admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

update text

Browse Source
This commit is contained in:
Desiree Beck
2020-10-14 13:45:05 -04:00
parent fdfeb243d6
commit 258a0f9505
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
defense-evasion/obfuscate-files.md
+9 -8
View File
@@ -15,20 +15,21 @@ Another related MBC behavior (code characteristic), is [Software Packing](../ant
See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
|**Encoding-Custom Encoding**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
|**Encoding-Standard Encoding**|E1027.m02|A standard algorithm, such as base64 encoding, is used to encode a malware sample, file, or other information.|
|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
|**Encoding-Standard Algorithm**|E1027.m02|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
|**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted.|
|**Encryption-Custom Encryption**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
|**Encryption-Custom Encryption of Code**|E1027.m09|A custom algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|**Encryption-Custom Encryption of Data**|E1027.m10|A custom algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|**Encryption-Standard Encryption**|E1027.m05|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt a malware sample, file, or other information.|
|**Encryption-Standard Encryption of Code**|E1027.m06|A standard algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|**Encryption-Standard Encryption of Data**|E1027.m07|A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information.|
|**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
|**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
Malware Examples
----------------
micro-behaviors/cryptography/README.md
+1
View File
@@ -9,6 +9,7 @@ Micro-behaviors that enable malware to use crypto.
|Name|ID|Description|
|---|---|---|
|[**Encrypt Data**](../cryptography/encrypt.md)|C0027||
|[**Decrypt Data**](../cryptography/decrypt.md)|C0031||
|[**Generate Pseudo-random Sequence**](../cryptography/gen-random.md)|C0021||
|[**Use Cryptography Hash**](../cryptography/crypto-hash.md)|C0029||
|[**Use Encryption Key**](../cryptography/key.md)|C0028||