From 28028ce5c675be3a3b5814ca097efacdc2ca2f26 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Fri, 21 Aug 2020 16:00:03 -0400 Subject: [PATCH] shift Methods columns, sort alphabetically --- anti-behavioral-analysis/detect-debugger.md | 76 +++++++++--------- anti-behavioral-analysis/detect-emulator.md | 10 +-- anti-behavioral-analysis/detect-sandbox.md | 20 ++--- anti-behavioral-analysis/detect-vm.md | 78 +++++++++---------- anti-behavioral-analysis/evade-capture.md | 8 +- anti-behavioral-analysis/evade-debugger.md | 62 +++++++-------- .../evade-dynamic-analysis.md | 22 +++--- anti-behavioral-analysis/evade-emulator.md | 10 +-- anti-behavioral-analysis/evade-memory-dump.md | 20 ++--- .../execution-guardrails.md | 14 ++-- anti-static-analysis/evade-call-graph.md | 6 +- anti-static-analysis/evade-disassembler.md | 12 +-- anti-static-analysis/exe-code-obfuscate.md | 38 ++++----- anti-static-analysis/exe-code-optimize.md | 6 +- anti-static-analysis/exe-code-virtualize.md | 4 +- anti-static-analysis/software-packing.md | 26 +++---- collection/cryptocurrency.md | 8 +- collection/input-capture.md | 4 +- collection/keylogging.md | 6 +- collection/screen-capture.md | 4 +- command-and-control/command-control-comm.md | 22 +++--- credential-access/hooking.md | 12 +-- defense-evasion/alter-install-location.md | 6 +- defense-evasion/bypass-dep.md | 4 +- defense-evasion/covert-location.md | 6 +- defense-evasion/disable-security-tools.md | 12 +-- defense-evasion/hidden-files.md | 6 +- defense-evasion/indicator-blocking.md | 4 +- defense-evasion/obfuscate-files.md | 22 +++--- defense-evasion/polymorphic-code.md | 8 +- defense-evasion/process-inject.md | 8 +- defense-evasion/rootkit-behavior.md | 24 +++--- defense-evasion/self-deletion.md | 4 +- discovery/analysis-tool-discover.md | 20 ++--- discovery/system-info-discover.md | 4 +- execution/conditional-execute.md | 4 +- execution/exploit-software.md | 14 ++-- execution/remote-commands.md | 16 ++-- exfiltration/auto-exfiltrate.md | 4 +- exfiltration/data-encrypted.md | 14 ++-- impact/data-destruction.md | 8 +- impact/generate-fraud-rev.md | 6 +- impact/hijack-sys-resources.md | 6 +- impact/remote-access.md | 4 +- lateral-movement/supply-chain-compromise.md | 6 +- micro-behaviors/communication/dns-comm.md | 12 +-- micro-behaviors/communication/ftp-comm.md | 6 +- micro-behaviors/communication/http-comm.md | 26 +++---- micro-behaviors/communication/icmp-comm.md | 4 +- .../communication/inter-process.md | 10 +-- micro-behaviors/communication/smtp-comm.md | 6 +- micro-behaviors/communication/tcp-comm.md | 16 ++-- micro-behaviors/communication/udp-comm.md | 4 +- micro-behaviors/communication/wininet.md | 12 +-- micro-behaviors/cryptography/gen-random.md | 8 +- .../file-manipulation/alter-extend.md | 4 +- .../file-manipulation/create-file.md | 6 +- .../memory-manipulation/memory-protect.md | 6 +- micro-behaviors/processes/create-process.md | 6 +- micro-behaviors/processes/synchronization.md | 4 +- persistence/component-firmware.md | 4 +- persistence/kernel-modules-ext.md | 4 +- 62 files changed, 408 insertions(+), 408 deletions(-) diff --git a/anti-behavioral-analysis/detect-debugger.md b/anti-behavioral-analysis/detect-debugger.md index c5fdaa3..1078f91 100644 --- a/anti-behavioral-analysis/detect-debugger.md +++ b/anti-behavioral-analysis/detect-debugger.md @@ -13,45 +13,45 @@ Details on methods of detecting debuggers are given in the references; many are Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0001.001|**API Hook Detection**|Module bounds based [[7]](#7).| -|B0001.002|**CheckRemoteDebuggerPresent**|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).| -|B0001.003|**CloseHandle**|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)| -|B0001.004|**Debugger Artifacts**|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).| -|B0001.005|**Hardware Breakpoints**|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.| -|B0001.006|**Interrupt 0x2d**|If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.| -|B0001.007|**Interrupt 1**|[[7]](#7)| -|B0001.008|**IsDebuggerPresent**|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.| -|B0001.009|**Memory Breakpoints**|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.| -|B0001.010|**Memory Write Watching**|[[7]](#7)| -|B0001.011|**Monitoring Thread**|Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.| -|B0001.012|**NtQueryInformationProcess**|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).| -|B0001.013|**NtQueryObject**|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.| -|B0001.014|**NtSetInformationThread**|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)| -|B0001.015|**NtYieldExecution/SwitchToThread**|[[7]](#7)| -|B0001.016|**OutputDebugString**|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.| -|B0001.017|**Page Exception Breakpoint Detection**|[[7]](#7)| -|B0001.018|**Parent Process**|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)| -|B0001.019|**Process Environment Block**|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method).| -|B0001.020|**Process Jobs**|[[7]](#7)| -|B0001.021|**ProcessHeap**|Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).| -|B0001.022|**RtlAdjustPrivilege**|Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).| -|B0001.023|**SeDebugPrivilege**|(Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)| -|B0001.024|**SetHandleInformation**|(Protected Handle)| -|B0001.025|**Software Breakpoints**|(INT3/0xCC)| -|B0001.026|**Stack Canary**|Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.| -|B0001.027|**TIB Aware**|Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).| -|B0001.028|**Timing/Delay Check**|Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging.| -|B0001.029|**TLS Callbacks**|[[7]](#7)| -|B0001.030|**UnhandledExceptionFilter**|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.| -|B0001.031|**WudfIsAnyDebuggerPresent**|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.| -|B0001.032|**Timing/Delay Check GetTickCount**|Malware uses GetTickCount function in a timing/delay check.| -|B0001.033|**Timing/Delay Check QueryPerformanceCounter**|Malware uses QueryPerformanceCounter in a timing/delay check.| -|B0001.034|**Anti-debugging Instructions**|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).| -|B0001.035|**Process Environment Block BeingDebugged**|The BeingDebugged field is tested to determine whether the process is being debugged.| -|B0001.036|**Process Environment Block NtGlobalFlag**|The NtGlobalFlag field is tested to determine whether the process is being debugged.| -|B0001.037|**Process Environment Block IsDebugged**|The IsDebugged field is tested to determine whether the process is being debugged.| +|**API Hook Detection**|B0001.001|Module bounds based [[7]](#7).| +|**Anti-debugging Instructions**|B0001.034|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).| +|**CheckRemoteDebuggerPresent**|B0001.002|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).| +|**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)| +|**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).| +|**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.| +|**Interrupt 0x2d**|B0001.006|If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.| +|**Interrupt 1**|B0001.007|[[7]](#7)| +|**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.| +|**Memory Breakpoints**|B0001.009|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.| +|**Memory Write Watching**|B0001.010|[[7]](#7)| +|**Monitoring Thread**|B0001.011|Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.| +|**NtQueryInformationProcess**|B0001.012|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).| +|**NtQueryObject**|B0001.013|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.| +|**NtSetInformationThread**|B0001.014|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)| +|**NtYieldExecution/SwitchToThread**|B0001.015|[[7]](#7)| +|**OutputDebugString**|B0001.016|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.| +|**Page Exception Breakpoint Detection**|B0001.017|[[7]](#7)| +|**Parent Process**|B0001.018|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)| +|**Process Environment Block**|B0001.019|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method).| +|**Process Environment Block BeingDebugged**|B0001.035|The BeingDebugged field is tested to determine whether the process is being debugged.| +|**Process Environment Block IsDebugged**|B0001.037|The IsDebugged field is tested to determine whether the process is being debugged.| +|**Process Environment Block NtGlobalFlag**|B0001.036|The NtGlobalFlag field is tested to determine whether the process is being debugged.| +|**Process Jobs**|B0001.020|[[7]](#7)| +|**ProcessHeap**|B0001.021|Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).| +|**RtlAdjustPrivilege**|B0001.022|Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).| +|**SeDebugPrivilege**|B0001.023|(Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)| +|**SetHandleInformation**|B0001.024|(Protected Handle)| +|**Software Breakpoints**|B0001.025|(INT3/0xCC)| +|**Stack Canary**|B0001.026|Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.| +|**TIB Aware**|B0001.027|Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).| +|**TLS Callbacks**|B0001.029|[[7]](#7)| +|**Timing/Delay Check**|B0001.028|Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging.| +|**Timing/Delay Check GetTickCount**|B0001.032|Malware uses GetTickCount function in a timing/delay check.| +|**Timing/Delay Check QueryPerformanceCounter**|B0001.033|Malware uses QueryPerformanceCounter in a timing/delay check.| +|**UnhandledExceptionFilter**|B0001.030|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.| +|**WudfIsAnyDebuggerPresent**|B0001.031|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.| Malware Examples ---------------- diff --git a/anti-behavioral-analysis/detect-emulator.md b/anti-behavioral-analysis/detect-emulator.md index 9d7b03f..33b4770 100644 --- a/anti-behavioral-analysis/detect-emulator.md +++ b/anti-behavioral-analysis/detect-emulator.md @@ -11,12 +11,12 @@ Detects whether the malware instance is being executed inside an emulator. If so Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0004.001|**Check for Emulator-related Files**|Checks whether particular files (e.g., QEMU files) exist.| -|B0004.002|**Check for WINE Version**|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.| -|B0004.003|**Check Emulator-related Registry Keys**|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)| -|B0004.004|**Failed Network Connections**|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.| +|**Check Emulator-related Registry Keys**|B0004.003|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)| +|**Check for Emulator-related Files**|B0004.001|Checks whether particular files (e.g., QEMU files) exist.| +|**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.| +|**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.| References ---------- diff --git a/anti-behavioral-analysis/detect-sandbox.md b/anti-behavioral-analysis/detect-sandbox.md index 9e07ac2..f95341c 100644 --- a/anti-behavioral-analysis/detect-sandbox.md +++ b/anti-behavioral-analysis/detect-sandbox.md @@ -13,17 +13,17 @@ The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&C Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0007.001|**Check Clipboard Data**|Checks clipboard data which can be used to detect whether execution is inside a sandbox.| -|B0007.002|**Check Files**|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.| -|B0007.003|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| -|B0007.004|**Injected DLL Testing**|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.| -|B0007.005|**Product Key/ID Testing**|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.| -|B0007.006|**Screen Resolution Testing**|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.| -|B0007.007|**Self Check**|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.| -|B0007.008|**Timing/Date Check**|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.| -|B0007.009|**Timing/Uptime Check**|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.| +|**Check Clipboard Data**|B0007.001|Checks clipboard data which can be used to detect whether execution is inside a sandbox.| +|**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.| +|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| +|**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.| +|**Product Key/ID Testing**|B0007.005|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.| +|**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.| +|**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.| +|**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.| +|**Timing/Uptime Check**|B0007.009|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.| Malware Examples ---------------- diff --git a/anti-behavioral-analysis/detect-vm.md b/anti-behavioral-analysis/detect-vm.md index 2685ce5..acb01bd 100644 --- a/anti-behavioral-analysis/detect-vm.md +++ b/anti-behavioral-analysis/detect-vm.md @@ -13,46 +13,46 @@ The Virtual Machine Detection behavior relates to anti-analysis, whereas a relat Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0009.001|**Check File and Directory Artifacts**|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)| -|B0009.002|**Check Memory Artifacts**|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)| -|B0009.003|**Check Named System Objects**|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.| -|B0009.004|**Check Processes**|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)| -|B0009.005|**Check Registry Keys**|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)| -|B0009.006|**Check Running Services**|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)| -|B0009.007|**Check Software**|Malware may check software version; for example, to determine whether the software is relatively current.| -|B0009.008|**Check Virtual Devices**|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)| -|B0009.009|**Check Windows**|Malware may check windows for VM-related characteristics.| -|B0009.010|**Guest Process Testing**|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.| -|B0009.011|**HTML5 Performance Object Check**|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.| -|B0009.012|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| -|B0009.013|**Modern Specs Check**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.| -|B0009.014|**Modern Specs Check - Total physical memory**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).| -|B0009.015|**Modern Specs Check - Drive size**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).| -|B0009.016|**Modern Specs Check - USB drive**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential USB drive; if not a virtual environment is suspected.| -|B0009.017|**Modern Specs Check - Printer**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.| -|B0009.018|**Modern Specs Check - Processor count**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks number of processors; single CPU machines are suspect.| -|B0009.019|**Modern Specs Check - Keyboard layout**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Check keyboard layout.| -|B0009.020|**Check Windows - Window size**|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.| -|B0009.021|**Check Windows - Unique windows**|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.| -|B0009.022|**Check Windows - Title bars**|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.| -|B0009.023|**Unique Hardware/Firmware Check**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment.| -|B0009.024|**Unique Hardware/Firmware Check - BIOS**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Characteristics of the BIOS, such as version, can indicate virtualization.| -|B0009.025|**Unique Hardware/Firmware Check - I/O Communication Port**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.| -|B0009.026|**Unique Hardware/Firmware Check - CPU Name**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Checks the CPU name to determine virtualization.| -|B0009.027|**Unique Hardware/Firmware Check - CPU Location**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. When an Operating System is virtualized, the CPU is relocated. [[2]](#2)| -|B0009.028|**Unique Hardware/Firmware Check - MAC Address**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)| -|B0009.029|**Instruction Testing**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|B0009.030|**Instruction Testing - SIDT (red pill)**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.| -|B0009.031|**Instruction Testing - SGDT/SLDT (no pill)**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.| -|B0009.032|**Instruction Testing - SMSW**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|B0009.033|**Instruction Testing - STR**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|B0009.034|**Instruction Testing - CPUID**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.| -|B0009.035|**Instruction Testing - IN**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|B0009.036|**Instruction Testing - RDTSC**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|B0009.037|**Instruction Testing - VMCPUID**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| -|B0009.038|**Instruction Testing - VPCEXT**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Check File and Directory Artifacts**|B0009.001|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)| +|**Check Memory Artifacts**|B0009.002|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)| +|**Check Named System Objects**|B0009.003|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.| +|**Check Processes**|B0009.004|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)| +|**Check Registry Keys**|B0009.005|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)| +|**Check Running Services**|B0009.006|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)| +|**Check Software**|B0009.007|Malware may check software version; for example, to determine whether the software is relatively current.| +|**Check Virtual Devices**|B0009.008|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)| +|**Check Windows**|B0009.009|Malware may check windows for VM-related characteristics.| +|**Check Windows - Title bars**|B0009.022|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.| +|**Check Windows - Unique windows**|B0009.021|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.| +|**Check Windows - Window size**|B0009.020|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.| +|**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.| +|**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.| +|**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| +|**Instruction Testing**|B0009.029|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.| +|**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Instruction Testing - SGDT/SLDT (no pill)**|B0009.031|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.| +|**Instruction Testing - SIDT (red pill)**|B0009.030|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.| +|**Instruction Testing - SMSW**|B0009.032|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Instruction Testing - STR**|B0009.033|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Instruction Testing - VMCPUID**|B0009.037|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Instruction Testing - VPCEXT**|B0009.038|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)| +|**Modern Specs Check**|B0009.013|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.| +|**Modern Specs Check - Drive size**|B0009.015|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).| +|**Modern Specs Check - Keyboard layout**|B0009.019|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Check keyboard layout.| +|**Modern Specs Check - Printer**|B0009.017|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.| +|**Modern Specs Check - Processor count**|B0009.018|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks number of processors; single CPU machines are suspect.| +|**Modern Specs Check - Total physical memory**|B0009.014|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).| +|**Modern Specs Check - USB drive**|B0009.016|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential USB drive; if not a virtual environment is suspected.| +|**Unique Hardware/Firmware Check**|B0009.023|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment.| +|**Unique Hardware/Firmware Check - BIOS**|B0009.024|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Characteristics of the BIOS, such as version, can indicate virtualization.| +|**Unique Hardware/Firmware Check - CPU Location**|B0009.027|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. When an Operating System is virtualized, the CPU is relocated. [[2]](#2)| +|**Unique Hardware/Firmware Check - CPU Name**|B0009.026|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Checks the CPU name to determine virtualization.| +|**Unique Hardware/Firmware Check - I/O Communication Port**|B0009.025|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.| +|**Unique Hardware/Firmware Check - MAC Address**|B0009.028|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)| Malware Examples ---------------- diff --git a/anti-behavioral-analysis/evade-capture.md b/anti-behavioral-analysis/evade-capture.md index e7a59e6..ab93434 100644 --- a/anti-behavioral-analysis/evade-capture.md +++ b/anti-behavioral-analysis/evade-capture.md @@ -11,8 +11,8 @@ Malware has characteristics enabling it to evade capture from the infected syste Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0036.001|**Memory-only Payload**|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).| -|B0036.002|**Encrypted Payloads**|Decryption key is stored external to the executable or never touches the disk.| -|B0036.003|**Multiple Stages of Loaders**|Multiple stages of loaders are used with an encoded payload.| +|**Encrypted Payloads**|B0036.002|Decryption key is stored external to the executable or never touches the disk.| +|**Memory-only Payload**|B0036.001|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).| +|**Multiple Stages of Loaders**|B0036.003|Multiple stages of loaders are used with an encoded payload.| diff --git a/anti-behavioral-analysis/evade-debugger.md b/anti-behavioral-analysis/evade-debugger.md index d50d8f3..c06c8a0 100644 --- a/anti-behavioral-analysis/evade-debugger.md +++ b/anti-behavioral-analysis/evade-debugger.md @@ -13,38 +13,38 @@ A thorough reference for anti-debugging, both detection and evasion, is given in Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0002.001|**Block Interrupts**|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.| -|B0002.002|**Break Point Clearing**|Intentionally clearing software or hardware breakpoints.| -|B0002.003|**Byte Stealing**|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.| -|B0002.004|**Change SizeOfImage**|Changing this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.| -|B0002.005|**Code Integrity Check**|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.| -|B0002.006|**Exception Misdirection**|Using exception handling (SEH) to cause flow of program to non-obvious paths.| -|B0002.007|**Get Base Indirectly**|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.| -|B0002.008|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.| -|B0002.009|**Hook Interrupt**|Modification of interrupt vector or descriptor tables.| -|B0002.010|**Import Obfuscation**|Add obfuscation between imports calls and APIs.| -|B0002.011|**Inlining**|Variation of static linking where full API code inserted everywhere it would have been called.| -|B0002.012|**Loop Escapes**|Use SEH or other methods to break out of a loop instead of a conditional jump.| -|B0002.013|**Malloc Use**|Instead of unpacking into a pre-defined section/segment (ex: .text) of the binary, use malloc() / VirtualAlloc() to create a new segment. This makes keeping track of memory locations across different runs more difficult, as there is no guarantee that malloc/VirtualAlloc will assign the same address range each time.| -|B0002.014|**Modify PE Header**|Any part of the header is changed or erased.| -|B0002.015|**Nanomites**|int3 with code replacement table; debugs itself.| -|B0002.016|**Obfuscate Library Use**|LoadLibrary API calls or direct access of kernel32 via PEB (fs[0]) pointers, used to rebuild IAT or just obfuscate library use.| -|B0002.017|**Parallel Threads**|Use several parallel threads to make analysis harder.| -|B0002.018|**Pipeline Misdirection**|Take advantage of pipelining in modern processors to misdirect debugging, emulation, or static analysis tools. An unpacker can assume a certain number of opcodes will be cached and then proceed to overwrite them in memory, causing a debugger/emulator/analyzer to follow different code than is normally executed.| -|B0002.019|**Pre-Debug**|Prevents debugger from attaching to process or to break until after the code of interest has been executed.| -|B0002.020|**Relocate API Code**|Relocate API code in separate buffer (calls don’t lead to imported DLLs).| -|B0002.021|**Return Obfuscation**|Overwrite the RET address on the stack or the code at the RET address. Variation seen that writes to the start-up code or main module that called the malware's WinMain or DllMain.| -|B0002.022|**RtlAdjustPrivilege**|Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached.| -|B0002.023|**Section Misalignment**|Some analysis tools cannot handle binaries with misaligned sections.| -|B0002.024|**Self-Debugging**|Debug itself to prevent another debugger to be attached.| -|B0002.025|**Self-Unmapping**|UnmapViewOfFile() on itself.| -|B0002.026|**Static Linking**|Copy locally the whole content of API code.| -|B0002.027|**Stolen API Code**|A variation of "byte stealing" where the first few instructions or bytes of an API are executed in user code, allowing the IAT to point into the middle of an API function. This confuses IAT rebuilders such as ImpRec and Scylla and may bypass breakpoints.| -|B0002.028|**Tampering**|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).| -|B0002.029|**Thread Timeout**|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.| -|B0002.030|**Use Interrupts**|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".| +|**Block Interrupts**|B0002.001|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.| +|**Break Point Clearing**|B0002.002|Intentionally clearing software or hardware breakpoints.| +|**Byte Stealing**|B0002.003|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.| +|**Change SizeOfImage**|B0002.004|Changing this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.| +|**Code Integrity Check**|B0002.005|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.| +|**Exception Misdirection**|B0002.006|Using exception handling (SEH) to cause flow of program to non-obvious paths.| +|**Get Base Indirectly**|B0002.007|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.| +|**Guard Pages**|B0002.008|Encrypt blocks of code individually and decrypt temporarily only upon execution.| +|**Hook Interrupt**|B0002.009|Modification of interrupt vector or descriptor tables.| +|**Import Obfuscation**|B0002.010|Add obfuscation between imports calls and APIs.| +|**Inlining**|B0002.011|Variation of static linking where full API code inserted everywhere it would have been called.| +|**Loop Escapes**|B0002.012|Use SEH or other methods to break out of a loop instead of a conditional jump.| +|**Malloc Use**|B0002.013|Instead of unpacking into a pre-defined section/segment (ex: .text) of the binary, use malloc() / VirtualAlloc() to create a new segment. This makes keeping track of memory locations across different runs more difficult, as there is no guarantee that malloc/VirtualAlloc will assign the same address range each time.| +|**Modify PE Header**|B0002.014|Any part of the header is changed or erased.| +|**Nanomites**|B0002.015|int3 with code replacement table; debugs itself.| +|**Obfuscate Library Use**|B0002.016|LoadLibrary API calls or direct access of kernel32 via PEB (fs[0]) pointers, used to rebuild IAT or just obfuscate library use.| +|**Parallel Threads**|B0002.017|Use several parallel threads to make analysis harder.| +|**Pipeline Misdirection**|B0002.018|Take advantage of pipelining in modern processors to misdirect debugging, emulation, or static analysis tools. An unpacker can assume a certain number of opcodes will be cached and then proceed to overwrite them in memory, causing a debugger/emulator/analyzer to follow different code than is normally executed.| +|**Pre-Debug**|B0002.019|Prevents debugger from attaching to process or to break until after the code of interest has been executed.| +|**Relocate API Code**|B0002.020|Relocate API code in separate buffer (calls don’t lead to imported DLLs).| +|**Return Obfuscation**|B0002.021|Overwrite the RET address on the stack or the code at the RET address. Variation seen that writes to the start-up code or main module that called the malware's WinMain or DllMain.| +|**RtlAdjustPrivilege**|B0002.022|Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached.| +|**Section Misalignment**|B0002.023|Some analysis tools cannot handle binaries with misaligned sections.| +|**Self-Debugging**|B0002.024|Debug itself to prevent another debugger to be attached.| +|**Self-Unmapping**|B0002.025|UnmapViewOfFile() on itself.| +|**Static Linking**|B0002.026|Copy locally the whole content of API code.| +|**Stolen API Code**|B0002.027|A variation of "byte stealing" where the first few instructions or bytes of an API are executed in user code, allowing the IAT to point into the middle of an API function. This confuses IAT rebuilders such as ImpRec and Scylla and may bypass breakpoints.| +|**Tampering**|B0002.028|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).| +|**Thread Timeout**|B0002.029|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.| +|**Use Interrupts**|B0002.030|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".| Malware Examples ---------------- diff --git a/anti-behavioral-analysis/evade-dynamic-analysis.md b/anti-behavioral-analysis/evade-dynamic-analysis.md index 0efea0c..f0f1642 100644 --- a/anti-behavioral-analysis/evade-dynamic-analysis.md +++ b/anti-behavioral-analysis/evade-dynamic-analysis.md @@ -13,18 +13,18 @@ See [Emulator Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/an Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0003.001|**Alternative ntdll.dll**|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.| -|B0003.002|**Data Flood**|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)| -|B0003.003|**Delayed Execution**|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.| -|B0003.004|**Demo Mode**|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.| -|B0003.005|**Drop Code**|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).| -|B0003.006|**Encode File**|Encode a file on disk, such as an implant's config file.| -|B0003.007|**Hook File System**|Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.| -|B0003.008|**Hook Interrupt**|Modification of interrupt vector or descriptor tables.| -|B0003.009|**Illusion**|Creates an illusion; makes the analyst think something happened when it didn't.| -|B0003.010|**Restart**|Restarts or shuts down system to bypass sandboxing.| +|**Alternative ntdll.dll**|B0003.001|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.| +|**Data Flood**|B0003.002|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)| +|**Delayed Execution**|B0003.003|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.| +|**Demo Mode**|B0003.004|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.| +|**Drop Code**|B0003.005|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).| +|**Encode File**|B0003.006|Encode a file on disk, such as an implant's config file.| +|**Hook File System**|B0003.007|Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.| +|**Hook Interrupt**|B0003.008|Modification of interrupt vector or descriptor tables.| +|**Illusion**|B0003.009|Creates an illusion; makes the analyst think something happened when it didn't.| +|**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.| Malware Examples diff --git a/anti-behavioral-analysis/evade-emulator.md b/anti-behavioral-analysis/evade-emulator.md index 417649b..bb4988a 100644 --- a/anti-behavioral-analysis/evade-emulator.md +++ b/anti-behavioral-analysis/evade-emulator.md @@ -11,12 +11,12 @@ Behaviors that obstruct analysis in an emulator. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0005.001|**Different Opcode Sets**|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.| -|B0005.002|**Undocumented Opcodes**|Use rare or undocumented opcodes to block non-exhaustive emulators.| -|B0005.003|**Unusual/Undocumented API Calls**|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).| -|B0005.004|**Extra Loops/Time Locks**|Add extra loops to make time-constraint emulators give up.| +|**Different Opcode Sets**|B0005.001|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.| +|**Extra Loops/Time Locks**|B0005.004|Add extra loops to make time-constraint emulators give up.| +|**Undocumented Opcodes**|B0005.002|Use rare or undocumented opcodes to block non-exhaustive emulators.| +|**Unusual/Undocumented API Calls**|B0005.003|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).| Malware Examples ---------------- diff --git a/anti-behavioral-analysis/evade-memory-dump.md b/anti-behavioral-analysis/evade-memory-dump.md index 356f6c6..a23dd4b 100644 --- a/anti-behavioral-analysis/evade-memory-dump.md +++ b/anti-behavioral-analysis/evade-memory-dump.md @@ -11,17 +11,17 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0006.001|**Code Encryption in Memory**|Encrypt the executing malware instance code in memory.| -|B0006.002|**Erase the PE header**|Erase PE header from memory.| -|B0006.003|**Hide virtual memory**|Hide arbitrary segments of virtual memory.| -|B0006.004|**SizeOfImage**|Set the SizeOfImage field of PEB.LoaderData to be huge.| -|B0006.005|**Tampering**|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).| -|B0006.006|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.| -|B0006.007|**On-the-Fly APIs**|Resolve API addresses before each use to prevent complete dumping.| -|B0006.008|**Feed Misinformation**|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md).| -|B0006.009|**Flow Opcode Obstruction**|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).| +|**Code Encryption in Memory**|B0006.001|Encrypt the executing malware instance code in memory.| +|**Erase the PE header**|B0006.002|Erase PE header from memory.| +|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md).| +|**Flow Opcode Obstruction**|B0006.009|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).| +|**Guard Pages**|B0006.006|Encrypt blocks of code individually and decrypt temporarily only upon execution.| +|**Hide virtual memory**|B0006.003|Hide arbitrary segments of virtual memory.| +|**On-the-Fly APIs**|B0006.007|Resolve API addresses before each use to prevent complete dumping.| +|**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.| +|**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).| Malware Examples ---------------- diff --git a/anti-behavioral-analysis/execution-guardrails.md b/anti-behavioral-analysis/execution-guardrails.md index 819609c..102adeb 100644 --- a/anti-behavioral-analysis/execution-guardrails.md +++ b/anti-behavioral-analysis/execution-guardrails.md @@ -13,11 +13,11 @@ Malware may use execution guardrails (environmental conditions) to constrain exe Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1480.m01|**Deposited Keys**|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.| -|E1480.m02|**Environmental Keys**|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.| -|E1480.m03|**GetVolumeInformation**|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.| -|E1480.m04|**Host Fingerprint Check**|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.| -|E1480.m05|**Secure Triggers**|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).| -|E1480.m06|**Token Check**|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.| +|**Deposited Keys**|E1480.m01|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.| +|**Environmental Keys**|E1480.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.| +|**GetVolumeInformation**|E1480.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.| +|**Host Fingerprint Check**|E1480.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.| +|**Secure Triggers**|E1480.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).| +|**Token Check**|E1480.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.| diff --git a/anti-static-analysis/evade-call-graph.md b/anti-static-analysis/evade-call-graph.md index 7fc42ea..be676bb 100644 --- a/anti-static-analysis/evade-call-graph.md +++ b/anti-static-analysis/evade-call-graph.md @@ -11,10 +11,10 @@ Malware code evades accurate call graph generation during disassembly. Call grap Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0010.001|**Two-layer Function Return**|Two layer jumping confuses tools plotting call graphs. [[3]](#3)| -|B0010.002|**Invoke NTDLL System Calls via Encoded Table**|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)| +|**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)| +|**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[3]](#3)| References ---------- diff --git a/anti-static-analysis/evade-disassembler.md b/anti-static-analysis/evade-disassembler.md index 702d1ec..6cacfa0 100644 --- a/anti-static-analysis/evade-disassembler.md +++ b/anti-static-analysis/evade-disassembler.md @@ -11,13 +11,13 @@ Malware code evades disassembly in a recursive or linear disassembler. Some meth Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0012.001|**Argument Obfuscation**|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.| -|B0012.002|**Conditional Misdirection**|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).| -|B0012.003|**Value Dependent Jumps**|Explicit use of computed values for control flow, often many times in the same basic block or function.| -|B0012.004|**Variable Recomposition**|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.| -|B0012.005|**VBA Stomping**|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.| +|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.| +|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).| +|**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.| +|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.| +|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.| References ---------- diff --git a/anti-static-analysis/exe-code-obfuscate.md b/anti-static-analysis/exe-code-obfuscate.md index 10983df..43fb638 100644 --- a/anti-static-analysis/exe-code-obfuscate.md +++ b/anti-static-analysis/exe-code-obfuscate.md @@ -13,26 +13,26 @@ For encryption and encoding characteristics of malware samples, as well as malwa Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0032.001|**API Hashing**|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)| -|B0032.002|**Code Insertion**|Insert code to impede disassembly.| -|B0032.003|**Dead Code Insertion**|Include "dead" code with no real functionality.| -|B0032.004|**Fake Code Insertion**|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.| -|B0032.005|**Jump Insertion**|Insert jumps to make analysis visually harder.| -|B0032.006|**Thunk Code Insertion**|Variation on Jump Insertion. Used by some compilers for user-generated functions.| -|B0032.007|**Junk Code Insertion**|Insert dummy code between relevant opcodes. Can make signature writing more complex.| -|B0032.008|**Data Value Obfuscation**|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*. [NEEDS REVIEW]| -|B0032.009|**Entry Point Obfuscation**|Obfuscate the entry point of the malware executable.| -|B0032.010|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.| -|B0032.011|**Import Address Table Obfuscation**|Obfuscate the import address table.| -|B0032.012|**Import Compression**|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.| -|B0032.013|**Instruction Overlap**|Jump after the first byte of an instruction to confuse disassembler.| -|B0032.014|**Interleaving Code**|Split code into sections that may be rearranged and are connected by unconditional jumps.| -|B0032.015|**Merged Code Sections**|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.| -|B0032.016|**Structured Exception Handling (SEH)**|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).| -|B0032.017|**Stack Strings**|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.| -|B0032.018|**Symbol Obfuscation**|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.| +|**API Hashing**|B0032.001|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)| +|**Code Insertion**|B0032.002|Insert code to impede disassembly.| +|**Data Value Obfuscation**|B0032.008|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*. [NEEDS REVIEW]| +|**Dead Code Insertion**|B0032.003|Include "dead" code with no real functionality.| +|**Entry Point Obfuscation**|B0032.009|Obfuscate the entry point of the malware executable.| +|**Fake Code Insertion**|B0032.004|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.| +|**Guard Pages**|B0032.010|Encrypt blocks of code individually and decrypt temporarily only upon execution.| +|**Import Address Table Obfuscation**|B0032.011|Obfuscate the import address table.| +|**Import Compression**|B0032.012|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.| +|**Instruction Overlap**|B0032.013|Jump after the first byte of an instruction to confuse disassembler.| +|**Interleaving Code**|B0032.014|Split code into sections that may be rearranged and are connected by unconditional jumps.| +|**Jump Insertion**|B0032.005|Insert jumps to make analysis visually harder.| +|**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.| +|**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.| +|**Stack Strings**|B0032.017|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.| +|**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).| +|**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.| +|**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.| Malware Examples ---------------- diff --git a/anti-static-analysis/exe-code-optimize.md b/anti-static-analysis/exe-code-optimize.md index 8385126..f8eeca6 100644 --- a/anti-static-analysis/exe-code-optimize.md +++ b/anti-static-analysis/exe-code-optimize.md @@ -11,10 +11,10 @@ Code is optimized, making it harder to statically analyze. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0034.001|**Jump/Call Absolute Address**|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.| -|B0034.002|**Minification**|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.| +|**Jump/Call Absolute Address**|B0034.001|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.| +|**Minification**|B0034.002|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.| References ---------- diff --git a/anti-static-analysis/exe-code-virtualize.md b/anti-static-analysis/exe-code-virtualize.md index 4c9b314..35f7a23 100644 --- a/anti-static-analysis/exe-code-virtualize.md +++ b/anti-static-analysis/exe-code-virtualize.md @@ -13,9 +13,9 @@ Virtualized code is a software protection technique. Themida is a commercial too Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0008.001|**Multiple VMs**|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.| +|**Multiple VMs**|B0008.001|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.| Malware Examples ---------------- diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index 0e07f60..fb047a3 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -12,20 +12,20 @@ This description refines the ATT&CK [**Obfuscated Files or Information: Software Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0001.001|**Nested Packing**|The malware is packed by one packer, the result is packed, etc.| -|F0001.002|**Standard Compression**|Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.| -|F0001.003|**Standard Compression of Code**|Uses a standard algorithm to compress the opcode mnemonics.| -|F0001.004|**Standard Compression of Data**|Uses a standard algorithm to compress strings and variables (executable file data).| -|F0001.005|**Custom Compression**|Uses a custom algorithm to compress an executable file.| -|F0001.006|**Custom Compression of Code**|Uses a custom algorithm to compress opcode mnemonics.| -|F0001.007|**Custom Compression of Data**|Uses a custom algorithm to compress strings and variables (executable file data).| -|F0001.008|**UPX**|Uses UPX packer.| -|F0001.009|**Confuser**|Uses Confuser packer.| -|F0001.010|**VMProtect**|Uses VMProtect.| -|F0001.011|**Themida**|Uses Themida.| -|F0001.012|**Armadillo**|Uses Armadillo.| +|**Armadillo**|F0001.012|Uses Armadillo.| +|**Confuser**|F0001.009|Uses Confuser packer.| +|**Custom Compression**|F0001.005|Uses a custom algorithm to compress an executable file.| +|**Custom Compression of Code**|F0001.006|Uses a custom algorithm to compress opcode mnemonics.| +|**Custom Compression of Data**|F0001.007|Uses a custom algorithm to compress strings and variables (executable file data).| +|**Nested Packing**|F0001.001|The malware is packed by one packer, the result is packed, etc.| +|**Standard Compression**|F0001.002|Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.| +|**Standard Compression of Code**|F0001.003|Uses a standard algorithm to compress the opcode mnemonics.| +|**Standard Compression of Data**|F0001.004|Uses a standard algorithm to compress strings and variables (executable file data).| +|**Themida**|F0001.011|Uses Themida.| +|**UPX**|F0001.008|Uses UPX packer.| +|**VMProtect**|F0001.010|Uses VMProtect.| Malware Examples ---------------- diff --git a/collection/cryptocurrency.md b/collection/cryptocurrency.md index 03e6fc5..8b97068 100644 --- a/collection/cryptocurrency.md +++ b/collection/cryptocurrency.md @@ -11,8 +11,8 @@ Malware accesses files that contain sensitive data or credentials related to Bit Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0028.001|**Bitcoin**|Access Bitcoin data.| -|B0028.002|**Ethereum**|Access Ethereum data.| -|B0028.003|**Zcash**|Access Zcash data.| +|**Bitcoin**|B0028.001|Access Bitcoin data.| +|**Ethereum**|B0028.002|Access Ethereum data.| +|**Zcash**|B0028.003|Access Zcash data.| diff --git a/collection/input-capture.md b/collection/input-capture.md index 17fba1c..735624b 100644 --- a/collection/input-capture.md +++ b/collection/input-capture.md @@ -13,9 +13,9 @@ Malware captures user input. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1056.m01|**Mouse Events**|Mouse events are captured.| +|**Mouse Events**|E1056.m01|Mouse events are captured.| Malware Examples ---------------- diff --git a/collection/keylogging.md b/collection/keylogging.md index 48ecddf..ddfd71d 100644 --- a/collection/keylogging.md +++ b/collection/keylogging.md @@ -13,7 +13,7 @@ Malware captures user keyboard input. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0002.001|**Application Hook**|Keystrokes are captured with an application hook.| -|F0002.002|**Polling**|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).| +|**Application Hook**|F0002.001|Keystrokes are captured with an application hook.| +|**Polling**|F0002.002|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).| diff --git a/collection/screen-capture.md b/collection/screen-capture.md index 3337248..85ae3e5 100644 --- a/collection/screen-capture.md +++ b/collection/screen-capture.md @@ -13,6 +13,6 @@ Malware takes screen captures of the desktop. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1113.m01|**WinAPI**|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).| +|**WinAPI**|E1113.m01|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).| diff --git a/command-and-control/command-control-comm.md b/command-and-control/command-control-comm.md index ca16167..a197c7d 100644 --- a/command-and-control/command-control-comm.md +++ b/command-and-control/command-control-comm.md @@ -13,15 +13,15 @@ Command and Control Communication relates to *autonomous* client/server communic Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0030.001|**Send Data**|Send data to a C2 server.| -|B0030.002|**Receive Data**|Receive data from a C2 server.| -|B0030.003|**Server to Client File Transfer**|File is transferred from server to client.| -|B0030.004|**Client to Server File Transfer**|File is transferred from client to server.| -|B0030.005|**Check for Payload**|Check for payload.| -|B0030.006|**Send System Information**|Client sends system information.| -|B0030.007|**Send Heartbeat**|Heartbeat sent.| -|B0030.008|**Request Command**|Client requests a command.| -|B0030.009|**Request Email Template**|Request email template.| -|B0030.010|**Request Email Address List**|Request email address list.| +|**Check for Payload**|B0030.005|Check for payload.| +|**Client to Server File Transfer**|B0030.004|File is transferred from client to server.| +|**Receive Data**|B0030.002|Receive data from a C2 server.| +|**Request Command**|B0030.008|Client requests a command.| +|**Request Email Address List**|B0030.010|Request email address list.| +|**Request Email Template**|B0030.009|Request email template.| +|**Send Data**|B0030.001|Send data to a C2 server.| +|**Send Heartbeat**|B0030.007|Heartbeat sent.| +|**Send System Information**|B0030.006|Client sends system information.| +|**Server to Client File Transfer**|B0030.003|File is transferred from server to client.| diff --git a/credential-access/hooking.md b/credential-access/hooking.md index 88175fe..638baae 100644 --- a/credential-access/hooking.md +++ b/credential-access/hooking.md @@ -15,13 +15,13 @@ Note that in MBC, Hooking is also associated with the [Defense Evasion](https:// Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0003.001|**Patch MmGetPhysicalMemoryRanges**|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)| -|F0003.002|**Hook memory mapping APIs**|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)| -|F0003.003|**Hook procedures**|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)| -|F0003.004|**Import Address Hooking (IAT) Hooking**|Uses modifications to a process's IAT where pointers to imported API functions are stored.| -|F0003.005|**Inline Hooking**|Overwrites the first bytes in an API function to redirect code flow.| +|**Hook memory mapping APIs**|F0003.002|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)| +|**Hook procedures**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)| +|**Import Address Hooking (IAT) Hooking**|F0003.004|Uses modifications to a process's IAT where pointers to imported API functions are stored.| +|**Inline Hooking**|F0003.005|Overwrites the first bytes in an API function to redirect code flow.| +|**Patch MmGetPhysicalMemoryRanges**|F0003.001|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)| Malware Examples ---------------- diff --git a/defense-evasion/alter-install-location.md b/defense-evasion/alter-install-location.md index 85be3eb..b9ae115 100644 --- a/defense-evasion/alter-install-location.md +++ b/defense-evasion/alter-install-location.md @@ -11,10 +11,10 @@ Malware may install itself not as a file on the hard drive. [[1]](#1) Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0027.001|**Fileless Malware**|Stores itself in memory.| -|B0027.002|**Registry Install**|Stores itself in the Windows registry.| +|**Fileless Malware**|B0027.001|Stores itself in memory.| +|**Registry Install**|B0027.002|Stores itself in the Windows registry.| Malware Examples ---------------- diff --git a/defense-evasion/bypass-dep.md b/defense-evasion/bypass-dep.md index ea76d70..9b1dacc 100644 --- a/defense-evasion/bypass-dep.md +++ b/defense-evasion/bypass-dep.md @@ -11,9 +11,9 @@ Malware may bypass Data Execution Prevention (DEP). Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0037.001|**ROP Chains**|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)| +|**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)| References ---------- diff --git a/defense-evasion/covert-location.md b/defense-evasion/covert-location.md index 7eac39f..330e427 100644 --- a/defense-evasion/covert-location.md +++ b/defense-evasion/covert-location.md @@ -11,7 +11,7 @@ Malware may hide data or binary files within other files, the registry, etc. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0040.001|**Hide Data in Registry**|Malware may use a registry key to store a long sequence of bytes.| -|B0040.002|**Steganography**|Malware may store information in an image.| +|**Hide Data in Registry**|B0040.001|Malware may use a registry key to store a long sequence of bytes.| +|**Steganography**|B0040.002|Malware may store information in an image.| diff --git a/defense-evasion/disable-security-tools.md b/defense-evasion/disable-security-tools.md index 35f39ff..73859d0 100644 --- a/defense-evasion/disable-security-tools.md +++ b/defense-evasion/disable-security-tools.md @@ -15,13 +15,13 @@ See ATT&CK: [**Impair Defenses: Disable or Modify Tools**](https://attack.mitre. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0004.001|**Disable Kernel Patch Protection**|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).| -|F0004.002|**Disable System File Overwrite Protection**|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.| -|F0004.003|**Unhook APIs**|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.| -|F0004.004|**AMSI Bypass**|Malware bypasses AMSI (Anti-malware Scan Interface).| -|F0004.005|**Modify Policy**|Malware may modify policies to make software less effective.| +|**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).| +|**Disable Kernel Patch Protection**|F0004.001|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).| +|**Disable System File Overwrite Protection**|F0004.002|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.| +|**Modify Policy**|F0004.005|Malware may modify policies to make software less effective.| +|**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.| Malware Examples ---------------- diff --git a/defense-evasion/hidden-files.md b/defense-evasion/hidden-files.md index 721b2ab..ff41114 100644 --- a/defense-evasion/hidden-files.md +++ b/defense-evasion/hidden-files.md @@ -13,7 +13,7 @@ See ATT&CK: [**Hide Artifacts: Hidden Files and Directories**](https://attack.mi Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0005.001|**File Extension Change**|Malware may change the file extension of a file.| -|F0005.002|**Change File Location**|Malware may change the location of itself or another file to prevent detection.| +|**Change File Location**|F0005.002|Malware may change the location of itself or another file to prevent detection.| +|**File Extension Change**|F0005.001|Malware may change the file extension of a file.| diff --git a/defense-evasion/indicator-blocking.md b/defense-evasion/indicator-blocking.md index ab79079..36b400a 100644 --- a/defense-evasion/indicator-blocking.md +++ b/defense-evasion/indicator-blocking.md @@ -13,6 +13,6 @@ See ATT&CK: [**Impair Defenses: Indicator Blocking**](https://attack.mitre.org/t Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0006.001|**Remove SMS Warning Messages**|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.| +|**Remove SMS Warning Messages**|F0006.001|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.| diff --git a/defense-evasion/obfuscate-files.md b/defense-evasion/obfuscate-files.md index 72daf1c..0ea1d99 100644 --- a/defense-evasion/obfuscate-files.md +++ b/defense-evasion/obfuscate-files.md @@ -15,18 +15,18 @@ See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techn Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1027.m01|**Encoding**|The malware sample, file, or other information is encoded.| -|E1027.m02|**Encoding - Standard Encoding**|The malware sample, file, or other information is encoded. A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.| -|E1027.m03|**Encoding - Custom Encoding**|The malware sample, file, or other information is encoded. A custom algorithm is used to encode the malware sample, a file, or other information.| -|E1027.m04|**Encryption**|The malware sample, file, or other information is encrypted.| -|E1027.m05|**Encryption - Standard Encryption**|The malware sample, file, or other information is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.| -|E1027.m06|**Encryption - Standard Encryption of Code**|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.| -|E1027.m07|**Encryption - Standard Encryption of Data**|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.| -|E1027.m08|**Encryption - Custom Encryption**|The malware sample, file, or other information is encrypted. A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.| -|E1027.m09|**Encryption - Custom Encryption of Code**|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.| -|E1027.m10|**Encryption - Custom Encryption of Data**|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.| +|**Encoding**|E1027.m01|The malware sample, file, or other information is encoded.| +|**Encoding - Custom Encoding**|E1027.m03|The malware sample, file, or other information is encoded. A custom algorithm is used to encode the malware sample, a file, or other information.| +|**Encoding - Standard Encoding**|E1027.m02|The malware sample, file, or other information is encoded. A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.| +|**Encryption**|E1027.m04|The malware sample, file, or other information is encrypted.| +|**Encryption - Custom Encryption**|E1027.m08|The malware sample, file, or other information is encrypted. A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.| +|**Encryption - Custom Encryption of Code**|E1027.m09|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.| +|**Encryption - Custom Encryption of Data**|E1027.m10|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.| +|**Encryption - Standard Encryption**|E1027.m05|The malware sample, file, or other information is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.| +|**Encryption - Standard Encryption of Code**|E1027.m06|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.| +|**Encryption - Standard Encryption of Data**|E1027.m07|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.| Malware Examples ---------------- diff --git a/defense-evasion/polymorphic-code.md b/defense-evasion/polymorphic-code.md index 0d35860..3aeef7c 100644 --- a/defense-evasion/polymorphic-code.md +++ b/defense-evasion/polymorphic-code.md @@ -11,11 +11,11 @@ Polymorphic code, a file with the same functionality but different execution, is Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0029.001|**Packer Stub**|A packer stub can generate polymorphic code.| -|B0029.002|**Call Indirections**|[[1]](#1)| -|B0029.003|**Code Reordering**|[[1]](#1)| +|**Call Indirections**|B0029.002|[[1]](#1)| +|**Code Reordering**|B0029.003|[[1]](#1)| +|**Packer Stub**|B0029.001|A packer stub can generate polymorphic code.| References ---------- diff --git a/defense-evasion/process-inject.md b/defense-evasion/process-inject.md index 8513e8e..50326eb 100644 --- a/defense-evasion/process-inject.md +++ b/defense-evasion/process-inject.md @@ -24,11 +24,11 @@ Methods not captured by ATT&CK Process Injection sub-techniques are listed below Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1055.m01|**Hook Injection via SetWindowsHooksEx**|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)| -|E1055.m02|**Injection and Persistence via Registry Modification**|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)| -|E1055.m03|**Injection using Shims**|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)| +|**Hook Injection via SetWindowsHooksEx**|E1055.m01|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)| +|**Injection and Persistence via Registry Modification**|E1055.m02|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)| +|**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)| Malware Examples ---------------- diff --git a/defense-evasion/rootkit-behavior.md b/defense-evasion/rootkit-behavior.md index 1fac2d4..727d2bd 100644 --- a/defense-evasion/rootkit-behavior.md +++ b/defense-evasion/rootkit-behavior.md @@ -13,19 +13,19 @@ See ATT&CK: [**Rootkit**](https://attack.mitre.org/techniques/T1014). Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1014.m01|**Hide Kernel Modules**|Hides the usage of any kernel modules by the malware instance.| -|E1014.m02|**Hide Services**|Hides any system services that the malware instance creates or injects itself into.| -|E1014.m04|**Hide Threads**|Hides one or more threads that belong to the malware instance.| -|E1014.m05|**Hide Userspace Libraries**|Hides the usage of userspace libraries by the malware instance.| -|E1014.m06|**Prevent API Unhooking**|Prevents the API hooks installed by the malware instance from being removed.| -|E1014.m07|**Prevent Registry Access**|Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.| -|E1014.m08|**Prevent Registry Deletion**|Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.| -|E1014.m09|**Prevent File Access**|Prevents access to the file system, including to specific files and/or directories associated with the malware instance.| -|E1014.m10|**Prevent File Deletion**|Prevents files and/or directories associated with the malware instance from being deleted from a system.| -|E1014.m11|**Prevent Memory Access**|Prevents access to system memory where the malware instance may be storing code or data.| -|E1014.m12|**Prevent Native API Hooking**|Prevents other software from hooking native system APIs.| +|**Hide Kernel Modules**|E1014.m01|Hides the usage of any kernel modules by the malware instance.| +|**Hide Services**|E1014.m02|Hides any system services that the malware instance creates or injects itself into.| +|**Hide Threads**|E1014.m04|Hides one or more threads that belong to the malware instance.| +|**Hide Userspace Libraries**|E1014.m05|Hides the usage of userspace libraries by the malware instance.| +|**Prevent API Unhooking**|E1014.m06|Prevents the API hooks installed by the malware instance from being removed.| +|**Prevent File Access**|E1014.m09|Prevents access to the file system, including to specific files and/or directories associated with the malware instance.| +|**Prevent File Deletion**|E1014.m10|Prevents files and/or directories associated with the malware instance from being deleted from a system.| +|**Prevent Memory Access**|E1014.m11|Prevents access to system memory where the malware instance may be storing code or data.| +|**Prevent Native API Hooking**|E1014.m12|Prevents other software from hooking native system APIs.| +|**Prevent Registry Access**|E1014.m07|Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.| +|**Prevent Registry Deletion**|E1014.m08|Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.| Malware Examples ---------------- diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 9a8bf80..7a70bbb 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -13,6 +13,6 @@ See ATT&CK: [**Indicator Removal on Host: File Deletion**](https://attack.mitre. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0007.001|**COMSPEC Environment Variable**|Uninstalls self via COMSPEC environment variable.| +|**COMSPEC Environment Variable**|F0007.001|Uninstalls self via COMSPEC environment variable.| diff --git a/discovery/analysis-tool-discover.md b/discovery/analysis-tool-discover.md index ec8c33c..25c0e2a 100644 --- a/discovery/analysis-tool-discover.md +++ b/discovery/analysis-tool-discover.md @@ -13,14 +13,14 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0013.001|**Process detection**|Malware can scan for the process name associated with common analysis tools.| -|B0013.002|**Process detection - Debuggers**|Malware can scan for the process name associated with common analysis tools. OllyDBG / ImmunityDebugger / WinDbg / IDA Pro| -|B0013.003|**Process detection - SysInternals Suite Tools**|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns| -|B0013.004|**Process detection - PCAP Utilities**|Malware can scan for the process name associated with common analysis tools. Wireshark / Dumpcap| -|B0013.005|**Process detection - Process Utilities**|Malware can scan for the process name associated with common analysis tools. ProcessHacker / SysAnalyzer / HookExplorer / SysInspector| -|B0013.006|**Process detection - PE Utilities**|Malware can scan for the process name associated with common analysis tools. ImportREC / PETools / LordPE| -|B0013.007|**Process detection - Sandboxes**|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.| -|B0013.008|**Known File Location**|Malware may detect an analysis tool by the presence of a file in a known location.| -|B0013.009|**Known Window**|Malware may detect an analysis tool via the presence of a known window.| +|**Known File Location**|B0013.008|Malware may detect an analysis tool by the presence of a file in a known location.| +|**Known Window**|B0013.009|Malware may detect an analysis tool via the presence of a known window.| +|**Process detection**|B0013.001|Malware can scan for the process name associated with common analysis tools.| +|**Process detection - Debuggers**|B0013.002|Malware can scan for the process name associated with common analysis tools. OllyDBG / ImmunityDebugger / WinDbg / IDA Pro| +|**Process detection - PCAP Utilities**|B0013.004|Malware can scan for the process name associated with common analysis tools. Wireshark / Dumpcap| +|**Process detection - PE Utilities**|B0013.006|Malware can scan for the process name associated with common analysis tools. ImportREC / PETools / LordPE| +|**Process detection - Process Utilities**|B0013.005|Malware can scan for the process name associated with common analysis tools. ProcessHacker / SysAnalyzer / HookExplorer / SysInspector| +|**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.| +|**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns| diff --git a/discovery/system-info-discover.md b/discovery/system-info-discover.md index c2a3d78..78f19ec 100644 --- a/discovery/system-info-discover.md +++ b/discovery/system-info-discover.md @@ -13,9 +13,9 @@ See ATT&CK: [**System Information Discovery**](https://attack.mitre.org/techniqu Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1082.m01|**Generate Windows Exception**|Malware may trigger an exception as a way of gathering system details.| +|**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.| Malware Examples ---------------- diff --git a/execution/conditional-execute.md b/execution/conditional-execute.md index 1f9a5fe..2508a8a 100644 --- a/execution/conditional-execute.md +++ b/execution/conditional-execute.md @@ -11,9 +11,9 @@ Malware checks system environment conditions or characteristics to determine exe Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0025.001|**Suicide Exit**|Malware terminates its execution based on a trigger condition or value (or because it has completed).| +|**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).| Malware Examples ---------------- diff --git a/execution/exploit-software.md b/execution/exploit-software.md index 10c2377..7e01d00 100644 --- a/execution/exploit-software.md +++ b/execution/exploit-software.md @@ -13,14 +13,14 @@ Software is exploited - either because of a vulnerability or through its designe Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1203.m01|**Remote Desktop Protocols (RDP)**|RDP is used by malware.| -|E1203.m02|**Java-based Web Servers**|| -|E1203.m03|**File Transfer Protocol (FTP) Servers**|Malware leverages an FTP server.| -|E1203.m04|**Red Hat JBoss Enterprise Products**|| -|E1203.m05|**Sysinternals**|Sysinternals tools are used for additional command line functionality.| -|E1203.m06|**Windows Utilities**|One or more Windows utilities are used.| +|**File Transfer Protocol (FTP) Servers**|E1203.m03|Malware leverages an FTP server.| +|**Java-based Web Servers**|E1203.m02|| +|**Red Hat JBoss Enterprise Products**|E1203.m04|| +|**Remote Desktop Protocols (RDP)**|E1203.m01|RDP is used by malware.| +|**Sysinternals**|E1203.m05|Sysinternals tools are used for additional command line functionality.| +|**Windows Utilities**|E1203.m06|One or more Windows utilities are used.| Malware Examples ---------------- diff --git a/execution/remote-commands.md b/execution/remote-commands.md index 675a096..a1a4003 100644 --- a/execution/remote-commands.md +++ b/execution/remote-commands.md @@ -19,12 +19,12 @@ Autonomous behaviors - those done by the malware without an active attacker - sh Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0011.001|**Delete File**|| -|B0011.002|**Download File**|| -|B0011.003|**Execute**|| -|B0011.004|**Shutdown**|| -|B0011.005|**Sleep**|| -|B0011.006|**Uninstall**|| -|B0011.007|**Upload File**|| +|**Delete File**|B0011.001|| +|**Download File**|B0011.002|| +|**Execute**|B0011.003|| +|**Shutdown**|B0011.004|| +|**Sleep**|B0011.005|| +|**Uninstall**|B0011.006|| +|**Upload File**|B0011.007|| diff --git a/exfiltration/auto-exfiltrate.md b/exfiltration/auto-exfiltrate.md index 4f323f0..6404608 100644 --- a/exfiltration/auto-exfiltrate.md +++ b/exfiltration/auto-exfiltrate.md @@ -13,6 +13,6 @@ Malware may exfiltrate data via automated processing or scripting. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1020.m01|**Exfiltrate via File Hosting Service**|Malware may exfiltrate files to a file hosting location.| +|**Exfiltrate via File Hosting Service**|E1020.m01|Malware may exfiltrate files to a file hosting location.| diff --git a/exfiltration/data-encrypted.md b/exfiltration/data-encrypted.md index 968ffdd..5cbe99e 100644 --- a/exfiltration/data-encrypted.md +++ b/exfiltration/data-encrypted.md @@ -13,11 +13,11 @@ Malware may obfuscate data via encryption or encoding before exfiltration. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1560.m01|**Encoding**|Data is encoded.| -|E1560.m02|**Encryption**|Data is encrypted.| -|E1560.m03|**Encoding - Standard Encoding**|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.| -|E1560.m04|**Encoding - Custom Encoding**|Data is encoded. A custom algorithm is used to encode the exfiltrated data.| -|E1560.m05|**Encryption - Standard Encryption**|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.| -|E1560.m06|**Encryption - Custom Encryption**|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.| +|**Encoding**|E1560.m01|Data is encoded.| +|**Encoding - Custom Encoding**|E1560.m04|Data is encoded. A custom algorithm is used to encode the exfiltrated data.| +|**Encoding - Standard Encoding**|E1560.m03|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.| +|**Encryption**|E1560.m02|Data is encrypted.| +|**Encryption - Custom Encryption**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.| +|**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.| diff --git a/impact/data-destruction.md b/impact/data-destruction.md index 27920dd..fd2f4fe 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -13,11 +13,11 @@ see ATT&CK: [**Data Destruction**](https://attack.mitre.org/techniques/T1485/). Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1485.m01|**Delete Shadow Drive**|Deletes shadow drive data, which is related to ransomware.| -|E1485.m02|**Empty Recycle Bin**|Empties the recycle bin, which can be related to ransomware.| -|E1485.m03|**Delete Application/Software**|An application or software is deleted.| +|**Delete Application/Software**|E1485.m03|An application or software is deleted.| +|**Delete Shadow Drive**|E1485.m01|Deletes shadow drive data, which is related to ransomware.| +|**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.| Malware Examples ---------------- diff --git a/impact/generate-fraud-rev.md b/impact/generate-fraud-rev.md index c60efdc..09c2883 100644 --- a/impact/generate-fraud-rev.md +++ b/impact/generate-fraud-rev.md @@ -13,10 +13,10 @@ See ATT&CK: [**Generate Fraudulent Advertising Revenue**](https://attack.mitre.o Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1472.m01|**Click Hijacking**|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)| -|E1472.m02|**Advertisement Replacement Fraud**|Malware injects ad windows onto websites the user views. [[2]](#2)| +|**Advertisement Replacement Fraud**|E1472.m02|Malware injects ad windows onto websites the user views. [[2]](#2)| +|**Click Hijacking**|E1472.m01|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)| Malware Examples ---------------- diff --git a/impact/hijack-sys-resources.md b/impact/hijack-sys-resources.md index 0c222eb..37106e0 100644 --- a/impact/hijack-sys-resources.md +++ b/impact/hijack-sys-resources.md @@ -13,10 +13,10 @@ The subsequently defined ATT&CK technique [Resource Hijacking](https://attack.mi Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0018.001|**Password Cracking**|Consume system resources for the purpose of password cracking.| -|B0018.002|**Cryptojacking**|Consume system resources to mine for cryptocurrency (e.g., Bitcoin, Litecoin, etc.).| +|**Cryptojacking**|B0018.002|Consume system resources to mine for cryptocurrency (e.g., Bitcoin, Litecoin, etc.).| +|**Password Cracking**|B0018.001|Consume system resources for the purpose of password cracking.| Malware Examples ---------------- diff --git a/impact/remote-access.md b/impact/remote-access.md index fcc61b9..d6054f3 100644 --- a/impact/remote-access.md +++ b/impact/remote-access.md @@ -15,9 +15,9 @@ Note that the [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1 Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|B0022.001|**Reverse Shell**|Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.| +|**Reverse Shell**|B0022.001|Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.| Malware Examples ---------------- diff --git a/lateral-movement/supply-chain-compromise.md b/lateral-movement/supply-chain-compromise.md index 4a74de7..912129a 100644 --- a/lateral-movement/supply-chain-compromise.md +++ b/lateral-movement/supply-chain-compromise.md @@ -11,10 +11,10 @@ The supply chain may be compromised to enable initial malware infection. Malware Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|E1195.m01|**Abuse Enterprise Certificates**|Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see *Exploit Private APIs* below).| -|E1195.m02|**Exploit Private APIs**|Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.| +|**Abuse Enterprise Certificates**|E1195.m01|Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see *Exploit Private APIs* below).| +|**Exploit Private APIs**|E1195.m02|Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.| Malware Examples ---------------- diff --git a/micro-behaviors/communication/dns-comm.md b/micro-behaviors/communication/dns-comm.md index 48b5313..b63d71d 100644 --- a/micro-behaviors/communication/dns-comm.md +++ b/micro-behaviors/communication/dns-comm.md @@ -11,10 +11,10 @@ The DNS Communication micro-behavior focuses on DNS communication. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0011.001|**Resolve**|Resolves a domain.| -|C0011.002|**Server Connect**|Connects to DNS server.| -|C0011.003|**DDNS Domain Connect**|Connects to dynamic DNS domain.| -|C0011.004|**Resolve TLD**|Resolves top level domain.| -|C0011.005|**Resolve Free Hosting Domain**|Resolves a free hosting domain (e.g., freeiz.com).| +|**DDNS Domain Connect**|C0011.003|Connects to dynamic DNS domain.| +|**Resolve**|C0011.001|Resolves a domain.| +|**Resolve Free Hosting Domain**|C0011.005|Resolves a free hosting domain (e.g., freeiz.com).| +|**Resolve TLD**|C0011.004|Resolves top level domain.| +|**Server Connect**|C0011.002|Connects to DNS server.| diff --git a/micro-behaviors/communication/ftp-comm.md b/micro-behaviors/communication/ftp-comm.md index 5197709..bf13208 100644 --- a/micro-behaviors/communication/ftp-comm.md +++ b/micro-behaviors/communication/ftp-comm.md @@ -11,7 +11,7 @@ The FTP Communication micro-behavior focuses on FTP communication. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0004.001|**Put**|FTP Put| -|C0004.002|**WinINet API**|Send FTP command via WinINet.| +|**Put**|C0004.001|FTP Put| +|**WinINet API**|C0004.002|Send FTP command via WinINet.| diff --git a/micro-behaviors/communication/http-comm.md b/micro-behaviors/communication/http-comm.md index 5a1fb15..18d765d 100644 --- a/micro-behaviors/communication/http-comm.md +++ b/micro-behaviors/communication/http-comm.md @@ -11,17 +11,17 @@ This micro-behavior is related to HTTP communication. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0002.001|**Server**|General HTTP server behavior.| -|C0002.002|**Client**|General HTTP client behavior.| -|C0002.003|**Request**|Non-specific HTTP request.| -|C0002.004|**GET Request**|HTTP Get request.| -|C0002.005|**POST Request**|HTTP Post request.| -|C0002.006|**PUT Request**|HTTP Put request.| -|C0002.007|**WinINet API**|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md) microbehavior.| -|C0002.008|**WinHTTP API**|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).| -|C0002.008|**URLMON Function**|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.| -|C0002.008|**IWebBrowser**|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.| -|C0002.008|**IHTMLDocument**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.| -|C0002.008|**IHTMLElement**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.| +|**Client**|C0002.002|General HTTP client behavior.| +|**GET Request**|C0002.004|HTTP Get request.| +|**IHTMLDocument**|C0002.008|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.| +|**IHTMLElement**|C0002.008|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.| +|**IWebBrowser**|C0002.008|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.| +|**POST Request**|C0002.005|HTTP Post request.| +|**PUT Request**|C0002.006|HTTP Put request.| +|**Request**|C0002.003|Non-specific HTTP request.| +|**Server**|C0002.001|General HTTP server behavior.| +|**URLMON Function**|C0002.008|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.| +|**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).| +|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md) microbehavior.| diff --git a/micro-behaviors/communication/icmp-comm.md b/micro-behaviors/communication/icmp-comm.md index adbdb67..629e852 100644 --- a/micro-behaviors/communication/icmp-comm.md +++ b/micro-behaviors/communication/icmp-comm.md @@ -11,6 +11,6 @@ This micro-behavior is related to ICMP communication. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0014.001|**Generate Traffic**|Generate ICMP traffic.| +|**Generate Traffic**|C0014.001|Generate ICMP traffic.| diff --git a/micro-behaviors/communication/inter-process.md b/micro-behaviors/communication/inter-process.md index bcb6eed..a62b2d6 100644 --- a/micro-behaviors/communication/inter-process.md +++ b/micro-behaviors/communication/inter-process.md @@ -11,9 +11,9 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0003.001|**Create Pipe**|| -|C0003.002|**Connect Pipe**|| -|C0003.003|**Read Pipe**|| -|C0003.004|**Write Pipe**|| +|**Connect Pipe**|C0003.002|| +|**Create Pipe**|C0003.001|| +|**Read Pipe**|C0003.003|| +|**Write Pipe**|C0003.004|| diff --git a/micro-behaviors/communication/smtp-comm.md b/micro-behaviors/communication/smtp-comm.md index f65c261..3a26f0f 100644 --- a/micro-behaviors/communication/smtp-comm.md +++ b/micro-behaviors/communication/smtp-comm.md @@ -11,7 +11,7 @@ This micro-behavior focuses on SMTP communication. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0012.001|**Server Connect**|Connects to an smtp server.| -|C0012.002|**Request**|Makes SMTP request.| +|**Request**|C0012.002|Makes SMTP request.| +|**Server Connect**|C0012.001|Connects to an smtp server.| diff --git a/micro-behaviors/communication/tcp-comm.md b/micro-behaviors/communication/tcp-comm.md index 7b6af67..ce37a27 100644 --- a/micro-behaviors/communication/tcp-comm.md +++ b/micro-behaviors/communication/tcp-comm.md @@ -11,12 +11,12 @@ This micro-behavior focuses on TCP communication. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0001.001|**Client**|General TCP client behavior.| -|C0001.002|**Server**|General TCP server behavior.| -|C0001.003|**Create Socket**|A server or client creates a TCP socket.| -|C0001.004|**Connect Socket**|A server or client connects via a TCP socket.| -|C0001.005|**Listen Socket**|A server listens for client requests.| -|C0001.006|**Receive Data**|Receive data on socket.| -|C0001.007|**Send Data**|Send data on socket.| +|**Client**|C0001.001|General TCP client behavior.| +|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.| +|**Create Socket**|C0001.003|A server or client creates a TCP socket.| +|**Listen Socket**|C0001.005|A server listens for client requests.| +|**Receive Data**|C0001.006|Receive data on socket.| +|**Send Data**|C0001.007|Send data on socket.| +|**Server**|C0001.002|General TCP server behavior.| diff --git a/micro-behaviors/communication/udp-comm.md b/micro-behaviors/communication/udp-comm.md index 5fa5c65..3873de8 100644 --- a/micro-behaviors/communication/udp-comm.md +++ b/micro-behaviors/communication/udp-comm.md @@ -11,6 +11,6 @@ The micro-behavior is related to UDP communication. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0013.001|**STUN Server**|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.| +|**STUN Server**|C0013.001|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.| diff --git a/micro-behaviors/communication/wininet.md b/micro-behaviors/communication/wininet.md index 880b16c..9f42a99 100644 --- a/micro-behaviors/communication/wininet.md +++ b/micro-behaviors/communication/wininet.md @@ -13,13 +13,13 @@ The methods below are those of most interest in malware analysis. Details can be Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0005.001|**InternetConnect**|Opens an FTP or HTTP session for a given site.| -|C0005.002|**InternetOpen**|Initializes an application's use of the WinINet functions.| -|C0005.003|**InternetOpenURL**|Opens a resource specified by a complete FTP or HTTP URL.| -|C0005.004|**InternetReadFile**|Reads data from an open Internet file (URL data).| -|C0005.005|**InternetWriteFile**|Writes data to an open Internet file.| +|**InternetConnect**|C0005.001|Opens an FTP or HTTP session for a given site.| +|**InternetOpen**|C0005.002|Initializes an application's use of the WinINet functions.| +|**InternetOpenURL**|C0005.003|Opens a resource specified by a complete FTP or HTTP URL.| +|**InternetReadFile**|C0005.004|Reads data from an open Internet file (URL data).| +|**InternetWriteFile**|C0005.005|Writes data to an open Internet file.| References ---------- diff --git a/micro-behaviors/cryptography/gen-random.md b/micro-behaviors/cryptography/gen-random.md index 4a4a6e6..29fd631 100644 --- a/micro-behaviors/cryptography/gen-random.md +++ b/micro-behaviors/cryptography/gen-random.md @@ -11,8 +11,8 @@ The Generate Pseudo-random Sequence microbehavior can be used for a number of pu Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0021.001|**GetTickCount**|Generate random using GetTickCount.| -|C0021.002|**rand**|Generate random using rand.| -|C0021.003|**Use API**|Generate random using a Windows API.| +|**GetTickCount**|C0021.001|Generate random using GetTickCount.| +|**Use API**|C0021.003|Generate random using a Windows API.| +|**rand**|C0021.002|Generate random using rand.| diff --git a/micro-behaviors/file-manipulation/alter-extend.md b/micro-behaviors/file-manipulation/alter-extend.md index 56afc7d..a917417 100644 --- a/micro-behaviors/file-manipulation/alter-extend.md +++ b/micro-behaviors/file-manipulation/alter-extend.md @@ -11,6 +11,6 @@ Malware alters a file extension. This could be done for many reasons, including Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0015.001|**Append Extension**|A new extension is appended.| +|**Append Extension**|C0015.001|A new extension is appended.| diff --git a/micro-behaviors/file-manipulation/create-file.md b/micro-behaviors/file-manipulation/create-file.md index 582d9c8..012bcbf 100644 --- a/micro-behaviors/file-manipulation/create-file.md +++ b/micro-behaviors/file-manipulation/create-file.md @@ -11,7 +11,7 @@ Malware creates a file. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0016.001|**Create Office Document**|An Office document is created.| -|C0016.002|**Create Ransomware File**|Create a file used by ransomware.| +|**Create Office Document**|C0016.001|An Office document is created.| +|**Create Ransomware File**|C0016.002|Create a file used by ransomware.| diff --git a/micro-behaviors/memory-manipulation/memory-protect.md b/micro-behaviors/memory-manipulation/memory-protect.md index 5086326..e7d5f6b 100644 --- a/micro-behaviors/memory-manipulation/memory-protect.md +++ b/micro-behaviors/memory-manipulation/memory-protect.md @@ -11,7 +11,7 @@ Malware may change memory protection. For example, read-write memory may be chan Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0002.001|**Executable Stack**|The stack is made executable.| -|C0002.002|**Executable Heap**|The heap is made executable.| +|**Executable Heap**|C0002.002|The heap is made executable.| +|**Executable Stack**|C0002.001|The stack is made executable.| diff --git a/micro-behaviors/processes/create-process.md b/micro-behaviors/processes/create-process.md index 4276866..a6fed11 100644 --- a/micro-behaviors/processes/create-process.md +++ b/micro-behaviors/processes/create-process.md @@ -11,7 +11,7 @@ Malware creates a process. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0017.001|**Create Process via Shellcode**|Malware uses shellcode to create a process.| -|C0017.002|**Create Process via WMI**|Malware uses WMI to create a process.| +|**Create Process via Shellcode**|C0017.001|Malware uses shellcode to create a process.| +|**Create Process via WMI**|C0017.002|Malware uses WMI to create a process.| diff --git a/micro-behaviors/processes/synchronization.md b/micro-behaviors/processes/synchronization.md index 6bfcd2c..13c86d8 100644 --- a/micro-behaviors/processes/synchronization.md +++ b/micro-behaviors/processes/synchronization.md @@ -11,6 +11,6 @@ Malware enables two or more processes/threads to share a resource. Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|C0022.001|**Create Mutex**|Malware creates a mutex to enable synchronization.| +|**Create Mutex**|C0022.001|Malware creates a mutex to enable synchronization.| diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index b7c90ce..0e7f554 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -13,9 +13,9 @@ see ATT&CK: [**Pre-OS Boot: Component Firmware**](https://attack.mitre.org/techn Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0009.001|**Router Firmware**|Cisco routers can have their firmware images modified in order to maliciously infect and persist on end-user machines in a network. This is accomplished by using default or acquired credentials to gain access to a router and to install a backdoor. The implant resides within a modified Cisco IOS image and, when loaded, maintains its persistence in the environment, even after a system reboot. However, any further modules loaded by the attacker will only exist in the router's volatile memory and will not be available for use after reboot. Known affected hardware includes Cisco routers 1841, 2811, and 3825.| +|**Router Firmware**|F0009.001|Cisco routers can have their firmware images modified in order to maliciously infect and persist on end-user machines in a network. This is accomplished by using default or acquired credentials to gain access to a router and to install a backdoor. The implant resides within a modified Cisco IOS image and, when loaded, maintains its persistence in the environment, even after a system reboot. However, any further modules loaded by the attacker will only exist in the router's volatile memory and will not be available for use after reboot. Known affected hardware includes Cisco routers 1841, 2811, and 3825.| Malware Examples ---------------- diff --git a/persistence/kernel-modules-ext.md b/persistence/kernel-modules-ext.md index 28cd494..66dd67e 100644 --- a/persistence/kernel-modules-ext.md +++ b/persistence/kernel-modules-ext.md @@ -13,6 +13,6 @@ See ATT&CK: [**Boot or Logon Autostart Execution: Kernel Modules and Extensions* Methods ------- -|ID|Name|Description| +|Name|ID|Description| |---|---|---| -|F0010.001|**Device Driver**|Allows kernel to access hardware connected to the system.| +|**Device Driver**|F0010.001|Allows kernel to access hardware connected to the system.|