mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
remove redundancy of behaviors
This commit is contained in:
Desiree Beck
@@ -9,13 +9,13 @@ Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugge
|
||||
Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).
|
||||
|
||||
* **Capture Evasion** [B0036](../anti-behavioral-analysis/evade-capture.md)
|
||||
* **Conditional Execution** [B0025](../execution/conditional-execute.md)
|
||||
* **Debugger Detection** [B0001](../anti-behavioral-analysis/detect-debugger.md)
|
||||
* **Debugger Evasion** [B0002](../anti-behavioral-analysis/evade-debugger.md)
|
||||
* **Dynamic Analysis Evasion** [B0003](../anti-behavioral-analysis/evade-dynamic-analysis.md)
|
||||
* **Emulator Detection** [B0004](../anti-behavioral-analysis/detect-emulator.md)
|
||||
* **Emulator Evasion** [B0005](../anti-behavioral-analysis/evade-emulator.md)
|
||||
* **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
|
||||
* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
|
||||
* **Hooking** [F0003](../credential-access/hooking.md)
|
||||
* **Memory Dump Evasion** [B0006](../anti-behavioral-analysis/evade-memory-dump.md)
|
||||
* **Sandbox Detection** [B0007](../anti-behavioral-analysis/detect-sandbox.md)
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**E1480**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
|
||||
|
||||
|
||||
Execution Guardrails
|
||||
====================
|
||||
Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
|
||||
|
||||
**See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Deposited Keys**|E1480.m01|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
|
||||
|**Environmental Keys**|E1480.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
|
||||
|**GetVolumeInformation**|E1480.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|**Host Fingerprint Check**|E1480.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
|
||||
|**Runs as Service**|E1480.m07|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[1]](#1)|
|
||||
|**Secure Triggers**|E1480.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
|
||||
|**Token Check**|E1480.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a>
|
||||
https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
|
||||
|
||||
|
||||
@@ -10,9 +10,9 @@ Behaviors that evade detection or avoid other defenses.
|
||||
* **Bootkit** [F0013](../defense-evasion/boot-sector-mod.md)
|
||||
* **Bypass DEP** [B0037](../defense-evasion/bypass-dep.md)
|
||||
* **Component Firmware** [F0009](../persistence/component-firmware.md)
|
||||
* **Conditional Execution** [B0025](../execution/conditional-execute.md)
|
||||
* **Covert Location** [B0040](../defense-evasion/covert-location.md)
|
||||
* **Disable or Evade Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
|
||||
* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
|
||||
* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files.md)
|
||||
* **Hooking** [F0003](../credential-access/hooking.md)
|
||||
* **Indicator Blocking** [F0006](../defense-evasion/indicator-blocking.md)
|
||||
|
||||
@@ -1,19 +1,30 @@
|
||||
|||
|
||||
|---|---|
|
||||
|**ID**|**B0025**|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Objective(s)**|[Execution](../execution), [Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Conditional Execution
|
||||
=====================
|
||||
Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution happens autonomously, not because of an attacker's command.
|
||||
Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution in malware happens autonomously, not because of an attacker's command.
|
||||
|
||||
This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
|
||||
|
||||
Conditional execution may also be called "execution guardrails." **See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
|
||||
|**Deposited Keys**|B0025.m01|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
|
||||
|**Environmental Keys**|B0025.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
|
||||
|**GetVolumeInformation**|B0025.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|**Host Fingerprint Check**|B0025.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
|
||||
|**Runs as Service**|B0025.m07|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[2]](#2)|
|
||||
|**Secure Triggers**|B0025.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
|
||||
|**Token Check**|B0025.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
@@ -25,3 +36,5 @@ Malware Examples
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
|
||||
<a name="2">[2]</a>
|
||||
https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
|
||||
|
||||
Reference in New Issue
Block a user