From f97bfd879413e888026c015e183b8581fad5c9f8 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Thu, 2 Jun 2022 12:49:08 -0400 Subject: [PATCH 01/16] Update remote-copy.md Updated behavior name from "Remote File Copy" to "Ingress Tool Transfer" to align with ATT&CK technique (T1105). --- command-and-control/remote-file-copy.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/command-and-control/remote-file-copy.md b/command-and-control/remote-file-copy.md index 973a368..53cc4ff 100644 --- a/command-and-control/remote-file-copy.md +++ b/command-and-control/remote-file-copy.md @@ -5,9 +5,9 @@ |**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)| -Remote File Copy +Ingress Tool Transfer ================ -Malware may copy files from one system to another. +Malware may copy files from an external system to a system on a compromised network. Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](../execution/install-prog.md) behavior. From af0350ec08716dfc3be2300db142786aee2478a6 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Thu, 2 Jun 2022 14:56:37 -0400 Subject: [PATCH 02/16] Update component-firmware.md Updated behavior description to align with ATT&CK technique. --- persistence/component-firmware.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index 992f7d1..2cf8efa 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -7,7 +7,7 @@ Component Firmware ================== -Malware may overwrite the flash memory contents of system BIOS or other firmware. [[1]](#1). Methods related to malware (extending ATT&CK's definitions) are below. +Malware may overwrite the flash memory of firmware outside of the main system firmware or BIOS. [[1]](#1). Methods related to malware (extending ATT&CK's definitions) are below. see ATT&CK: [**Pre-OS Boot: Component Firmware**](https://attack.mitre.org/techniques/T1542/002/). From 8b97ca31cdbf7afb03d71ebc61ad11f255fa87c5 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Thu, 2 Jun 2022 15:01:05 -0400 Subject: [PATCH 03/16] Update hide-artifacts.md Changed behavior name from "Hidden Artifacts" to "Hide Artifacts" to align with ATT&CK technique. --- defense-evasion/hide-artifacts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defense-evasion/hide-artifacts.md b/defense-evasion/hide-artifacts.md index 6b2f7f0..22fa997 100644 --- a/defense-evasion/hide-artifacts.md +++ b/defense-evasion/hide-artifacts.md @@ -5,7 +5,7 @@ |**Related ATT&CK Technique**|[Hide Artifacts](https://attack.mitre.org/techniques/T1564)| -Hidden Artifacts +Hide Artifacts ================ Malware may hide artifacts to evade detection and/or to persist on the system. See potential methods related to malware below. From 7375cf16c6266207cc82ea8864103c3ecb322cfc Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Thu, 2 Jun 2022 16:47:39 -0400 Subject: [PATCH 04/16] Update exploit-kit-behavior.md Changing title from "Exploit Kit Behavior" to "Exploit Kit" since none of the other behaviors have "Behavior" in the title. --- impact/exploit-kit-behavior.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/impact/exploit-kit-behavior.md b/impact/exploit-kit-behavior.md index 9867fce..38f4350 100644 --- a/impact/exploit-kit-behavior.md +++ b/impact/exploit-kit-behavior.md @@ -5,7 +5,7 @@ |**Related ATT&CK Technique**|[Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)| -Exploit Kit Behavior +Exploit Kit ==================== An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver malicious payloads (malware). From dcdc71c325154535b04cd7b5c20c80e8bab5a9c8 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 05:24:27 -0400 Subject: [PATCH 05/16] Create generate-traffic-from-victim.md Created a new behavior for generating traffic from the victim system to encompass generating fraudulent ad revenue. --- impact/generate-traffic-from-victim.md | 34 ++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 impact/generate-traffic-from-victim.md diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md new file mode 100644 index 0000000..97eda33 --- /dev/null +++ b/impact/generate-traffic-from-victim.md @@ -0,0 +1,34 @@ +||| +|---|---| +|**ID**|**E1643**| +|**Objective(s)**|[Impact](../impact)| +|**Related ATT&CK Technique**|[Generate Traffic from Victim](https://attack.mitre.org/techniques/T1643/)| + + +Generate Traffic from Victim +======================================= +Malware may generate traffic from the victim system such as clicks of advertising links that generate fraudulent ad revenue. The ATT&CK technique, [Generate Traffic from Victim](https://attack.mitre.org/techniques/T1643/), pertains only to mobile platform, but the behavior is applicable to other platforms as well. + +Methods +------- +|Name|ID|Description| +|---|---|---| +|**Advertisement Replacement Fraud**|E1472.m02|Malware injects ad windows onto websites the user views. [[2]](#2)| +|**Click Hijacking**|E1472.m01|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)| + +Malware Examples +---------------- +|Name|Date|Description| +|---|---|---| +|[**DNSChanger**](../xample-malware/dnschanger.md)|November 2011|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)| +|[**Kovter**](../xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)| + +References +---------- +[1] https://www.itworld.com/article/2734253/security/behind-the--massive--malware-ad-revenue-fraud-case.html + +[2] https://www.fipp.com/news/insightnews/what-are-the-nine-types-of-digital-ad-fraud + +[3] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html + +[4] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan From 2f87c60a47c3ae01237cbf93967517725bd56039 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 08:05:42 -0400 Subject: [PATCH 06/16] Delete generate-fraud-rev.md Removing in favor of adding new behavior for "Generate Traffic from Victim" technique. --- impact/generate-fraud-rev.md | 36 ------------------------------------ 1 file changed, 36 deletions(-) delete mode 100644 impact/generate-fraud-rev.md diff --git a/impact/generate-fraud-rev.md b/impact/generate-fraud-rev.md deleted file mode 100644 index 82cb83a..0000000 --- a/impact/generate-fraud-rev.md +++ /dev/null @@ -1,36 +0,0 @@ -||| -|---|---| -|**ID**|**E1472**| -|**Objective(s)**|[Impact](../impact)| -|**Related ATT&CK Technique**|[Generate Fraudulent Advertising Revenue](https://attack.mitre.org/techniques/T1472/)| - - -Generate Fraudulent Advertising Revenue -======================================= -Malware may generate advertising revenue by generating clicks of advertising links. The ATT&CK technique, [Generate Fraudulent Advertising Revenue](https://attack.mitre.org/techniques/T1472/), pertains only to mobile platform, but the behavior is applicable to other platforms as well. - -See ATT&CK: [**Generate Fraudulent Advertising Revenue**](https://attack.mitre.org/techniques/T1472/). - -Methods -------- -|Name|ID|Description| -|---|---|---| -|**Advertisement Replacement Fraud**|E1472.m02|Malware injects ad windows onto websites the user views. [[2]](#2)| -|**Click Hijacking**|E1472.m01|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)| - -Malware Examples ----------------- -|Name|Date|Description| -|---|---|---| -|[**DNSChanger**](../xample-malware/dnschanger.md)|November 2011|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)| -|[**Kovter**](../xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)| - -References ----------- -[1] https://www.itworld.com/article/2734253/security/behind-the--massive--malware-ad-revenue-fraud-case.html - -[2] https://www.fipp.com/news/insightnews/what-are-the-nine-types-of-digital-ad-fraud - -[3] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html - -[4] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan From 2524861df3b338abe39ad4cb724430380a266c6b Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 08:12:53 -0400 Subject: [PATCH 07/16] Update README.md Updated "Generate Fraudulent Revenue" to "Generate Network Traffic from Victim". --- impact/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/impact/README.md b/impact/README.md index 37d6adb..c3c8b0a 100644 --- a/impact/README.md +++ b/impact/README.md @@ -16,7 +16,7 @@ Behaviors that enable malware to achieve its mission of manipulating, interrupti * **Disk Wipe** [F0014](../impact/disk-wipe.md) * **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md) * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md) -* **Generate Fraudulent Advertising Revenue** [E1472](../impact/generate-fraud-rev.md) +* **Generate Network Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md) * **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md) * **Modify Hardware** [B0042](../impact/modify-hardware.md) * **Remote Access** [B0022](../impact/remote-access.md) From 08b41c057fbefac18bd10317ebd6786dc13375bc Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 10:25:05 -0400 Subject: [PATCH 08/16] Update config-mod.md Updated to be its own behavior because the ATT&CK v11 technique (Subvert Trust Controls: Code Signing Policy Modification) is too narrowly scoped for what malware can do. --- defense-evasion/config-mod.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/defense-evasion/config-mod.md b/defense-evasion/config-mod.md index 4f81d20..82c4d2a 100644 --- a/defense-evasion/config-mod.md +++ b/defense-evasion/config-mod.md @@ -1,12 +1,10 @@ ||| |---|---| -|**ID**|**E1478**| +|**ID**|**B0047**| |**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)| -|**Related ATT&CK Technique**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)| +|**Related ATT&CK Technique**|None| Install Insecure or Malicious Configuration =========================================== -Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective. - -See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478). +Malware may install malicious configuration settings or may modify existing configuration settings. For example, malware may change configuration settings associated with security mechanisms to make it difficult to detect or change configuration settings to maintain a foothold on the network. From 67c9b4d30ce29df3102882b7996625ead31c3e22 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 10:53:10 -0400 Subject: [PATCH 09/16] Update data-destruction.md Removing "Delete Device Data / Indicator Removal on Host: File Deletion" since that is covered under Self Deletion. --- impact/data-destruction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/impact/data-destruction.md b/impact/data-destruction.md index 712a919..2c8b1d3 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -2,7 +2,7 @@ |---|---| |**ID**|**E1485**| |**Objective(s)**|[Impact](../impact)| -|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/), [Delete Device Data](https://attack.mitre.org/techniques/T1447/)| +|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/)| Data Destruction From 556c01f636486a6d2f1afde300bb31ef3612bace Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 14:11:58 -0400 Subject: [PATCH 10/16] Delete hooking.md Deleting Hooking behavior as the content will be merged Hijack Execution Flow behavior. --- credential-access/hooking.md | 42 ------------------------------------ 1 file changed, 42 deletions(-) delete mode 100644 credential-access/hooking.md diff --git a/credential-access/hooking.md b/credential-access/hooking.md deleted file mode 100644 index 86a3130..0000000 --- a/credential-access/hooking.md +++ /dev/null @@ -1,42 +0,0 @@ -||| -|---|---| -|**ID**|**F0003**| -|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Collection](../collection), [Credential Access](../credential-access), [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)| -|**Related ATT&CK Sub-Technique**|[Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)| - - -Hooking -======= -Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md). - -For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/). - -Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives. - -For hooking related to memory dump evasion, see [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md). - -Methods -------- -|Name|ID|Description| -|---|---|---| -|**Procedure Hooking**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[1]](#1)| -|**Inline Patching**|F0003.002|Overwrites the first bytes in an API function to redirect code flow.| -|**Export Address Table (EAT) Hooking**|F0003.006|Hooks the export address table (EAT).| -|**Import Address Table (IAT) Hooking**|F0003.001|Modifies a process's import address table (IAT), which stores pointers to imported API functions.| -|**System Service Dispatch Table Hooking**|F0003.004|Hooks the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.| -|**Shadow SDT Hooking**|F0003.005|Hooks the Shadow SSDT similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).| - -Malware Examples ----------------- -|Name|Date|Description| -|---|---|---| -|**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[2]](#2)| -|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| - -References ----------- -[1] https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures - -[2] https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/ - - From 40ddc39e3c93ef4cd2a1192fbbd6937977953987 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 14:12:41 -0400 Subject: [PATCH 11/16] Update README.md Removing Hooking behavior as material was moved into Hijack Execution Flow behavior. --- credential-access/README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/credential-access/README.md b/credential-access/README.md index 4e26ee6..f955354 100644 --- a/credential-access/README.md +++ b/credential-access/README.md @@ -7,7 +7,6 @@ Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions. * **Cryptocurrency** [B0028](../collection/cryptocurrency.md) -* **Hooking** [F0003](../credential-access/hooking.md) * **Input Capture** [E1056](../collection/input-capture.md) * **Keylogging** [F0002](../collection/keylogging.md) * **Screen Capture** [E1113](../collection/screen-capture.md) From cb553d3681b8c74d25d666b8caecd4f782eaff2f Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 14:16:35 -0400 Subject: [PATCH 12/16] Update self-deletion.md Updating behavior to also reference Indicator Removal on Host: Uninstall Malicious Application (T1630.001). --- defense-evasion/self-deletion.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 5416118..336de19 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -2,14 +2,14 @@ |---|---| |**ID**|**F0007**| |**Objective(s)**|[Defense Evasion](../defense-evasion)| -|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)| +|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: Uninstall Malicious Application](https://attack.mitre.org/techniques/T1630/001/),[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)| Self Deletion ============= Malware may uninstall itself to avoid detection. -See ATT&CK: [**Indicator Removal on Host: File Deletion**](https://attack.mitre.org/techniques/T1070/004/). +See ATT&CK: [**Indicator Removal on Host: Uninstall Malicious Application**](https://attack.mitre.org/techniques/T1630/001/), [**Indicator Removal on Host: File Deletion**](https://attack.mitre.org/techniques/T1070/004/). Methods ------- From c648c032a3b029ed2007aaabf835b009c0000f54 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 14:17:05 -0400 Subject: [PATCH 13/16] Update self-deletion.md Adding space between techniques. --- defense-evasion/self-deletion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 336de19..e20bfcd 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -2,7 +2,7 @@ |---|---| |**ID**|**F0007**| |**Objective(s)**|[Defense Evasion](../defense-evasion)| -|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: Uninstall Malicious Application](https://attack.mitre.org/techniques/T1630/001/),[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)| +|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: Uninstall Malicious Application](https://attack.mitre.org/techniques/T1630/001/), [Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)| Self Deletion From ce6453a6921a27d90bfab74883fd0d86ad891408 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 14:20:38 -0400 Subject: [PATCH 14/16] Update hijack-execution-flow.md Merged Hooking behavior content into Hijack Execution Flow behavior. --- defense-evasion/hijack-execution-flow.md | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index 908fe5b..a8834fe 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -1,13 +1,19 @@ ||| |---|---| |**ID**|**F0015**| -|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)| +|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Collection](../collection), [Credential Access](../credential-access), [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)| |**Related ATT&CK Technique**|[Hijack Execution Flow](https://attack.mitre.org/techniques/T1574/)| Hijack Execution Flow ===================== -Malware may execute by hijacking the way operating systems run programs. Malware (e.g. rootkit) alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Different types of hooking are defined as methods below. +Malware may execute by hijacking the way operating systems run programs. Malware (e.g. rootkit) alters API behavior or redirects execution (i.e., hooking) to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Different types of hooking are defined as methods below. + +Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives. + +For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/). + +For hooking related to memory dump evasion, see [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md). See ATT&CK: [**Hijack Execution Flow**](https://attack.mitre.org/techniques/T1574/). @@ -18,10 +24,18 @@ Methods |**Abuse Windows Function Calls**|F0015.006|Malware abuses native Windows function calls to transfer execution to shellcode that it loads into memory. A pointer to the callback function is used to supply the memory address of the shellcode. Functions that can be abused include EnumResourceTypesA and EnumUILanguagesW. [[4]](#4)| |**Export Address Table (EAT) Hooking**|F0015.001|Malware (e.g. rootkit) hooks the export address table (EAT).| |**Import Address Table (IAT) Hooking**|F0015.003|Malware (e.g. rootkit) modifies a process's import address table (IAT), which stores pointers to imported API functions.[[1]](#1)| -|**Inline Patching**|F0015.002|Inline patching (inline hooking) is done by modifying the beginning of a function in order to redirect the execution flow to custom code (i.e. redirecting code flow) before jumping back to the original function.[[2]](#2)| +|**Inline Patching**|F0015.002|Inline patching (inline hooking) is done by modifying the beginning of a function (e.g., first bytes) in order to redirect the execution flow to custom code (i.e. redirecting code flow) before jumping back to the original function.[[2]](#2)| +|**Procedure Hooking**|F0015.007|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[5]](#5)| |**Shadow System Service Dispatch Table Hooking**|F0015.004|The Shadow System Service Dispatch Table (SSDT) can be hooked similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).[[3]](#3)| |**System Service Dispatch Table Hooking**|F0015.005|Malware (e.g. rootkit, malicious drivers) may hook the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.[[3]](#3)| +Malware Examples +---------------- +|Name|Date|Description| +|---|---|---| +|**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[6]](#6)| +|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| + References ---------- [1] https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf @@ -32,3 +46,6 @@ References [4] http://ropgadget.com/posts/abusing_win_functions.html +[5] https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures + +[] https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/ From 4e6d8a44aa34bf182dacde9c3980819a3fe19ac9 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 14:21:56 -0400 Subject: [PATCH 15/16] Update hijack-execution-flow.md Unbolded text to be consistent with other text. --- defense-evasion/hijack-execution-flow.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index a8834fe..f7cd808 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -11,7 +11,7 @@ Malware may execute by hijacking the way operating systems run programs. Malware Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives. -For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/). +For discussion related to the Credential Access and Collection objectives, see [Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/). For hooking related to memory dump evasion, see [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md). From e1b1756c938e7585af82349b75812868ec3887b7 Mon Sep 17 00:00:00 2001 From: Danny Haynes Date: Fri, 3 Jun 2022 14:22:40 -0400 Subject: [PATCH 16/16] Update hijack-execution-flow.md Fixed reference identifier. --- defense-evasion/hijack-execution-flow.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index f7cd808..ce59591 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -48,4 +48,4 @@ References [5] https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures -[] https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/ +[6] https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/