Encoding-Custom AlgorithmF0003.001: PatchMmGetPhysicalMemoryRangesE1014.m08:Prevent Registry DeletionF0001.012: ArmadilloF0001.008: UPXF0001.013: ASPackE1027.m08:Encryption-Custom AlgorithmB0029.003:Code ReorderingE1014.m07:Prevent Registry AccessF0003.005: Inline HookingB0027.002:Registry InstallB0040.002: SteganographyE1014.m09:Prevent File AccessF0001.003: StandardCompression of CodeF0001.004: StandardCompression of DataE1480.m03:GetVolumeInformationB0029.002:Call IndirectionsF0001.007: CustomCompression of DataF0004.004: AMSI BypassE1014.m11:Prevent Memory AccessF0001.002:Standard CompressionF0007.001: COMSPECEnvironment VariableF0001.011: ThemidaE1480.m05:Secure TriggersB0029.001: Packer StubE1480.m06: Token CheckB0040.001:Hide Data in RegistryF0004.008: Heavens GateE1014.m06:Prevent API UnhookingE1014.m04: Hide ThreadsF0005.002: LocationE1480.m07:Runs as ServiceF0001.010: VMProtectF0004.007: BypassWindows File ProtectionF0003.003:Hook proceduresE1014.m05:Hide Userspace LibrariesF0009.001:Router FirmwareDefense EvasionE1020:Automated ExfiltrationE1560:Archive Collected DataE1560.m01: EncodingE1560.m02: EncryptionE1560.m03: Encoding- Standard EncodingE1020.m01: Exfiltratevia File Hosting ServiceE1560.m05: Encryption- Standard EncryptionE1560.m06: Encryption- Custom EncryptionE1560.m04: Encoding- Custom EncodingExfiltrationC0036: RegistryC0034: Environment VariableC0033: ConsoleC0035: WallpaperC0036.004: CreateRegistry Key::RegistryC0036.005: QueryRegistry Key::RegistryC0036.003: OpenRegistry Key::RegistryC0036.007: DeleteRegistry Value::RegistryC0036.001: SetRegistry Key::RegistryC0036.002: DeleteRegistry Key::RegistryC0034.001: SetVariable::Environment VariableC0036.006: QueryRegistry Value::RegistryOperatingSystem Micro-objectiveE1113: Screen CaptureF0003: HookingB0028: CryptocurrencyF0002: KeyloggingE1056: Input CaptureB0028.003: ZcashB0028.001: BitcoinE1113.m01: WinAPIF0003.004: Import AddressHooking (IAT) HookingF0003.002:Hook memory mapping APIsF0002.002: PollingF0003.001: PatchMmGetPhysicalMemoryRangesF0003.005: Inline HookingB0028.002: EthereumE1056.m01: Mouse EventsF0002.001:Application HookF0003.003:Hook proceduresCollectionE1105: Remote File CopyB0031:Domain Name GenerationB0030: C2 CommunicationB0030.006:Send System InformationB0030.003: Serverto Client File TransferB0030.004: Clientto Server File TransferB0030.009:Request Email TemplateB0030.007: Send HeartbeatB0030.002: Receive DataB0030.008:Request CommandB0030.005:Check for PayloadB0030.010: RequestEmail Address ListB0030.001: Send DataCommand and ControlE1113: Screen CaptureF0003: HookingB0028: CryptocurrencyF0002: KeyloggingE1056: Input CaptureB0028.003: ZcashB0028.001: BitcoinE1113.m01: WinAPIF0003.004: Import AddressHooking (IAT) HookingF0003.002:Hook memory mapping APIsF0002.002: PollingF0003.001: PatchMmGetPhysicalMemoryRangesF0003.005: Inline HookingB0028.002: EthereumE1056.m01: Mouse EventsF0002.001:Application HookF0003.003:Hook proceduresCredential AccessC0059: Crypto LibraryC0028: Encryption KeyC0027: Encrypt DataC0021: GeneratePseudo-random SequenceC0029: Cryptographic HashC0031: Decrypt DataC0031.009:RC6::Decrypt DataC0027.009:RC4::Encrypt DataC0021.002: rand::GeneratePseudo-random SequenceC0027.005:Twofish::Encrypt DataC0031.007:HC-256::Decrypt DataC0027.013:Skipjack::Encrypt DataC0021.003: Use API::GeneratePseudo-random SequenceC0031.012:Sosemanuk::Decrypt DataC0031.010:RSA::Decrypt DataC0029.005:Tiger::Cryptographic HashC0021.005: Mersenne Twister::GeneratePseudo-random SequenceC0027.004:3DES::Encrypt DataC0027.007:HC-256::Encrypt DataC0027.012: StreamCipher::Encrypt DataC0031.004:Camellia::Decrypt DataC0031.005:3DES::Decrypt DataC0027.011:RSA::Encrypt DataC0031.003:Blowfish::Decrypt DataC0029.006:Snefru::Cryptographic HashC0031.014:Twofish::Decrypt DataC0029.003:SHA256::Cryptographic HashC0029.001:MD5::Cryptographic HashC0021.004: RC4 PRGA::GeneratePseudo-random SequenceC0031.011:Skipjack::Decrypt DataC0031.013: StreamCipher::Decrypt DataC0029.004:SHA224::Cryptographic HashC0027.008:Sosemanuk::Encrypt DataC0031.002: BlockCipher::Decrypt DataC0027.006:HC-128::Encrypt DataC0028.002:RC4 KSA::Encryption KeyC0029.002:SHA1::Cryptographic HashC0027.003:Camellia::Encrypt DataC0028.001: Import PublicKey::Encryption KeyC0031.001:AES::Decrypt DataC0021.001: GetTickCount::GeneratePseudo-random SequenceC0031.008:RC4::Decrypt DataC0027.001:AES::Encrypt DataC0027.010:RC6::Encrypt DataC0031.006:HC-128::Decrypt DataC0027.014: BlockCipher::Encrypt DataC0027.002:Blowfish::Encrypt DataCryptographyMicro-objectiveC0048: Delete DirectoryC0047: Delete FileC0045: Copy FileC0051: Read FileC0056: Read Virtual DiskC0016: Create FileC0050: Set File AttributesC0015: Alter File ExtensionC0046: Create DirectoryC0049: Get File AttributesC0052: Writes FileC0016.002: CreateRansomware File::Create FileC0015.001: AppendExtension::Alter File ExtensionC0016.001: Create OfficeDocument::Create FileFile System Micro-objectiveE1472: Generate FraudulentAdvertising RevenueB0018: Resource HijackingE1510:Clipboard ModificationB0022: Remote AccessB0016:Compromise Data IntegrityB0033: Denial of ServiceB0042: Modify HardwareB0039: SpammingE1203: Exploitationfor Client ExecutionF0009: Component FirmwareB0019:Manipulate Network TrafficE1486:Data Encrypted for ImpactE1485: Data DestructionF0014: Disk Content WipeE1190: Exploit Kit BehaviorB0017: Destroy HardwareE1203.m04: Red HatJBoss Enterprise ProductsB0042.002: MouseB0042.001: CDROME1472.m01:Click HijackingE1485.m02:Empty Recycle BinB0018.001:Password CrackingB0022.001: Reverse ShellB0042.003: PrinterB0018.002: CryptojackingE1472.m02: AdvertisementReplacement FraudE1203.m03: File TransferProtocol (FTP) ServersE1485.m03: DeleteApplication/SoftwareE1203.m02:Java-based Web ServersE1203.m01: RemoteDesktop Protocols (RDP)F0014.001:Delete Shadow DriveE1203.m06:Windows UtilitiesE1203.m05: SysinternalsF0009.001:Router FirmwareImpactC0025: Decompress DataC0024: Compress DataC0058: ModuloC0026: Encode DataC0019: Check StringC0053: Decode DataC0030:Non-Cryptographic HashC0032: ChecksumC0060: Compression LibraryC0020: Use ConstantC0032.002: Luhn::ChecksumC0030.001:MurmurHash::Non-Cryptographic HashC0030.002:pHash::Non-Cryptographic HashC0032.003: BSD::ChecksumC0030.004:dhash::Non-Cryptographic HashC0053.001:Base64::Decode DataC0032.001:CRC32::ChecksumC0026.002:XOR::Encode DataC0024.001:QuickLZ::Compress DataC0025.001:QuickLZ::Decompress DataC0032.005:Adler::ChecksumC0032.004:Verhoeff::ChecksumC0025.002:IEncodingFilterFactory::DecompressDataC0024.002:IEncodingFilterFactory::Compress DataC0030.003:Fast-Hash::Non-Cryptographic HashC0053.002:XOR::Decode DataC0026.001:Base64::Encode DataC0030.005:FNV::Non-Cryptographic HashData Micro-objectiveF0001: Software PackingB0010: CallGraph Generation EvasionB0034: ExecutableCode OptimizationE1027: ObfuscatedFiles or InformationB0032:Executable Code ObfuscationB0012: Disassembler EvasionB0008: ExecutableCode VirtualizationF0001.009: ConfuserE1027.m07:Encryption of DataE1027.m02:Encoding-Standard AlgorithmB0032.018:Symbol ObfuscationF0001.005:Custom CompressionE1027.m06:Encryption of CodeB0012.004:Variable RecompositionB0034.001: Jump/CallAbsolute AddressB0032.011: ImportAddress Table ObfuscationF0001.001: Nested PackingB0010.001:Two-layer Function ReturnE1027.m05:Encryption-Standard AlgorithmB0032.005: Jump InsertionB0032.016: StructuredException Handling (SEH)F0001.006: CustomCompression of CodeB0032.012:Import CompressionE1027.m03:Encoding-Custom AlgorithmB0008.001: Multiple VMsF0001.012: ArmadilloF0001.008: UPXF0001.013: ASPackE1027.m08:Encryption-Custom AlgorithmB0012.001:Argument ObfuscationB0012.005: VBA StompingB0012.003:Value Dependent JumpsB0032.008:Data Value ObfuscationB0032.007:Junk Code InsertionF0001.003: StandardCompression of CodeF0001.004: StandardCompression of DataB0012.002:Conditional MisdirectionB0010.002: Invoke NTDLLSystem Calls via Encoded TableF0001.007: CustomCompression of DataB0032.003:Dead Code InsertionF0001.002:Standard CompressionB0032.015:Merged Code SectionsB0032.013:Instruction OverlapB0032.010: Guard PagesF0001.011: ThemidaB0034.002: MinificationB0032.002: Code InsertionB0032.006:Thunk Code InsertionB0032.017: Stack StringsB0032.001: API HashingF0001.010: VMProtectB0032.014:Interleaving CodeB0032.009:Entry Point ObfuscationB0032.004:Fake Code InsertionAnti-Static AnalysisE1105: Remote File CopyB0021:Send Poisoned Text MessageB0026:Malicious Network DriverE1195:Supply Chain CompromiseB0020: Send EmailE1195.m01: AbuseEnterprise CertificatesE1195.m02:Exploit Private APIsLateral Movement \ No newline at end of file +C0003:Interprocess CommunicationC0014: ICMP CommunicationC0002: HTTP CommunicationC0005: WinINetC0001: Socket CommunicationC0004: FTP CommunicationC0012: SMTP CommunicationC0011: DNS CommunicationC0004.002: WinINet::FTPCommunicationC0003.001: CreatePipe::Interprocess CommunicationC0011.003: DDNS DomainConnect::DNS CommunicationC0005.005:InternetWriteFile::WinINetC0001.001: Set SocketConfig::Socket CommunicationC0011.004: ResolveTLD::DNS CommunicationC0002.010: IWebBrowser::HTTPCommunicationC0011.001: Resolve::DNSCommunicationC0003.003: ReadPipe::Interprocess CommunicationC0001.004: ConnectSocket::Socket CommunicationC0001.006: ReceiveData::Socket CommunicationC0001.016: Receive TCPData::Socket CommunicationC0001.002: TCPServer::Socket CommunicationC0003.002: ConnectPipe::Interprocess CommunicationC0004.001: SendFile::FTP CommunicationC0005.003:InternetOpenURL::WinINetC0002.007: WinINet::HTTPCommunicationC0001.015: Send UDPData::Socket CommunicationC0001.010: Create UDPSocket::Socket CommunicationC0001.013: UDPClient::Socket CommunicationC0001.009: Initialize WinsockLibrary::Socket CommunicationC0001.007: SendData::Socket CommunicationC0005.001:InternetConnect::WinINetC0001.005: Start TCPServer::Socket CommunicationC0002.016: SendResponse::HTTP CommunicationC0014.002: EchoRequest::ICMP CommunicationC0001.003: CreateSocket::Socket CommunicationC0002.014: ReadHeader::HTTP CommunicationC0001.011: Create TCPSocket::Socket CommunicationC0002.017: GetResponse::HTTP CommunicationC0001.012: Get SocketStatus::Socket CommunicationC0002.005: SendData::HTTP CommunicationC0002.003: SendRequest::HTTP CommunicationC0005.004:InternetReadFile::WinINetC0002.009: Connect toServer::HTTP CommunicationC0001.014: Send TCPData::Socket CommunicationC0011.002: ServerConnect::DNS CommunicationC0002.006: DownloadURL::HTTP CommunicationC0002.004: OpenURL::HTTP CommunicationC0001.008: TCPClient::Socket CommunicationC0012.001: ServerConnect::SMTP CommunicationC0002.011: ExtractBody::HTTP CommunicationC0002.018: StartServer::HTTP CommunicationC0002.008: WinHTTP::HTTPCommunicationC0002.015: ReceiveRequest::HTTP CommunicationC0001.017: Receive UDPData::Socket CommunicationC0014.001: GenerateTraffic::ICMP CommunicationC0002.002: Client::HTTPCommunicationC0002.001: Server::HTTPCommunicationC0002.013: SetHeader::HTTP CommunicationC0002.012: CreateRequest::HTTP CommunicationC0003.004: WritePipe::Interprocess CommunicationC0011.005: Resolve Free HostingDomain::DNS CommunicationC0012.002: Request::SMTPCommunicationC0005.002:InternetOpen::WinINetCommunicationMicro-objectiveB0023:Install Additional ProgramB0025:Conditional ExecutionE1059: Commandand Scripting InterpreterE1204: User InteractionE1203: Exploitationfor Client ExecutionB0011: Remote CommandsB0024: PreventConcurrent ExecutionB0021:Send Poisoned Text MessageB0020: Send EmailB0025.001: Suicide ExitE1203.m04: Red HatJBoss Enterprise ProductsB0011.002: Download FileB0011.004: ShutdownE1203.m03: File TransferProtocol (FTP) ServersB0011.003: ExecuteB0011.006: UninstallE1203.m02:Java-based Web ServersB0011.005: SleepE1203.m01: RemoteDesktop Protocols (RDP)B0011.007: Upload FileE1203.m06:Windows UtilitiesE1203.m05: SysinternalsExecutionF0001: Software PackingF0003: HookingB0002: Debugger EvasionB0001: Debugger DetectionE1480: Execution GuardrailsB0006: Memory Dump EvasionB0005: Emulator EvasionB0009:Virtual Machine DetectionB0008: ExecutableCode VirtualizationB0003:Dynamic Analysis EvasionB0007: Sandbox DetectionB0036: Capture EvasionB0004: Emulator DetectionB0001.020: Process JobsB0002.019: Pre-DebugF0001.009: ConfuserB0001.033: Timing/DelayCheck QueryPerformanceCounterB0001.008:IsDebuggerPresentB0004.004: FailedNetwork ConnectionsB0003.004: Demo ModeB0036.003: MultipleStages of LoadersB0001.010:Memory Write WatchingB0001.009:Memory BreakpointsB0006.003:Hide virtual memoryB0009.027: Unique Hardware/FirmwareCheck - CPU LocationB0002.021:Return ObfuscationF0001.005:Custom CompressionB0005.002:Undocumented OpcodesB0002.017:Parallel ThreadsB0009.029:Instruction TestingB0004.003: CheckEmulator-related Registry KeysB0002.027:Stolen API CodeB0007.007: Self CheckB0001.021: ProcessHeapB0009.030: InstructionTesting - SIDT (red pill)B0009.035:Instruction Testing - INB0002.003: Byte StealingB0003.001:Alternative ntdll.dllB0002.014:Modify PE HeaderF0003.004: Import AddressHooking (IAT) HookingB0009.001: Check Fileand Directory ArtifactsE1480.m02:Environmental KeysE1480.m01: Deposited KeysB0009.033:Instruction Testing - STRB0009.019: Modern SpecsCheck - Keyboard layoutB0006.007:On-the-Fly APIsB0003.006: Encode FileB0009.024: UniqueHardware/Firmware Check - BIOSB0009.038: InstructionTesting - VPCEXTB0001.031:WudfIsAnyDebuggerPresentB0001.032: Timing/DelayCheck GetTickCountB0001.007: Interrupt 1F0001.001: Nested PackingB0003.008: Hook InterruptB0009.021: CheckWindows - Unique windowsB0002.006:Exception MisdirectionB0009.017: ModernSpecs Check - PrinterB0002.004:Change SizeOfImageB0001.002:CheckRemoteDebuggerPresentB0002.026: Static LinkingB0001.030:UnhandledExceptionFilterB0007.008:Timing/Date CheckB0001.034: Anti-debuggingInstructionsB0006.005: TamperingE1480.m04:Host Fingerprint CheckB0009.020: CheckWindows - Window sizeB0001.026: Stack CanaryB0009.007: Check SoftwareF0003.002:Hook memory mapping APIsB0009.032: InstructionTesting - SMSWB0003.007:Hook File SystemF0001.006: CustomCompression of CodeB0007.002: Check FilesB0009.026: UniqueHardware/Firmware Check - CPU NameB0001.036: ProcessEnvironment Block NtGlobalFlagB0004.001: Check forEmulator-related FilesB0009.023: UniqueHardware/Firmware CheckB0009.022: CheckWindows - Title barsB0009.008:Check Virtual DevicesB0001.018: Parent ProcessB0009.011: HTML5Performance Object CheckB0001.006: Interrupt 0x2dB0009.005:Check Registry KeysB0001.015:NtYieldExecution/SwitchToThreadB0004.002:Check for WINE VersionB0002.024: Self-DebuggingB0002.015: NanomitesB0009.018: Modern SpecsCheck - Processor countB0001.013: NtQueryObjectB0002.022:RtlAdjustPrivilegeB0001.011:Monitoring ThreadB0008.001: Multiple VMsB0003.009: IllusionB0001.025:Software BreakpointsB0001.014:NtSetInformationThreadF0003.001: PatchMmGetPhysicalMemoryRangesF0001.012: ArmadilloB0001.029: TLS CallbacksF0001.008: UPXB0009.013:Modern Specs CheckF0001.013: ASPackB0002.012: Loop EscapesB0009.012:Human User CheckB0002.011: InliningB0001.016:OutputDebugStringB0002.020:Relocate API CodeB0009.010:Guest Process TestingB0006.008:Feed MisinformationB0003.005: Drop CodeB0006.004: SizeOfImageB0009.036: InstructionTesting - RDTSCF0003.005: Inline HookingB0007.006:Screen Resolution TestingB0002.016:Obfuscate Library UseB0001.023:SeDebugPrivilegeB0003.002: Data FloodB0002.007:Get Base IndirectlyF0001.003: StandardCompression of CodeB0001.005:Hardware BreakpointsF0001.004: StandardCompression of DataB0001.028:Timing/Delay CheckE1480.m03:GetVolumeInformationB0036.002:Encrypted PayloadsB0009.031: InstructionTesting - SGDT/SLDT (no pill)B0001.004:Debugger ArtifactsF0001.007: CustomCompression of DataB0001.027: TIB AwareB0002.002:Break Point ClearingB0003.010: RestartB0003.003:Delayed ExecutionB0009.002:Check Memory ArtifactsB0009.003: CheckNamed System ObjectsB0005.001:Different Opcode SetsF0001.002:Standard CompressionB0002.023:Section MisalignmentB0002.030: Use InterruptsB0002.018:Pipeline MisdirectionB0002.025: Self-UnmappingB0001.019:Process Environment BlockF0001.011: ThemidaE1480.m05:Secure TriggersB0006.001:Code Encryption in MemoryB0001.037: ProcessEnvironment Block IsDebuggedB0007.001:Check Clipboard DataE1480.m06: Token CheckB0009.034: InstructionTesting - CPUIDB0006.002:Erase the PE headerB0002.001:Block InterruptsB0006.009:Flow Opcode ObstructionB0009.037: InstructionTesting - VMCPUIDB0009.009: Check WindowsB0005.004:Extra Loops/Time LocksB0036.001:Memory-only PayloadB0002.029: Thread TimeoutB0001.012:NtQueryInformationProcessB0009.004:Check ProcessesB0001.017: Page ExceptionBreakpoint DetectionB0009.015: ModernSpecs Check - Drive sizeB0002.013: Malloc UseB0009.006:Check Running ServicesB0009.025: Unique Hardware/FirmwareCheck - I/O Communication PortB0001.003: CloseHandleE1480.m07:Runs as ServiceF0001.010: VMProtectB0002.010:Import ObfuscationB0009.014: Modern SpecsCheck - Total physical memoryF0003.003:Hook proceduresB0009.028: Unique Hardware/FirmwareCheck - MAC AddressB0009.016: ModernSpecs Check - USB driveB0001.024:SetHandleInformationB0005.003:Unusual/Undocumented API CallsB0007.004:Injected DLL TestingB0001.035: Process EnvironmentBlock BeingDebuggedB0002.005:Code Integrity CheckB0007.005:Product Key/ID TestingB0001.001:API Hook DetectionB0007.009:Timing/Uptime CheckAnti-Behavioral AnalysisC0044: Free MemoryC0009: Stack PivotC0007: Allocate MemoryC0006: Heap SprayC0008:Change Memory ProtectionC0010: Overflow BufferC0008.001: ExecutableStack::Change Memory ProtectionC0008.002: ExecutableHeap::Change Memory ProtectionMemory Micro-objectiveC0037: Install DriverC0023: Load DriverC0057: Simulate HardwareC0057.002: MouseClick::Simulate HardwareC0057.001:Ctrl-Alt-Del::Simulate HardwareHardware Micro-objectiveF0003: HookingF0010: KernelModules and ExtensionsE1112: Modify RegistryB0022: Remote AccessB0035: Shutdown EventE1105: Remote File CopyF0009: Component FirmwareE1478: Install Insecureor Malicious ConfigurationF0011:Modify Existing ServiceF0013: BootkitB0026:Malicious Network DriverF0012: RegistryRun Keys / Startup FolderF0005: HiddenFiles and DirectoriesF0005.003: AttributeF0003.004: Import AddressHooking (IAT) HookingF0010.001: Device DriverF0003.002:Hook memory mapping APIsF0005.001: ExtensionF0005.004: TimestampB0022.001: Reverse ShellF0003.001: PatchMmGetPhysicalMemoryRangesF0003.005: Inline HookingF0005.002: LocationF0003.003:Hook proceduresF0009.001:Router FirmwarePersistenceC0040: AllocateThread Local StorageC0054: Resume ThreadC0022: SynchronizationC0042: Create MutexC0041: SetThread Local Storage ValueC0043: Check MutexC0039: Terminate ThreadC0038: Create ThreadC0017: Create ProcessC0055: Suspend ThreadC0018: Terminate ProcessC0017.003: Create SuspendedProcess::Create ProcessC0022.001: CreateMutex::SynchronizationC0017.001: Create Processvia Shellcode::Create ProcessC0017.002: Create Processvia WMI::Create ProcessProcess Micro-objectiveB0038: Self DiscoveryE1083: Fileand Directory DiscoveryE1082: SystemInformation DiscoveryB0014:SMTP Connection DiscoveryB0013:Analysis Tool DiscoveryB0043: Taskbar DiscoveryE1010: ApplicationWindow DiscoveryE1082.m01: GenerateWindows ExceptionB0013.008:Known File LocationE1010.m01: Window TextB0013.004: Processdetection - PCAP UtilitiesB0013.002: Processdetection - DebuggersE1083.m01: Log FileB0013.005: Process detection- Process UtilitiesB0013.006: Processdetection - PE UtilitiesB0013.003: Process detection- SysInternals Suite ToolsB0013.009: Known WindowB0013.001:Process detectionB0013.007: Processdetection - SandboxesDiscoveryF0001: Software PackingF0004: Disableor Evade Security ToolsB0029: Polymorphic CodeB0040: Covert LocationF0006: Indicator BlockingF0003: HookingE1112: Modify RegistryE1014: RootkitE1027: ObfuscatedFiles or InformationE1480: Execution GuardrailsB0027: AlternativeInstallation LocationF0007: Self DeletionB0037: BypassData Execution PreventionF0009: Component FirmwareE1478: Install Insecureor Malicious ConfigurationF0013: BootkitE1055: Process InjectionF0005: HiddenFiles and DirectoriesF0001.009: ConfuserE1027.m07:Encryption of DataF0006.001: RemoveSMS Warning MessagesE1027.m02:Encoding-Standard AlgorithmE1055.m01: Hook Injectionvia SetWindowsHooksExF0001.005:Custom CompressionE1027.m06:Encryption of CodeF0005.003: AttributeF0004.003: Unhook APIsF0003.004: Import AddressHooking (IAT) HookingE1480.m02:Environmental KeysE1480.m01: Deposited KeysE1014.m01:Hide Kernel ModulesF0004.005: Modify PolicyF0001.001: Nested PackingE1027.m05:Encryption-Standard AlgorithmB0037.001: ROP ChainsE1014.m12: PreventNative API HookingE1055.m03:Injection using ShimsF0004.006:Force Lazy WritingB0027.001:Fileless MalwareF0004.001: DisableKernel Patch ProtectionE1480.m04:Host Fingerprint CheckE1055.m02: Injection and Persistencevia Registry ModificationF0003.002:Hook memory mapping APIsE1014.m02: Hide ServicesF0001.006: CustomCompression of CodeF0005.001: ExtensionE1014.m10:Prevent File DeletionF0005.004: TimestampF0004.002: Disable SystemFile Overwrite ProtectionE1027.m03:Encoding-Custom AlgorithmF0003.001: PatchMmGetPhysicalMemoryRangesE1014.m08:Prevent Registry DeletionF0001.012: ArmadilloF0001.008: UPXF0001.013: ASPackE1027.m08:Encryption-Custom AlgorithmB0029.003:Code ReorderingE1014.m07:Prevent Registry AccessF0003.005: Inline HookingB0027.002:Registry InstallB0040.002: SteganographyE1014.m09:Prevent File AccessF0001.003: StandardCompression of CodeF0001.004: StandardCompression of DataE1480.m03:GetVolumeInformationB0029.002:Call IndirectionsF0001.007: CustomCompression of DataF0004.004: AMSI BypassE1014.m11:Prevent Memory AccessF0001.002:Standard CompressionF0007.001: COMSPECEnvironment VariableF0001.011: ThemidaE1480.m05:Secure TriggersB0029.001: Packer StubE1480.m06: Token CheckB0040.001:Hide Data in RegistryF0004.008: Heavens GateE1014.m06:Prevent API UnhookingE1014.m04: Hide ThreadsF0005.002: LocationE1480.m07:Runs as ServiceF0001.010: VMProtectF0004.007: BypassWindows File ProtectionF0003.003:Hook proceduresE1014.m05:Hide Userspace LibrariesF0009.001:Router FirmwareDefense EvasionE1020:Automated ExfiltrationE1560:Archive Collected DataE1560.m01: EncodingE1560.m02: EncryptionE1560.m03: Encoding- Standard EncodingE1020.m01: Exfiltratevia File Hosting ServiceE1560.m05: Encryption- Standard EncryptionE1560.m06: Encryption- Custom EncryptionE1560.m04: Encoding- Custom EncodingExfiltrationC0036: RegistryC0034: Environment VariableC0033: ConsoleC0035: WallpaperC0036.004: CreateRegistry Key::RegistryC0036.005: QueryRegistry Key::RegistryC0036.003: OpenRegistry Key::RegistryC0036.007: DeleteRegistry Value::RegistryC0036.001: SetRegistry Key::RegistryC0036.002: DeleteRegistry Key::RegistryC0034.001: SetVariable::Environment VariableC0036.006: QueryRegistry Value::RegistryOperatingSystem Micro-objectiveE1113: Screen CaptureF0003: HookingB0028: CryptocurrencyF0002: KeyloggingE1056: Input CaptureB0028.003: ZcashB0028.001: BitcoinE1113.m01: WinAPIF0003.004: Import AddressHooking (IAT) HookingF0003.002:Hook memory mapping APIsF0002.002: PollingF0003.001: PatchMmGetPhysicalMemoryRangesF0003.005: Inline HookingB0028.002: EthereumE1056.m01: Mouse EventsF0002.001:Application HookF0003.003:Hook proceduresCollectionE1105: Remote File CopyB0031:Domain Name GenerationB0030: C2 CommunicationB0030.006:Send System InformationB0030.003: Serverto Client File TransferB0030.004: Clientto Server File TransferB0030.009:Request Email TemplateB0030.007: Send HeartbeatB0030.002: Receive DataB0030.008:Request CommandB0030.005:Check for PayloadB0030.010: RequestEmail Address ListB0030.001: Send DataCommand and ControlE1113: Screen CaptureF0003: HookingB0028: CryptocurrencyF0002: KeyloggingE1056: Input CaptureB0028.003: ZcashB0028.001: BitcoinE1113.m01: WinAPIF0003.004: Import AddressHooking (IAT) HookingF0003.002:Hook memory mapping APIsF0002.002: PollingF0003.001: PatchMmGetPhysicalMemoryRangesF0003.005: Inline HookingB0028.002: EthereumE1056.m01: Mouse EventsF0002.001:Application HookF0003.003:Hook proceduresCredential AccessC0059: Crypto LibraryC0028: Encryption KeyC0027: Encrypt DataC0021: GeneratePseudo-random SequenceC0029: Cryptographic HashC0031: Decrypt DataC0031.009:RC6::Decrypt DataC0027.009:RC4::Encrypt DataC0021.002: rand::GeneratePseudo-random SequenceC0027.005:Twofish::Encrypt DataC0031.007:HC-256::Decrypt DataC0027.013:Skipjack::Encrypt DataC0021.003: Use API::GeneratePseudo-random SequenceC0031.012:Sosemanuk::Decrypt DataC0031.010:RSA::Decrypt DataC0029.005:Tiger::Cryptographic HashC0021.005: Mersenne Twister::GeneratePseudo-random SequenceC0027.004:3DES::Encrypt DataC0027.007:HC-256::Encrypt DataC0027.012: StreamCipher::Encrypt DataC0031.004:Camellia::Decrypt DataC0031.005:3DES::Decrypt DataC0027.011:RSA::Encrypt DataC0031.003:Blowfish::Decrypt DataC0029.006:Snefru::Cryptographic HashC0031.014:Twofish::Decrypt DataC0029.003:SHA256::Cryptographic HashC0029.001:MD5::Cryptographic HashC0021.004: RC4 PRGA::GeneratePseudo-random SequenceC0031.011:Skipjack::Decrypt DataC0031.013: StreamCipher::Decrypt DataC0029.004:SHA224::Cryptographic HashC0027.008:Sosemanuk::Encrypt DataC0031.002: BlockCipher::Decrypt DataC0027.006:HC-128::Encrypt DataC0028.002:RC4 KSA::Encryption KeyC0029.002:SHA1::Cryptographic HashC0027.003:Camellia::Encrypt DataC0028.001: Import PublicKey::Encryption KeyC0031.001:AES::Decrypt DataC0021.001: GetTickCount::GeneratePseudo-random SequenceC0031.008:RC4::Decrypt DataC0027.001:AES::Encrypt DataC0027.010:RC6::Encrypt DataC0031.006:HC-128::Decrypt DataC0027.014: BlockCipher::Encrypt DataC0027.002:Blowfish::Encrypt DataCryptographyMicro-objectiveC0048: Delete DirectoryC0047: Delete FileC0045: Copy FileC0051: Read FileC0056: Read Virtual DiskC0016: Create FileC0050: Set File AttributesC0015: Alter File ExtensionC0046: Create DirectoryC0049: Get File AttributesC0052: Writes FileC0016.002: CreateRansomware File::Create FileC0015.001: AppendExtension::Alter File ExtensionC0016.001: Create OfficeDocument::Create FileFile System Micro-objectiveE1472: Generate FraudulentAdvertising RevenueB0018: Resource HijackingE1510:Clipboard ModificationB0022: Remote AccessB0016:Compromise Data IntegrityB0033: Denial of ServiceB0042: Modify HardwareB0039: SpammingE1203: Exploitationfor Client ExecutionF0009: Component FirmwareB0019:Manipulate Network TrafficE1486:Data Encrypted for ImpactE1485: Data DestructionF0014: Disk Content WipeE1190: Exploit Kit BehaviorB0017: Destroy HardwareE1203.m04: Red HatJBoss Enterprise ProductsB0042.002: MouseB0042.001: CDROME1472.m01:Click HijackingE1485.m02:Empty Recycle BinB0018.001:Password CrackingB0022.001: Reverse ShellB0042.003: PrinterB0018.002: CryptojackingE1472.m02: AdvertisementReplacement FraudE1203.m03: File TransferProtocol (FTP) ServersE1485.m03: DeleteApplication/SoftwareE1203.m02:Java-based Web ServersE1203.m01: RemoteDesktop Protocols (RDP)F0014.001:Delete Shadow DriveE1203.m06:Windows UtilitiesE1203.m05: SysinternalsF0009.001:Router FirmwareImpactC0025: Decompress DataC0024: Compress DataC0058: ModuloC0026: Encode DataC0019: Check StringC0053: Decode DataC0030:Non-Cryptographic HashC0032: ChecksumC0060: Compression LibraryC0020: Use ConstantC0032.002: Luhn::ChecksumC0030.001:MurmurHash::Non-Cryptographic HashC0030.002:pHash::Non-Cryptographic HashC0032.003: BSD::ChecksumC0030.004:dhash::Non-Cryptographic HashC0053.001:Base64::Decode DataC0032.001:CRC32::ChecksumC0026.002:XOR::Encode DataC0024.001:QuickLZ::Compress DataC0025.001:QuickLZ::Decompress DataC0032.005:Adler::ChecksumC0032.004:Verhoeff::ChecksumC0025.002:IEncodingFilterFactory::DecompressDataC0024.002:IEncodingFilterFactory::Compress DataC0030.003:Fast-Hash::Non-Cryptographic HashC0053.002:XOR::Decode DataC0026.001:Base64::Encode DataC0030.005:FNV::Non-Cryptographic HashData Micro-objectiveF0001: Software PackingB0010: CallGraph Generation EvasionB0034: ExecutableCode OptimizationE1027: ObfuscatedFiles or InformationB0032:Executable Code ObfuscationB0012: Disassembler EvasionB0008: ExecutableCode VirtualizationF0001.009: ConfuserE1027.m07:Encryption of DataE1027.m02:Encoding-Standard AlgorithmB0032.018:Symbol ObfuscationF0001.005:Custom CompressionE1027.m06:Encryption of CodeB0012.004:Variable RecompositionB0034.001: Jump/CallAbsolute AddressB0032.011: ImportAddress Table ObfuscationF0001.001: Nested PackingB0010.001:Two-layer Function ReturnE1027.m05:Encryption-Standard AlgorithmB0032.005: Jump InsertionB0032.016: StructuredException Handling (SEH)F0001.006: CustomCompression of CodeB0032.012:Import CompressionE1027.m03:Encoding-Custom AlgorithmB0008.001: Multiple VMsF0001.012: ArmadilloF0001.008: UPXF0001.013: ASPackE1027.m08:Encryption-Custom AlgorithmB0012.001:Argument ObfuscationB0012.005: VBA StompingB0012.003:Value Dependent JumpsB0032.008:Data Value ObfuscationB0032.007:Junk Code InsertionF0001.003: StandardCompression of CodeF0001.004: StandardCompression of DataB0012.002:Conditional MisdirectionB0010.002: Invoke NTDLLSystem Calls via Encoded TableF0001.007: CustomCompression of DataB0032.003:Dead Code InsertionF0001.002:Standard CompressionB0032.015:Merged Code SectionsB0032.013:Instruction OverlapB0032.010: Guard PagesF0001.011: ThemidaB0034.002: MinificationB0032.002: Code InsertionB0032.006:Thunk Code InsertionB0032.017: Stack StringsB0032.001: API HashingF0001.010: VMProtectB0032.014:Interleaving CodeB0032.009:Entry Point ObfuscationB0032.004:Fake Code InsertionAnti-Static AnalysisE1105: Remote File CopyB0021:Send Poisoned Text MessageB0026:Malicious Network DriverE1195:Supply Chain CompromiseB0020: Send EmailE1195.m01: AbuseEnterprise CertificatesE1195.m02:Exploit Private APIsLateral Movement \ No newline at end of file diff --git a/yfaq/mbc_matrix_without_ids.svg b/yfaq/mbc_matrix_without_ids.svg index 3206596..6df2716 100644 --- a/yfaq/mbc_matrix_without_ids.svg +++ b/yfaq/mbc_matrix_without_ids.svg @@ -1 +1 @@ -Interprocess CommunicationICMP CommunicationHTTP CommunicationWinINetSocket CommunicationFTP CommunicationSMTP CommunicationDNS CommunicationWinINet::FTPCommunicationCreate Pipe::InterprocessCommunicationDDNS Domain Connect::DNSCommunicationInternetWriteFile::WinINetSet Socket Config::SocketCommunicationResolveTLD::DNS CommunicationIWebBrowser::HTTPCommunicationResolve::DNSCommunicationRead Pipe::InterprocessCommunicationConnect Socket::SocketCommunicationReceive Data::SocketCommunicationReceive TCP Data::SocketCommunicationTCP Server::SocketCommunicationConnect Pipe::InterprocessCommunicationSendFile::FTP CommunicationInternetOpenURL::WinINetWinINet::HTTPCommunicationSend UDP Data::SocketCommunicationCreate UDP Socket::SocketCommunicationUDP Client::SocketCommunicationInitialize WinsockLibrary::Socket CommunicationSend Data::SocketCommunicationInternetConnect::WinINetStart TCP Server::SocketCommunicationSend Response::HTTPCommunicationEcho Request::ICMPCommunicationCreate Socket::SocketCommunicationRead Header::HTTPCommunicationCreate TCP Socket::SocketCommunicationGet Response::HTTPCommunicationGet Socket Status::SocketCommunicationSendData::HTTP CommunicationSend Request::HTTPCommunicationInternetReadFile::WinINetConnect to Server::HTTPCommunicationSend TCP Data::SocketCommunicationServer Connect::DNSCommunicationDownloadURL::HTTP CommunicationOpenURL::HTTP CommunicationTCP Client::SocketCommunicationServer Connect::SMTPCommunicationExtractBody::HTTP CommunicationStart Server::HTTPCommunicationWinHTTP::HTTPCommunicationReceive Request::HTTPCommunicationReceive UDP Data::SocketCommunicationGenerate Traffic::ICMPCommunicationClient::HTTPCommunicationServer::HTTPCommunicationSet Header::HTTPCommunicationCreate Request::HTTPCommunicationWrite Pipe::InterprocessCommunicationResolve Free HostingDomain::DNS CommunicationRequest::SMTPCommunicationInternetOpen::WinINetCommunicationMicro-objectiveInstall Additional ProgramConditional ExecutionCommandand Scripting InterpreterUser InteractionExploitationfor Client ExecutionRemote CommandsPreventConcurrent ExecutionSend Poisoned Text MessageSend EmailSuicide ExitRed HatJBoss Enterprise ProductsDownload FileShutdownFile TransferProtocol (FTP) ServersExecuteUninstallJava-based Web ServersSleepRemoteDesktop Protocols (RDP)Upload FileWindows UtilitiesSysinternalsExecutionSoftware PackingHookingDebugger EvasionDebugger DetectionExecution GuardrailsMemory Dump EvasionEmulator EvasionVirtual Machine DetectionExecutableCode VirtualizationDynamic Analysis EvasionSandbox DetectionCapture EvasionEmulator DetectionProcess JobsPre-DebugConfuserTiming/Delay CheckQueryPerformanceCounterIsDebuggerPresentFailedNetwork ConnectionsDemo ModeMultipleStages of LoadersMemory Write WatchingMemory BreakpointsHide virtual memoryUnique Hardware/FirmwareCheck - CPU LocationReturn ObfuscationCustom CompressionUndocumented OpcodesParallel ThreadsInstruction TestingCheck Emulator-relatedRegistry KeysStolen API CodeSelf CheckProcessHeapInstructionTesting - SIDT (red pill)Instruction Testing - INByte StealingAlternative ntdll.dllModify PE HeaderImport AddressHooking (IAT) HookingCheck Fileand Directory ArtifactsEnvironmental KeysDeposited KeysInstruction Testing - STRModern SpecsCheck - Keyboard layoutOn-the-Fly APIsEncode FileUnique Hardware/FirmwareCheck - BIOSInstructionTesting - VPCEXTWudfIsAnyDebuggerPresentTiming/DelayCheck GetTickCountInterrupt 1Nested PackingHook InterruptCheckWindows - Unique windowsException MisdirectionModernSpecs Check - PrinterChange SizeOfImageCheckRemoteDebuggerPresentStatic LinkingUnhandledExceptionFilterTiming/Date CheckAnti-debuggingInstructionsTamperingHost Fingerprint CheckCheckWindows - Window sizeStack CanaryCheck SoftwareHook memory mapping APIsInstructionTesting - SMSWHook File SystemCustomCompression of CodeCheck FilesUnique Hardware/FirmwareCheck - CPU NameProcess EnvironmentBlock NtGlobalFlagCheck forEmulator-related FilesUniqueHardware/Firmware CheckCheckWindows - Title barsCheck Virtual DevicesParent ProcessHTML5Performance Object CheckInterrupt 0x2dCheck Registry KeysNtYieldExecution/SwitchToThreadCheck for WINE VersionSelf-DebuggingNanomitesModern SpecsCheck - Processor countNtQueryObjectRtlAdjustPrivilegeMonitoring ThreadMultiple VMsIllusionSoftware BreakpointsNtSetInformationThreadPatchMmGetPhysicalMemoryRangesArmadilloTLS CallbacksUPXModern Specs CheckASPackLoop EscapesHuman User CheckInliningOutputDebugStringRelocate API CodeGuest Process TestingFeed MisinformationDrop CodeSizeOfImageInstructionTesting - RDTSCInline HookingScreen Resolution TestingObfuscate Library UseSeDebugPrivilegeData FloodGet Base IndirectlyStandardCompression of CodeHardware BreakpointsStandardCompression of DataTiming/Delay CheckGetVolumeInformationEncrypted PayloadsInstruction Testing- SGDT/SLDT (no pill)Debugger ArtifactsCustomCompression of DataTIB AwareBreak Point ClearingRestartDelayed ExecutionCheck Memory ArtifactsCheckNamed System ObjectsDifferent Opcode SetsStandard CompressionSection MisalignmentUse InterruptsPipeline MisdirectionSelf-UnmappingProcess Environment BlockThemidaSecure TriggersCode Encryption in MemoryProcess EnvironmentBlock IsDebuggedCheck Clipboard DataToken CheckInstructionTesting - CPUIDErase the PE headerBlock InterruptsFlow Opcode ObstructionInstructionTesting - VMCPUIDCheck WindowsExtra Loops/Time LocksMemory-only PayloadThread TimeoutNtQueryInformationProcessCheck ProcessesPage ExceptionBreakpoint DetectionModernSpecs Check - Drive sizeMalloc UseCheck Running ServicesUnique Hardware/FirmwareCheck - I/O Communication PortCloseHandleRuns as ServiceVMProtectImport ObfuscationModern Specs Check- Total physical memoryHook proceduresUnique Hardware/FirmwareCheck - MAC AddressModernSpecs Check - USB driveSetHandleInformationUnusual/UndocumentedAPI CallsInjected DLL TestingProcess EnvironmentBlock BeingDebuggedCode Integrity CheckProduct Key/ID TestingAPI Hook DetectionTiming/Uptime CheckAnti-Behavioral AnalysisFree MemoryStack PivotAllocate MemoryHeap SprayChange Memory ProtectionOverflow BufferExecutable Stack::ChangeMemory ProtectionExecutable Heap::ChangeMemory ProtectionMemory Micro-objectiveInstall DriverLoad DriverSimulate HardwareMouseClick::Simulate HardwareCtrl-Alt-Del::SimulateHardwareHardware Micro-objectiveHookingKernelModules and ExtensionsModify RegistryRemote AccessShutdown EventRemote File CopyComponent FirmwareInstall Insecureor Malicious ConfigurationModify Existing ServiceBootkitMalicious Network DriverRegistryRun Keys / Startup FolderHiddenFiles and DirectoriesAttributeImport AddressHooking (IAT) HookingDevice DriverHook memory mapping APIsExtensionTimestampReverse ShellPatchMmGetPhysicalMemoryRangesInline HookingLocationHook proceduresRouter FirmwarePersistenceAllocateThread Local StorageResume ThreadSynchronizationCreate MutexSetThread Local Storage ValueCheck MutexTerminate ThreadCreate ThreadCreate ProcessSuspend ThreadTerminate ProcessCreate SuspendedProcess::Create ProcessCreateMutex::SynchronizationCreate Process viaShellcode::Create ProcessCreate Processvia WMI::Create ProcessProcess Micro-objectiveSelf DiscoveryFileand Directory DiscoverySystemInformation DiscoverySMTP Connection DiscoveryAnalysis Tool DiscoveryTaskbar DiscoveryApplicationWindow DiscoveryGenerateWindows ExceptionKnown File LocationWindow TextProcess detection- PCAP UtilitiesProcessdetection - DebuggersLog FileProcess detection- Process UtilitiesProcessdetection - PE UtilitiesProcess detection -SysInternals Suite ToolsKnown WindowProcess detectionProcessdetection - SandboxesDiscoverySoftware PackingDisableor Evade Security ToolsPolymorphic CodeCovert LocationIndicator BlockingHookingModify RegistryRootkitObfuscatedFiles or InformationExecution GuardrailsAlternativeInstallation LocationSelf DeletionBypassData Execution PreventionComponent FirmwareInstall Insecureor Malicious ConfigurationBootkitProcess InjectionHiddenFiles and DirectoriesConfuserEncryption of DataRemoveSMS Warning MessagesEncoding-StandardAlgorithmHook Injectionvia SetWindowsHooksExCustom CompressionEncryption of CodeAttributeUnhook APIsImport AddressHooking (IAT) HookingEnvironmental KeysDeposited KeysHide Kernel ModulesModify PolicyNested PackingEncryption-StandardAlgorithmROP ChainsPreventNative API HookingInjection using ShimsForce Lazy WritingFileless MalwareDisableKernel Patch ProtectionHost Fingerprint CheckInjection and Persistencevia Registry ModificationHook memory mapping APIsHide ServicesCustomCompression of CodeExtensionPrevent File DeletionTimestampDisable SystemFile Overwrite ProtectionEncoding-Custom AlgorithmPatchMmGetPhysicalMemoryRangesPrevent Registry DeletionArmadilloUPXASPackEncryption-CustomAlgorithmCode ReorderingPrevent Registry AccessInline HookingRegistry InstallSteganographyPrevent File AccessStandardCompression of CodeStandardCompression of DataGetVolumeInformationCall IndirectionsCustomCompression of DataAMSI BypassPrevent Memory AccessStandard CompressionCOMSPECEnvironment VariableThemidaSecure TriggersPacker StubToken CheckHide Data in RegistryHeavens GatePrevent API UnhookingHide ThreadsLocationRuns as ServiceVMProtectBypassWindows File ProtectionHook proceduresHide Userspace LibrariesRouter FirmwareDefense EvasionAutomated ExfiltrationArchive Collected DataEncodingEncryptionEncoding- Standard EncodingExfiltratevia File Hosting ServiceEncryption- Standard EncryptionEncryption- Custom EncryptionEncoding- Custom EncodingExfiltrationRegistryEnvironment VariableConsoleWallpaperCreateRegistry Key::RegistryQueryRegistry Key::RegistryOpenRegistry Key::RegistryDeleteRegistry Value::RegistrySetRegistry Key::RegistryDeleteRegistry Key::RegistrySet Variable::EnvironmentVariableQueryRegistry Value::RegistryOperatingSystem Micro-objectiveScreen CaptureHookingCryptocurrencyKeyloggingInput CaptureZcashBitcoinWinAPIImport AddressHooking (IAT) HookingHook memory mapping APIsPollingPatchMmGetPhysicalMemoryRangesInline HookingEthereumMouse EventsApplication HookHook proceduresCollectionRemote File CopyDomain Name GenerationC2 CommunicationSend System InformationServerto Client File TransferClientto Server File TransferRequest Email TemplateSend HeartbeatReceive DataRequest CommandCheck for PayloadRequestEmail Address ListSend DataCommand and ControlScreen CaptureHookingCryptocurrencyKeyloggingInput CaptureZcashBitcoinWinAPIImport AddressHooking (IAT) HookingHook memory mapping APIsPollingPatchMmGetPhysicalMemoryRangesInline HookingEthereumMouse EventsApplication HookHook proceduresCredential AccessCrypto LibraryEncryption KeyEncrypt DataGeneratePseudo-random SequenceCryptographic HashDecrypt DataRC6::Decrypt DataRC4::Encrypt Datarand::GeneratePseudo-random SequenceTwofish::Encrypt DataHC-256::Decrypt DataSkipjack::Encrypt DataUse API::GeneratePseudo-random SequenceSosemanuk::Decrypt DataRSA::Decrypt DataTiger::Cryptographic HashMersenne Twister::GeneratePseudo-random Sequence3DES::Encrypt DataHC-256::Encrypt DataStreamCipher::Encrypt DataCamellia::Decrypt Data3DES::Decrypt DataRSA::Encrypt DataBlowfish::Decrypt DataSnefru::CryptographicHashTwofish::Decrypt DataSHA256::CryptographicHashMD5::Cryptographic HashRC4 PRGA::GeneratePseudo-random SequenceSkipjack::Decrypt DataStreamCipher::Decrypt DataSHA224::CryptographicHashSosemanuk::Encrypt DataBlockCipher::Decrypt DataHC-128::Encrypt DataRC4 KSA::Encryption KeySHA1::Cryptographic HashCamellia::Encrypt DataImport PublicKey::Encryption KeyAES::Decrypt DataGetTickCount::GeneratePseudo-random SequenceRC4::Decrypt DataAES::Encrypt DataRC6::Encrypt DataHC-128::Decrypt DataBlockCipher::Encrypt DataBlowfish::Encrypt DataCryptographyMicro-objectiveDelete DirectoryDelete FileCopy FileRead FileRead Virtual DiskCreate FileSet File AttributesAlter File ExtensionCreate DirectoryGet File AttributesWrites FileCreate RansomwareFile::Create FileAppend Extension::AlterFile ExtensionCreate OfficeDocument::Create FileFile System Micro-objectiveGenerate FraudulentAdvertising RevenueResource HijackingClipboard ModificationRemote AccessCompromise Data IntegrityDenial of ServiceModify HardwareSpammingExploitationfor Client ExecutionComponent FirmwareManipulate Network TrafficData Encrypted for ImpactData DestructionDisk Content WipeExploit Kit BehaviorDestroy HardwareRed HatJBoss Enterprise ProductsMouseCDROMClick HijackingEmpty Recycle BinPassword CrackingReverse ShellPrinterCryptojackingAdvertisementReplacement FraudFile TransferProtocol (FTP) ServersDeleteApplication/SoftwareJava-based Web ServersRemoteDesktop Protocols (RDP)Delete Shadow DriveWindows UtilitiesSysinternalsRouter FirmwareImpactDecompress DataCompress DataModuloEncode DataCheck StringDecode DataNon-Cryptographic HashChecksumCompression LibraryUse ConstantLuhn::ChecksumMurmurHash::Non-CryptographicHashpHash::Non-CryptographicHashBSD::Checksumdhash::Non-CryptographicHashBase64::Decode DataCRC32::ChecksumXOR::Encode DataQuickLZ::Compress DataQuickLZ::Decompress DataAdler::ChecksumVerhoeff::ChecksumIEncodingFilterFactory::DecompressDataIEncodingFilterFactory::CompressDataFast-Hash::Non-CryptographicHashXOR::Decode DataBase64::Encode DataFNV::Non-CryptographicHashData Micro-objectiveSoftware PackingCallGraph Generation EvasionExecutableCode OptimizationObfuscatedFiles or InformationExecutable Code ObfuscationDisassembler EvasionExecutableCode VirtualizationConfuserEncryption of DataEncoding-StandardAlgorithmSymbol ObfuscationCustom CompressionEncryption of CodeVariable RecompositionJump/CallAbsolute AddressImportAddress Table ObfuscationNested PackingTwo-layer Function ReturnEncryption-StandardAlgorithmJump InsertionStructuredException Handling (SEH)CustomCompression of CodeImport CompressionEncoding-Custom AlgorithmMultiple VMsArmadilloUPXASPackEncryption-CustomAlgorithmArgument ObfuscationVBA StompingValue Dependent JumpsData Value ObfuscationJunk Code InsertionStandardCompression of CodeStandardCompression of DataConditional MisdirectionInvoke NTDLL SystemCalls via Encoded TableCustomCompression of DataDead Code InsertionStandard CompressionMerged Code SectionsInstruction OverlapGuard PagesThemidaMinificationCode InsertionThunk Code InsertionStack StringsAPI HashingVMProtectInterleaving CodeEntry Point ObfuscationFake Code InsertionAnti-Static AnalysisRemote File CopySend Poisoned Text MessageMalicious Network DriverSupply Chain CompromiseSend EmailAbuseEnterprise CertificatesExploit Private APIsLateral Movement \ No newline at end of file +Interprocess CommunicationICMP CommunicationHTTP CommunicationWinINetSocket CommunicationFTP CommunicationSMTP CommunicationDNS CommunicationWinINet::FTPCommunicationCreate Pipe::InterprocessCommunicationDDNS Domain Connect::DNSCommunicationInternetWriteFile::WinINetSet Socket Config::SocketCommunicationResolveTLD::DNS CommunicationIWebBrowser::HTTPCommunicationResolve::DNSCommunicationRead Pipe::InterprocessCommunicationConnect Socket::SocketCommunicationReceive Data::SocketCommunicationReceive TCP Data::SocketCommunicationTCP Server::SocketCommunicationConnect Pipe::InterprocessCommunicationSendFile::FTP CommunicationInternetOpenURL::WinINetWinINet::HTTPCommunicationSend UDP Data::SocketCommunicationCreate UDP Socket::SocketCommunicationUDP Client::SocketCommunicationInitialize WinsockLibrary::Socket CommunicationSend Data::SocketCommunicationInternetConnect::WinINetStart TCP Server::SocketCommunicationSend Response::HTTPCommunicationEcho Request::ICMPCommunicationCreate Socket::SocketCommunicationRead Header::HTTPCommunicationCreate TCP Socket::SocketCommunicationGet Response::HTTPCommunicationGet Socket Status::SocketCommunicationSendData::HTTP CommunicationSend Request::HTTPCommunicationInternetReadFile::WinINetConnect to Server::HTTPCommunicationSend TCP Data::SocketCommunicationServer Connect::DNSCommunicationDownloadURL::HTTP CommunicationOpenURL::HTTP CommunicationTCP Client::SocketCommunicationServer Connect::SMTPCommunicationExtractBody::HTTP CommunicationStart Server::HTTPCommunicationWinHTTP::HTTPCommunicationReceive Request::HTTPCommunicationReceive UDP Data::SocketCommunicationGenerate Traffic::ICMPCommunicationClient::HTTPCommunicationServer::HTTPCommunicationSet Header::HTTPCommunicationCreate Request::HTTPCommunicationWrite Pipe::InterprocessCommunicationResolve Free HostingDomain::DNS CommunicationRequest::SMTPCommunicationInternetOpen::WinINetCommunicationMicro-objectiveInstall Additional ProgramConditional ExecutionCommandand Scripting InterpreterUser InteractionExploitationfor Client ExecutionRemote CommandsPreventConcurrent ExecutionSend Poisoned Text MessageSend EmailSuicide ExitRed HatJBoss Enterprise ProductsDownload FileShutdownFile TransferProtocol (FTP) ServersExecuteUninstallJava-based Web ServersSleepRemoteDesktop Protocols (RDP)Upload FileWindows UtilitiesSysinternalsExecutionSoftware PackingHookingDebugger EvasionDebugger DetectionExecution GuardrailsMemory Dump EvasionEmulator EvasionVirtual Machine DetectionExecutableCode VirtualizationDynamic Analysis EvasionSandbox DetectionCapture EvasionEmulator DetectionProcess JobsPre-DebugConfuserTiming/Delay CheckQueryPerformanceCounterIsDebuggerPresentFailedNetwork ConnectionsDemo ModeMultipleStages of LoadersMemory Write WatchingMemory BreakpointsHide virtual memoryUnique Hardware/FirmwareCheck - CPU LocationReturn ObfuscationCustom CompressionUndocumented OpcodesParallel ThreadsInstruction TestingCheck Emulator-relatedRegistry KeysStolen API CodeSelf CheckProcessHeapInstructionTesting - SIDT (red pill)Instruction Testing - INByte StealingAlternative ntdll.dllModify PE HeaderImport AddressHooking (IAT) HookingCheck Fileand Directory ArtifactsEnvironmental KeysDeposited KeysInstruction Testing - STRModern SpecsCheck - Keyboard layoutOn-the-Fly APIsEncode FileUnique Hardware/FirmwareCheck - BIOSInstructionTesting - VPCEXTWudfIsAnyDebuggerPresentTiming/DelayCheck GetTickCountInterrupt 1Nested PackingHook InterruptCheckWindows - Unique windowsException MisdirectionModernSpecs Check - PrinterChange SizeOfImageCheckRemoteDebuggerPresentStatic LinkingUnhandledExceptionFilterTiming/Date CheckAnti-debuggingInstructionsTamperingHost Fingerprint CheckCheckWindows - Window sizeStack CanaryCheck SoftwareHook memory mapping APIsInstructionTesting - SMSWHook File SystemCustomCompression of CodeCheck FilesUnique Hardware/FirmwareCheck - CPU NameProcess EnvironmentBlock NtGlobalFlagCheck forEmulator-related FilesUniqueHardware/Firmware CheckCheckWindows - Title barsCheck Virtual DevicesParent ProcessHTML5Performance Object CheckInterrupt 0x2dCheck Registry KeysNtYieldExecution/SwitchToThreadCheck for WINE VersionSelf-DebuggingNanomitesModern SpecsCheck - Processor countNtQueryObjectRtlAdjustPrivilegeMonitoring ThreadMultiple VMsIllusionSoftware BreakpointsNtSetInformationThreadPatchMmGetPhysicalMemoryRangesArmadilloTLS CallbacksUPXModern Specs CheckASPackLoop EscapesHuman User CheckInliningOutputDebugStringRelocate API CodeGuest Process TestingFeed MisinformationDrop CodeSizeOfImageInstructionTesting - RDTSCInline HookingScreen Resolution TestingObfuscate Library UseSeDebugPrivilegeData FloodGet Base IndirectlyStandardCompression of CodeHardware BreakpointsStandardCompression of DataTiming/Delay CheckGetVolumeInformationEncrypted PayloadsInstruction Testing- SGDT/SLDT (no pill)Debugger ArtifactsCustomCompression of DataTIB AwareBreak Point ClearingRestartDelayed ExecutionCheck Memory ArtifactsCheckNamed System ObjectsDifferent Opcode SetsStandard CompressionSection MisalignmentUse InterruptsPipeline MisdirectionSelf-UnmappingProcess Environment BlockThemidaSecure TriggersCode Encryption in MemoryProcess EnvironmentBlock IsDebuggedCheck Clipboard DataToken CheckInstructionTesting - CPUIDErase the PE headerBlock InterruptsFlow Opcode ObstructionInstructionTesting - VMCPUIDCheck WindowsExtra Loops/Time LocksMemory-only PayloadThread TimeoutNtQueryInformationProcessCheck ProcessesPage ExceptionBreakpoint DetectionModernSpecs Check - Drive sizeMalloc UseCheck Running ServicesUnique Hardware/FirmwareCheck - I/O Communication PortCloseHandleRuns as ServiceVMProtectImport ObfuscationModern Specs Check- Total physical memoryHook proceduresUnique Hardware/FirmwareCheck - MAC AddressModernSpecs Check - USB driveSetHandleInformationUnusual/UndocumentedAPI CallsInjected DLL TestingProcess EnvironmentBlock BeingDebuggedCode Integrity CheckProduct Key/ID TestingAPI Hook DetectionTiming/Uptime CheckAnti-Behavioral AnalysisFree MemoryStack PivotAllocate MemoryHeap SprayChange Memory ProtectionOverflow BufferExecutable Stack::ChangeMemory ProtectionExecutable Heap::ChangeMemory ProtectionMemory Micro-objectiveInstall DriverLoad DriverSimulate HardwareMouseClick::Simulate HardwareCtrl-Alt-Del::SimulateHardwareHardware Micro-objectiveHookingKernelModules and ExtensionsModify RegistryRemote AccessShutdown EventRemote File CopyComponent FirmwareInstall Insecureor Malicious ConfigurationModify Existing ServiceBootkitMalicious Network DriverRegistryRun Keys / Startup FolderHiddenFiles and DirectoriesAttributeImport AddressHooking (IAT) HookingDevice DriverHook memory mapping APIsExtensionTimestampReverse ShellPatchMmGetPhysicalMemoryRangesInline HookingLocationHook proceduresRouter FirmwarePersistenceAllocateThread Local StorageResume ThreadSynchronizationCreate MutexSetThread Local Storage ValueCheck MutexTerminate ThreadCreate ThreadCreate ProcessSuspend ThreadTerminate ProcessCreate SuspendedProcess::Create ProcessCreateMutex::SynchronizationCreate Process viaShellcode::Create ProcessCreate Processvia WMI::Create ProcessProcess Micro-objectiveSelf DiscoveryFileand Directory DiscoverySystemInformation DiscoverySMTP Connection DiscoveryAnalysis Tool DiscoveryTaskbar DiscoveryApplicationWindow DiscoveryGenerateWindows ExceptionKnown File LocationWindow TextProcess detection- PCAP UtilitiesProcessdetection - DebuggersLog FileProcess detection- Process UtilitiesProcessdetection - PE UtilitiesProcess detection -SysInternals Suite ToolsKnown WindowProcess detectionProcessdetection - SandboxesDiscoverySoftware PackingDisableor Evade Security ToolsPolymorphic CodeCovert LocationIndicator BlockingHookingModify RegistryRootkitObfuscatedFiles or InformationExecution GuardrailsAlternativeInstallation LocationSelf DeletionBypassData Execution PreventionComponent FirmwareInstall Insecureor Malicious ConfigurationBootkitProcess InjectionHiddenFiles and DirectoriesConfuserEncryption of DataRemoveSMS Warning MessagesEncoding-StandardAlgorithmHook Injectionvia SetWindowsHooksExCustom CompressionEncryption of CodeAttributeUnhook APIsImport AddressHooking (IAT) HookingEnvironmental KeysDeposited KeysHide Kernel ModulesModify PolicyNested PackingEncryption-StandardAlgorithmROP ChainsPreventNative API HookingInjection using ShimsForce Lazy WritingFileless MalwareDisableKernel Patch ProtectionHost Fingerprint CheckInjection and Persistencevia Registry ModificationHook memory mapping APIsHide ServicesCustomCompression of CodeExtensionPrevent File DeletionTimestampDisable SystemFile Overwrite ProtectionEncoding-Custom AlgorithmPatchMmGetPhysicalMemoryRangesPrevent Registry DeletionArmadilloUPXASPackEncryption-CustomAlgorithmCode ReorderingPrevent Registry AccessInline HookingRegistry InstallSteganographyPrevent File AccessStandardCompression of CodeStandardCompression of DataGetVolumeInformationCall IndirectionsCustomCompression of DataAMSI BypassPrevent Memory AccessStandard CompressionCOMSPECEnvironment VariableThemidaSecure TriggersPacker StubToken CheckHide Data in RegistryHeavens GatePrevent API UnhookingHide ThreadsLocationRuns as ServiceVMProtectBypassWindows File ProtectionHook proceduresHide Userspace LibrariesRouter FirmwareDefense EvasionAutomated ExfiltrationArchive Collected DataEncodingEncryptionEncoding- Standard EncodingExfiltratevia File Hosting ServiceEncryption- Standard EncryptionEncryption- Custom EncryptionEncoding- Custom EncodingExfiltrationRegistryEnvironment VariableConsoleWallpaperCreateRegistry Key::RegistryQueryRegistry Key::RegistryOpenRegistry Key::RegistryDeleteRegistry Value::RegistrySetRegistry Key::RegistryDeleteRegistry Key::RegistrySet Variable::EnvironmentVariableQueryRegistry Value::RegistryOperatingSystem Micro-objectiveScreen CaptureHookingCryptocurrencyKeyloggingInput CaptureZcashBitcoinWinAPIImport AddressHooking (IAT) HookingHook memory mapping APIsPollingPatchMmGetPhysicalMemoryRangesInline HookingEthereumMouse EventsApplication HookHook proceduresCollectionRemote File CopyDomain Name GenerationC2 CommunicationSend System InformationServerto Client File TransferClientto Server File TransferRequest Email TemplateSend HeartbeatReceive DataRequest CommandCheck for PayloadRequestEmail Address ListSend DataCommand and ControlScreen CaptureHookingCryptocurrencyKeyloggingInput CaptureZcashBitcoinWinAPIImport AddressHooking (IAT) HookingHook memory mapping APIsPollingPatchMmGetPhysicalMemoryRangesInline HookingEthereumMouse EventsApplication HookHook proceduresCredential AccessCrypto LibraryEncryption KeyEncrypt DataGeneratePseudo-random SequenceCryptographic HashDecrypt DataRC6::Decrypt DataRC4::Encrypt Datarand::GeneratePseudo-random SequenceTwofish::Encrypt DataHC-256::Decrypt DataSkipjack::Encrypt DataUse API::GeneratePseudo-random SequenceSosemanuk::Decrypt DataRSA::Decrypt DataTiger::Cryptographic HashMersenne Twister::GeneratePseudo-random Sequence3DES::Encrypt DataHC-256::Encrypt DataStreamCipher::Encrypt DataCamellia::Decrypt Data3DES::Decrypt DataRSA::Encrypt DataBlowfish::Decrypt DataSnefru::CryptographicHashTwofish::Decrypt DataSHA256::CryptographicHashMD5::Cryptographic HashRC4 PRGA::GeneratePseudo-random SequenceSkipjack::Decrypt DataStreamCipher::Decrypt DataSHA224::CryptographicHashSosemanuk::Encrypt DataBlockCipher::Decrypt DataHC-128::Encrypt DataRC4 KSA::Encryption KeySHA1::Cryptographic HashCamellia::Encrypt DataImport PublicKey::Encryption KeyAES::Decrypt DataGetTickCount::GeneratePseudo-random SequenceRC4::Decrypt DataAES::Encrypt DataRC6::Encrypt DataHC-128::Decrypt DataBlockCipher::Encrypt DataBlowfish::Encrypt DataCryptographyMicro-objectiveDelete DirectoryDelete FileCopy FileRead FileRead Virtual DiskCreate FileSet File AttributesAlter File ExtensionCreate DirectoryGet File AttributesWrites FileCreate RansomwareFile::Create FileAppend Extension::AlterFile ExtensionCreate OfficeDocument::Create FileFile System Micro-objectiveGenerate FraudulentAdvertising RevenueResource HijackingClipboard ModificationRemote AccessCompromise Data IntegrityDenial of ServiceModify HardwareSpammingExploitationfor Client ExecutionComponent FirmwareManipulate Network TrafficData Encrypted for ImpactData DestructionDisk Content WipeExploit Kit BehaviorDestroy HardwareRed HatJBoss Enterprise ProductsMouseCDROMClick HijackingEmpty Recycle BinPassword CrackingReverse ShellPrinterCryptojackingAdvertisementReplacement FraudFile TransferProtocol (FTP) ServersDeleteApplication/SoftwareJava-based Web ServersRemoteDesktop Protocols (RDP)Delete Shadow DriveWindows UtilitiesSysinternalsRouter FirmwareImpactDecompress DataCompress DataModuloEncode DataCheck StringDecode DataNon-Cryptographic HashChecksumCompression LibraryUse ConstantLuhn::ChecksumMurmurHash::Non-CryptographicHashpHash::Non-CryptographicHashBSD::Checksumdhash::Non-CryptographicHashBase64::Decode DataCRC32::ChecksumXOR::Encode DataQuickLZ::Compress DataQuickLZ::Decompress DataAdler::ChecksumVerhoeff::ChecksumIEncodingFilterFactory::DecompressDataIEncodingFilterFactory::CompressDataFast-Hash::Non-CryptographicHashXOR::Decode DataBase64::Encode DataFNV::Non-CryptographicHashData Micro-objectiveSoftware PackingCallGraph Generation EvasionExecutableCode OptimizationObfuscatedFiles or InformationExecutable Code ObfuscationDisassembler EvasionExecutableCode VirtualizationConfuserEncryption of DataEncoding-StandardAlgorithmSymbol ObfuscationCustom CompressionEncryption of CodeVariable RecompositionJump/CallAbsolute AddressImportAddress Table ObfuscationNested PackingTwo-layer Function ReturnEncryption-StandardAlgorithmJump InsertionStructuredException Handling (SEH)CustomCompression of CodeImport CompressionEncoding-Custom AlgorithmMultiple VMsArmadilloUPXASPackEncryption-CustomAlgorithmArgument ObfuscationVBA StompingValue Dependent JumpsData Value ObfuscationJunk Code InsertionStandardCompression of CodeStandardCompression of DataConditional MisdirectionInvoke NTDLL SystemCalls via Encoded TableCustomCompression of DataDead Code InsertionStandard CompressionMerged Code SectionsInstruction OverlapGuard PagesThemidaMinificationCode InsertionThunk Code InsertionStack StringsAPI HashingVMProtectInterleaving CodeEntry Point ObfuscationFake Code InsertionAnti-Static AnalysisRemote File CopySend Poisoned Text MessageMalicious Network DriverSupply Chain CompromiseSend EmailAbuseEnterprise CertificatesExploit Private APIsLateral Movement \ No newline at end of file