From 546656036d3f062e517a654d186bc043f57bdd2f Mon Sep 17 00:00:00 2001 From: Desiree Beck Date: Fri, 10 Apr 2020 11:54:34 -0400 Subject: [PATCH] new behavior --- defense-evasion/README.md | 1 + defense-evasion/covert-location.md | 15 +++++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 defense-evasion/covert-location.md diff --git a/defense-evasion/README.md b/defense-evasion/README.md index cfb1f67..facbc28 100644 --- a/defense-evasion/README.md +++ b/defense-evasion/README.md @@ -15,6 +15,7 @@ Behaviors that evade detection or avoid other defenses. * **Code Signing** [T1116](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/code-signing.md) * **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md) * **Configuration Modification** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md) +* **Covert Location** [M0040](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/convert-location.md) * **DCShadow** [T1207](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/dcshadow.md) * **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md) * **Disabling Security Tools** [E1089](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md) diff --git a/defense-evasion/covert-location.md b/defense-evasion/covert-location.md new file mode 100644 index 0000000..55f5592 --- /dev/null +++ b/defense-evasion/covert-location.md @@ -0,0 +1,15 @@ +||| +|---------|------------------------| +|**ID**|**M0040**| +|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)| +|**Related ATT&CK Technique**|None| + + +Covert Location +=============== +Malware may hide data or binary files within other files, the registry, etc. + +Methods +------- +* **Hide Data in Registry**: malware may use a registry key to store a long sequence of bytes. +* **Steganography**: malware may store information in an image. \ No newline at end of file