admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
Desiree Beck
2019-08-01 13:56:04 -04:00
parent c10d9a020a
commit 2cca7af5ae
207 changed files with 3631 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-static-analysis/README.md
+22
View File
@@ -0,0 +1,22 @@
|||
|--|-----|
|**ID**|**M9002**|
# Anti-Static Analysis
Behaviors and methods that prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.
Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).
* **Call Graph Generation Evasion** [M0010](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/evade-call-graph.md)
* **Disassembler Evasion** [M0012](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/evade-disassembler.md)
* **Executable Code Compression** [E1045](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-compression.md)
* **Executable Code Obfuscation** [M0032](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-obfuscate.md)
* **Executable Code Optimization** [M0034](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-optimize.md)
* **Executable Code Virtualization** [M0008](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-virtualize.md)
References
----------
<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project
<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
anti-static-analysis/evade-call-graph.md
+30
View File
@@ -0,0 +1,30 @@
|||
|---------|------------------------|
|**ID**|**M0010**|
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
|**Related ATT&CK Technique(s)**|None|
Call Graph Generation Evasion
=============================
Malware code evades accurate call graph generation during disassembly. Call graphs are used by malware similarity tools and algorithms ([[1]](#1), [[4]](#4)), as well as for malware detection [[2]](#2).
Methods
-------
* **Two-layer Function Return**: two layer jumping confuses tools plotting call graphs. [[3]](#3)
* **Invoke NTDLL System Calls via Encoded Table**: invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
References
----------
<a name="1">[1]</a> K. Blokhin, D. Mentis, J. Saxe, "Malware Similarity Identification Using Call Graph Based System Call Subsequence Features," 2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, July 2013. https://www.researchgate.net/publication/269326967_Malware_Similarity_Identification_Using_Call_Graph_Based_System_Call_Subsequence_Features
<a name="2">[2]</a> P. Deshpande, M. Stamp, "Metamorphic Malware Detection Using Function Call Graph Analysis," MIS Review Vol. 21, Nos. 1/2, September(2015)/March(2016). https://pdfs.semanticscholar.org/8db2/69106ea6e1f59e4dac0889665dd3336ee9b1.pdf
<a name="3">[3]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html
<a name="4">[4]</a> S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. http://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf
anti-static-analysis/evade-disassembler.md
+33
View File
@@ -0,0 +1,33 @@
|||
|---------|------------------------|
|**ID**|**M0012**|
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
|**Related ATT&CK Technique(s)**|None|
Disassembler Evasion
====================
Malware code evades disassembly in a recursive or linear disassembler. Some methods apply to both types of disassemblers; others apply to one type and not the other.
Methods
-------
* **Conditional Misdirection**: Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).
* **Value Dependent Jumps**: Explicit use of computed values for control flow, often many times in the same basic block or function.
* **Argument Obfuscation**: Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.
* **Variable Recomposition**: Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.
* **VBA Stomping**: Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
References
----------
<a name="1">[1]</a> http://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf
<a name="2">[2]</a> http://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf
<a name="3">[3]</a> https://isc.sans.edu/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870
<a name="4">[4]</a> https://boingboing.net/2019/05/05/p-code-r-us.html
anti-static-analysis/exe-code-compression.md
+33
View File
@@ -0,0 +1,33 @@
|||
|---------|------------------------|
|**ID**|**E1045**|
|**Objective(s)**|[Anti-Behaviorial Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Software Packing](https://attack.mitre.org/techniques/T1045/)|
Executable Code Compression
===========================
Executable Code Compression can make static and behavioral analysis difficult [[1]](#1). Methods related to anti-analysis are below.
See ATT&CK: [**Software Packing**](https://attack.mitre.org/techniques/T1045/).
Methods
-------
* **Nested Packing**: the malware is packed by one packer, the result is packed, etc.
* **Standard Compression**: Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.
* **Standard Compression of Code**: Uses a standard algorithm to compress the opcode mnemonics.
* **Standard Compression of Data**: Uses a standard algorithm to compress strings and variables (executable file data).
* **Custom Compression**: Uses a custom algorithm to compress an executable file.
* **Custom Compression of Code**: Uses a custom algorithm to compress opcode mnemonics.
* **Custom Compression of Data**: Uses a custom algorithm to compress strings and variables (executable file data).
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|-----------|-----------------------------|
References
----------
<a name="1">[1]</a> Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf
<a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.
anti-static-analysis/exe-code-obfuscate.md
+55
View File
@@ -0,0 +1,55 @@
|||
|---------|------------------------|
|**ID**|**M0032**|
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
|**Related ATT&CK Technique(s)**|None|
Executable Code Obfuscation
===========================
Executable code uses obfuscation to hinder disassembly and static code analysis. Methods related to *anti-static analysis* are below. The Executable Code Obfuscation behavior is specific to a malware sample's executable code (data and text sections).
For obfuscation behaviors related to non-malware-sample files and information, see ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/), under the [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion) objective.
Methods
-------
* **API Hashing**: Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)
* **Code Insertion**: Insert code to impede disassembly.
* *Dead Code Insertion*: Include "dead" code with no real functionality.
* *Fake Code Insertion*: Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.
* *Jump Insertion*: Insert jumps to make analysis visually harder.
* *Thunk Code Insertion*: Variation on Jump Insertion. Used by some compilers for user-generated functions.
* *Junk Code Insertion*: Insert dummy code between relevant opcodes. Can make signature writing more complex.
* **Data Value Obfuscation**: Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*. [NEEDS REVIEW]
* **Encryption**:
* *Standard Encryption*: A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
* *Standard Encryption of Code*: A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.
* *Standard Encryption of Data*: A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.
* *Custom Encryption*: A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
* *Custom Encryption of Code*: A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.
* *Custom Encryption of Data*: A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.
* **Entry Point Obfuscation**: Obfuscate the entry point of the malware executable.
* **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution.
* **Import Address Table Obfuscation**: Obfuscate the import address table.
* **Import Compression**: Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.
* **Instruction Overlap**: Jump after the first byte of an instruction to confuse disassembler.
* **Interleaving Code**: Split code into sections that may be rearranged and are connected by unconditional jumps.
* **Merged Code Sections**: Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.
* **Structured Exception Handling (SEH)**: A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).
* **Stack Strings**: Build and decrypt strings on the stack at each use, then discard to avoid obvious references.
* **Symbol Obfuscation**: Remove or rename symbolic information commonly inserted by compilers for debugging purposes.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------------------------|--------|-----------------------------|
|[**Heriplor Trojan**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/heriplor.md) | March 2019 | The Heriplor Trojan uses API Hashing. [[1]](#1)|
|[**Geodo**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/geodo.md) |August 2018| Geodo macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
References
----------
<a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html
<a name="2">[2]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/
<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons
anti-static-analysis/exe-code-optimize.md
+24
View File
@@ -0,0 +1,24 @@
|||
|---------|------------------------|
|**ID**|**M0034**|
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
|**Related ATT&CK Technique(s)**|None|
Executable Code Optimization
============================
Code is optimized, making it harder to statically analyze.
Methods
-------
* **Jump/Call Absolute Address**: Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.
* **Minification**: Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
References
----------
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Minification_(programming)
anti-static-analysis/exe-code-virtualize.md
+28
View File
@@ -0,0 +1,28 @@
|||
|---------|------------------------|
|**ID**|**M0008**|
|**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
|**Related ATT&CK Technique(s)**|None|
Executable Code Virtualization
==============================
Original executable code is virtualized by translating the code into a special format that only a special virtual machine (VM) can run; the VM uses a customized virtual instruction set. A "stub" function calls the VM when the code is run. Virtualized code makes static analysis and reverse engineering more difficult; dumped code won’t run without the VM.
Virtualized code is a software protection technique. Themida is a commercial tool; WPProtect is an open source tool. [[1]](#1)
Methods
-------
* **Multiple VMs**: multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
| Locky Bart | January 2017 | Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)
References
----------
<a name="1">[1]</a> https://github.com/xiaoweime/WProtect
<a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/
collection/README.md
+24
View File
@@ -0,0 +1,24 @@
|||
|--|-----|
|**ID**|**M9003**|
# Collection #
Behaviors that identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.
* **Access Call Log** [T1433](https://github.com/MAECProject/malware-behaviors/blob/master/collection/access-call-log.md)
* **Access Sensitive Data or Credentials in Files** [T1409](https://github.com/MAECProject/malware-behaviors/blob/master/collection/access-sensitive-data.md)
* **Audio Capture** [T1123](https://github.com/MAECProject/malware-behaviors/blob/master/collection/audio-capture.md)
* **Automated Collection** [T1119](https://github.com/MAECProject/malware-behaviors/blob/master/collection/auto-collect.md)
* **Capture SMS Message** [T1412](https://github.com/MAECProject/malware-behaviors/blob/master/collection/capture-sms.md)
* **Clipboard Data** [T1115](https://github.com/MAECProject/malware-behaviors/blob/master/collection/clipboard-data.md)
* **Data from Local System** [T1005](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-local-system.md)
* **Data from Network Shared Drive** [T1039](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-network-share.md)
* **Data from Removable Media** [T1025](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-removable-media.md)
* **Data Staged** [T1074](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-staged.md)
* **Email Collection** [T1114](https://github.com/MAECProject/malware-behaviors/blob/master/collection/email-collect.md)
* **Input Capture** [T1056](https://github.com/MAECProject/malware-behaviors/blob/master/collection/input-capture.md)
* **Location Tracking** [T1430](https://github.com/MAECProject/malware-behaviors/blob/master/collection/location-track.md)
* **Man in the Browser** [T1185](https://github.com/MAECProject/malware-behaviors/blob/master/collection/man-in-browser.md)
* **Microphone or Camera Recordings** [T1429](https://github.com/MAECProject/malware-behaviors/blob/master/collection/micro-cam-capture.md)
* **Screen Capture** [T1113](https://github.com/MAECProject/malware-behaviors/blob/master/collection/screen-capture.md)
* **Video Capture** [T1125](https://github.com/MAECProject/malware-behaviors/blob/master/collection/video-capture.md)
collection/access-call-log.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1433**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Access Call Log](https://attack.mitre.org/techniques/T1433/)|
Access Call Log
===============
Malware gathers call log data.
**See ATT&CK:** [**Access Call Log**](https://attack.mitre.org/techniques/T1433/).
collection/access-sensitive-data.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1409**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Access Sensitive Data or Credentials in Files](https://attack.mitre.org/techniques/T1409/)|
Access Sensitive Data or Credentials in Files
=============================================
Malware accesses files that contain sensitive data or credentials (e.g., passwords).
**See ATT&CK:** [**Access Sensitive Data or Credentials in Files**](https://attack.mitre.org/techniques/T1409/).
collection/audio-capture.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1123**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Audio Capture](https://attack.mitre.org/techniques/T1123/)|
Audio Capture
=============
Malware leverages system's peripheral devices to capture audio.
**See ATT&CK:** [**Audio Capture**](https://attack.mitre.org/techniques/T1123/).
collection/auto-collect.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1119**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Automated Collection](https://attack.mitre.org/techniques/T1119/)|
Automated Collection
====================
Malware uses automated techniques for collecting system data.
**See ATT&CK:** [**Automated Collection**](https://attack.mitre.org/techniques/T1119/).
collection/capture-sms.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1412**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Capture SMS Messages](https://attack.mitre.org/techniques/T1412/)|
Capture SMS Messages
====================
Malware captures data sent via SMS (e.g., authentication credentials).
**See ATT&CK:** [**Capture SMS Messages**](https://attack.mitre.org/techniques/T1412/).
collection/clipboard-data.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1115**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Clipboard Data](https://attack.mitre.org/techniques/T1115/)|
Clipboard Data
==============
Malware collects data stored in the Windows clipboard.
**See ATT&CK:** [**Clipboard Data**](https://attack.mitre.org/techniques/T1115/).
collection/data-local-system.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1005**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Data from Local System](https://attack.mitre.org/techniques/T1005/)|
Data from Local System
======================
Malware collects sensitive data from local system sources.
**See ATT&CK:** [**Data from Local System**](https://attack.mitre.org/techniques/T1005/).
collection/data-network-share.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1039**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Data from Network Shared Drive](https://attack.mitre.org/techniques/T1039/)|
Data from Network Shared Drive
==============================
Malware collects from remote systems via shared network drives that are accessible from the compromised system.
**See ATT&CK:** [**Data from Network Shared Drive**](https://attack.mitre.org/techniques/T1039/).
collection/data-removable-media.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1025**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Data from Removable Media](https://attack.mitre.org/techniques/T1025/)|
Data from Removable Media
=========================
Malware collects from removable media connected to the compromised system.
**See ATT&CK:** [**Data from Removable Media**](https://attack.mitre.org/techniques/T1025/).
collection/data-staged.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1074**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Data Staged](https://attack.mitre.org/techniques/T1074/)|
Data Staged
===========
Malware stages collected data prior to [Exfiltration](https://github.com/MAECProject/malware-behaviors/tree/master/exfiltration).
**See ATT&CK:** [**Data Staged**](https://attack.mitre.org/techniques/T1074/).
collection/email-collect.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1114**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Email Collection](https://attack.mitre.org/techniques/T1114/)|
Email Collection
================
Malware targets user email for collection.
**See ATT&CK:** [**Email Collection**](https://attack.mitre.org/techniques/T1114/).
collection/input-capture.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1056**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Input Capture](https://attack.mitre.org/techniques/T1056/)|
Input Capture
=============
Malware captures user input.
**See ATT&CK:** [**Input Capture**](https://attack.mitre.org/techniques/T1056/).
collection/location-track.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1430**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Location Tracking](https://attack.mitre.org/techniques/T1430/)|
Location Tracking
=================
Malware tracks a system's physical location.
**See ATT&CK:** [**Location Tracking**](https://attack.mitre.org/techniques/T1430/).
collection/man-in-browser.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1185**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Man in the Browser](https://attack.mitre.org/techniques/T1185/)|
Man in the Browser
==================
Malware leverages vulnerabilities and functionality in browser softwarwe to change content, modify behavior, and intercept information.
**See ATT&CK:** [**Man in the Browser**](https://attack.mitre.org/techniques/T1185/).
collection/micro-cam-capture.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1429**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Microphone or Camera Recordings](https://attack.mitre.org/techniques/T1429/)|
Microphone or Camera Recordings
===============================
Malware records activities using the device microphone and/or camera.
**See ATT&CK:** [**Microphone or Camera Recordings**](https://attack.mitre.org/techniques/T1429/).
collection/screen-capture.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1113**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|
Screen Capture
==============
Malware takes screen captures.
**See ATT&CK:** [**Screen Capture**](https://attack.mitre.org/techniques/T1113/).
collection/video-capture.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1125**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
|**Related ATT&CK Technique(s)**|[Video Capture](https://attack.mitre.org/techniques/T1125/)|
Video Capture
=============
Malware captures video recordings.
**See ATT&CK:** [**Video Capture**](https://attack.mitre.org/techniques/T1125/).
command-and-control/README.md
+24
View File
@@ -0,0 +1,24 @@
|||
|--|-----|
|**ID**|**M9004**|
# Command and Control
Behaviors to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology.
* **Command and Control Communication** [M0030](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/command-control-comm.md)
* **Commonly Used Port** [T1043](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/common-port.md)
* **Connection Proxy** [T1090](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/connect-proxy.md)
* **Custom Command and Control Protocol** [T1094](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/custom-c2-protocol.md)
* **Custom Cryptographic Protocol** [T1024](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/custom-crypto-protocol.md)
* **Data Encoding** [T1132](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/data-encode.md)
* **Data Obfuscation** [T1001](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/data-obfuscate.md)
* **Domain Name Generation** [M0031:T1483](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/domain-name-generate.md)
* **Fallback Channels** [T1008](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/fallback-channels.md)
* **Multi-Stage Channels** [T1104](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/multi-stage-channels.md)
* **Port Knocking** [T1205](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/port-knocking.md)
* **Remote File Copy** [T1105](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/remote-file-copy.md)
* **Standard Application Layer Protocol** [T1071](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/std-app-protocol.md)
* **Standard Cryptographic Protocol** [T1032](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/std-crypto-protocol.md)
* **Standard Non-Application Layer Protocol** [T1095](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/std-non-app-protocol.md)
* **Uncommonly Used Port** [T1065](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/uncommon-port.md)
* **Web Service** [T1102](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/web-service.md)
command-and-control/command-control-comm.md
+20
View File
@@ -0,0 +1,20 @@
|||
|---------|------------------------|
|**ID**|**M0030**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|None|
C2 Communication
================
All command and control malware uses client/server communication. The methods listed below can be used to capture explicit communication details.
Command and Control Communication relates to *autonomous* client/server communications, not commands that are provided to an adversary. Commands provided to an attacker should be captured under [Remote Commands](https://github.com/MAECProject/malware-behaviors/blob/master/execution/remote-commands.md) under the Execution objective.
Methods
-------
* **Check for Payload**
* **Send System Information**
* **Send Heartbeat**
* **Request Command**
* **Request Email Template**
* **Request Email Address List**
command-and-control/common-port.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1043**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Commonly Used Port](https://attack.mitre.org/techniques/T1043/), [Commonly Used Port (Mobile)](https://attack.mitre.org/techniques/T1436/)|
Commonly Used Port
==================
Malware may use a common port to avoid detection of command and control activity.
**See ATT&CK:** [**Commonly Used Port**](https://attack.mitre.org/techniques/T1043/) and [**Commonly Used Port (Mobile)**](https://attack.mitre.org/techniques/T1436/).
command-and-control/connect-proxy.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1090**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Connection Proxy](https://attack.mitre.org/techniques/T1090/)|
Connection Proxy
================
Malware may use a connection proxy to manage command and control communications.
**See ATT&CK:** [**Connection Proxy**](https://attack.mitre.org/techniques/T1090/).
command-and-control/custom-c2-protocol.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1094**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Custom Command and Control Protocol](https://attack.mitre.org/techniques/T1094/)|
Custom Command and Control Protocol
===================================
Malware may use a custom command and control protocol instead of encapsulating commands and data in a [Standard Application Layer Protocol](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control/std-protocol.md).
**See ATT&CK:** [**Custom Command and Control Protocol**](https://attack.mitre.org/techniques/T1094/).
command-and-control/custom-crypto-protocol.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1024**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Custom Cryptographic Protocol](https://attack.mitre.org/techniques/T1024/)|
Custom Cryptographic Protocol
=============================
Malware may use a custom cryptographic protocol to hide command and control communications.
**See ATT&CK:** [**Custom Cryptographic Protocol**](https://attack.mitre.org/techniques/T1024/).
command-and-control/data-encode.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1132**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Data Encoding](https://attack.mitre.org/techniques/T1132/)|
Data Encoding
=============
Malware encodes its command and control information using a standard system such as Unicode, Base64, etc.
**See ATT&CK:** [**Data Encoding**](https://attack.mitre.org/techniques/T1132/).
command-and-control/data-obfuscate.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1001**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Data Obfuscation](https://attack.mitre.org/techniques/T1001/)|
Data Obfuscation
================
Malware hides its command and control information.
**See ATT&CK:** [**Data Obfuscation**](https://attack.mitre.org/techniques/T1001/).
command-and-control/domain-name-generate.md
+26
View File
@@ -0,0 +1,26 @@
|||
|---------|------------------------|
|**ID**|**M0031:T1483**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/)|
Domain Name Generation
======================
Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
The newly defined ATT&CK Technique ([Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/)) is oriented toward an adversary perspective, but the examples include malware.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
|[**Kraken**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/kraken.md) | April 2008 | Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
|[**Conficker**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/conficker.md)| November 2008| Conficker uses a domain name generator. [[3]](#3)
References
----------
<a name="1">[1]</a> https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/
<a name="2">[2]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
<a name="3">[3]</a> https://en.wikipedia.org/wiki/Conficker
command-and-control/fallback-channels.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1008**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Fallback Channels](https://attack.mitre.org/techniques/T1008/)|
Fallback Channels
=================
Malware may contain a secondary command and control server or may communicate over a backup channel.
**See ATT&CK:** [**Fallback Channels**](https://attack.mitre.org/techniques/T1008/).
command-and-control/multi-stage-channels.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1104**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Multi-Stage Channels](https://attack.mitre.org/techniques/T1104/)|
Multi-Stage Channels
====================
Malware may create multiple stages for command and control, making detection more difficult.
**See ATT&CK:** [**Multi-Stage Channels**](https://attack.mitre.org/techniques/T1104/).
command-and-control/port-knocking.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1205**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control), [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[Port Knocking](https://attack.mitre.org/techniques/T1205/)|
Port Knocking
=============
Malware may hide open ports.
**See ATT&CK:** [**Port Knocking**](https://attack.mitre.org/techniques/T1205/).
command-and-control/remote-file-copy.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1105**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control), [Lateral Movement](https://github.com/MAECProject/malware-behaviors/tree/master/lateral-movement)|
|**Related ATT&CK Technique(s)**|[Remote File Copy](https://attack.mitre.org/techniques/T1105/)|
Remote File Copy
================
Malware may copy files from one system to another.
**See ATT&CK:** [**Remote File Copy**](https://attack.mitre.org/techniques/T1105/).
command-and-control/std-app-protocol.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1071**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Standard Application Layer Protocol](https://attack.mitre.org/techniques/T1071/)|
Standard Application Layer Protocol
===================================
Malware may use a standard application layer protocol (e.g., HTTP) to blend with usual traffic.
**See ATT&CK:** [**Standard Application Layer Protocol**](https://attack.mitre.org/techniques/T1071/).
command-and-control/std-crypto-protocol.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1032**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Standard Cryptographic Protocol](https://attack.mitre.org/techniques/T1032/)|
Standard Cryptographic Protocol
===============================
Malware may use a standard cryptographic protocol to conceal command and control traffic or other data.
**See ATT&CK:** [**Standard Cryptographic Protocol**](https://attack.mitre.org/techniques/T1032/).
command-and-control/std-non-app-protocol.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1095**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Standard Non-Application Layer Protocol](https://attack.mitre.org/techniques/T1095/)|
Standard Non-Application Layer Protocol
=======================================
Malware may use a standard non-application layer protocol (e.g., ICMP) because such protocols may be less commonly monitored, enabling communication to be hidden.
**See ATT&CK:** [**Standard Non-Application Layer Protocol**](https://attack.mitre.org/techniques/T1095/).
command-and-control/uncommon-port.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1065**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Uncommonly Used Port](https://attack.mitre.org/techniques/T1065/)|
Uncommonly Used Port
====================
Malware may use an uncommon port to bypass poorly configured boundary controllers.
**See ATT&CK:** [**Uncommonly Used Port**](https://attack.mitre.org/techniques/T1065/).
command-and-control/web-service.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1102**|
|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
|**Related ATT&CK Technique(s)**|[Web Service](https://attack.mitre.org/techniques/T1102/)|
Web Service
===========
Malware may use existing external Web services for relaying C2 commands.
**See ATT&CK:** [**Web Service**](https://attack.mitre.org/techniques/T1102/).
credential-access/LLMNR-poison.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1171**|
|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[LLMNR/NBT-NS Poisoning](https://attack.mitre.org/techniques/T1171/)|
LLMNR/NBT-NS Poisoning
======================
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. Malware may spoof an authoritative source, poisoning the service.
**See ATT&CK:** [**LLMNR/NBT-NS Poisoning**](https://attack.mitre.org/techniques/T1171/).
credential-access/README.md
+18
View File
@@ -0,0 +1,18 @@
|||
|--|-----|
|**ID**|**M9005**|
# Credential Access
Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.
* **Access Sensitive Data or Credentials in Files** [T1409](https://github.com/MAECProject/malware-behaviors/blob/master/collection/access-sensitive-data.md)
* **Account Manipulation** [T1098](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/acct-manipulate.md)
* **Capture SMS Messages** [T1412](https://github.com/MAECProject/malware-behaviors/blob/master/collection/capture-sms.md)
* **Credential Dumping** [T1003](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/credential-dump.md)
* **Credentials in Files** [T1081](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/credentials-in-files.md)
* **Hooking** [E1179](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/hooking.md)
* **Input Capture** [T1056](https://github.com/MAECProject/malware-behaviors/blob/master/collection/input-capture.md)
* **LLMNR/NBT-NS Poisoning** [T1171](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/LLMNR-poison.md)
* **Network Sniffing** [T1040](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/network-sniff.md)
* **Private Keys** [T1145](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/private-keys.md)
* **Replication Through Removable Media** [T1091](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/replicate-remove-media.md)
credential-access/acct-manipulate.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1098**|
|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Account Manipulation](https://attack.mitre.org/techniques/T1098/)|
Account Manipulation
====================
Malware may manipulate accounts to maintain access to credentials or permission levels.
**See ATT&CK:** [**Account Manipulation**](https://attack.mitre.org/techniques/T1098/).
credential-access/credential-dump.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1003**|
|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Credential Dumping](https://attack.mitre.org/techniques/T1003/)|
Credential Dumping
==================
Malware may obtain account login and password information.
**See ATT&CK:** [**Credential Dumping**](https://attack.mitre.org/techniques/T1003/).
credential-access/credentials-in-files.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1081**|
|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Credentials in Files](https://attack.mitre.org/techniques/T1081/)|
Credentials in Files
====================
Malware may search local file system and remote file shares for files containing passwords.
**See ATT&CK:** [**Credentials in Files**](https://attack.mitre.org/techniques/T1081/).
credential-access/hooking.md
+34
View File
@@ -0,0 +1,34 @@
|||
|------------------|------------------------|
|**ID**|**E1179**|
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access), [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence), [Privilege Escalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation)|
|**Related ATT&CK Technique**|[Hooking](https://attack.mitre.org/techniques/T1179/)|
Hooking
=======
Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Obstruction](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/memory-dump-obstruct.md).
For discussion related to the Credential Access, Persistence, and Privilege Escalation objectives, see ATT&CK: [**Hooking**](https://attack.mitre.org/techniques/T1179/).
Note that in MBC, but not in ATT&CK, Hooking is also associated with the [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion) and [Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis) objectives.
Methods
-------
* **Patch MmGetPhysicalMemoryRanges**: Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)
* **Hook memory mapping APIs**: Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|-----------|-----------------------------|
|**Kronos** | June 2014 | Kronos hooks the API of processes to prevent detection. [[2]](#2)|
References
----------
<a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf
<a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
credential-access/private-keys.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1145**|
|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Private Keys](https://attack.mitre.org/techniques/T1145/)|
Private Keys
============
Malware may gather private keys from compromised systems.
**See ATT&CK:** [**Private Keys**](https://attack.mitre.org/techniques/T1145/).
credential-access/replicate-remove-media.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1091**|
|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
|**Related ATT&CK Technique(s)**|[Replicate Through Removeable Media](https://attack.mitre.org/techniques/T1091/)|
Replicate Through Removable Media
=================================
Malware may move onto systems by copying themselves or secondary files to removable media, taking advantage of autorun features.
**See ATT&CK:** [**Replicate Through Removeable Media**](https://attack.mitre.org/techniques/T1091/).
defense-evasion/README.md
+49
View File
@@ -0,0 +1,49 @@
|||
|--|-----|
|**ID**|**M9006**|
# Defense Evasion #
Behaviors that evade detection or avoid other defenses.
* **Access Token Manipulation** [T1134](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/access-token.md)
* **Alternative Installation Location** [M0027](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/alter-install-location.md)
* **Application Discovery** [T1418](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/app-discover.md)
* **Binary Padding** [T1009](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/binary-pad.md)
* **BITS Jobs** [T1197](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/bits-jobs.md)
* **Boot Sector Modification** [M0028](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/boot-sector-mod.md)
* **Bypass User Account Control** [T1088](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/bypass-user-acct-cntl.md)
* **Code Signing** [T1116](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/code-signing.md)
* **Component Object Model Hijacking** [T1122](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/component-hijack.md)
* **DCShadow** [T1207](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/dcshadow.md)
* **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/deobfuscate-files.md)
* **Disabling Security Tools** [E1089](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/disable-security-tools.md)
* **DLL Search Order Hijacking** [T1038](https://github.com/MAECProject/malware-behaviors/blob/master/privilege-escalation/dll-search-order-hijack.md)
* **Executable Code Compression** [E1045](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-compression.md)
* **Execution Guardrails** [E1480](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/execution-guardrails.md)
* **Exploitations for Defense Evasion** [T1211](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/exploit-for-defense.md)
* **File Deletion** [E1107](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/file-deletion.md)
* **File System Logical Offsets** [T1006](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/file-sys-logical-offset.md)
* **Hidden Files and Directories** [T1158](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/hidden-files.md)
* **HISTCONTROL** [T1148](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/histcontrol.md)
* **Hooking** [E1179](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/hooking.md)
* **Image File Execution Options Injection** [T1183](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/image-file-exe-opt-inj.md)
* **Indicator Blocking** [E1054](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/indicator-blocking.md)
* **Indicator Removal on Host** [T1070](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/indicator-remove-host.md)
* **Indirect Command Execution** [T1202](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/indirect-command.md)
* **Install Root Certificate** [T1130](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/install-root-cert.md)
* **Masquerading** [T1036](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/masquerading.md)
* **Modify Registry** [T1112](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/modify-reg.md)
* **Modify Trusted Execution Environment** [T1399](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/mod-trust-exe-environ.md)
* **Obfuscated Files or Information** [E1027](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/obfuscate-files.md)
* **Polymorphic Code** [M0029](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/polymorphic-code.md)
* **Port Knocking** [T1205](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/port-knocking.md)
* **Process Injection** [T1055](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/process-inject.md)
* **Redundant Access** [T1008](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/redundant-access.md)
* **Regsvr32** [T1117](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/regsvr32.md)
* **Rundll32** [T1085](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/rundll32.md)
* **Rootkit Behavior** [E1014](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/rootkit-behavior.md)
* **Scripting** [T1064](https://github.com/MAECProject/malware-behaviors/blob/master/execution/scripting.md)
* **Software Packing** [E1045](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-compression.md)
* **Timestomp** [T1099](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/timestomp.md)
* **Virtualization/Sandbox Evasion** [T1497](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/virtualization-sandbox-evade.md)
* **Web Service** [T1102](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/web-service.md)
defense-evasion/access-token.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1134**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Access Token Manipulation](https://attack.mitre.org/techniques/T1134)|
Access Token Manipulation
=========================
Malware manipulates access tokens to make a running process appear as thought it belongs to someone other than the user who started the process.
See ATT&CK: [**Access Token Manipulation**](https://attack.mitre.org/techniques/T1134).
defense-evasion/alter-install-location.md
+25
View File
@@ -0,0 +1,25 @@
|||
|---------|------------------------|
|**ID**|**M0027**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|None|
Alternative Installation Location
=================================
Malware may install itself not as a file on the hard drive. [[1]](#1)
Methods
-------
* **Fileless Malware**: Stores itself in memory.
* **Registry Install**: Stores itself in the Windows registry.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
|Kovter|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
References
----------
<a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
defense-evasion/binary-pad.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1009**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Binary Padding](https://attack.mitre.org/techniques/T1009)|
Binary Padding
==============
Malware is padded to increase its size beyond what security tools can handle or to change its hash.
See ATT&CK: [**Binary Padding**](https://attack.mitre.org/techniques/T1009).
defense-evasion/bits-jobs.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1197**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[BITS Jobs](https://attack.mitre.org/techniques/T1197)|
BITS Jobs
=========
Malware may abuse Windows Background Intelligent Transfer Service (BITS) to download and/or execute malicious code.
See ATT&CK: [**BITS Jobs**](https://attack.mitre.org/techniques/T1197).
defense-evasion/boot-sector-mod.md
+22
View File
@@ -0,0 +1,22 @@
|||
|---------|------------------------|
|**ID**|**M0028**|
|**Objective(s)**|[Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[Bootkit](https://attack.mitre.org/techniques/T1067/)|
Boot Sector Modification
========================
The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: [**Bootkit**](https://attack.mitre.org/techniques/T1067/).
The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|-----------|-----------------------------|
|Mebromi|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
References
----------
<a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
defense-evasion/bypass-user-acct-cntl.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1088**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation)|
|**Related ATT&CK Technique(s)**|[Bypass User Account Control](https://attack.mitre.org/techniques/T1088)|
Bypass User Account Control
===========================
Malware bypasses Windows User Account Control.
See ATT&CK: [**Bypass User Account Control**](https://attack.mitre.org/techniques/T1088).
defense-evasion/code-signing.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1116**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Code Signing](https://attack.mitre.org/techniques/T1116)|
Code Signing
============
Malware code is digitally signed to appear as legitimate sofware.
See ATT&CK: [**Code Signing**](https://attack.mitre.org/techniques/T1116).
defense-evasion/component-hijack.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1122**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[Componpent Object Model Hijacking](https://attack.mitre.org/techniques/T1122)|
Componpent Object Model Hijacking
=================================
Malware hijacks a component object model (COM) object to execute itself or other malicious code.
See ATT&CK: [**Componpent Object Model Hijacking**](https://attack.mitre.org/techniques/T1122).
defense-evasion/dcshadow.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1207**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[DCShadow](https://attack.mitre.org/techniques/T1207)|
DCShadow
========
Malware may use DCShadow, a method of manipulating Active Directory (AD) data, to register a rogue domain controller, which may be able to inject and replicate changes into the AD infrastructure for any domain object (e.g., credentials and keys).
See ATT&CK: [**DCShadow**](https://attack.mitre.org/techniques/T1207).
defense-evasion/deobfuscate-files.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1140**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)|
Deobfuscate/Decode Files or Information
=======================================
This behavior is the counterpart to [Obfuscated Files or Information](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/obfuscate-files.md), which is used to hide artifacts of an intrusion.
See ATT&CK: [**Deobfuscate/Decode Files or Information**](https://attack.mitre.org/techniques/T1140).
defense-evasion/disable-security-tools.md
+29
View File
@@ -0,0 +1,29 @@
|||
|---------|------------------------|
|**ID**|**E1089**|
|**Objective(s)**|[Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Disabling Security Tools](https://attack.mitre.org/techniques/T1089/)|
Disabling Security Tools
========================
Malware may disable security tools to avoid detection. Malware-related methods extending ATT&CK's definition are below.
See ATT&CK: [**Disabling Security Tools**](https://attack.mitre.org/techniques/T1089/).
Methods
-------
* **Disable Kernel Patch Protection**: Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).
* **Disable System File Overwrite Protection**: Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.
* **Unhook APIs**: Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|-----------|-----------------------------|
|[**WebCobra**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
References
----------
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
defense-evasion/exploit-for-defense.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1211**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211)|
Exploitation for Defense Evasion
================================
Malware may exploit a software vulnerability in defensive security software to avoid detection.
See ATT&CK: [**Exploitation for Defense Evasion**](https://attack.mitre.org/techniques/T1211).
defense-evasion/file-deletion.md
+17
View File
@@ -0,0 +1,17 @@
|||
|---------|------------------------|
|**ID**|**E1107**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[File Deletion](https://attack.mitre.org/techniques/T1107)|
File Deletion
=============
Malware may remove dropped files or tools to avoid detection.
See ATT&CK: [**File Deletion**](https://attack.mitre.org/techniques/T1107).
Methods
-------
* **Uninstall Self**: Uninstalls self after execution is finished or when system conditions dictate.
defense-evasion/file-sys-logical-offset.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1006]**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[File System Logical Offsets](https://attack.mitre.org/techniques/T1006)|
File System Logical Offsets
===========================
Malware may bypass Windows file access controls by analyzing file system data structures.
See ATT&CK: [**File System Logical Offsets**](https://attack.mitre.org/techniques/T1006).
defense-evasion/hidden-files.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1158**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[Hidden Files and Directories](https://attack.mitre.org/techniques/T1158)|
Hidden Files and Directories
============================
Malware may hide files and folders to avoid detection and/or to persist on the system.
See ATT&CK: [**Hidden Files and Directories**](https://attack.mitre.org/techniques/T1158).
defense-evasion/histcontrol.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1148**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[HISTCONTROL](https://attack.mitre.org/techniques/T1148)|
HISTCONTROL
===========
Malware may configure this environment variable to hide its activity.
See ATT&CK: [**HISTCONTROL**](https://attack.mitre.org/techniques/T1148).
defense-evasion/image-file-exe-opt-inj.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1183**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[Image File Execution Options Injection](https://attack.mitre.org/techniques/T1183)|
Image File Execution Options Injection
======================================
Malware may use Image File Execution Options to launch a process.
See ATT&CK: [**Image File Execution Options Injection**](https://attack.mitre.org/techniques/T1183).
defense-evasion/indicator-blocking.md
+23
View File
@@ -0,0 +1,23 @@
|||
|---------|------------------------|
|**ID**|**E1054**|
|**Objective(s)**|[Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Indicator Blocking](https://attack.mitre.org/techniques/T1054/)|
Indicator Blocking
==================
Malware blocks indicators or events that would indicate malicious activity. Methods relevant to the malware domain are below.
See ATT&CK: [**Indicator Blocking**](https://attack.mitre.org/techniques/T1054/).
Methods
-------
* **Remove SMS Warning Messages**: Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|-----------|-----------------------------|
References
----------
defense-evasion/indicator-remove-host.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1070**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Indicator Removal on Host](https://attack.mitre.org/techniques/T1070)|
Indicator Removal on Host
=========================
Malware may delete artifacts on the infected system.
See ATT&CK: [**Indicator Removal on Host**](https://attack.mitre.org/techniques/T1070).
defense-evasion/indirect-command.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1202**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Indirect Command Execution](https://attack.mitre.org/techniques/T1202)|
Indirect Command Execution
==========================
Malware may may use Windows utilities to execute commands.
See ATT&CK: [**Indirect Command Execution**](https://attack.mitre.org/techniques/T1202).
defense-evasion/install-root-cert.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1130**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Install Root Certificate](https://attack.mitre.org/techniques/T1130)|
Install Root Certificate
========================
Malware may install a root certificate to avoid warning prompts during certificate-enabled connections.
See ATT&CK: [**Install Root Certificate**](https://attack.mitre.org/techniques/T1130).
defense-evasion/masquerading.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1036**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Masquerading](https://attack.mitre.org/techniques/T1036)|
Masquerading
============
Malware may change the name or location of files to avoid detection.
See ATT&CK: [**Masquerading**](https://attack.mitre.org/techniques/T1036).
defense-evasion/mod-trust-exe-environ.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1399**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[Modify Trusted Execution Environment](https://attack.mitre.org/techniques/T1399)|
Modify Trusted Execution Environment
====================================
Malware may run code in the Android Trusted Execution Environment.
See ATT&CK: [**Modify Trusted Execution Environment**](https://attack.mitre.org/techniques/T1399).
defense-evasion/modify-reg.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1112**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|
Modify Registry
===============
Malware may make changes to the Windows Registry to hide execution.
See ATT&CK: [**Modify Registry**](https://attack.mitre.org/techniques/T1112).
defense-evasion/obfuscate-files.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**E1027**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)|
Obfuscated Files or Information
===============================
Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. A related MBC behavior, associated explicitly with executable code and its analysis, is [Executable Code Obfuscation](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis/exe-code-obfuscate.md).
See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
defense-evasion/polymorphic-code.md
+25
View File
@@ -0,0 +1,25 @@
|||
|---------|------------------------|
|**ID**|**M0029**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|None|
Polymorphic Code
================
Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic Code behavior is typically identified through analysis of related samples.
Methods
-------
* **Packer Stub**: A packer stub can generate polymorphic code.
* **Call Indirections**: [[1]](#1)
* **Code Reordering**: [[1]](#1)
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
References
----------
<a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
defense-evasion/process-inject.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1055**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Privilege Excalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation)|
|**Related ATT&CK Technique(s)**|[Process Injection](https://attack.mitre.org/techniques/T1055)|
Process Injection
=================
Malware may execute code in the address space of a separate process.
See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055).
defense-evasion/redundant-access.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1108**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
|**Related ATT&CK Technique(s)**|[Redundant Access](https://attack.mitre.org/techniques/T1108)|
Redundant Access
================
Malware may use more than one type of access for persistence and to avoid detection.
See ATT&CK: [**Redundant Access**](https://attack.mitre.org/techniques/T1108).
defense-evasion/regsvr32.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1117**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Execution](https://github.com/MAECProject/malware-behaviors/tree/master/execution)|
|**Related ATT&CK Technique(s)**|[Regsvr32](https://attack.mitre.org/techniques/T1117)|
Regsvr32
========
Malware may use the Regsvr32.exe command-line program to execute binary code.
See ATT&CK: [**Regsvr32**](https://attack.mitre.org/techniques/T1117).
defense-evasion/rootkit-behavior.md
+30
View File
@@ -0,0 +1,30 @@
|||
|---------|------------------------|
|**ID**|**E1014**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Rootkit](https://attack.mitre.org/techniques/T1014)|
Rootkit Behavior
================
Behaviors of a rootkit: "A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that is not otherwise allowed and often masks its existence or the existence of other software." [[1]](#1)
See ATT&CK: [**Rootkit**](https://attack.mitre.org/techniques/T1014).
Methods
-------
* **Hide Kernel Modules**: Hides the usage of any kernel modules by the malware instance.
* **Hide Services**: Hides any system services that the malware instance creates or injects itself into.
* **Hide Threads**: Hides one or more threads that belong to the malware instance.
* **Hide Userspace Libraries**: Hides the usage of userspace libraries by the malware instance.
* **Prevent API Unhooking**: Prevents the API hooks installed by the malware instance from being removed.
* **Prevent Registry Access**: Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.
* **Prevent Registry Deletion**: Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.
* **Prevent File Access**: Prevents access to the file system, including to specific files and/or directories associated with the malware instance.
* **Prevent File Deletion**: Prevents files and/or directories associated with the malware instance from being deleted from a system.
* **Prevent Memory Access**: Prevents access to system memory where the malware instance may be storing code or data.
* **Prevent Native API Hooking**: Prevents other software from hooking native system APIs.
References
----------
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Rootkit
defense-evasion/rundll32.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1085**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Execution](https://github.com/MAECProject/malware-behaviors/tree/master/execution)|
|**Related ATT&CK Technique(s)**|[Rundll32](https://attack.mitre.org/techniques/T1085)|
Rundll32
========
Malware may use the Rundll32.exe program to execute binary code.
See ATT&CK: [**Rundll32**](https://attack.mitre.org/techniques/T1085).
defense-evasion/timestomp.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1099**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Timestomp](https://attack.mitre.org/techniques/T1099)|
TimeStomp
=============
Malware may modify the timestamps of a file to mimic files in the same folder and avoid detection.
See ATT&CK: [**Timestomp**](https://attack.mitre.org/techniques/T1099).
defense-evasion/virtualization-sandbox-evade.md
+14
View File
@@ -0,0 +1,14 @@
|||
|---------|------------------------|
|**ID**|**T1497**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
|**Related ATT&CK Technique(s)**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)|
Virtualization/Sandbox Evasion
==============================
Malware may check for the presence or a virtual machine or sandbox to avoid detection.
See ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497). Note that the ATT&CK technique primarily refers to checks made by an adversary.
The ATT&CK Virtualization/Sandbox Evasion technique relates explicitly to Defense Evasion, whereas two related MBC behaviors pertain to malware anti-analysis objectives: for details see [Sandbox Detection](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-sandbox.md) and [Virtual Machine Detection](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-vm.md).
discovery/README.md
+28
View File
@@ -0,0 +1,28 @@
|||
|--|-----|
|**ID**|**M9007**|
# Discovery #
Behaviors that aim to gain knowledge about the system and internal network.
* **Account Discovery** [T1087](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/account-discover.md)
* **Analysis Tool Discovery** [M0013](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/analysis-tool-discover.md)
* **Application Discovery** [T1418](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/app-discover.md)
* **Application Window Discovery** [T1010](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/app-window-discover.md)
* **Device Type Discovery** [T1419](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/device-type-discover.md)
* **File and Directory Discovery** [T1083](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/file-and-directory-discover.md)
* **Local Network Configuration Discovery** [T1422](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/local-network-configuration-discover.md)
* **Network Sniffing** [T1040](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/network-sniff.md)
* **Network Service Scanning** [T1046](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/network-service-scan.md)
* **Peripheral Device Discovery** [T1120](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/peripheral-device-discover.md)
* **Process Discovery** [T1057](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/process-discover.md)
* **Query Registry** [T1012](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/query-registry.md)
* **Remote System Discovery** [T1018](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/remote-sys-discover.md)
* **Security Software Discovery** [T1063](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/security-sw-discover.md)
* **SMTP Connection Discovery** [M0014](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/smtp-connect-discover.md)
* **System Information Discovery** [T1082](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-info-discover.md)
* **System Network Configuration Discovery** [T1016](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-network-config-discover.md)
* **System Network Connections Discovery** [T1049](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-network-conn-discover.md)
* **System Owner/User Discovery** [T1033](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-owner-discover.md)
* **System Service Discovery** [T1007](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-service-discover.md)
* **System Time Discovery** [T1124](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-time-discover.md)
discovery/account-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1087**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Account Discovery](https://attack.mitre.org/techniques/T1087)|
Account Discovery
=================
Malware may try to get names of local system or domain accounts.
See ATT&CK: [**Account Discovery**](https://attack.mitre.org/techniques/T1087).
discovery/analysis-tool-discover.md
+29
View File
@@ -0,0 +1,29 @@
|||
|---------|------------------------|
|**ID**|**M0013**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|None|
Analysis Tool Discovery
=======================
Malware can employ various means to detect whether analysis tools are present or running on the system on which it is executing.
Methods
-------
* **Process detection**: Malware can scan for the process name associated with common analysis tools:
* Debuggers: OllyDBG / ImmunityDebugger / WinDbg / IDA Pro
* SysInternals Suite Tools (Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns)
* PCAP Utilities: Wireshark / Dumpcap
* Process Utilities: ProcessHacker / SysAnalyzer / HookExplorer / SysInspector
* PE Utilities: ImportREC / PETools / LordPE
* Sandboxes: Joe Sandbox, etc.
Malware Examples
----------------
|Name|Date|Description|
|-----------------------------|--------|-----------------------------|
References
----------
discovery/app-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1418**|
|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Application Discovery](https://attack.mitre.org/techniques/T1418)|
Application Discovery
=====================
Malware may try to identify all applications installed on the device.
See ATT&CK: [**Application Discovery**](https://attack.mitre.org/techniques/T1418).
discovery/app-window-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1010**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Application Window Discovery](https://attack.mitre.org/techniques/T1010)|
Application Window Discovery
============================
Malware may try to get a list of open application windows.
See ATT&CK: [**Application Window Discovery**](https://attack.mitre.org/techniques/T1010).
discovery/device-type-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1419**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Device Type Discovery](https://attack.mitre.org/techniques/T1419)|
Device Type Discovery
=====================
Android malware may get device type information through the android.os.Build class.
See ATT&CK: [**Device Type Discovery**](https://attack.mitre.org/techniques/T1419).
discovery/file-and-directory-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1083**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083)|
File and Directory Discovery
============================
Malware may enumerate files and/or directories.
See ATT&CK: [**File and Directory Discovery**](https://attack.mitre.org/techniques/T1083).
discovery/local-network-configuration-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1422**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Local Network Configuration Discovery](https://attack.mitre.org/techniques/T1422)|
Local Network Configuration Discovery
=====================================
Android malware may try to get details of on-board network interfaces through the java.net.NetworkInterface class.
See ATT&CK: [**Local Network Configuration Discovery**](https://attack.mitre.org/techniques/T1422).
discovery/network-service-scan.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1046**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Network Service Scanning](https://attack.mitre.org/techniques/T1046)|
Network Service Scanning
========================
Malware may try to a listing of services running on remotes hosts.
See ATT&CK: [**Network Service Scanning**](https://attack.mitre.org/techniques/T1046).
discovery/network-sniff.md
+11
View File
@@ -0,0 +1,11 @@
|||
|---------|------------------------|
|**ID**|**T1040**|
|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access), [Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Network Sniffing](https://attack.mitre.org/techniques/T1040/)|
Network Sniffing
================
Malware captures information sent over a wired or wireless connection.
**See ATT&CK:** [**Network Sniffing**](https://attack.mitre.org/techniques/T1040/).
discovery/peripheral-device-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1120**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Peripheral Device Discovery](https://attack.mitre.org/techniques/T1120)|
Peripheral Device Discovery
===========================
Malware may try to get information about peripheral devices.
See ATT&CK: [**Peripheral Device Discovery**](https://attack.mitre.org/techniques/T1120).
discovery/process-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1057**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Process Discovery](https://attack.mitre.org/techniques/T1057)|
Process Discovery
=================
Malware may try to get information about running processes.
See ATT&CK: [**Process Discovery**](https://attack.mitre.org/techniques/T1057).
discovery/query-registry.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1012**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Query Registry](https://attack.mitre.org/techniques/T1012)|
Query Registry
===============
Malware may gather information from the Windows registry.
See ATT&CK: [**Query Registry**](https://attack.mitre.org/techniques/T1012).
discovery/remote-sys-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1018**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Remote System Discovery](https://attack.mitre.org/techniques/T1018)|
Remote System Discovery
=======================
Malware may try to get a list of network-accessible systems (by IP address or hostname).
See ATT&CK: [**Remote System Discovery**](https://attack.mitre.org/techniques/T1018).
discovery/security-sw-discover.md
+12
View File
@@ -0,0 +1,12 @@
|||
|---------|------------------------|
|**ID**|**T1063**|
|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
|**Related ATT&CK Technique(s)**|[Security Software Discovery](https://attack.mitre.org/techniques/T1063)|
Security Software Discovery
===========================
Malware may try to a listing of security software or defensive tools installed on the system.
See ATT&CK: [**Security Software Discovery**](https://attack.mitre.org/techniques/T1063).

Some files were not shown because too many files have changed in this diff Show More