admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update poison-ivy.md

Browse Source
This commit is contained in:
Desiree Beck
2023-03-01 03:17:02 -05:00
committed by GitHub
parent bfbe6defaa
commit 573b932926
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xample-malware/poison-ivy.md
+1 -1
View File
@@ -53,7 +53,7 @@ See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S00
|[Micro-Behaviors::Cryptography::Encrypt Data::Camellia (C0027.003)](../micro-behaviors/cryptography/encrypt-data.md)|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key. [[2]](#2)|
|[Micro-Behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Poison Ivy has a default process mutex, but it can be altered at build time. [[3]](#3)|
|[Anti-Behavioral Analysis::Debugger Detection::Hardware Breakpoints (B0001.005)](../anti-behavioral-analysis/debugger-detection.md)|A Poison Ivy variant checks for breakpoints and exits immediately if found. [[3]](#3)|
|[Discovery::Analysis Tool Discovery (B0013)](../discovery/anlaysis-tool-discovery.md)|A Poison Ivy variant runs a thread to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one of the analysis tools is running. [[3]](#3)|
|[Discovery::Analysis Tool Discovery (B0013)](../discovery/analysis-tool-discovery.md)|A Poison Ivy variant runs a thread to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one of the analysis tools is running. [[3]](#3)|
|[Discovery::Analysis Tool Discovery::Known Windows Class Name (B0013.010)](../discovery/analysis-tool-discovery.md)|A Poison Ivy variant goes through all the running program windows to check if any Windows class name contains a special string to determine if an analysis tool is running. [[3]](#3)|
|[Micro-Behaviors::Process::Check Mutex (C0043)](../micro-behaviors/process/check-mutex.md)|A Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[3]](#3)|
|[Anti-Behavioral Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md)|A Poison Ivy variant uses the IsDebuggerPresent API function call to check if the process is running in a debugger. [[3]](#3)|