diff --git a/README.md b/README.md index 29627bd..25a06a8 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,16 @@ # Malware Behavior Catalog v2.3 # The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions, and read the [newsletters](./ynewsletters/README.md) for information on the most recent MBC updates and activity. +Two open-source malware analysis tools map their output to MBC and ATT&CK: + +* [capa](https://github.com/fireeye/capa-rules) - see the [capa rule mapping distribution](./capa.md) +* [CAPE](https://github.com/kevoreilly/community/tree/master/modules/signatures) - see the [CAPE signature mapping distribution](./cape.md) + Check out the MBC presentations: * [Standardized Reporting with the Malware Behavior Catalog](https://youtu.be/qZef-SoREdY), VB2020 localhost (October 2020) * [Malware Behavior Catalog](https://youtu.be/KY8Ty-0sdVU), BSides DC (October 2019) -We've also mapped MBC (and ATT&CK) to two open-source malware analysis tools: - -* [Cuckoo community signatures](https://github.com/MBCProject/community) -* [capa rules](https://github.com/fireeye/capa-rules) - see the [mapping distribution](./capa.md) - To join the **MBC mailing list**, please send a request to mbc@mitre.org. ### Objectives ### diff --git a/capa.md b/capa.md index 12c4b46..1de9f5b 100644 --- a/capa.md +++ b/capa.md @@ -2,7 +2,7 @@ 15 August 2022 ## Histograms ## -Histograms showing the number of capa rules mapped into each ATT&CK tactic, MBC objective, and MBC micro-objective are shown below. Details of the tactics and objectives follow. +The histograms below show the number of capa rules mapped into each ATT&CK tactic, MBC objective, and MBC micro-objective. Details of the tactics and objectives follow. ### ATT&CK Mapping Histogram ### diff --git a/cape.md b/cape.md new file mode 100644 index 0000000..116c667 --- /dev/null +++ b/cape.md @@ -0,0 +1,107 @@ +# CAPE Signature Distribution # +XX December 2022 + +## Histograms ## +The histograms below show the number of CAPE signatures mapped into each ATT&CK tactic, MBC objective, and MBC micro-objective. Details of the tactics and objectives follow. + +The data below reflects [community repository signatures](https://github.com/kevoreilly/community/tree/master/modules/signatures) (not including deprecated signatures), as well as [CAPEv2 signatures](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py). + +Information on CAPE signatures can be found [here](https://github.com/kevoreilly/CAPEv2/blob/master/docs/book/src/customization/signatures.rst). + +### ATT&CK Mapping Histogram ### + +| **TACTIC** | **Number** | | +|-----|-----|-----| + + + +### MBC Mapping Histogram (Objectives) ### + +| **OBJECTIVE** | **Number** | | +|-----|-----|-----| + + +### MBC Mapping Histogram (Micro-Objectives) ### + +| **MICRO-OBJECTIVE** | **Number** | | +|-----|-----|-----| + + + +## ATT&CK MAPPINGS ## + +### Collection: ### + num: + + +### Command and Control: ### + num: + + +### Credential Access: ### + num: + + +### Defense Evasion: ### + num: + + +### Discovery: ### + num: + + +### Execution: ### + num: + + +### Exfiltration: ### + num: + + +### Impact: ### + num: + + +### Initial Access: ### + num: + + +### Lateral Movement: ### + num: + + +### Persistence: ### + num: + + +### Privilege Escalation: ### + num: + + +### Reconnaissance: ### + num: + + +### Resource Development: ### + num: + + +## MBC MAPPINGS ## + +### Anti-Behavioral Analysis: ### + num: + + +### Anti-Static Analysis: ### + num: + + +### Privilege Escalation: ### + num: + + +## MBC MICRO-BEHAVIOR MAPPINGS ## + +### Communication: ### + num: + diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md index a2c07df..1fd8d4f 100644 --- a/defense-evasion/modify-registry.md +++ b/defense-evasion/modify-registry.md @@ -9,7 +9,7 @@ Related ATT&CK Techniques -Modify RegistryT1112) +Modify Registry (T1112) Version diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index f45a1a3..762464f 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -39,7 +39,7 @@ See ATT&CK: [YiSpecter - Techniques Used](https://attack.mitre.org/software/S031 |[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements [[1]](#1)| |[Lateral Movement::Supply Chain Compromise::Exploit Private APIs (E1195.m02)](../lateral-movement/supply-chain-compromise.md)|Use of the private api allowed both Installation of malicious apps and uninstallation of legitimate apps without user notification [[1]](#1)| |[Lateral Movement::Supply Chain Compromise::Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution [[1]](#1)| -|[Impact::Generate Fraudulent Advertising Revenue::Advertisement Replacement Fraud (E1472.m02)](../persistence/component-firmware.md)|Displays brief advertisements whenever the user opens applications on their phone [[1]](#1)| +|[Impact::Generate Fraudulent Advertising Revenue::Advertisement Replacement Fraud (E1643.m02)](../impact/generate-traffic-from-victim.md)|Displays brief advertisements whenever the user opens applications on their phone [[1]](#1)| ## MBC Behaviors diff --git a/ynewsletters/12152022.md b/ynewsletters/12152022.md new file mode 100644 index 0000000..8283d99 --- /dev/null +++ b/ynewsletters/12152022.md @@ -0,0 +1,20 @@ +# Malware Behavior Catalog Newsletter # +**December 15, 2022** + +Hi everyone! + +Highlights of recent MBC development include: + + +* Added new properties to behavior pages - see [Sandbox Detection](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/sandbox-detection.md) for an example that includes detection and code snippet information +* Reviewed ATT&CK v12 (no updates to MBC required) +* Released [v22.12](https://github.com/MBCProject/mbc-stix2/tree/v22.12) of the STIX 2.1 representation (corrected v22.10) +* Reviewed [CAPE](https://github.com/kevoreilly/CAPEv2) signature mappings (CAPE maps its signatures to MBC!) +* Expanded MBC's [malware corpus](../xample-malware/README.md) +* Finalized MBC terminology - MBC will continue using the terms "behaviors" and "objectives," rather than changing to "techniques" and "tactics" + +Going forward, we'll continue expanding the malware corpus and will integrate capa analysis results to existing corpus entries. We'll also be populating the new behavior properties, focusing on detection content. MBC v3.0 will be released after detection information is complete. + +We activated [Discussions](https://github.com/MBCProject/mbc-markdown/discussions) on GitHub, so please any post questions or comments there. You can also email us at mbc@mitre.org to let us know what you think. + +**If you're interested in meeting with our team - please let us know. We'd love to get your feedback and understand your MBC use cases!** diff --git a/ynewsletters/README.md b/ynewsletters/README.md index 77803ee..0af1101 100644 --- a/ynewsletters/README.md +++ b/ynewsletters/README.md @@ -1,3 +1,5 @@ ## Malware Behavior Catalog Newsletters ## -September 2022 \ No newline at end of file +September 2022 + +December 2022 \ No newline at end of file