From 476ca33ec4207d8ca738514a38de9399c88957c8 Mon Sep 17 00:00:00 2001 From: Desiree Beck Date: Fri, 13 Dec 2019 17:40:00 -0500 Subject: [PATCH] add behavior --- defense-evasion/README.md | 1 + defense-evasion/config-mod.md | 12 ++++++++++++ persistence/README.md | 1 + 3 files changed, 14 insertions(+) create mode 100644 defense-evasion/config-mod.md diff --git a/defense-evasion/README.md b/defense-evasion/README.md index 0cac16a..edeb69d 100644 --- a/defense-evasion/README.md +++ b/defense-evasion/README.md @@ -14,6 +14,7 @@ Behaviors that evade detection or avoid other defenses. * **Bypass User Account Control** [T1088](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-user-acct-cntl.md) * **Code Signing** [T1116](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/code-signing.md) * **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md) +* **Configuration Modification** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md) * **DCShadow** [T1207](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/dcshadow.md) * **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md) * **Disabling Security Tools** [E1089](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md) diff --git a/defense-evasion/config-mod.md b/defense-evasion/config-mod.md new file mode 100644 index 0000000..e0ba34f --- /dev/null +++ b/defense-evasion/config-mod.md @@ -0,0 +1,12 @@ +||| +|---------|------------------------| +|**ID**|**E1478**| +|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)| +|**Related ATT&CK Technique(s)**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)| + + +Configuration Modification +========================== +Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective. + +See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478). \ No newline at end of file diff --git a/persistence/README.md b/persistence/README.md index fc7e477..2e40aae 100644 --- a/persistence/README.md +++ b/persistence/README.md @@ -14,6 +14,7 @@ Malware aims to remain on a system regardless of system events. * **Change Default File Association** [T1042](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/change-default-file-assoc.md) * **Component Firmware** [E1109](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md) * **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md) +* **Configuration Modification** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md) * **Create Account** [T1136](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/create-account.md) * **DLL Search Order Hijacking** [T1038](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/dll-search-order-hijack.md) * **File System Permissions Weakness** [T1044](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/file-system-perm-weakness.md)