diff --git a/README.md b/README.md index e2237f9..1458eba 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# Malware Behavior Catalog v2.3 # +# Malware Behavior Catalog v3.0 # The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions, and read the [newsletters](./ynewsletters/README.md) for information on the most recent MBC updates and activity. Open-source malware analysis tools map their output to MBC and ATT&CK: @@ -62,7 +62,7 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**. Objectives and behaviors can be used alone, but a method *must* be associated with a behavior. ### STIX 2.1 Representation ### -A refined STIX 2.1 [Malware Behavior Extension](https://docs.google.com/document/d/1azr8ewNXhWyLt1a2wE2cG964QuFSPdIBSqCJFJrwEVo/) includes new STIX domain objects for MBC objectives, behaviors, and methods. +A STIX 2.1 representation for MBC v3.0 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior) that includes new STIX domain objects for MBC objectives, behaviors, and methods. ### Navigator View ### This visual representation of the MBC Matrix is based on the ATT&CK Navigator. Two views are available: diff --git a/mbc_summary.md b/mbc_summary.md index f14ce53..aaf9172 100644 --- a/mbc_summary.md +++ b/mbc_summary.md @@ -1,194 +1,194 @@ ## Malware Objectives | Objective | Description | |-----------|-------------| -|**[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/README.md)**|Behaviors that prevent, obstruct, or evade behavioral analysis of malware--for example, analysis done using a sandbox or debugger. Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas.| -|**[Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/README.md)**|Behaviors and code characteristics that prevent or hinder static analysis of the malware. Simple static analysis identifies features such as embedded strings, header information, or file metadata. More involved static analysis involves the disassembly of the binary code.| -|**[Collection](https://github.com/MBCProject/mbc-markdown/blob/v2.3/collection/README.md)**|Behaviors that enable malware to identify and gather information, such as sensitive files, from a machine or network. Sources often targeted include drives, browsers, audio/video, and email. Often the malware's next objective is to exfiltrate the information gathered.| -|**[Command and Control](https://github.com/MBCProject/mbc-markdown/blob/v2.3/command-and-control/README.md)**|Behaviors that enable malware to communicate with systems such as C2 servers or bots. Malware can establish command and control with various levels of covertness, depending on system configuration and network topology.| -|**[Credential Access](https://github.com/MBCProject/mbc-markdown/blob/v2.3/credential-access/README.md)**|Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account with the associated system and network permissions.| -|**[Defense Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/README.md)**|Behaviors that enable malware to evade detection.| -|**[Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/README.md)**|Behaviors that enable malware to gain knowledge about the system and network.| -|**[Execution](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/README.md)**|Behaviors that enable malware to execute code on a system to achieve a variety of goals.| -|**[Exfiltration](https://github.com/MBCProject/mbc-markdown/blob/v2.3/exfiltration/README.md)**|Behaviors that enable malware to steal data from a system. This includes stored data, such as files, as well as data input into applications, such as web browsers.| -|**[Impact](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/README.md)**|Behaviors that enable malware to manipulate, interrupt, or destroy systems and data.| -|**[Lateral Movement](https://github.com/MBCProject/mbc-markdown/blob/v2.3/lateral-movement/README.md)**|Behaviors that enable malware to propagate or otherwise move through an environment. Lateral movement may be active, happening via direct machine access, or may be passive (for example, done via malicious email).| -|**[Persistence](https://github.com/MBCProject/mbc-markdown/blob/v2.3/persistence/README.md)**|Behaviors that enable malware to remain on a system regardless of system events, such as reboots.| -|**[Privilege Escalation](https://github.com/MBCProject/mbc-markdown/blob/v2.3/privilege-escalation/README.md)**|Behaviors that enable malware to obtain higher level permissions. These behaviors often overlap with Persistence behaviors.| +|**[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/README.md)**|Behaviors that prevent, obstruct, or evade behavioral analysis of malware--for example, analysis done using a sandbox or debugger. Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas.| +|**[Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/README.md)**|Behaviors and code characteristics that prevent or hinder static analysis of the malware. Simple static analysis identifies features such as embedded strings, header information, or file metadata. More involved static analysis involves the disassembly of the binary code.| +|**[Collection](https://github.com/MBCProject/mbc-markdown/blob/main/collection/README.md)**|Behaviors that enable malware to identify and gather information, such as sensitive files, from a machine or network. Sources often targeted include drives, browsers, audio/video, and email. Often the malware's next objective is to exfiltrate the information gathered.| +|**[Command and Control](https://github.com/MBCProject/mbc-markdown/blob/main/command-and-control/README.md)**|Behaviors that enable malware to communicate with systems such as C2 servers or bots. Malware can establish command and control with various levels of covertness, depending on system configuration and network topology.| +|**[Credential Access](https://github.com/MBCProject/mbc-markdown/blob/main/credential-access/README.md)**|Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account with the associated system and network permissions.| +|**[Defense Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/README.md)**|Behaviors that enable malware to evade detection.| +|**[Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/README.md)**|Behaviors that enable malware to gain knowledge about the system and network.| +|**[Execution](https://github.com/MBCProject/mbc-markdown/blob/main/execution/README.md)**|Behaviors that enable malware to execute code on a system to achieve a variety of goals.| +|**[Exfiltration](https://github.com/MBCProject/mbc-markdown/blob/main/exfiltration/README.md)**|Behaviors that enable malware to steal data from a system. This includes stored data, such as files, as well as data input into applications, such as web browsers.| +|**[Impact](https://github.com/MBCProject/mbc-markdown/blob/main/impact/README.md)**|Behaviors that enable malware to manipulate, interrupt, or destroy systems and data.| +|**[Lateral Movement](https://github.com/MBCProject/mbc-markdown/blob/main/lateral-movement/README.md)**|Behaviors that enable malware to propagate or otherwise move through an environment. Lateral movement may be active, happening via direct machine access, or may be passive (for example, done via malicious email).| +|**[Persistence](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/README.md)**|Behaviors that enable malware to remain on a system regardless of system events, such as reboots.| +|**[Privilege Escalation](https://github.com/MBCProject/mbc-markdown/blob/main/privilege-escalation/README.md)**|Behaviors that enable malware to obtain higher level permissions. These behaviors often overlap with Persistence behaviors.| ## Malware Behaviors | ID | Objective(s) | Behavior | Related ATT&CK Technique | |----|--------------|----------|--------------------------| -|B0001|ANTI-BEHAVIORAL ANALYSIS|**[Debugger Detection](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/debugger-detection.md)**|*none*| -|B0002|ANTI-BEHAVIORAL ANALYSIS|**[Debugger Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/debugger-evasion.md)**|Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T1622))| -|B0003|ANTI-BEHAVIORAL ANALYSIS|**[Dynamic Analysis Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/dynamic-analysis-evasion.md)**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))| -|B0004|ANTI-BEHAVIORAL ANALYSIS|**[Emulator Detection](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/emulator-detection.md)**|*none*| -|B0005|ANTI-BEHAVIORAL ANALYSIS|**[Emulator Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/emulator-evasion.md)**|*none*| -|B0006|ANTI-BEHAVIORAL ANALYSIS|**[Memory Dump Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/memory-dump-evasion.md)**|*none*| -|B0007|ANTI-BEHAVIORAL ANALYSIS|**[Sandbox Detection](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/sandbox-detection.md)**|Virtualization/Sandbox Evasion: System Checks ([T1497.001](https://attack.mitre.org/techniques/T1497/001),[T1633.001](https://attack.mitre.org/techniques/T1633/001)); Virtualization/Sandbox Evasion: User Activity Based Checks ([T1497.002](https://attack.mitre.org/techniques/T1497/002))| -|B0008|ANTI-BEHAVIORAL ANALYSIS, ANTI-STATIC ANALYSIS|**[Executable Code Virtualization](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/executable-code-virtualization.md)**|*none*| -|B0009|ANTI-BEHAVIORAL ANALYSIS|**[Virtual Machine Detection](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/virtual-machine-detection.md)**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))| -|B0010|ANTI-STATIC ANALYSIS|**[Call Graph Generation Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/call-graph-generation-evasion.md)**|*none*| -|B0011|EXECUTION|**[Remote Commands](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/remote-commands.md)**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))| -|B0012|ANTI-STATIC ANALYSIS|**[Disassembler Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/disassembler-evasion.md)**|*none*| -|B0013|DISCOVERY|**[Analysis Tool Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/analysis-tool-discovery.md)**|*none*| -|B0014|DISCOVERY|**[SMTP Connection Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/smtp-connection-discovery.md)**|*none*| +|B0001|ANTI-BEHAVIORAL ANALYSIS|**[Debugger Detection](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/debugger-detection.md)**|*none*| +|B0002|ANTI-BEHAVIORAL ANALYSIS|**[Debugger Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/debugger-evasion.md)**|Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T1622))| +|B0003|ANTI-BEHAVIORAL ANALYSIS|**[Dynamic Analysis Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/dynamic-analysis-evasion.md)**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))| +|B0004|ANTI-BEHAVIORAL ANALYSIS|**[Emulator Detection](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/emulator-detection.md)**|*none*| +|B0005|ANTI-BEHAVIORAL ANALYSIS|**[Emulator Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/emulator-evasion.md)**|*none*| +|B0006|ANTI-BEHAVIORAL ANALYSIS|**[Memory Dump Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/memory-dump-evasion.md)**|*none*| +|B0007|ANTI-BEHAVIORAL ANALYSIS|**[Sandbox Detection](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/sandbox-detection.md)**|Virtualization/Sandbox Evasion: System Checks ([T1497.001](https://attack.mitre.org/techniques/T1497/001),[T1633.001](https://attack.mitre.org/techniques/T1633/001)); Virtualization/Sandbox Evasion: User Activity Based Checks ([T1497.002](https://attack.mitre.org/techniques/T1497/002))| +|B0008|ANTI-BEHAVIORAL ANALYSIS, ANTI-STATIC ANALYSIS|**[Executable Code Virtualization](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/executable-code-virtualization.md)**|*none*| +|B0009|ANTI-BEHAVIORAL ANALYSIS|**[Virtual Machine Detection](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/virtual-machine-detection.md)**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))| +|B0010|ANTI-STATIC ANALYSIS|**[Call Graph Generation Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/call-graph-generation-evasion.md)**|*none*| +|B0011|EXECUTION|**[Remote Commands](https://github.com/MBCProject/mbc-markdown/blob/main/execution/remote-commands.md)**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))| +|B0012|ANTI-STATIC ANALYSIS|**[Disassembler Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/disassembler-evasion.md)**|*none*| +|B0013|DISCOVERY|**[Analysis Tool Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/analysis-tool-discovery.md)**|*none*| +|B0014|DISCOVERY|**[SMTP Connection Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/smtp-connection-discovery.md)**|*none*| |B0015|*not defined*|---|---| -|B0016|IMPACT|**[Compromise Data Integrity](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/compromise-data-integrity.md)**|Data Manipulation: Stored Data Manipulation ([T1565.001](https://attack.mitre.org/techniques/T1565/001))| -|B0017|IMPACT|**[Destroy Hardware](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/destroy-hardware.md)**|*none*| -|B0018|IMPACT|**[Resource Hijacking](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/resource-hijacking.md)**|Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1496))| -|B0019|IMPACT|**[Manipulate Network Traffic](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/manipulate-network-traffic.md)**|Data Manipulation: Transmitted Data Manipulation ([T1565.002](https://attack.mitre.org/techniques/T1565/002))| -|B0020|EXECUTION, LATERAL MOVEMENT|**[Send Email](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/send-email.md)**|Phishing ([T1566](https://attack.mitre.org/techniques/T1566))| -|B0021|EXECUTION, LATERAL MOVEMENT|**[Send Poisoned Text Message](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/send-poisoned-text-message.md)**|*none*| -|B0022|IMPACT, PERSISTENCE|**[Remote Access](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/remote-access.md)**|*none*| -|B0023|EXECUTION|**[Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/install-additional-program.md)**|*none*| -|B0024|EXECUTION|**[Prevent Concurrent Execution](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/prevent-concurrent-execution.md)**|*none*| -|B0025|ANTI-BEHAVIORAL ANALYSIS, EXECUTION|**[Conditional Execution](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/conditional-execution.md)**|Execution Guardrails ([T1480](https://attack.mitre.org/techniques/T1480))| -|B0026|LATERAL MOVEMENT, PERSISTENCE|**[Malicious Network Driver](https://github.com/MBCProject/mbc-markdown/blob/v2.3/persistence/malicious-network-driver.md)**|*none*| -|B0027|DEFENSE EVASION|**[Alternative Installation Location](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/alternative-installation-location.md)**|*none*| -|B0028|COLLECTION, CREDENTIAL ACCESS|**[Cryptocurrency](https://github.com/MBCProject/mbc-markdown/blob/v2.3/collection/cryptocurrency.md)**|*none*| -|B0029|DEFENSE EVASION|**[Polymorphic Code](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/polymorphic-code.md)**|*none*| -|B0030|COMMAND AND CONTROL|**[C2 Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/command-and-control/c2-communication.md)**|*none*| -|B0031|COMMAND AND CONTROL|**[Domain Name Generation](https://github.com/MBCProject/mbc-markdown/blob/v2.3/command-and-control/domain-name-generation.md)**|Dynamic Resolution: Domain Name Generation ([T1568.002](https://attack.mitre.org/techniques/T1568/002))| -|B0032|ANTI-STATIC ANALYSIS|**[Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/executable-code-obfuscation.md)**|*none*| -|B0033|IMPACT|**[Denial of Service](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/denial-of-service.md)**|Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498))| -|B0034|ANTI-STATIC ANALYSIS|**[Executable Code Optimization](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/executable-code-optimization.md)**|*none*| -|B0035|PERSISTENCE|**[Shutdown Event](https://github.com/MBCProject/mbc-markdown/blob/v2.3/persistence/shutdown-event.md)**|*none*| -|B0036|ANTI-BEHAVIORAL ANALYSIS|**[Capture Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-behavioral-analysis/capture-evasion.md)**|*none*| -|B0037|DEFENSE EVASION|**[Bypass Data Execution Prevention](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/bypass-data-execution-prevention.md)**|*none*| -|B0038|DISCOVERY|**[Self Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/self-discovery.md)**|*none*| -|B0039|IMPACT|**[Spamming](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/spamming.md)**|*none*| -|B0040|DEFENSE EVASION|**[Covert Location](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/covert-location.md)**|*none*| +|B0016|IMPACT|**[Compromise Data Integrity](https://github.com/MBCProject/mbc-markdown/blob/main/impact/compromise-data-integrity.md)**|Data Manipulation: Stored Data Manipulation ([T1565.001](https://attack.mitre.org/techniques/T1565/001))| +|B0017|IMPACT|**[Destroy Hardware](https://github.com/MBCProject/mbc-markdown/blob/main/impact/destroy-hardware.md)**|*none*| +|B0018|IMPACT|**[Resource Hijacking](https://github.com/MBCProject/mbc-markdown/blob/main/impact/resource-hijacking.md)**|Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1496))| +|B0019|IMPACT|**[Manipulate Network Traffic](https://github.com/MBCProject/mbc-markdown/blob/main/impact/manipulate-network-traffic.md)**|Data Manipulation: Transmitted Data Manipulation ([T1565.002](https://attack.mitre.org/techniques/T1565/002))| +|B0020|EXECUTION, LATERAL MOVEMENT|**[Send Email](https://github.com/MBCProject/mbc-markdown/blob/main/execution/send-email.md)**|Phishing ([T1566](https://attack.mitre.org/techniques/T1566))| +|B0021|EXECUTION, LATERAL MOVEMENT|**[Send Poisoned Text Message](https://github.com/MBCProject/mbc-markdown/blob/main/execution/send-poisoned-text-message.md)**|*none*| +|B0022|IMPACT, PERSISTENCE|**[Remote Access](https://github.com/MBCProject/mbc-markdown/blob/main/impact/remote-access.md)**|*none*| +|B0023|EXECUTION|**[Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/main/execution/install-additional-program.md)**|*none*| +|B0024|EXECUTION|**[Prevent Concurrent Execution](https://github.com/MBCProject/mbc-markdown/blob/main/execution/prevent-concurrent-execution.md)**|*none*| +|B0025|ANTI-BEHAVIORAL ANALYSIS, EXECUTION|**[Conditional Execution](https://github.com/MBCProject/mbc-markdown/blob/main/execution/conditional-execution.md)**|Execution Guardrails ([T1480](https://attack.mitre.org/techniques/T1480))| +|B0026|LATERAL MOVEMENT, PERSISTENCE|**[Malicious Network Driver](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/malicious-network-driver.md)**|*none*| +|B0027|DEFENSE EVASION|**[Alternative Installation Location](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/alternative-installation-location.md)**|*none*| +|B0028|COLLECTION, CREDENTIAL ACCESS|**[Cryptocurrency](https://github.com/MBCProject/mbc-markdown/blob/main/collection/cryptocurrency.md)**|*none*| +|B0029|DEFENSE EVASION|**[Polymorphic Code](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/polymorphic-code.md)**|*none*| +|B0030|COMMAND AND CONTROL|**[C2 Communication](https://github.com/MBCProject/mbc-markdown/blob/main/command-and-control/c2-communication.md)**|*none*| +|B0031|COMMAND AND CONTROL|**[Domain Name Generation](https://github.com/MBCProject/mbc-markdown/blob/main/command-and-control/domain-name-generation.md)**|Dynamic Resolution: Domain Name Generation ([T1568.002](https://attack.mitre.org/techniques/T1568/002))| +|B0032|ANTI-STATIC ANALYSIS|**[Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/executable-code-obfuscation.md)**|*none*| +|B0033|IMPACT|**[Denial of Service](https://github.com/MBCProject/mbc-markdown/blob/main/impact/denial-of-service.md)**|Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498))| +|B0034|ANTI-STATIC ANALYSIS|**[Executable Code Optimization](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/executable-code-optimization.md)**|*none*| +|B0035|PERSISTENCE|**[Shutdown Event](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/shutdown-event.md)**|*none*| +|B0036|ANTI-BEHAVIORAL ANALYSIS|**[Capture Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-behavioral-analysis/capture-evasion.md)**|*none*| +|B0037|DEFENSE EVASION|**[Bypass Data Execution Prevention](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/bypass-data-execution-prevention.md)**|*none*| +|B0038|DISCOVERY|**[Self Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/self-discovery.md)**|*none*| +|B0039|IMPACT|**[Spamming](https://github.com/MBCProject/mbc-markdown/blob/main/impact/spamming.md)**|*none*| +|B0040|DEFENSE EVASION|**[Covert Location](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/covert-location.md)**|*none*| |B0041|*not defined*|---|---| -|B0042|IMPACT|**[Modify Hardware](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/modify-hardware.md)**|*none*| -|B0043|DISCOVERY|**[Taskbar Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/taskbar-discovery.md)**|*none*| -|B0044|EXECUTION|**[Execution Dependency](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/execution-dependency.md)**|*none*| -|B0045|ANTI-STATIC ANALYSIS|**[Data Flow Analysis Evasion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/data-flow-analysis-evasion.md)**|*none*| -|B0046|DISCOVERY|**[Code Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/code-discovery.md)**|*none*| -|B0047|DEFENSE EVASION, PERSISTENCE|**[Install Insecure or Malicious Configuration](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/install-insecure-or-malicious-configuration.md)**|*none*| +|B0042|IMPACT|**[Modify Hardware](https://github.com/MBCProject/mbc-markdown/blob/main/impact/modify-hardware.md)**|*none*| +|B0043|DISCOVERY|**[Taskbar Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/taskbar-discovery.md)**|*none*| +|B0044|EXECUTION|**[Execution Dependency](https://github.com/MBCProject/mbc-markdown/blob/main/execution/execution-dependency.md)**|*none*| +|B0045|ANTI-STATIC ANALYSIS|**[Data Flow Analysis Evasion](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/data-flow-analysis-evasion.md)**|*none*| +|B0046|DISCOVERY|**[Code Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/code-discovery.md)**|*none*| +|B0047|DEFENSE EVASION, PERSISTENCE|**[Install Insecure or Malicious Configuration](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/install-insecure-or-malicious-configuration.md)**|*none*| ## Malware Micro-objectives | Objective | Description | |-----------|-------------| -|**[Communication Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/README.md)**|Micro-behaviors that enable malware to communicate.| -|**[Cryptography Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/README.md)**|Micro-behaviors that enable malware to use crypto.| -|**[Data Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/README.md)**|Micro-behaviors related to malware manipulating data.| -|**[File System Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/README.md)**|Micro-behaviors related to file manipulation.| -|**[Hardware Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/hardware/README.md)**|Micro-behaviors related to hardware.| -|**[Memory Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/memory/README.md)**|Micro-behaviors related to malware manipulating machine memory.| -|**[Operating System Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/operating-system/README.md)**|Micro-behaviors related to operating systems.| -|**[Process Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/README.md)**|Micro-behaviors related to processes.| +|**[Communication Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/README.md)**|Micro-behaviors that enable malware to communicate.| +|**[Cryptography Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/README.md)**|Micro-behaviors that enable malware to use crypto.| +|**[Data Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/README.md)**|Micro-behaviors related to malware manipulating data.| +|**[File System Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/README.md)**|Micro-behaviors related to file manipulation.| +|**[Hardware Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/hardware/README.md)**|Micro-behaviors related to hardware.| +|**[Memory Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/README.md)**|Micro-behaviors related to malware manipulating machine memory.| +|**[Operating System Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/operating-system/README.md)**|Micro-behaviors related to operating systems.| +|**[Process Micro-objective](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/README.md)**|Micro-behaviors related to processes.| ## Malware Micro-behaviors | ID | Objective(s) | Micro-behavior | |----|--------------|----------------| -|C0001|COMMUNICATION|**[Socket Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/socket-communication.md)**| -|C0002|COMMUNICATION|**[HTTP Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/http-communication.md)**| -|C0003|COMMUNICATION|**[Interprocess Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/interprocess-communication.md)**| -|C0004|COMMUNICATION|**[FTP Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/ftp-communication.md)**| -|C0005|COMMUNICATION|**[WinINet](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/wininet.md)**| -|C0006|MEMORY|**[Heap Spray](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/memory/heap-spray.md)**| -|C0007|MEMORY|**[Allocate Memory](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/memory/allocate-memory.md)**| -|C0008|MEMORY|**[Change Memory Protection](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/memory/change-memory-protection.md)**| -|C0009|MEMORY|**[Stack Pivot](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/memory/stack-pivot.md)**| -|C0010|MEMORY|**[Overflow Buffer](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/memory/overflow-buffer.md)**| -|C0011|COMMUNICATION|**[DNS Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/dns-communication.md)**| -|C0012|COMMUNICATION|**[SMTP Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/smtp-communication.md)**| -|C0014|COMMUNICATION|**[ICMP Communication](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/communication/icmp-communication.md)**| -|C0015|FILE SYSTEM|**[Alter File Extension](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/alter-file-extension.md)**| -|C0016|FILE SYSTEM|**[Create File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/create-file.md)**| -|C0017|PROCESS|**[Create Process](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/create-process.md)**| -|C0018|PROCESS|**[Terminate Process](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/terminate-process.md)**| -|C0019|DATA|**[Check String](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/check-string.md)**| -|C0020|DATA|**[Use Constant](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/use-constant.md)**| -|C0021|CRYPTOGRAPHY|**[Generate Pseudo-random Sequence](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/generate-pseudorandom-sequence.md)**| -|C0022|PROCESS|**[Synchronization](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/synchronization.md)**| -|C0023|HARDWARE|**[Load Driver](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/hardware/load-driver.md)**| -|C0024|DATA|**[Compress Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/compress-data.md)**| -|C0025|DATA|**[Decompress Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/decompress-data.md)**| -|C0026|DATA|**[Encode Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/encode-data.md)**| -|C0027|CRYPTOGRAPHY|**[Encrypt Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/encrypt-data.md)**| -|C0028|CRYPTOGRAPHY|**[Encryption Key](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/encryption-key.md)**| -|C0029|CRYPTOGRAPHY|**[Cryptographic Hash](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/cryptographic-hash.md)**| -|C0030|DATA|**[Non-Cryptographic Hash](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/noncryptographic-hash.md)**| -|C0031|CRYPTOGRAPHY|**[Decrypt Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/decrypt-data.md)**| -|C0032|DATA|**[Checksum](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/checksum.md)**| -|C0033|OPERATING SYSTEM|**[Console](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/operating-system/console.md)**| -|C0034|OPERATING SYSTEM|**[Environment Variable](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/operating-system/environment-variable.md)**| -|C0035|OPERATING SYSTEM|**[Wallpaper](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/operating-system/wallpaper.md)**| -|C0036|OPERATING SYSTEM|**[Registry](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/operating-system/registry.md)**| -|C0037|HARDWARE|**[Install Driver](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/hardware/install-driver.md)**| -|C0038|PROCESS|**[Create Thread](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/create-thread.md)**| -|C0039|PROCESS|**[Terminate Thread](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/terminate-thread.md)**| -|C0040|PROCESS|**[Allocate Thread Local Storage](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/allocate-thread-local-storage.md)**| -|C0041|PROCESS|**[Set Thread Local Storage Value](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/set-thread-local-storage-value.md)**| -|C0042|PROCESS|**[Create Mutex](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/create-mutex.md)**| -|C0043|PROCESS|**[Check Mutex](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/check-mutex.md)**| -|C0044|MEMORY|**[Free Memory](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/memory/free-memory.md)**| -|C0045|FILE SYSTEM|**[Copy File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/copy-file.md)**| -|C0046|FILE SYSTEM|**[Create Directory](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/create-directory.md)**| -|C0047|FILE SYSTEM|**[Delete File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/delete-file.md)**| -|C0048|FILE SYSTEM|**[Delete Directory](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/delete-directory.md)**| -|C0049|FILE SYSTEM|**[Get File Attributes](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/get-file-attributes.md)**| -|C0050|FILE SYSTEM|**[Set File Attributes](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/set-file-attributes.md)**| -|C0051|FILE SYSTEM|**[Read File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/read-file.md)**| -|C0052|FILE SYSTEM|**[Writes File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/writes-file.md)**| -|C0053|DATA|**[Decode Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/decode-data.md)**| -|C0054|PROCESS|**[Resume Thread](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/resume-thread.md)**| -|C0055|PROCESS|**[Suspend Thread](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/suspend-thread.md)**| -|C0056|FILE SYSTEM|**[Read Virtual Disk](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/read-virtual-disk.md)**| -|C0057|HARDWARE|**[Simulate Hardware](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/hardware/simulate-hardware.md)**| -|C0058|DATA|**[Modulo](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/modulo.md)**| -|C0059|CRYPTOGRAPHY|**[Crypto Library](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/crypto-lib.md)**| -|C0060|DATA|**[Compression Library](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/data/compression-library.md)**| -|C0061|CRYPTOGRAPHY|**[Hashed Message Authentication Code](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/hashed-message-authentication-code.md)**| -|C0063|FILE SYSTEM|**[Move File](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/file-system/move-file.md)**| -|C0064|PROCESS|**[Enumerate Threads](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/enumerate-threads.md)**| -|C0065|PROCESS|**[Open Process](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/open-process.md)**| -|C0066|PROCESS|**[Open Thread](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/process/open-thread.md)**| -|C0068|CRYPTOGRAPHY|**[Crypto Algorithm](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/crypto-algorithm.md)**| -|C0069|CRYPTOGRAPHY|**[Crypto Constant](https://github.com/MBCProject/mbc-markdown/blob/v2.3/micro-behaviors/cryptography/crypto-constant.md)**| +|C0001|COMMUNICATION|**[Socket Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/socket-communication.md)**| +|C0002|COMMUNICATION|**[HTTP Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/http-communication.md)**| +|C0003|COMMUNICATION|**[Interprocess Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/interprocess-communication.md)**| +|C0004|COMMUNICATION|**[FTP Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/ftp-communication.md)**| +|C0005|COMMUNICATION|**[WinINet](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/wininet.md)**| +|C0006|MEMORY|**[Heap Spray](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/heap-spray.md)**| +|C0007|MEMORY|**[Allocate Memory](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/allocate-memory.md)**| +|C0008|MEMORY|**[Change Memory Protection](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/change-memory-protection.md)**| +|C0009|MEMORY|**[Stack Pivot](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/stack-pivot.md)**| +|C0010|MEMORY|**[Overflow Buffer](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/overflow-buffer.md)**| +|C0011|COMMUNICATION|**[DNS Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/dns-communication.md)**| +|C0012|COMMUNICATION|**[SMTP Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/smtp-communication.md)**| +|C0014|COMMUNICATION|**[ICMP Communication](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/communication/icmp-communication.md)**| +|C0015|FILE SYSTEM|**[Alter File Extension](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/alter-file-extension.md)**| +|C0016|FILE SYSTEM|**[Create File](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/create-file.md)**| +|C0017|PROCESS|**[Create Process](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/create-process.md)**| +|C0018|PROCESS|**[Terminate Process](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/terminate-process.md)**| +|C0019|DATA|**[Check String](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/check-string.md)**| +|C0020|DATA|**[Use Constant](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/use-constant.md)**| +|C0021|CRYPTOGRAPHY|**[Generate Pseudo-random Sequence](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/generate-pseudorandom-sequence.md)**| +|C0022|PROCESS|**[Synchronization](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/synchronization.md)**| +|C0023|HARDWARE|**[Load Driver](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/hardware/load-driver.md)**| +|C0024|DATA|**[Compress Data](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/compress-data.md)**| +|C0025|DATA|**[Decompress Data](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/decompress-data.md)**| +|C0026|DATA|**[Encode Data](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/encode-data.md)**| +|C0027|CRYPTOGRAPHY|**[Encrypt Data](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/encrypt-data.md)**| +|C0028|CRYPTOGRAPHY|**[Encryption Key](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/encryption-key.md)**| +|C0029|CRYPTOGRAPHY|**[Cryptographic Hash](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/cryptographic-hash.md)**| +|C0030|DATA|**[Non-Cryptographic Hash](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/noncryptographic-hash.md)**| +|C0031|CRYPTOGRAPHY|**[Decrypt Data](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/decrypt-data.md)**| +|C0032|DATA|**[Checksum](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/checksum.md)**| +|C0033|OPERATING SYSTEM|**[Console](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/operating-system/console.md)**| +|C0034|OPERATING SYSTEM|**[Environment Variable](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/operating-system/environment-variable.md)**| +|C0035|OPERATING SYSTEM|**[Wallpaper](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/operating-system/wallpaper.md)**| +|C0036|OPERATING SYSTEM|**[Registry](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/operating-system/registry.md)**| +|C0037|HARDWARE|**[Install Driver](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/hardware/install-driver.md)**| +|C0038|PROCESS|**[Create Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/create-thread.md)**| +|C0039|PROCESS|**[Terminate Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/terminate-thread.md)**| +|C0040|PROCESS|**[Allocate Thread Local Storage](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/allocate-thread-local-storage.md)**| +|C0041|PROCESS|**[Set Thread Local Storage Value](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/set-thread-local-storage-value.md)**| +|C0042|PROCESS|**[Create Mutex](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/create-mutex.md)**| +|C0043|PROCESS|**[Check Mutex](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/check-mutex.md)**| +|C0044|MEMORY|**[Free Memory](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/memory/free-memory.md)**| +|C0045|FILE SYSTEM|**[Copy File](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/copy-file.md)**| +|C0046|FILE SYSTEM|**[Create Directory](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/create-directory.md)**| +|C0047|FILE SYSTEM|**[Delete File](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/delete-file.md)**| +|C0048|FILE SYSTEM|**[Delete Directory](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/delete-directory.md)**| +|C0049|FILE SYSTEM|**[Get File Attributes](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/get-file-attributes.md)**| +|C0050|FILE SYSTEM|**[Set File Attributes](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/set-file-attributes.md)**| +|C0051|FILE SYSTEM|**[Read File](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/read-file.md)**| +|C0052|FILE SYSTEM|**[Writes File](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/writes-file.md)**| +|C0053|DATA|**[Decode Data](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/decode-data.md)**| +|C0054|PROCESS|**[Resume Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/resume-thread.md)**| +|C0055|PROCESS|**[Suspend Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/suspend-thread.md)**| +|C0056|FILE SYSTEM|**[Read Virtual Disk](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/read-virtual-disk.md)**| +|C0057|HARDWARE|**[Simulate Hardware](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/hardware/simulate-hardware.md)**| +|C0058|DATA|**[Modulo](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/modulo.md)**| +|C0059|CRYPTOGRAPHY|**[Crypto Library](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/crypto-lib.md)**| +|C0060|DATA|**[Compression Library](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/data/compression-library.md)**| +|C0061|CRYPTOGRAPHY|**[Hashed Message Authentication Code](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/hashed-message-authentication-code.md)**| +|C0063|FILE SYSTEM|**[Move File](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/file-system/move-file.md)**| +|C0064|PROCESS|**[Enumerate Threads](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/enumerate-threads.md)**| +|C0065|PROCESS|**[Open Process](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/open-process.md)**| +|C0066|PROCESS|**[Open Thread](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/process/open-thread.md)**| +|C0068|CRYPTOGRAPHY|**[Crypto Algorithm](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/crypto-algorithm.md)**| +|C0069|CRYPTOGRAPHY|**[Crypto Constant](https://github.com/MBCProject/mbc-markdown/blob/main/micro-behaviors/cryptography/crypto-constant.md)**| ## Enhanced Malware ATT&CK Techniques | ID | Objective(s) | Technique | |----|--------------|-----------| -|E1010|DISCOVERY|**[Application Window Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/application-window-discovery.md)**| -|E1014|DEFENSE EVASION|**[Rootkit](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/rootkit.md)**| -|E1020|EXFILTRATION|**[Automated Exfiltration](https://github.com/MBCProject/mbc-markdown/blob/v2.3/exfiltration/automated-exfiltration.md)**| -|E1027|ANTI-STATIC ANALYSIS, DEFENSE EVASION|**[Obfuscated Files or Information](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/obfuscated-files-or-information.md)**| -|E1055|DEFENSE EVASION, PRIVILEGE ESCALATION|**[Process Injection](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/process-injection.md)**| -|E1056|COLLECTION, CREDENTIAL ACCESS|**[Input Capture](https://github.com/MBCProject/mbc-markdown/blob/v2.3/collection/input-capture.md)**| -|E1059|EXECUTION|**[Command and Scripting Interpreter](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/command-and-scripting-interpreter.md)**| -|E1082|DISCOVERY|**[System Information Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/system-information-discovery.md)**| -|E1083|DISCOVERY|**[File and Directory Discovery](https://github.com/MBCProject/mbc-markdown/blob/v2.3/discovery/file-and-directory-discovery.md)**| -|E1105|COMMAND AND CONTROL, LATERAL MOVEMENT, PERSISTENCE|**[Ingress Tool Transfer](https://github.com/MBCProject/mbc-markdown/blob/v2.3/command-and-control/ingress-tool-transfer.md)**| -|E1112|DEFENSE EVASION, PERSISTENCE|**[Modify Registry](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/modify-registry.md)**| -|E1113|COLLECTION, CREDENTIAL ACCESS|**[Screen Capture](https://github.com/MBCProject/mbc-markdown/blob/v2.3/collection/screen-capture.md)**| -|E1190|IMPACT|**[Exploit Kit](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/exploit-kit.md)**| -|E1195|LATERAL MOVEMENT|**[Supply Chain Compromise](https://github.com/MBCProject/mbc-markdown/blob/v2.3/lateral-movement/supply-chain-compromise.md)**| -|E1203|EXECUTION, IMPACT|**[Exploitation for Client Execution](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/exploitation-for-client-execution.md)**| -|E1204|EXECUTION|**[User Execution](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/user-execution.md)**| -|E1485|IMPACT|**[Data Destruction](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/data-destruction.md)**| -|E1486|IMPACT|**[Data Encrypted for Impact](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/data-encrypted-for-impact.md)**| -|E1510|IMPACT|**[Clipboard Modification](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/clipboard-modification.md)**| -|E1560|EXFILTRATION|**[Archive Collected Data](https://github.com/MBCProject/mbc-markdown/blob/v2.3/exfiltration/archive-collected-data.md)**| -|E1564|DEFENSE EVASION, PERSISTENCE|**[Hide Artifacts](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/hide-artifacts.md)**| -|E1569|EXECUTION|**[System Services](https://github.com/MBCProject/mbc-markdown/blob/v2.3/execution/system-services.md)**| -|E1608|PRIVILEGE ESCALATION|**[Install Certificate](https://github.com/MBCProject/mbc-markdown/blob/v2.3/privilege-escalation/install-certificate.md)**| -|E1643|IMPACT|**[Generate Traffic from Victim](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/generate-traffic-from-victim.md)**| +|E1010|DISCOVERY|**[Application Window Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/application-window-discovery.md)**| +|E1014|DEFENSE EVASION|**[Rootkit](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/rootkit.md)**| +|E1020|EXFILTRATION|**[Automated Exfiltration](https://github.com/MBCProject/mbc-markdown/blob/main/exfiltration/automated-exfiltration.md)**| +|E1027|ANTI-STATIC ANALYSIS, DEFENSE EVASION|**[Obfuscated Files or Information](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/obfuscated-files-or-information.md)**| +|E1055|DEFENSE EVASION, PRIVILEGE ESCALATION|**[Process Injection](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/process-injection.md)**| +|E1056|COLLECTION, CREDENTIAL ACCESS|**[Input Capture](https://github.com/MBCProject/mbc-markdown/blob/main/collection/input-capture.md)**| +|E1059|EXECUTION|**[Command and Scripting Interpreter](https://github.com/MBCProject/mbc-markdown/blob/main/execution/command-and-scripting-interpreter.md)**| +|E1082|DISCOVERY|**[System Information Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/system-information-discovery.md)**| +|E1083|DISCOVERY|**[File and Directory Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/file-and-directory-discovery.md)**| +|E1105|COMMAND AND CONTROL, LATERAL MOVEMENT, PERSISTENCE|**[Ingress Tool Transfer](https://github.com/MBCProject/mbc-markdown/blob/main/command-and-control/ingress-tool-transfer.md)**| +|E1112|DEFENSE EVASION, PERSISTENCE|**[Modify Registry](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/modify-registry.md)**| +|E1113|COLLECTION, CREDENTIAL ACCESS|**[Screen Capture](https://github.com/MBCProject/mbc-markdown/blob/main/collection/screen-capture.md)**| +|E1190|IMPACT|**[Exploit Kit](https://github.com/MBCProject/mbc-markdown/blob/main/impact/exploit-kit.md)**| +|E1195|LATERAL MOVEMENT|**[Supply Chain Compromise](https://github.com/MBCProject/mbc-markdown/blob/main/lateral-movement/supply-chain-compromise.md)**| +|E1203|EXECUTION, IMPACT|**[Exploitation for Client Execution](https://github.com/MBCProject/mbc-markdown/blob/main/execution/exploitation-for-client-execution.md)**| +|E1204|EXECUTION|**[User Execution](https://github.com/MBCProject/mbc-markdown/blob/main/execution/user-execution.md)**| +|E1485|IMPACT|**[Data Destruction](https://github.com/MBCProject/mbc-markdown/blob/main/impact/data-destruction.md)**| +|E1486|IMPACT|**[Data Encrypted for Impact](https://github.com/MBCProject/mbc-markdown/blob/main/impact/data-encrypted-for-impact.md)**| +|E1510|IMPACT|**[Clipboard Modification](https://github.com/MBCProject/mbc-markdown/blob/main/impact/clipboard-modification.md)**| +|E1560|EXFILTRATION|**[Archive Collected Data](https://github.com/MBCProject/mbc-markdown/blob/main/exfiltration/archive-collected-data.md)**| +|E1564|DEFENSE EVASION, PERSISTENCE|**[Hide Artifacts](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/hide-artifacts.md)**| +|E1569|EXECUTION|**[System Services](https://github.com/MBCProject/mbc-markdown/blob/main/execution/system-services.md)**| +|E1608|PRIVILEGE ESCALATION|**[Install Certificate](https://github.com/MBCProject/mbc-markdown/blob/main/privilege-escalation/install-certificate.md)**| +|E1643|IMPACT|**[Generate Traffic from Victim](https://github.com/MBCProject/mbc-markdown/blob/main/impact/generate-traffic-from-victim.md)**| ## Enhanced Malware ATT&CK Sub-techniques | ID | Objective(s) | Sub-technique | |----|--------------|---------------| -|F0001|ANTI-BEHAVIORAL ANALYSIS, ANTI-STATIC ANALYSIS, DEFENSE EVASION|**[Software Packing](https://github.com/MBCProject/mbc-markdown/blob/v2.3/anti-static-analysis/software-packing.md)**| -|F0002|COLLECTION, CREDENTIAL ACCESS|**[Keylogging](https://github.com/MBCProject/mbc-markdown/blob/v2.3/collection/keylogging.md)**| -|F0004|DEFENSE EVASION|**[Disable or Evade Security Tools](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/disable-or-evade-security-tools.md)**| -|F0005|DEFENSE EVASION, PERSISTENCE|**[Hidden Files and Directories](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/hidden-files-and-directories.md)**| -|F0006|DEFENSE EVASION|**[Indicator Blocking](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/indicator-blocking.md)**| -|F0007|DEFENSE EVASION|**[Self Deletion](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/self-deletion.md)**| -|F0009|DEFENSE EVASION, IMPACT, PERSISTENCE|**[Component Firmware](https://github.com/MBCProject/mbc-markdown/blob/v2.3/persistence/component-firmware.md)**| -|F0010|PERSISTENCE, PRIVILEGE ESCALATION|**[Kernel Modules and Extensions](https://github.com/MBCProject/mbc-markdown/blob/v2.3/persistence/kernel-modules-and-extensions.md)**| -|F0011|PERSISTENCE, PRIVILEGE ESCALATION|**[Modify Existing Service](https://github.com/MBCProject/mbc-markdown/blob/v2.3/persistence/modify-existing-service.md)**| -|F0012|PERSISTENCE|**[Registry Run Keys / Startup Folder](https://github.com/MBCProject/mbc-markdown/blob/v2.3/persistence/registry-run-keys-startup-folder.md)**| -|F0013|DEFENSE EVASION, PERSISTENCE|**[Bootkit](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/bootkit.md)**| -|F0014|IMPACT|**[Disk Wipe](https://github.com/MBCProject/mbc-markdown/blob/v2.3/impact/disk-wipe.md)**| -|F0015|ANTI-BEHAVIORAL ANALYSIS, COLLECTION, CREDENTIAL ACCESS, DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION|**[Hijack Execution Flow](https://github.com/MBCProject/mbc-markdown/blob/v2.3/defense-evasion/hijack-execution-flow.md)**| +|F0001|ANTI-BEHAVIORAL ANALYSIS, ANTI-STATIC ANALYSIS, DEFENSE EVASION|**[Software Packing](https://github.com/MBCProject/mbc-markdown/blob/main/anti-static-analysis/software-packing.md)**| +|F0002|COLLECTION, CREDENTIAL ACCESS|**[Keylogging](https://github.com/MBCProject/mbc-markdown/blob/main/collection/keylogging.md)**| +|F0004|DEFENSE EVASION|**[Disable or Evade Security Tools](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/disable-or-evade-security-tools.md)**| +|F0005|DEFENSE EVASION, PERSISTENCE|**[Hidden Files and Directories](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/hidden-files-and-directories.md)**| +|F0006|DEFENSE EVASION|**[Indicator Blocking](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/indicator-blocking.md)**| +|F0007|DEFENSE EVASION|**[Self Deletion](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/self-deletion.md)**| +|F0009|DEFENSE EVASION, IMPACT, PERSISTENCE|**[Component Firmware](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/component-firmware.md)**| +|F0010|PERSISTENCE, PRIVILEGE ESCALATION|**[Kernel Modules and Extensions](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/kernel-modules-and-extensions.md)**| +|F0011|PERSISTENCE, PRIVILEGE ESCALATION|**[Modify Existing Service](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/modify-existing-service.md)**| +|F0012|PERSISTENCE|**[Registry Run Keys / Startup Folder](https://github.com/MBCProject/mbc-markdown/blob/main/persistence/registry-run-keys-startup-folder.md)**| +|F0013|DEFENSE EVASION, PERSISTENCE|**[Bootkit](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/bootkit.md)**| +|F0014|IMPACT|**[Disk Wipe](https://github.com/MBCProject/mbc-markdown/blob/main/impact/disk-wipe.md)**| +|F0015|ANTI-BEHAVIORAL ANALYSIS, COLLECTION, CREDENTIAL ACCESS, DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION|**[Hijack Execution Flow](https://github.com/MBCProject/mbc-markdown/blob/main/defense-evasion/hijack-execution-flow.md)**| diff --git a/persistence/README.md b/persistence/README.md index c537067..317ec09 100644 --- a/persistence/README.md +++ b/persistence/README.md @@ -8,7 +8,7 @@ Last Modified -12 June 2023 +27 Sept 2023 @@ -21,7 +21,7 @@ Behaviors that enable malware to remain on a system regardless of system events, * **Component Firmware** [F0009](../persistence/component-firmware.md) * **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md) * **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md) -* **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md) +* **Hijack Execution Flow** [F0015](../defense-evasion/hijack-execution-flow.md) * **Install Insecure or Malicious Configuration** [B0047](../defense-evasion/install-insecure-or-malicious-configuration.md) * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-and-extensions.md) * **Malicious Network Driver** [B0026](../persistence/malicious-network-driver.md) diff --git a/privilege-escalation/README.md b/privilege-escalation/README.md index 05402e3..790485c 100644 --- a/privilege-escalation/README.md +++ b/privilege-escalation/README.md @@ -8,7 +8,7 @@ Last Modified -29 November 2022 +27 September 2023 @@ -17,7 +17,7 @@ Behaviors that enable malware to obtain higher level permissions. These behaviors often overlap with Persistence behaviors. -* **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md) +* **Hijack Execution Flow** [F0015](../defense-evasion/hijack-execution-flow.md) * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-and-extensions.md) * **Modify Existing Service** [F0011](../persistence/modify-existing-service.md) * **Process Injection** [E1055](../defense-evasion/process-injection.md) diff --git a/xample-malware/conti.md b/xample-malware/conti.md index 9282c85..ca5df87 100644 --- a/xample-malware/conti.md +++ b/xample-malware/conti.md @@ -22,7 +22,7 @@ -# Conti Ransomware +# Conti Conti is a Ransomware-as-a-Service (RaaS) malware. diff --git a/yfaq/README.md b/yfaq/README.md index ab60478..831d31d 100644 --- a/yfaq/README.md +++ b/yfaq/README.md @@ -10,9 +10,9 @@ ## What's New? ## -* **MBC v3.0** - The latest MBC release (to be released soon) includes behavior detection information, expanded descriptions, and new properties, such as version and created and modified dates. +* **MBC v3.0** - The latest MBC release includes behavior detection information, expanded descriptions, and new properties, such as version and created and modified dates. -* **STIX 2.1 Representation** - MBC content will soon be available in an updated STIX format based on the new [STIX 2.1 Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). +* **STIX 2.1 Representation** - MBC content is available in an updated STIX format based on the new [STIX 2.1 Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). * **Attack Flow Examples** - Example attack flows for [Shamoon](../xample-malware/shamoon.md) and [SearchAwesome](../xample-malware/searchawesome.md) reference MBC behaviors. @@ -67,7 +67,7 @@ There was no version control when MBC v1.0 was released at the end of January 20 * MBC v2.1 was released in February 2021 and includes additional micro-behaviors and behavior methods. * MBC v2.2 was released in February 2022 and includes additional micro-behaviors and behavior methods. Added code snippets to certain methods. * MBC v2.3 was released in September 2022 and aligns with ATT&CK v11 and includes an updated malware corpus. -* MBC v3.0 will be released in September 2023. +* MBC v3.0 was released in September 2023 and includes behavior detection information, expanded descriptions, and new properties. ## Using MBC ## @@ -147,10 +147,10 @@ Malware behaviors and adversary behaviors can overlap because adversaries someti ## STIX Representation ## ### How are MBC behaviors captured in STIX 2? ### -MBC content is available in STIX 2.1 format. See the [mbc-stix2](https://github.com/MBCProject/mbc-stix2) repository for details. The [usage document](https://github.com/MBCProject/mbc-stix2/blob/master/USAGE.md) gives details of how behaviors are captured with STIX 2 objects. +MBC content is available in STIX 2.1 format. See the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository for details. MBC content is also available in an [older STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2) based on the representation used for ATT&CK. ### Why was MBC's STIX representation updated? ### -The previous STIX 2.1 representation was valid, but it didn't take advantage of the STIX 2.1 Extension Definition Object. MBC users said they found the MBC representation (and ATT&CK) kludgy, so we defined new SDOs and extended the STIX Malware Object in a [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications). We think it works much better! +The previous STIX 2.1 representation is valid, but it doesn't take advantage of the STIX 2.1 Extension Definition Object. MBC users said they found the MBC representation (and ATT&CK) kludgy, so we defined new SDOs and extended the STIX Malware Object in a [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). We think it works much better! ### How are malware corpus examples captured in STIX? ### Corpus examples are captured using the Malware SDO. Three new properties are defined in the STIX 2.1 Malware Behavior extension: @@ -162,6 +162,9 @@ Corpus examples are captured using the Malware SDO. Three new properties are def ### Why is the STIX "is_family" property set to true for all the malware in the corpus? ### The "is_family" property (defined on the Malware SDO) indicates whether an object represents a malware family (if true) or a malware instance (if false). All the malware in the corpus represent malware families. +### How is MBC versioning captured in STIX? ### +The "Created" and "Last Modified" metadata for versioned MBC objects are captured in the corresponding STIX object's "created" and "modified" common properties. In such cases, the STIX properties do not correspond to the created and modified dates of the STIX object, but they remain effective for versioning because the modified property is updated each time MBC content changes. + ## Malware Analysis Tools ## MBC is used in the following malware analysis tools. diff --git a/yfaq/mbc_matrix_with_ids.svg b/yfaq/mbc_matrix_with_ids.svg index bd962f0..c840efb 100644 --- a/yfaq/mbc_matrix_with_ids.svg +++ b/yfaq/mbc_matrix_with_ids.svg @@ -1 +1 @@ -B0036: Capture EvasionB0025:Conditional ExecutionB0001: Debugger DetectionB0002: Debugger EvasionB0003:Dynamic Analysis EvasionB0004: Emulator DetectionB0005: Emulator EvasionB0008: ExecutableCode VirtualizationF0003: HookingB0006: Memory Dump EvasionB0007: Sandbox DetectionF0001: Software PackingB0009:Virtual Machine DetectionB0036.003: MultipleStages of LoadersB0036.001:Memory-only PayloadB0036.002:Encrypted PayloadsB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0001.003: CloseHandleB0001.031:WudfIsAnyDebuggerPresentB0001.025:Software BreakpointsB0001.027: TIB AwareB0001.028:Timing/Delay CheckB0001.024:SetHandleInformationB0001.007: Interrupt 1B0001.029: TLS CallbacksB0001.018: Parent ProcessB0001.009:Memory BreakpointsB0001.026: Stack CanaryB0001.033: Timing/DelayCheck QueryPerformanceCounterB0001.032: Timing/DelayCheck GetTickCountB0001.006: Interrupt 0x2dB0001.017: Page ExceptionBreakpoint DetectionB0001.034: Anti-debuggingInstructionsB0001.015:NtYieldExecution/SwitchToThreadB0001.021: ProcessHeapB0001.037: ProcessEnvironment Block IsDebuggedB0001.001:API Hook DetectionB0001.004:Debugger ArtifactsB0001.012:NtQueryInformationProcessB0001.023:SeDebugPrivilegeB0001.016:OutputDebugStringB0001.008:IsDebuggerPresentB0001.022:RtlAdjustPrivilegeB0001.010:Memory Write WatchingB0001.036: ProcessEnvironment Block NtGlobalFlagB0001.002:CheckRemoteDebuggerPresentB0001.005:Hardware BreakpointsB0001.014:NtSetInformationThreadB0001.013: NtQueryObjectB0001.030:UnhandledExceptionFilterB0001.011:Monitoring ThreadB0001.020: Process JobsB0001.035: Process EnvironmentBlock BeingDebuggedB0001.019:Process Environment BlockB0002.009: Hook InterruptB0002.025: Self-UnmappingB0002.007:Get Base IndirectlyB0002.005:Code Integrity CheckB0002.024: Self-DebuggingB0002.004:Change SizeOfImageB0002.013: Malloc UseB0002.026: Static LinkingB0002.030: Use InterruptsB0002.021:Return ObfuscationB0002.003: Byte StealingB0002.011: InliningB0002.019: Pre-DebugB0002.029: Thread TimeoutB0002.023:Section MisalignmentB0002.028: TamperingB0002.018:Pipeline MisdirectionB0002.002:Break Point ClearingB0002.008: Guard PagesB0002.020:Relocate API CodeB0002.006:Exception MisdirectionB0002.022:RtlAdjustPrivilegeB0002.012: Loop EscapesB0002.014:Modify PE HeaderB0002.015: NanomitesB0002.017:Parallel ThreadsB0002.001:Block InterruptsB0002.016:Obfuscate Library UseB0002.027:Stolen API CodeB0002.010:Import ObfuscationB0003.007:Hook File SystemB0003.001:Alternative ntdll.dllB0003.009: IllusionB0003.004: Demo ModeB0003.008: Hook InterruptB0003.003:Delayed ExecutionB0003.002: Data FloodB0003.006: Encode FileB0003.010: RestartB0003.005: Drop CodeB0004.003: CheckEmulator-related Registry KeysB0004.001: Check forEmulator-related FilesB0004.004: FailedNetwork ConnectionsB0004.002:Check for WINE VersionB0005.004:Extra Loops/Time LocksB0005.001:Different Opcode SetsB0005.002:Undocumented OpcodesB0005.003:Unusual/Undocumented API CallsB0008.001: Multiple VMsF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingB0006.010:Hook memory mapping APIsB0006.001:Code Encryption in MemoryB0006.003:Hide virtual memoryB0006.005: TamperingB0006.002:Erase the PE headerB0006.004: SizeOfImageB0006.011: PatchMmGetPhysicalMemoryRangesB0006.006: Guard PagesB0006.008:Feed MisinformationB0006.009:Flow Opcode ObstructionB0006.007:On-the-Fly APIsB0007.006:Screen Resolution TestingB0007.007: Self CheckB0007.008:Timing/Date CheckB0007.005:Product Key/ID TestingB0007.009:Timing/Uptime CheckB0007.001:Check Clipboard DataB0007.003:Human User CheckB0007.002: Check FilesB0007.004:Injected DLL TestingF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXB0009.009: Check WindowsB0009.018: Modern SpecsCheck - Processor countB0009.005:Check Registry KeysB0009.006:Check Running ServicesB0009.034: InstructionTesting - CPUIDB0009.020: CheckWindows - Window sizeB0009.012:Human User CheckB0009.019: Modern SpecsCheck - Keyboard layoutB0009.011: HTML5Performance Object CheckB0009.021: CheckWindows - Unique windowsB0009.016: ModernSpecs Check - USB driveB0009.038: InstructionTesting - VPCEXTB0009.029:Instruction TestingB0009.036: InstructionTesting - RDTSCB0009.003: CheckNamed System ObjectsB0009.037: InstructionTesting - VMCPUIDB0009.017: ModernSpecs Check - PrinterB0009.013:Modern Specs CheckB0009.030: InstructionTesting - SIDT (red pill)B0009.007: Check SoftwareB0009.022: CheckWindows - Title barsB0009.032: InstructionTesting - SMSWB0009.033:Instruction Testing - STRB0009.027: Unique Hardware/FirmwareCheck - CPU LocationB0009.031: InstructionTesting - SGDT/SLDT (no pill)B0009.010:Guest Process TestingB0009.001: Check Fileand Directory ArtifactsB0009.025: Unique Hardware/FirmwareCheck - I/O Communication PortB0009.004:Check ProcessesB0009.035:Instruction Testing - INB0009.008:Check Virtual DevicesB0009.026: UniqueHardware/Firmware Check - CPU NameB0009.024: UniqueHardware/Firmware Check - BIOSB0009.015: ModernSpecs Check - Drive sizeB0009.002:Check Memory ArtifactsB0009.028: Unique Hardware/FirmwareCheck - MAC AddressB0009.014: Modern SpecsCheck - Total physical memoryB0009.023: UniqueHardware/Firmware CheckAnti-Behavioral AnalysisB0010: CallGraph Generation EvasionB0045:Data Flow Analysis EvasionB0012: Disassembler EvasionB0032:Executable Code ObfuscationB0034: ExecutableCode OptimizationB0008: ExecutableCode VirtualizationE1027: ObfuscatedFiles or InformationF0001: Software PackingB0010.001:Two-layer Function ReturnB0010.002: Invoke NTDLLSystem Calls via Encoded TableB0045.001:Control DependenceB0045.002: Implicit FlowsB0045.003: ArbitraryMemory CorruptionB0012.001:Argument ObfuscationB0012.002:Conditional MisdirectionB0012.005: VBA StompingB0012.004:Variable RecompositionB0012.003:Value Dependent JumpsB0032.001: API HashingB0032.017: Stack StringsB0032.002: Code InsertionB0032.003:Dead Code InsertionB0032.008:Data Value ObfuscationB0032.014:Interleaving CodeB0032.005: Jump InsertionB0032.004:Fake Code InsertionB0032.009:Entry Point ObfuscationB0032.007:Junk Code InsertionB0032.011: ImportAddress Table ObfuscationB0032.015:Merged Code SectionsB0032.012:Import CompressionB0032.018:Symbol ObfuscationB0032.016: StructuredException Handling (SEH)B0032.013:Instruction OverlapB0032.006:Thunk Code InsertionB0032.010: Guard PagesB0034.002: MinificationB0034.001: Jump/CallAbsolute AddressB0008.001: Multiple VMsE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXAnti-Static AnalysisB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICollectionB0030: C2 CommunicationB0031:Domain Name GenerationE1105: Ingress Tool TransferB0030.012:Directory ListingB0030.009:Request Email TemplateB0030.008:Request CommandB0030.010: RequestEmail Address ListB0030.001: Send DataB0030.007: Send HeartbeatB0030.014:Execute Shell CommandB0030.002: Receive DataB0030.016:Start Interactive ShellB0030.004: Implant toController File TransferB0030.003: Serverto Client File TransferB0030.013: Execute FileB0030.006:Send System InformationB0030.011: AuthenticateB0030.005:Check for PayloadB0030.015: File searchCommand and ControlB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICredential AccessB0027: AlternativeInstallation LocationF0013: BootkitB0037: BypassData Execution PreventionF0009: Component FirmwareB0025:Conditional ExecutionB0040: Covert LocationF0004: Disableor Evade Security ToolsE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingF0006: Indicator BlockingB0047: Install Insecureor Malicious ConfigurationE1112: Modify RegistryE1027: ObfuscatedFiles or InformationB0029: Polymorphic CodeE1055: Process InjectionE1014: RootkitF0007: Self DeletionF0001: Software PackingB0027.002:Registry InstallB0027.001:Fileless MalwareB0037.001: ROP ChainsF0009.001:Router FirmwareB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0040.001:Hide Data in RegistryB0040.002: SteganographyF0004.008: Heavens GateF0004.005: Modify PolicyF0004.004: AMSI BypassF0004.009:Disable Code IntegrityF0004.001: DisableKernel Patch ProtectionF0004.002: Disable SystemFile Overwrite ProtectionF0004.007: BypassWindows File ProtectionF0004.006:Force Lazy WritingF0004.003: Unhook APIsE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0006.001: RemoveSMS Warning MessagesE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmB0029.001: Packer StubB0029.003:Code ReorderingB0029.002:Call IndirectionsE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsE1014.m15:Hypervisor/Virtualized RootkitE1014.m14:Hardware/Firmware RootkitE1014.m12:Application RootkitE1014.m17: Memory RootkitE1014.m16:Kernel Mode RootkitE1014.m13: BootloaderF0007.001: COMSPECEnvironment VariableF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXDefense EvasionB0013:Analysis Tool DiscoveryE1010: ApplicationWindow DiscoveryB0046: Code DiscoveryE1083: Fileand Directory DiscoveryB0038: Self DiscoveryB0014:SMTP Connection DiscoveryE1082: SystemInformation DiscoveryB0043: Taskbar DiscoveryB0013.002: Processdetection - DebuggersB0013.004: Processdetection - PCAP UtilitiesB0013.005: Process detection- Process UtilitiesB0013.003: Process detection- SysInternals Suite ToolsB0013.006: Processdetection - PE UtilitiesB0013.001:Process detectionB0013.008:Known File LocationB0013.009: Known WindowB0013.007: Processdetection - SandboxesE1010.m01: Window TextB0046.001:Enumerate PE SectionsB0046.003:Parse PE HeaderB0046.002: InspectSection Memory PermissionsE1083.m01: Log FileE1082.m01: GenerateWindows ExceptionDiscoveryE1059: Commandand Scripting InterpreterB0025:Conditional ExecutionB0044: Execution DependencyE1203: Exploitationfor Client ExecutionB0023:Install Additional ProgramB0024: PreventConcurrent ExecutionB0011: Remote CommandsB0020: Send EmailB0021:Send Poisoned Text MessageE1569: System ServicesE1204: User InteractionB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsB0011.001: Delete FileB0011.003: ExecuteB0011.005: SleepB0011.006: UninstallB0011.007: Upload FileB0011.004: ShutdownB0011.002: Download FileE1569.m01: MSDTCExecutionE1560:Archive Collected DataE1020:Automated ExfiltrationE1560.m03: Encoding- Standard EncodingE1560.m05: Encryption- Standard EncryptionE1560.m06: Encryption- Custom EncryptionE1560.m01: EncodingE1560.m04: Encoding- Custom EncodingE1560.m02: EncryptionE1020.m01: Exfiltratevia File Hosting ServiceExfiltrationE1510:Clipboard ModificationF0009: Component FirmwareB0016:Compromise Data IntegrityE1485: Data DestructionE1486:Data Encrypted for ImpactB0033: Denial of ServiceB0017: Destroy HardwareF0014: Disk WipeE1190: Exploit Kit BehaviorE1203: Exploitationfor Client ExecutionE1472: Generate FraudulentAdvertising RevenueB0019:Manipulate Network TrafficB0042: Modify HardwareB0022: Remote AccessB0018: Resource HijackingB0039: SpammingF0009.001:Router FirmwareE1485.m02:Empty Recycle BinE1485.m03: DeleteApplication/SoftwareE1485.m04:Delete Shadow CopiesE1486.001: Ransom NoteE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsE1472.m01:Click HijackingE1472.m02: AdvertisementReplacement FraudB0042.002: MouseB0042.001: CDROMB0042.003: PrinterB0022.001: Reverse ShellB0018.002: CryptojackingB0018.001:Password CrackingImpactB0026:Malicious Network DriverE1105: Ingress Tool TransferB0020: Send EmailB0021:Send Poisoned Text MessageE1195:Supply Chain CompromiseE1195.m02:Exploit Private APIsE1195.m01: AbuseEnterprise CertificatesLateral MovementC0011: DNS CommunicationC0004: FTP CommunicationC0002: HTTP CommunicationC0014: ICMP CommunicationC0003:Interprocess CommunicationC0012: SMTP CommunicationC0001: Socket CommunicationC0005: WinINetC0011.004: ResolveTLD::DNS CommunicationC0011.003: DDNS DomainConnect::DNS CommunicationC0011.005: Resolve Free HostingDomain::DNS CommunicationC0011.001: Resolve::DNSCommunicationC0011.002: ServerConnect::DNS CommunicationC0004.001: SendFile::FTP CommunicationC0004.002: WinINet::FTPCommunicationC0002.002: Client::HTTPCommunicationC0002.009: Connect toServer::HTTP CommunicationC0002.017: GetResponse::HTTP CommunicationC0002.003: SendRequest::HTTP CommunicationC0002.004: OpenURL::HTTP CommunicationC0002.007: WinINet::HTTPCommunicationC0002.015: ReceiveRequest::HTTP CommunicationC0002.013: SetHeader::HTTP CommunicationC0002.005: SendData::HTTP CommunicationC0002.010: IWebBrowser::HTTPCommunicationC0002.016: SendResponse::HTTP CommunicationC0002.012: CreateRequest::HTTP CommunicationC0002.001: Server::HTTPCommunicationC0002.011: ExtractBody::HTTP CommunicationC0002.014: ReadHeader::HTTP CommunicationC0002.008: WinHTTP::HTTPCommunicationC0002.018: StartServer::HTTP CommunicationC0002.006: DownloadURL::HTTP CommunicationC0014.002: EchoRequest::ICMP CommunicationC0014.001: GenerateTraffic::ICMP CommunicationC0003.001: CreatePipe::Interprocess CommunicationC0003.003: ReadPipe::Interprocess CommunicationC0003.004: WritePipe::Interprocess CommunicationC0003.002: ConnectPipe::Interprocess CommunicationC0012.002: Request::SMTPCommunicationC0012.001: ServerConnect::SMTP CommunicationC0001.015: Send UDPData::Socket CommunicationC0001.016: Receive TCPData::Socket CommunicationC0001.005: Start TCPServer::Socket CommunicationC0001.006: ReceiveData::Socket CommunicationC0001.013: UDPClient::Socket CommunicationC0001.012: Get SocketStatus::Socket CommunicationC0001.017: Receive UDPData::Socket CommunicationC0001.007: SendData::Socket CommunicationC0001.014: Send TCPData::Socket CommunicationC0001.009: Initialize WinsockLibrary::Socket CommunicationC0001.008: TCPClient::Socket CommunicationC0001.004: ConnectSocket::Socket CommunicationC0001.011: Create TCPSocket::Socket CommunicationC0001.003: CreateSocket::Socket CommunicationC0001.001: Set SocketConfig::Socket CommunicationC0001.010: Create UDPSocket::Socket CommunicationC0001.002: TCPServer::Socket CommunicationC0005.002:InternetOpen::WinINetC0005.003:InternetOpenURL::WinINetC0005.005:InternetWriteFile::WinINetC0005.004:InternetReadFile::WinINetC0005.001:InternetConnect::WinINetCommunicationMicro-objectiveC0059: Crypto LibraryC0029: Cryptographic HashC0031: Decrypt DataC0027: Encrypt DataC0028: Encryption KeyC0021: GeneratePseudo-random SequenceC0061: HashedMessage Authentication CodeC0029.002:SHA1::Cryptographic HashC0029.003:SHA256::Cryptographic HashC0029.004:SHA224::Cryptographic HashC0029.001:MD5::Cryptographic HashC0029.006:Snefru::Cryptographic HashC0029.005:Tiger::Cryptographic HashC0031.014:Twofish::Decrypt DataC0031.011:Skipjack::Decrypt DataC0031.003:Blowfish::Decrypt DataC0031.006:HC-128::Decrypt DataC0031.001:AES::Decrypt DataC0031.008:RC4::Decrypt DataC0031.013: StreamCipher::Decrypt DataC0031.002: BlockCipher::Decrypt DataC0031.004:Camellia::Decrypt DataC0031.007:HC-256::Decrypt DataC0031.005:3DES::Decrypt DataC0031.012:Sosemanuk::Decrypt DataC0031.009:RC6::Decrypt DataC0031.010:RSA::Decrypt DataC0027.011:RSA::Encrypt DataC0027.014: BlockCipher::Encrypt DataC0027.001:AES::Encrypt DataC0027.012: StreamCipher::Encrypt DataC0027.010:RC6::Encrypt DataC0027.003:Camellia::Encrypt DataC0027.007:HC-256::Encrypt DataC0027.005:Twofish::Encrypt DataC0027.002:Blowfish::Encrypt DataC0027.006:HC-128::Encrypt DataC0027.013:Skipjack::Encrypt DataC0027.009:RC4::Encrypt DataC0027.004:3DES::Encrypt DataC0027.008:Sosemanuk::Encrypt DataC0028.001: Import PublicKey::Encryption KeyC0028.002:RC4 KSA::Encryption KeyC0021.001: GetTickCount::GeneratePseudo-random SequenceC0021.005: Mersenne Twister::GeneratePseudo-random SequenceC0021.003: Use API::GeneratePseudo-random SequenceC0021.002: rand::GeneratePseudo-random SequenceC0021.004: RC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveC0019: Check StringC0032: ChecksumC0024: Compress DataC0060: Compression LibraryC0053: Decode DataC0025: Decompress DataC0026: Encode DataC0058: ModuloC0030:Non-Cryptographic HashC0020: Use ConstantC0032.003: BSD::ChecksumC0032.002: Luhn::ChecksumC0032.001:CRC32::ChecksumC0032.005:Adler::ChecksumC0032.004:Verhoeff::ChecksumC0024.001:QuickLZ::Compress DataC0024.002:IEncodingFilterFactory::Compress DataC0053.001:Base64::Decode DataC0053.002:XOR::Decode DataC0025.003:aPLib::Decompress DataC0025.002:IEncodingFilterFactory::DecompressDataC0025.001:QuickLZ::Decompress DataC0026.002:XOR::Encode DataC0026.001:Base64::Encode DataC0030.003:Fast-Hash::Non-Cryptographic HashC0030.001:MurmurHash::Non-Cryptographic HashC0030.004:dhash::Non-Cryptographic HashC0030.002:pHash::Non-Cryptographic HashC0030.005:FNV::Non-Cryptographic HashData Micro-objectiveC0015: Alter File ExtensionC0045: Copy FileC0046: Create DirectoryC0016: Create FileC0048: Delete DirectoryC0047: Delete FileC0049: Get File AttributesC0063: Move FileC0051: Read FileC0056: Read Virtual DiskC0050: Set File AttributesC0052: Writes FileC0015.001: AppendExtension::Alter File ExtensionC0016.001: Create OfficeDocument::Create FileC0016.002: CreateRansomware File::Create FileFile System Micro-objectiveC0037: Install DriverC0023: Load DriverC0057: Simulate HardwareC0037.001:Minifilter::Install DriverC0023.001:Minifilter::Load DriverC0057.002: MouseClick::Simulate HardwareC0057.001:Ctrl-Alt-Del::Simulate HardwareHardware Micro-objectiveC0007: Allocate MemoryC0008:Change Memory ProtectionC0044: Free MemoryC0006: Heap SprayC0010: Overflow BufferC0009: Stack PivotC0008.001: ExecutableStack::Change Memory ProtectionC0008.002: ExecutableHeap::Change Memory ProtectionMemory Micro-objectiveC0033: ConsoleC0034: Environment VariableC0036: RegistryC0035: WallpaperC0034.002: GetVariable::Environment VariableC0034.001: SetVariable::Environment VariableC0036.004: CreateRegistry Key::RegistryC0036.002: DeleteRegistry Key::RegistryC0036.001: SetRegistry Key::RegistryC0036.005: QueryRegistry Key::RegistryC0036.007: DeleteRegistry Value::RegistryC0036.003: OpenRegistry Key::RegistryC0036.006: QueryRegistry Value::RegistryOperatingSystem Micro-objectiveC0040: AllocateThread Local StorageC0043: Check MutexC0042: Create MutexC0017: Create ProcessC0038: Create ThreadC0064: Enumerate ThreadsC0065: Open ProcessC0066: Open ThreadC0054: Resume ThreadC0041: SetThread Local Storage ValueC0055: Suspend ThreadC0022: SynchronizationC0018: Terminate ProcessC0039: Terminate ThreadC0017.001: Create Processvia Shellcode::Create ProcessC0017.003: Create SuspendedProcess::Create ProcessC0017.002: Create Processvia WMI::Create ProcessC0022.001: CreateMutex::SynchronizationProcess Micro-objectiveF0013: BootkitF0009: Component FirmwareE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingB0047: Install Insecureor Malicious ConfigurationF0010: KernelModules and ExtensionsB0026:Malicious Network DriverF0011:Modify Existing ServiceE1112: Modify RegistryF0012: RegistryRun Keys / Startup FolderB0022: Remote AccessE1105: Ingress Tool TransferB0035: Shutdown EventF0009.001:Router FirmwareE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverB0022.001: Reverse ShellPersistenceF0015:Hijack Execution FlowF0003: HookingF0010: KernelModules and ExtensionsF0011:Modify Existing ServiceE1055: Process InjectionF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsPrivilege Escalation +B0036: Capture EvasionB0025:Conditional ExecutionB0001: Debugger DetectionB0002: Debugger EvasionB0003:Dynamic Analysis EvasionB0004: Emulator DetectionB0005: Emulator EvasionB0008: ExecutableCode VirtualizationF0003: HookingB0006: Memory Dump EvasionB0007: Sandbox DetectionF0001: Software PackingB0009:Virtual Machine DetectionB0036.003: MultipleStages of LoadersB0036.001:Memory-only PayloadB0036.002:Encrypted PayloadsB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0001.003: CloseHandleB0001.031:WudfIsAnyDebuggerPresentB0001.025:Software BreakpointsB0001.027: TIB AwareB0001.028:Timing/Delay CheckB0001.024:SetHandleInformationB0001.007: Interrupt 1B0001.029: TLS CallbacksB0001.018: Parent ProcessB0001.009:Memory BreakpointsB0001.026: Stack CanaryB0001.033: Timing/DelayCheck QueryPerformanceCounterB0001.032: Timing/DelayCheck GetTickCountB0001.006: Interrupt 0x2dB0001.017: Page ExceptionBreakpoint DetectionB0001.034: Anti-debuggingInstructionsB0001.015:NtYieldExecution/SwitchToThreadB0001.021: ProcessHeapB0001.037: ProcessEnvironment Block IsDebuggedB0001.001:API Hook DetectionB0001.004:Debugger ArtifactsB0001.012:NtQueryInformationProcessB0001.023:SeDebugPrivilegeB0001.016:OutputDebugStringB0001.008:IsDebuggerPresentB0001.022:RtlAdjustPrivilegeB0001.010:Memory Write WatchingB0001.036: ProcessEnvironment Block NtGlobalFlagB0001.002:CheckRemoteDebuggerPresentB0001.005:Hardware BreakpointsB0001.014:NtSetInformationThreadB0001.013: NtQueryObjectB0001.030:UnhandledExceptionFilterB0001.011:Monitoring ThreadB0001.020: Process JobsB0001.035: Process EnvironmentBlock BeingDebuggedB0001.019:Process Environment BlockB0002.009: Hook InterruptB0002.025: Self-UnmappingB0002.007:Get Base IndirectlyB0002.005:Code Integrity CheckB0002.024: Self-DebuggingB0002.004:Change SizeOfImageB0002.013: Malloc UseB0002.026: Static LinkingB0002.030: Use InterruptsB0002.021:Return ObfuscationB0002.003: Byte StealingB0002.011: InliningB0002.019: Pre-DebugB0002.029: Thread TimeoutB0002.023:Section MisalignmentB0002.028: TamperingB0002.018:Pipeline MisdirectionB0002.002:Break Point ClearingB0002.008: Guard PagesB0002.020:Relocate API CodeB0002.006:Exception MisdirectionB0002.022:RtlAdjustPrivilegeB0002.012: Loop EscapesB0002.014:Modify PE HeaderB0002.015: NanomitesB0002.017:Parallel ThreadsB0002.001:Block InterruptsB0002.016:Obfuscate Library UseB0002.027:Stolen API CodeB0002.010:Import ObfuscationB0003.007:Hook File SystemB0003.001:Alternative ntdll.dllB0003.009: IllusionB0003.004: Demo ModeB0003.008: Hook InterruptB0003.003:Delayed ExecutionB0003.002: Data FloodB0003.006: Encode FileB0003.010: RestartB0003.005: Drop CodeB0004.003: CheckEmulator-related Registry KeysB0004.001: Check forEmulator-related FilesB0004.004: FailedNetwork ConnectionsB0004.002:Check for WINE VersionB0005.004:Extra Loops/Time LocksB0005.001:Different Opcode SetsB0005.002:Undocumented OpcodesB0005.003:Unusual/Undocumented API CallsB0008.001: Multiple VMsF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingB0006.010:Hook memory mapping APIsB0006.001:Code Encryption in MemoryB0006.003:Hide virtual memoryB0006.005: TamperingB0006.002:Erase the PE headerB0006.004: SizeOfImageB0006.011: PatchMmGetPhysicalMemoryRangesB0006.006: Guard PagesB0006.008:Feed MisinformationB0006.009:Flow Opcode ObstructionB0006.007:On-the-Fly APIsB0007.006:Screen Resolution TestingB0007.007: Self CheckB0007.008:Timing/Date CheckB0007.005:Product Key/ID TestingB0007.009:Timing/Uptime CheckB0007.001:Check Clipboard DataB0007.003:Human User CheckB0007.002: Check FilesB0007.004:Injected DLL TestingF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXB0009.009: Check WindowsB0009.018: Modern SpecsCheck - Processor countB0009.005:Check Registry KeysB0009.006:Check Running ServicesB0009.034: InstructionTesting - CPUIDB0009.020: CheckWindows - Window sizeB0009.012:Human User CheckB0009.019: Modern SpecsCheck - Keyboard layoutB0009.011: HTML5Performance Object CheckB0009.021: CheckWindows - Unique windowsB0009.016: ModernSpecs Check - USB driveB0009.038: InstructionTesting - VPCEXTB0009.029:Instruction TestingB0009.036: InstructionTesting - RDTSCB0009.003: CheckNamed System ObjectsB0009.037: InstructionTesting - VMCPUIDB0009.017: ModernSpecs Check - PrinterB0009.013:Modern Specs CheckB0009.030: InstructionTesting - SIDT (red pill)B0009.007: Check SoftwareB0009.022: CheckWindows - Title barsB0009.032: InstructionTesting - SMSWB0009.033:Instruction Testing - STRB0009.027: Unique Hardware/FirmwareCheck - CPU LocationB0009.031: InstructionTesting - SGDT/SLDT (no pill)B0009.010:Guest Process TestingB0009.001: Check Fileand Directory ArtifactsB0009.025: Unique Hardware/FirmwareCheck - I/O Communication PortB0009.004:Check ProcessesB0009.035:Instruction Testing - INB0009.008:Check Virtual DevicesB0009.026: UniqueHardware/Firmware Check - CPU NameB0009.024: UniqueHardware/Firmware Check - BIOSB0009.015: ModernSpecs Check - Drive sizeB0009.002:Check Memory ArtifactsB0009.028: Unique Hardware/FirmwareCheck - MAC AddressB0009.014: Modern SpecsCheck - Total physical memoryB0009.023: UniqueHardware/Firmware CheckAnti-Behavioral AnalysisB0010: CallGraph Generation EvasionB0045:Data Flow Analysis EvasionB0012: Disassembler EvasionB0032:Executable Code ObfuscationB0034: ExecutableCode OptimizationB0008: ExecutableCode VirtualizationE1027: ObfuscatedFiles or InformationF0001: Software PackingB0010.001:Two-layer Function ReturnB0010.002: Invoke NTDLLSystem Calls via Encoded TableB0045.001:Control DependenceB0045.002: Implicit FlowsB0045.003: ArbitraryMemory CorruptionB0012.001:Argument ObfuscationB0012.002:Conditional MisdirectionB0012.005: VBA StompingB0012.004:Variable RecompositionB0012.003:Value Dependent JumpsB0032.001: API HashingB0032.017: Stack StringsB0032.002: Code InsertionB0032.003:Dead Code InsertionB0032.008:Data Value ObfuscationB0032.014:Interleaving CodeB0032.005: Jump InsertionB0032.004:Fake Code InsertionB0032.009:Entry Point ObfuscationB0032.007:Junk Code InsertionB0032.011: ImportAddress Table ObfuscationB0032.015:Merged Code SectionsB0032.012:Import CompressionB0032.018:Symbol ObfuscationB0032.016: StructuredException Handling (SEH)B0032.013:Instruction OverlapB0032.006:Thunk Code InsertionB0032.010: Guard PagesB0034.002: MinificationB0034.001: Jump/CallAbsolute AddressB0008.001: Multiple VMsE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXAnti-Static AnalysisB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICollectionB0030: C2 CommunicationB0031:Domain Name GenerationE1105: Ingress Tool TransferB0030.012:Directory ListingB0030.009:Request Email TemplateB0030.008:Request CommandB0030.010: RequestEmail Address ListB0030.001: Send DataB0030.007: Send HeartbeatB0030.014:Execute Shell CommandB0030.002: Receive DataB0030.016:Start Interactive ShellB0030.004: Implant toController File TransferB0030.003: Serverto Client File TransferB0030.013: Execute FileB0030.006:Send System InformationB0030.011: AuthenticateB0030.005:Check for PayloadB0030.015: File searchCommand and ControlB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICredential AccessB0027: AlternativeInstallation LocationF0013: BootkitB0037: BypassData Execution PreventionF0009: Component FirmwareB0025:Conditional ExecutionB0040: Covert LocationF0004: Disableor Evade Security ToolsE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingF0006: Indicator BlockingB0047: Install Insecureor Malicious ConfigurationE1112: Modify RegistryE1027: ObfuscatedFiles or InformationB0029: Polymorphic CodeE1055: Process InjectionE1014: RootkitF0007: Self DeletionF0001: Software PackingB0027.002:Registry InstallB0027.001:Fileless MalwareB0037.001: ROP ChainsF0009.001:Router FirmwareB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0040.001:Hide Data in RegistryB0040.002: SteganographyF0004.008: Heavens GateF0004.005: Modify PolicyF0004.004: AMSI BypassF0004.009:Disable Code IntegrityF0004.001: DisableKernel Patch ProtectionF0004.002: Disable SystemFile Overwrite ProtectionF0004.007: BypassWindows File ProtectionF0004.006:Force Lazy WritingF0004.003: Unhook APIsE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0006.001: RemoveSMS Warning MessagesE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmB0029.001: Packer StubB0029.003:Code ReorderingB0029.002:Call IndirectionsE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsE1014.m15:Hypervisor/Virtualized RootkitE1014.m14:Hardware/Firmware RootkitE1014.m12:Application RootkitE1014.m17: Memory RootkitE1014.m16:Kernel Mode RootkitE1014.m13: BootloaderF0007.001: COMSPECEnvironment VariableF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXDefense EvasionB0013:Analysis Tool DiscoveryE1010: ApplicationWindow DiscoveryB0046: Code DiscoveryE1083: Fileand Directory DiscoveryB0038: Self DiscoveryB0014:SMTP Connection DiscoveryE1082: SystemInformation DiscoveryB0043: Taskbar DiscoveryB0013.002: Processdetection - DebuggersB0013.004: Processdetection - PCAP UtilitiesB0013.005: Process detection- Process UtilitiesB0013.003: Process detection- SysInternals Suite ToolsB0013.006: Processdetection - PE UtilitiesB0013.001:Process detectionB0013.008:Known File LocationB0013.009: Known WindowB0013.007: Processdetection - SandboxesE1010.m01: Window TextB0046.001:Enumerate PE SectionsB0046.003:Parse PE HeaderB0046.002: InspectSection Memory PermissionsE1083.m01: Log FileE1082.m01: GenerateWindows ExceptionDiscoveryE1059: Commandand Scripting InterpreterB0025:Conditional ExecutionB0044: Execution DependencyE1203: Exploitationfor Client ExecutionB0023:Install Additional ProgramB0024: PreventConcurrent ExecutionB0011: Remote CommandsB0020: Send EmailB0021:Send Poisoned Text MessageE1569: System ServicesE1204: User InteractionB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsB0011.001: Delete FileB0011.003: ExecuteB0011.005: SleepB0011.006: UninstallB0011.007: Upload FileB0011.004: ShutdownB0011.002: Download FileE1569.m01: MSDTCExecutionE1560:Archive Collected DataE1020:Automated ExfiltrationE1560.m03: Encoding- Standard EncodingE1560.m05: Encryption- Standard EncryptionE1560.m06: Encryption- Custom EncryptionE1560.m01: EncodingE1560.m04: Encoding- Custom EncodingE1560.m02: EncryptionE1020.m01: Exfiltratevia File Hosting ServiceExfiltrationE1510:Clipboard ModificationF0009: Component FirmwareB0016:Compromise Data IntegrityE1485: Data DestructionE1486:Data Encrypted for ImpactB0033: Denial of ServiceB0017: Destroy HardwareF0014: Disk WipeE1190: Exploit Kit BehaviorE1203: Exploitationfor Client ExecutionE1472: Generate FraudulentAdvertising RevenueB0019:Manipulate Network TrafficB0042: Modify HardwareB0022: Remote AccessB0018: Resource HijackingB0039: SpammingF0009.001:Router FirmwareE1485.m02:Empty Recycle BinE1485.m03: DeleteApplication/SoftwareE1485.m04:Delete Shadow CopiesE1486.001: Ransom NoteE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsE1472.m01:Click HijackingE1472.m02: AdvertisementReplacement FraudB0042.002: MouseB0042.001: CDROMB0042.003: PrinterB0022.001: Reverse ShellB0018.002: CryptojackingB0018.001:Password CrackingImpactB0026:Malicious Network DriverE1105: Ingress Tool TransferB0020: Send EmailB0021:Send Poisoned Text MessageE1195:Supply Chain CompromiseE1195.m02:Exploit Private APIsE1195.m01: AbuseEnterprise CertificatesLateral MovementC0011: DNS CommunicationC0004: FTP CommunicationC0002: HTTP CommunicationC0014: ICMP CommunicationC0003:Interprocess CommunicationC0012: SMTP CommunicationC0001: Socket CommunicationC0005: WinINetC0011.004: ResolveTLD::DNS CommunicationC0011.003: DDNS DomainConnect::DNS CommunicationC0011.005: Resolve Free HostingDomain::DNS CommunicationC0011.001: Resolve::DNSCommunicationC0011.002: ServerConnect::DNS CommunicationC0004.001: SendFile::FTP CommunicationC0004.002: WinINet::FTPCommunicationC0002.002: Client::HTTPCommunicationC0002.009: Connect toServer::HTTP CommunicationC0002.017: GetResponse::HTTP CommunicationC0002.003: SendRequest::HTTP CommunicationC0002.004: OpenURL::HTTP CommunicationC0002.007: WinINet::HTTPCommunicationC0002.015: ReceiveRequest::HTTP CommunicationC0002.013: SetHeader::HTTP CommunicationC0002.005: SendData::HTTP CommunicationC0002.010: IWebBrowser::HTTPCommunicationC0002.016: SendResponse::HTTP CommunicationC0002.012: CreateRequest::HTTP CommunicationC0002.001: Server::HTTPCommunicationC0002.011: ExtractBody::HTTP CommunicationC0002.014: ReadHeader::HTTP CommunicationC0002.008: WinHTTP::HTTPCommunicationC0002.018: StartServer::HTTP CommunicationC0002.006: DownloadURL::HTTP CommunicationC0014.002: EchoRequest::ICMP CommunicationC0014.001: GenerateTraffic::ICMP CommunicationC0003.001: CreatePipe::Interprocess CommunicationC0003.003: ReadPipe::Interprocess CommunicationC0003.004: WritePipe::Interprocess CommunicationC0003.002: ConnectPipe::Interprocess CommunicationC0012.002: Request::SMTPCommunicationC0012.001: ServerConnect::SMTP CommunicationC0001.015: Send UDPData::Socket CommunicationC0001.016: Receive TCPData::Socket CommunicationC0001.005: Start TCPServer::Socket CommunicationC0001.006: ReceiveData::Socket CommunicationC0001.013: UDPClient::Socket CommunicationC0001.012: Get SocketStatus::Socket CommunicationC0001.017: Receive UDPData::Socket CommunicationC0001.007: SendData::Socket CommunicationC0001.014: Send TCPData::Socket CommunicationC0001.009: Initialize WinsockLibrary::Socket CommunicationC0001.008: TCPClient::Socket CommunicationC0001.004: ConnectSocket::Socket CommunicationC0001.011: Create TCPSocket::Socket CommunicationC0001.003: CreateSocket::Socket CommunicationC0001.001: Set SocketConfig::Socket CommunicationC0001.010: Create UDPSocket::Socket CommunicationC0001.002: TCPServer::Socket CommunicationC0005.002:InternetOpen::WinINetC0005.003:InternetOpenURL::WinINetC0005.005:InternetWriteFile::WinINetC0005.004:InternetReadFile::WinINetC0005.001:InternetConnect::WinINetCommunicationMicro-objectiveC0059: Crypto LibraryC0029: Cryptographic HashC0031: Decrypt DataC0027: Encrypt DataC0028: Encryption KeyC0021: GeneratePseudo-random SequenceC0061: HashedMessage Authentication CodeC0029.002:SHA1::Cryptographic HashC0029.003:SHA256::Cryptographic HashC0029.004:SHA224::Cryptographic HashC0029.001:MD5::Cryptographic HashC0029.006:Snefru::Cryptographic HashC0029.005:Tiger::Cryptographic HashC0031.014:Twofish::Decrypt DataC0031.011:Skipjack::Decrypt DataC0031.003:Blowfish::Decrypt DataC0031.006:HC-128::Decrypt DataC0031.001:AES::Decrypt DataC0031.008:RC4::Decrypt DataC0031.013: StreamCipher::Decrypt DataC0031.002: BlockCipher::Decrypt DataC0031.004:Camellia::Decrypt DataC0031.007:HC-256::Decrypt DataC0031.005:3DES::Decrypt DataC0031.012:Sosemanuk::Decrypt DataC0031.009:RC6::Decrypt DataC0031.010:RSA::Decrypt DataC0027.011:RSA::Encrypt DataC0027.014: BlockCipher::Encrypt DataC0027.001:AES::Encrypt DataC0027.012: StreamCipher::Encrypt DataC0027.010:RC6::Encrypt DataC0027.003:Camellia::Encrypt DataC0027.007:HC-256::Encrypt DataC0027.005:Twofish::Encrypt DataC0027.002:Blowfish::Encrypt DataC0027.006:HC-128::Encrypt DataC0027.013:Skipjack::Encrypt DataC0027.009:RC4::Encrypt DataC0027.004:3DES::Encrypt DataC0027.008:Sosemanuk::Encrypt DataC0028.001: Import PublicKey::Encryption KeyC0028.002:RC4 KSA::Encryption KeyC0021.001: GetTickCount::GeneratePseudo-random SequenceC0021.005: Mersenne Twister::GeneratePseudo-random SequenceC0021.003: Use API::GeneratePseudo-random SequenceC0021.002: rand::GeneratePseudo-random SequenceC0021.004: RC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveC0019: Check StringC0032: ChecksumC0024: Compress DataC0060: Compression LibraryC0053: Decode DataC0025: Decompress DataC0026: Encode DataC0058: ModuloC0030:Non-Cryptographic HashC0020: Use ConstantC0032.003: BSD::ChecksumC0032.002: Luhn::ChecksumC0032.001:CRC32::ChecksumC0032.005:Adler::ChecksumC0032.004:Verhoeff::ChecksumC0024.001:QuickLZ::Compress DataC0024.002:IEncodingFilterFactory::Compress DataC0053.001:Base64::Decode DataC0053.002:XOR::Decode DataC0025.003:aPLib::Decompress DataC0025.002:IEncodingFilterFactory::DecompressDataC0025.001:QuickLZ::Decompress DataC0026.002:XOR::Encode DataC0026.001:Base64::Encode DataC0030.003:Fast-Hash::Non-Cryptographic HashC0030.001:MurmurHash::Non-Cryptographic HashC0030.004:dhash::Non-Cryptographic HashC0030.002:pHash::Non-Cryptographic HashC0030.005:FNV::Non-Cryptographic HashData Micro-objectiveC0015: Alter File ExtensionC0045: Copy FileC0046: Create DirectoryC0016: Create FileC0048: Delete DirectoryC0047: Delete FileC0049: Get File AttributesC0063: Move FileC0051: Read FileC0056: Read Virtual DiskC0050: Set File AttributesC0052: Writes FileC0015.001: AppendExtension::Alter File ExtensionC0016.001: Create OfficeDocument::Create FileC0016.002: CreateRansomware File::Create FileFile System Micro-objectiveC0037: Install DriverC0023: Load DriverC0057: Simulate HardwareC0037.001:Minifilter::Install DriverC0023.001:Minifilter::Load DriverC0057.002: MouseClick::Simulate HardwareC0057.001:Ctrl-Alt-Del::Simulate HardwareHardware Micro-objectiveC0007: Allocate MemoryC0008:Change Memory ProtectionC0044: Free MemoryC0006: Heap SprayC0010: Overflow BufferC0009: Stack PivotC0008.001: ExecutableStack::Change Memory ProtectionC0008.002: ExecutableHeap::Change Memory ProtectionMemory Micro-objectiveC0033: ConsoleC0034: Environment VariableC0036: RegistryC0035: WallpaperC0034.002: GetVariable::Environment VariableC0034.001: SetVariable::Environment VariableC0036.004: CreateRegistry Key::RegistryC0036.002: DeleteRegistry Key::RegistryC0036.001: SetRegistry Key::RegistryC0036.005: QueryRegistry Key::RegistryC0036.007: DeleteRegistry Value::RegistryC0036.003: OpenRegistry Key::RegistryC0036.006: QueryRegistry Value::RegistryOperatingSystem Micro-objectiveC0040: AllocateThread Local StorageC0043: Check MutexC0042: Create MutexC0017: Create ProcessC0038: Create ThreadC0064: Enumerate ThreadsC0065: Open ProcessC0066: Open ThreadC0054: Resume ThreadC0041: SetThread Local Storage ValueC0055: Suspend ThreadC0022: SynchronizationC0018: Terminate ProcessC0039: Terminate ThreadC0017.001: Create Processvia Shellcode::Create ProcessC0017.003: Create SuspendedProcess::Create ProcessC0017.002: Create Processvia WMI::Create ProcessC0022.001: CreateMutex::SynchronizationProcess Micro-objectiveF0013: BootkitF0009: Component FirmwareE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingB0047: Install Insecureor Malicious ConfigurationF0010: KernelModules and ExtensionsB0026:Malicious Network DriverF0011:Modify Existing ServiceE1112: Modify RegistryF0012: RegistryRun Keys / Startup FolderB0022: Remote AccessE1105: Ingress Tool TransferB0035: Shutdown EventF0009.001:Router FirmwareE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverB0022.001: Reverse ShellPersistenceF0015:Hijack Execution FlowF0003: HookingF0010: KernelModules and ExtensionsF0011:Modify Existing ServiceE1055: Process InjectionF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsPrivilege Escalation diff --git a/yfaq/mbc_matrix_without_ids.svg b/yfaq/mbc_matrix_without_ids.svg index 1b3633a..50d7e00 100644 --- a/yfaq/mbc_matrix_without_ids.svg +++ b/yfaq/mbc_matrix_without_ids.svg @@ -1 +1 @@ -Capture EvasionConditional ExecutionDebugger DetectionDebugger EvasionDynamic Analysis EvasionEmulator DetectionEmulator EvasionExecutableCode VirtualizationHookingMemory Dump EvasionSandbox DetectionSoftware PackingVirtual Machine DetectionMultipleStages of LoadersMemory-only PayloadEncrypted PayloadsRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckCloseHandleWudfIsAnyDebuggerPresentSoftware BreakpointsTIB AwareTiming/Delay CheckSetHandleInformationInterrupt 1TLS CallbacksParent ProcessMemory BreakpointsStack CanaryTiming/Delay CheckQueryPerformanceCounterTiming/DelayCheck GetTickCountInterrupt 0x2dPage ExceptionBreakpoint DetectionAnti-debuggingInstructionsNtYieldExecution/SwitchToThreadProcessHeapProcess EnvironmentBlock IsDebuggedAPI Hook DetectionDebugger ArtifactsNtQueryInformationProcessSeDebugPrivilegeOutputDebugStringIsDebuggerPresentRtlAdjustPrivilegeMemory Write WatchingProcess EnvironmentBlock NtGlobalFlagCheckRemoteDebuggerPresentHardware BreakpointsNtSetInformationThreadNtQueryObjectUnhandledExceptionFilterMonitoring ThreadProcess JobsProcess EnvironmentBlock BeingDebuggedProcess Environment BlockHook InterruptSelf-UnmappingGet Base IndirectlyCode Integrity CheckSelf-DebuggingChange SizeOfImageMalloc UseStatic LinkingUse InterruptsReturn ObfuscationByte StealingInliningPre-DebugThread TimeoutSection MisalignmentTamperingPipeline MisdirectionBreak Point ClearingGuard PagesRelocate API CodeException MisdirectionRtlAdjustPrivilegeLoop EscapesModify PE HeaderNanomitesParallel ThreadsBlock InterruptsObfuscate Library UseStolen API CodeImport ObfuscationHook File SystemAlternative ntdll.dllIllusionDemo ModeHook InterruptDelayed ExecutionData FloodEncode FileRestartDrop CodeCheck Emulator-relatedRegistry KeysCheck forEmulator-related FilesFailedNetwork ConnectionsCheck for WINE VersionExtra Loops/Time LocksDifferent Opcode SetsUndocumented OpcodesUnusual/UndocumentedAPI CallsMultiple VMsProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingHook memory mapping APIsCode Encryption in MemoryHide virtual memoryTamperingErase the PE headerSizeOfImagePatchMmGetPhysicalMemoryRangesGuard PagesFeed MisinformationFlow Opcode ObstructionOn-the-Fly APIsScreen Resolution TestingSelf CheckTiming/Date CheckProduct Key/ID TestingTiming/Uptime CheckCheck Clipboard DataHuman User CheckCheck FilesInjected DLL TestingConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXCheck WindowsModern SpecsCheck - Processor countCheck Registry KeysCheck Running ServicesInstructionTesting - CPUIDCheckWindows - Window sizeHuman User CheckModern SpecsCheck - Keyboard layoutHTML5Performance Object CheckCheckWindows - Unique windowsModernSpecs Check - USB driveInstructionTesting - VPCEXTInstruction TestingInstructionTesting - RDTSCCheckNamed System ObjectsInstructionTesting - VMCPUIDModernSpecs Check - PrinterModern Specs CheckInstructionTesting - SIDT (red pill)Check SoftwareCheckWindows - Title barsInstructionTesting - SMSWInstruction Testing - STRUnique Hardware/FirmwareCheck - CPU LocationInstruction Testing- SGDT/SLDT (no pill)Guest Process TestingCheck Fileand Directory ArtifactsUnique Hardware/FirmwareCheck - I/O Communication PortCheck ProcessesInstruction Testing - INCheck Virtual DevicesUnique Hardware/FirmwareCheck - CPU NameUnique Hardware/FirmwareCheck - BIOSModernSpecs Check - Drive sizeCheck Memory ArtifactsUnique Hardware/FirmwareCheck - MAC AddressModern Specs Check- Total physical memoryUniqueHardware/Firmware CheckAnti-Behavioral AnalysisCallGraph Generation EvasionData Flow Analysis EvasionDisassembler EvasionExecutable Code ObfuscationExecutableCode OptimizationExecutableCode VirtualizationObfuscatedFiles or InformationSoftware PackingTwo-layer Function ReturnInvoke NTDLL SystemCalls via Encoded TableControl DependenceImplicit FlowsArbitraryMemory CorruptionArgument ObfuscationConditional MisdirectionVBA StompingVariable RecompositionValue Dependent JumpsAPI HashingStack StringsCode InsertionDead Code InsertionData Value ObfuscationInterleaving CodeJump InsertionFake Code InsertionEntry Point ObfuscationJunk Code InsertionImportAddress Table ObfuscationMerged Code SectionsImport CompressionSymbol ObfuscationStructuredException Handling (SEH)Instruction OverlapThunk Code InsertionGuard PagesMinificationJump/CallAbsolute AddressMultiple VMsEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXAnti-Static AnalysisCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICollectionC2 CommunicationDomain Name GenerationIngress Tool TransferDirectory ListingRequest Email TemplateRequest CommandRequestEmail Address ListSend DataSend HeartbeatExecute Shell CommandReceive DataStart Interactive ShellImplant toController File TransferServerto Client File TransferExecute FileSend System InformationAuthenticateCheck for PayloadFile searchCommand and ControlCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICredential AccessAlternativeInstallation LocationBootkitBypassData Execution PreventionComponent FirmwareConditional ExecutionCovert LocationDisableor Evade Security ToolsHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingIndicator BlockingInstall Insecureor Malicious ConfigurationModify RegistryObfuscatedFiles or InformationPolymorphic CodeProcess InjectionRootkitSelf DeletionSoftware PackingRegistry InstallFileless MalwareROP ChainsRouter FirmwareRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckHide Data in RegistrySteganographyHeavens GateModify PolicyAMSI BypassDisable Code IntegrityDisableKernel Patch ProtectionDisable SystemFile Overwrite ProtectionBypassWindows File ProtectionForce Lazy WritingUnhook APIsHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingRemoveSMS Warning MessagesEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmPacker StubCode ReorderingCall IndirectionsPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsHypervisor/VirtualizedRootkitHardware/Firmware RootkitApplication RootkitMemory RootkitKernel Mode RootkitBootloaderCOMSPECEnvironment VariableConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXDefense EvasionAnalysis Tool DiscoveryApplicationWindow DiscoveryCode DiscoveryFileand Directory DiscoverySelf DiscoverySMTP Connection DiscoverySystemInformation DiscoveryTaskbar DiscoveryProcessdetection - DebuggersProcess detection- PCAP UtilitiesProcess detection- Process UtilitiesProcess detection -SysInternals Suite ToolsProcessdetection - PE UtilitiesProcess detectionKnown File LocationKnown WindowProcessdetection - SandboxesWindow TextEnumerate PE SectionsParse PE HeaderInspect SectionMemory PermissionsLog FileGenerateWindows ExceptionDiscoveryCommandand Scripting InterpreterConditional ExecutionExecution DependencyExploitationfor Client ExecutionInstall Additional ProgramPreventConcurrent ExecutionRemote CommandsSend EmailSend Poisoned Text MessageSystem ServicesUser InteractionRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsDelete FileExecuteSleepUninstallUpload FileShutdownDownload FileMSDTCExecutionArchive Collected DataAutomated ExfiltrationEncoding- Standard EncodingEncryption- Standard EncryptionEncryption- Custom EncryptionEncodingEncoding- Custom EncodingEncryptionExfiltratevia File Hosting ServiceExfiltrationClipboard ModificationComponent FirmwareCompromise Data IntegrityData DestructionData Encrypted for ImpactDenial of ServiceDestroy HardwareDisk WipeExploit Kit BehaviorExploitationfor Client ExecutionGenerate FraudulentAdvertising RevenueManipulate Network TrafficModify HardwareRemote AccessResource HijackingSpammingRouter FirmwareEmpty Recycle BinDeleteApplication/SoftwareDelete Shadow CopiesRansom NoteRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsClick HijackingAdvertisementReplacement FraudMouseCDROMPrinterReverse ShellCryptojackingPassword CrackingImpactMalicious Network DriverIngress Tool TransferSend EmailSend Poisoned Text MessageSupply Chain CompromiseExploit Private APIsAbuseEnterprise CertificatesLateral MovementDNS CommunicationFTP CommunicationHTTP CommunicationICMP CommunicationInterprocess CommunicationSMTP CommunicationSocket CommunicationWinINetResolveTLD::DNS CommunicationDDNS Domain Connect::DNSCommunicationResolve Free HostingDomain::DNS CommunicationResolve::DNSCommunicationServer Connect::DNSCommunicationSendFile::FTP CommunicationWinINet::FTPCommunicationClient::HTTPCommunicationConnect to Server::HTTPCommunicationGet Response::HTTPCommunicationSend Request::HTTPCommunicationOpenURL::HTTP CommunicationWinINet::HTTPCommunicationReceive Request::HTTPCommunicationSet Header::HTTPCommunicationSendData::HTTP CommunicationIWebBrowser::HTTPCommunicationSend Response::HTTPCommunicationCreate Request::HTTPCommunicationServer::HTTPCommunicationExtractBody::HTTP CommunicationRead Header::HTTPCommunicationWinHTTP::HTTPCommunicationStart Server::HTTPCommunicationDownloadURL::HTTP CommunicationEcho Request::ICMPCommunicationGenerate Traffic::ICMPCommunicationCreate Pipe::InterprocessCommunicationRead Pipe::InterprocessCommunicationWrite Pipe::InterprocessCommunicationConnect Pipe::InterprocessCommunicationRequest::SMTPCommunicationServer Connect::SMTPCommunicationSend UDP Data::SocketCommunicationReceive TCP Data::SocketCommunicationStart TCP Server::SocketCommunicationReceive Data::SocketCommunicationUDP Client::SocketCommunicationGet Socket Status::SocketCommunicationReceive UDP Data::SocketCommunicationSend Data::SocketCommunicationSend TCP Data::SocketCommunicationInitialize WinsockLibrary::Socket CommunicationTCP Client::SocketCommunicationConnect Socket::SocketCommunicationCreate TCP Socket::SocketCommunicationCreate Socket::SocketCommunicationSet Socket Config::SocketCommunicationCreate UDP Socket::SocketCommunicationTCP Server::SocketCommunicationInternetOpen::WinINetInternetOpenURL::WinINetInternetWriteFile::WinINetInternetReadFile::WinINetInternetConnect::WinINetCommunicationMicro-objectiveCrypto LibraryCryptographic HashDecrypt DataEncrypt DataEncryption KeyGeneratePseudo-random SequenceHashedMessage Authentication CodeSHA1::Cryptographic HashSHA256::CryptographicHashSHA224::CryptographicHashMD5::Cryptographic HashSnefru::CryptographicHashTiger::Cryptographic HashTwofish::Decrypt DataSkipjack::Decrypt DataBlowfish::Decrypt DataHC-128::Decrypt DataAES::Decrypt DataRC4::Decrypt DataStreamCipher::Decrypt DataBlockCipher::Decrypt DataCamellia::Decrypt DataHC-256::Decrypt Data3DES::Decrypt DataSosemanuk::Decrypt DataRC6::Decrypt DataRSA::Decrypt DataRSA::Encrypt DataBlockCipher::Encrypt DataAES::Encrypt DataStreamCipher::Encrypt DataRC6::Encrypt DataCamellia::Encrypt DataHC-256::Encrypt DataTwofish::Encrypt DataBlowfish::Encrypt DataHC-128::Encrypt DataSkipjack::Encrypt DataRC4::Encrypt Data3DES::Encrypt DataSosemanuk::Encrypt DataImport PublicKey::Encryption KeyRC4 KSA::Encryption KeyGetTickCount::GeneratePseudo-random SequenceMersenne Twister::GeneratePseudo-random SequenceUse API::GeneratePseudo-random Sequencerand::GeneratePseudo-random SequenceRC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveCheck StringChecksumCompress DataCompression LibraryDecode DataDecompress DataEncode DataModuloNon-Cryptographic HashUse ConstantBSD::ChecksumLuhn::ChecksumCRC32::ChecksumAdler::ChecksumVerhoeff::ChecksumQuickLZ::Compress DataIEncodingFilterFactory::CompressDataBase64::Decode DataXOR::Decode DataaPLib::Decompress DataIEncodingFilterFactory::DecompressDataQuickLZ::Decompress DataXOR::Encode DataBase64::Encode DataFast-Hash::Non-CryptographicHashMurmurHash::Non-CryptographicHashdhash::Non-CryptographicHashpHash::Non-CryptographicHashFNV::Non-CryptographicHashData Micro-objectiveAlter File ExtensionCopy FileCreate DirectoryCreate FileDelete DirectoryDelete FileGet File AttributesMove FileRead FileRead Virtual DiskSet File AttributesWrites FileAppend Extension::AlterFile ExtensionCreate OfficeDocument::Create FileCreate RansomwareFile::Create FileFile System Micro-objectiveInstall DriverLoad DriverSimulate HardwareMinifilter::InstallDriverMinifilter::Load DriverMouseClick::Simulate HardwareCtrl-Alt-Del::SimulateHardwareHardware Micro-objectiveAllocate MemoryChange Memory ProtectionFree MemoryHeap SprayOverflow BufferStack PivotExecutable Stack::ChangeMemory ProtectionExecutable Heap::ChangeMemory ProtectionMemory Micro-objectiveConsoleEnvironment VariableRegistryWallpaperGet Variable::EnvironmentVariableSet Variable::EnvironmentVariableCreateRegistry Key::RegistryDeleteRegistry Key::RegistrySetRegistry Key::RegistryQueryRegistry Key::RegistryDeleteRegistry Value::RegistryOpenRegistry Key::RegistryQueryRegistry Value::RegistryOperatingSystem Micro-objectiveAllocateThread Local StorageCheck MutexCreate MutexCreate ProcessCreate ThreadEnumerate ThreadsOpen ProcessOpen ThreadResume ThreadSetThread Local Storage ValueSuspend ThreadSynchronizationTerminate ProcessTerminate ThreadCreate Process viaShellcode::Create ProcessCreate SuspendedProcess::Create ProcessCreate Processvia WMI::Create ProcessCreateMutex::SynchronizationProcess Micro-objectiveBootkitComponent FirmwareHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingInstall Insecureor Malicious ConfigurationKernelModules and ExtensionsMalicious Network DriverModify Existing ServiceModify RegistryRegistryRun Keys / Startup FolderRemote AccessIngress Tool TransferShutdown EventRouter FirmwareHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverReverse ShellPersistenceHijack Execution FlowHookingKernelModules and ExtensionsModify Existing ServiceProcess InjectionImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsPrivilege Escalation +Capture EvasionConditional ExecutionDebugger DetectionDebugger EvasionDynamic Analysis EvasionEmulator DetectionEmulator EvasionExecutableCode VirtualizationHookingMemory Dump EvasionSandbox DetectionSoftware PackingVirtual Machine DetectionMultipleStages of LoadersMemory-only PayloadEncrypted PayloadsRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckCloseHandleWudfIsAnyDebuggerPresentSoftware BreakpointsTIB AwareTiming/Delay CheckSetHandleInformationInterrupt 1TLS CallbacksParent ProcessMemory BreakpointsStack CanaryTiming/Delay CheckQueryPerformanceCounterTiming/DelayCheck GetTickCountInterrupt 0x2dPage ExceptionBreakpoint DetectionAnti-debuggingInstructionsNtYieldExecution/SwitchToThreadProcessHeapProcess EnvironmentBlock IsDebuggedAPI Hook DetectionDebugger ArtifactsNtQueryInformationProcessSeDebugPrivilegeOutputDebugStringIsDebuggerPresentRtlAdjustPrivilegeMemory Write WatchingProcess EnvironmentBlock NtGlobalFlagCheckRemoteDebuggerPresentHardware BreakpointsNtSetInformationThreadNtQueryObjectUnhandledExceptionFilterMonitoring ThreadProcess JobsProcess EnvironmentBlock BeingDebuggedProcess Environment BlockHook InterruptSelf-UnmappingGet Base IndirectlyCode Integrity CheckSelf-DebuggingChange SizeOfImageMalloc UseStatic LinkingUse InterruptsReturn ObfuscationByte StealingInliningPre-DebugThread TimeoutSection MisalignmentTamperingPipeline MisdirectionBreak Point ClearingGuard PagesRelocate API CodeException MisdirectionRtlAdjustPrivilegeLoop EscapesModify PE HeaderNanomitesParallel ThreadsBlock InterruptsObfuscate Library UseStolen API CodeImport ObfuscationHook File SystemAlternative ntdll.dllIllusionDemo ModeHook InterruptDelayed ExecutionData FloodEncode FileRestartDrop CodeCheck Emulator-relatedRegistry KeysCheck forEmulator-related FilesFailedNetwork ConnectionsCheck for WINE VersionExtra Loops/Time LocksDifferent Opcode SetsUndocumented OpcodesUnusual/UndocumentedAPI CallsMultiple VMsProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingHook memory mapping APIsCode Encryption in MemoryHide virtual memoryTamperingErase the PE headerSizeOfImagePatchMmGetPhysicalMemoryRangesGuard PagesFeed MisinformationFlow Opcode ObstructionOn-the-Fly APIsScreen Resolution TestingSelf CheckTiming/Date CheckProduct Key/ID TestingTiming/Uptime CheckCheck Clipboard DataHuman User CheckCheck FilesInjected DLL TestingConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXCheck WindowsModern SpecsCheck - Processor countCheck Registry KeysCheck Running ServicesInstructionTesting - CPUIDCheckWindows - Window sizeHuman User CheckModern SpecsCheck - Keyboard layoutHTML5Performance Object CheckCheckWindows - Unique windowsModernSpecs Check - USB driveInstructionTesting - VPCEXTInstruction TestingInstructionTesting - RDTSCCheckNamed System ObjectsInstructionTesting - VMCPUIDModernSpecs Check - PrinterModern Specs CheckInstructionTesting - SIDT (red pill)Check SoftwareCheckWindows - Title barsInstructionTesting - SMSWInstruction Testing - STRUnique Hardware/FirmwareCheck - CPU LocationInstruction Testing- SGDT/SLDT (no pill)Guest Process TestingCheck Fileand Directory ArtifactsUnique Hardware/FirmwareCheck - I/O Communication PortCheck ProcessesInstruction Testing - INCheck Virtual DevicesUnique Hardware/FirmwareCheck - CPU NameUnique Hardware/FirmwareCheck - BIOSModernSpecs Check - Drive sizeCheck Memory ArtifactsUnique Hardware/FirmwareCheck - MAC AddressModern Specs Check- Total physical memoryUniqueHardware/Firmware CheckAnti-Behavioral AnalysisCallGraph Generation EvasionData Flow Analysis EvasionDisassembler EvasionExecutable Code ObfuscationExecutableCode OptimizationExecutableCode VirtualizationObfuscatedFiles or InformationSoftware PackingTwo-layer Function ReturnInvoke NTDLL SystemCalls via Encoded TableControl DependenceImplicit FlowsArbitraryMemory CorruptionArgument ObfuscationConditional MisdirectionVBA StompingVariable RecompositionValue Dependent JumpsAPI HashingStack StringsCode InsertionDead Code InsertionData Value ObfuscationInterleaving CodeJump InsertionFake Code InsertionEntry Point ObfuscationJunk Code InsertionImportAddress Table ObfuscationMerged Code SectionsImport CompressionSymbol ObfuscationStructuredException Handling (SEH)Instruction OverlapThunk Code InsertionGuard PagesMinificationJump/CallAbsolute AddressMultiple VMsEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXAnti-Static AnalysisCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICollectionC2 CommunicationDomain Name GenerationIngress Tool TransferDirectory ListingRequest Email TemplateRequest CommandRequestEmail Address ListSend DataSend HeartbeatExecute Shell CommandReceive DataStart Interactive ShellImplant toController File TransferServerto Client File TransferExecute FileSend System InformationAuthenticateCheck for PayloadFile searchCommand and ControlCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICredential AccessAlternativeInstallation LocationBootkitBypassData Execution PreventionComponent FirmwareConditional ExecutionCovert LocationDisableor Evade Security ToolsHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingIndicator BlockingInstall Insecureor Malicious ConfigurationModify RegistryObfuscatedFiles or InformationPolymorphic CodeProcess InjectionRootkitSelf DeletionSoftware PackingRegistry InstallFileless MalwareROP ChainsRouter FirmwareRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckHide Data in RegistrySteganographyHeavens GateModify PolicyAMSI BypassDisable Code IntegrityDisableKernel Patch ProtectionDisable SystemFile Overwrite ProtectionBypassWindows File ProtectionForce Lazy WritingUnhook APIsHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingRemoveSMS Warning MessagesEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmPacker StubCode ReorderingCall IndirectionsPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsHypervisor/VirtualizedRootkitHardware/Firmware RootkitApplication RootkitMemory RootkitKernel Mode RootkitBootloaderCOMSPECEnvironment VariableConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXDefense EvasionAnalysis Tool DiscoveryApplicationWindow DiscoveryCode DiscoveryFileand Directory DiscoverySelf DiscoverySMTP Connection DiscoverySystemInformation DiscoveryTaskbar DiscoveryProcessdetection - DebuggersProcess detection- PCAP UtilitiesProcess detection- Process UtilitiesProcess detection -SysInternals Suite ToolsProcessdetection - PE UtilitiesProcess detectionKnown File LocationKnown WindowProcessdetection - SandboxesWindow TextEnumerate PE SectionsParse PE HeaderInspect SectionMemory PermissionsLog FileGenerateWindows ExceptionDiscoveryCommandand Scripting InterpreterConditional ExecutionExecution DependencyExploitationfor Client ExecutionInstall Additional ProgramPreventConcurrent ExecutionRemote CommandsSend EmailSend Poisoned Text MessageSystem ServicesUser InteractionRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsDelete FileExecuteSleepUninstallUpload FileShutdownDownload FileMSDTCExecutionArchive Collected DataAutomated ExfiltrationEncoding- Standard EncodingEncryption- Standard EncryptionEncryption- Custom EncryptionEncodingEncoding- Custom EncodingEncryptionExfiltratevia File Hosting ServiceExfiltrationClipboard ModificationComponent FirmwareCompromise Data IntegrityData DestructionData Encrypted for ImpactDenial of ServiceDestroy HardwareDisk WipeExploit Kit BehaviorExploitationfor Client ExecutionGenerate FraudulentAdvertising RevenueManipulate Network TrafficModify HardwareRemote AccessResource HijackingSpammingRouter FirmwareEmpty Recycle BinDeleteApplication/SoftwareDelete Shadow CopiesRansom NoteRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsClick HijackingAdvertisementReplacement FraudMouseCDROMPrinterReverse ShellCryptojackingPassword CrackingImpactMalicious Network DriverIngress Tool TransferSend EmailSend Poisoned Text MessageSupply Chain CompromiseExploit Private APIsAbuseEnterprise CertificatesLateral MovementDNS CommunicationFTP CommunicationHTTP CommunicationICMP CommunicationInterprocess CommunicationSMTP CommunicationSocket CommunicationWinINetResolveTLD::DNS CommunicationDDNS Domain Connect::DNSCommunicationResolve Free HostingDomain::DNS CommunicationResolve::DNSCommunicationServer Connect::DNSCommunicationSendFile::FTP CommunicationWinINet::FTPCommunicationClient::HTTPCommunicationConnect to Server::HTTPCommunicationGet Response::HTTPCommunicationSend Request::HTTPCommunicationOpenURL::HTTP CommunicationWinINet::HTTPCommunicationReceive Request::HTTPCommunicationSet Header::HTTPCommunicationSendData::HTTP CommunicationIWebBrowser::HTTPCommunicationSend Response::HTTPCommunicationCreate Request::HTTPCommunicationServer::HTTPCommunicationExtractBody::HTTP CommunicationRead Header::HTTPCommunicationWinHTTP::HTTPCommunicationStart Server::HTTPCommunicationDownloadURL::HTTP CommunicationEcho Request::ICMPCommunicationGenerate Traffic::ICMPCommunicationCreate Pipe::InterprocessCommunicationRead Pipe::InterprocessCommunicationWrite Pipe::InterprocessCommunicationConnect Pipe::InterprocessCommunicationRequest::SMTPCommunicationServer Connect::SMTPCommunicationSend UDP Data::SocketCommunicationReceive TCP Data::SocketCommunicationStart TCP Server::SocketCommunicationReceive Data::SocketCommunicationUDP Client::SocketCommunicationGet Socket Status::SocketCommunicationReceive UDP Data::SocketCommunicationSend Data::SocketCommunicationSend TCP Data::SocketCommunicationInitialize WinsockLibrary::Socket CommunicationTCP Client::SocketCommunicationConnect Socket::SocketCommunicationCreate TCP Socket::SocketCommunicationCreate Socket::SocketCommunicationSet Socket Config::SocketCommunicationCreate UDP Socket::SocketCommunicationTCP Server::SocketCommunicationInternetOpen::WinINetInternetOpenURL::WinINetInternetWriteFile::WinINetInternetReadFile::WinINetInternetConnect::WinINetCommunicationMicro-objectiveCrypto LibraryCryptographic HashDecrypt DataEncrypt DataEncryption KeyGeneratePseudo-random SequenceHashedMessage Authentication CodeSHA1::Cryptographic HashSHA256::CryptographicHashSHA224::CryptographicHashMD5::Cryptographic HashSnefru::CryptographicHashTiger::Cryptographic HashTwofish::Decrypt DataSkipjack::Decrypt DataBlowfish::Decrypt DataHC-128::Decrypt DataAES::Decrypt DataRC4::Decrypt DataStreamCipher::Decrypt DataBlockCipher::Decrypt DataCamellia::Decrypt DataHC-256::Decrypt Data3DES::Decrypt DataSosemanuk::Decrypt DataRC6::Decrypt DataRSA::Decrypt DataRSA::Encrypt DataBlockCipher::Encrypt DataAES::Encrypt DataStreamCipher::Encrypt DataRC6::Encrypt DataCamellia::Encrypt DataHC-256::Encrypt DataTwofish::Encrypt DataBlowfish::Encrypt DataHC-128::Encrypt DataSkipjack::Encrypt DataRC4::Encrypt Data3DES::Encrypt DataSosemanuk::Encrypt DataImport PublicKey::Encryption KeyRC4 KSA::Encryption KeyGetTickCount::GeneratePseudo-random SequenceMersenne Twister::GeneratePseudo-random SequenceUse API::GeneratePseudo-random Sequencerand::GeneratePseudo-random SequenceRC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveCheck StringChecksumCompress DataCompression LibraryDecode DataDecompress DataEncode DataModuloNon-Cryptographic HashUse ConstantBSD::ChecksumLuhn::ChecksumCRC32::ChecksumAdler::ChecksumVerhoeff::ChecksumQuickLZ::Compress DataIEncodingFilterFactory::CompressDataBase64::Decode DataXOR::Decode DataaPLib::Decompress DataIEncodingFilterFactory::DecompressDataQuickLZ::Decompress DataXOR::Encode DataBase64::Encode DataFast-Hash::Non-CryptographicHashMurmurHash::Non-CryptographicHashdhash::Non-CryptographicHashpHash::Non-CryptographicHashFNV::Non-CryptographicHashData Micro-objectiveAlter File ExtensionCopy FileCreate DirectoryCreate FileDelete DirectoryDelete FileGet File AttributesMove FileRead FileRead Virtual DiskSet File AttributesWrites FileAppend Extension::AlterFile ExtensionCreate OfficeDocument::Create FileCreate RansomwareFile::Create FileFile System Micro-objectiveInstall DriverLoad DriverSimulate HardwareMinifilter::InstallDriverMinifilter::Load DriverMouseClick::Simulate HardwareCtrl-Alt-Del::SimulateHardwareHardware Micro-objectiveAllocate MemoryChange Memory ProtectionFree MemoryHeap SprayOverflow BufferStack PivotExecutable Stack::ChangeMemory ProtectionExecutable Heap::ChangeMemory ProtectionMemory Micro-objectiveConsoleEnvironment VariableRegistryWallpaperGet Variable::EnvironmentVariableSet Variable::EnvironmentVariableCreateRegistry Key::RegistryDeleteRegistry Key::RegistrySetRegistry Key::RegistryQueryRegistry Key::RegistryDeleteRegistry Value::RegistryOpenRegistry Key::RegistryQueryRegistry Value::RegistryOperatingSystem Micro-objectiveAllocateThread Local StorageCheck MutexCreate MutexCreate ProcessCreate ThreadEnumerate ThreadsOpen ProcessOpen ThreadResume ThreadSetThread Local Storage ValueSuspend ThreadSynchronizationTerminate ProcessTerminate ThreadCreate Process viaShellcode::Create ProcessCreate SuspendedProcess::Create ProcessCreate Processvia WMI::Create ProcessCreateMutex::SynchronizationProcess Micro-objectiveBootkitComponent FirmwareHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingInstall Insecureor Malicious ConfigurationKernelModules and ExtensionsMalicious Network DriverModify Existing ServiceModify RegistryRegistryRun Keys / Startup FolderRemote AccessIngress Tool TransferShutdown EventRouter FirmwareHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverReverse ShellPersistenceHijack Execution FlowHookingKernelModules and ExtensionsModify Existing ServiceProcess InjectionImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsPrivilege Escalation