Added Anti-Analysis/Impact Tags

anti-behavioral-analysis/capture-evasion.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-behavioral-analysis/debugger-detection.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-behavioral-analysis/debugger-evasion.md

@@ -12,6 +12,10 @@
 <td><b>Debugger Evasion (<a href="https://attack.mitre.org/techniques/T1622/">T1622</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-behavioral-analysis/dynamic-analysis-evasion.md

@@ -12,6 +12,10 @@
 <td><b>Virtualization/Sandbox Evasion (<a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-behavioral-analysis/emulator-detection.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-behavioral-analysis/memory-dump-evasion.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-behavioral-analysis/sandbox-detection.md

@@ -12,6 +12,10 @@
 <td><b>Virtualization/Sandbox Evasion Checks (<a href="https://attack.mitre.org/techniques/T1497/001/">T1497.001</a>, <a href="https://attack.mitre.org/techniques/T1633/001/">T1633.001</a>), Virtualization/Sandbox Evasion: User Activity Based Checks (<a href="https://attack.mitre.org/techniques/T1497/002/">T1497.002</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-behavioral-analysis/virtual-machine-detection.md

@@ -12,6 +12,10 @@
 <td><b>Virtualization/Sandbox Evasion (<a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-static-analysis/call-graph-generation-evasion.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-static-analysis/data-flow-analysis-evasion.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-static-analysis/disassembler-evasion.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-static-analysis/executable-code-obfuscation.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-static-analysis/executable-code-optimization.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-static-analysis/executable-code-virtualization.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

anti-static-analysis/software-packing.md

@@ -12,6 +12,10 @@
 <td><b>Obfuscated Files or Information: Software Packing (<a href="https://attack.mitre.org/techniques/T1027/002/">T1027.002</a>, <a href="https://attack.mitre.org/techniques/T1406/002/">T1406.002</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

defense-evasion/hijack-execution-flow.md

@@ -12,6 +12,10 @@
 <td><b>Hijack Execution Flow (<a href="https://attack.mitre.org/techniques/T1574">T1574</a>, <a href="https://attack.mitre.org/techniques/T1625">T1625</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

defense-evasion/obfuscated-files-or-information.md

@@ -12,6 +12,10 @@
 <td><b>Obfuscated Files or Information (<a href="https://attack.mitre.org/techniques/T1027/">T1027</a>, <a href="https://attack.mitre.org/techniques/T1406/">T1406</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

execution/conditional-execution.md

@@ -12,6 +12,10 @@
 <td><b>Execution Guardrails  (<a href="https://attack.mitre.org/techniques/T1480">T1480</a>)</b></td>
 </tr>
 <tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>3.0</b></td>
 </tr>

execution/exploitation-for-client-execution.md

@@ -12,6 +12,10 @@
 <td><b>Exploitation for Client Execution (<a href="https://attack.mitre.org/techniques/T1203">T1203</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>3.0</b></td>
 </tr>

impact/clipboard-modification.md

@@ -12,6 +12,10 @@
 <td><b>Clipboard Modification (<a href="https://attack.mitre.org/techniques/T1510/">T1510</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Integrity</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/compromise-data-integrity.md

@@ -12,6 +12,10 @@
 <td><b>Data Manipulation: Stored Data Manipulation (<a href="https://attack.mitre.org/techniques/T1565/001/">T1565.001</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Integrity</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/data-destruction.md

@@ -12,6 +12,10 @@
 <td><b>Data Destruction (<a href="https://attack.mitre.org/techniques/T1485/">T1485</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Availability</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/data-encrypted-for-impact.md

@@ -12,6 +12,10 @@
 <td><b>Data Encrypted for Impact (<a href="https://attack.mitre.org/techniques/T1486/">T1486</a>), Data Encrypted for Impact (Mobile) (<a href="https://attack.mitre.org/techniques/T1471/">T1471</a>) </b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Availability</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/denial-of-service.md

@@ -12,6 +12,10 @@
 <td><b>Network Denial of Service (<a href="https://attack.mitre.org/techniques/T1498/">T1498</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Availability</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/destroy-hardware.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Availability</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/disk-wipe.md

@@ -12,6 +12,10 @@
 <td><b>Disk Wipe (<a href="https://attack.mitre.org/techniques/T1561/">T1561</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Availability</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>3.0</b></td>
 </tr>

impact/exploit-kit.md

@@ -12,6 +12,10 @@
 <td><b>Exploit Public-Facing Application (<a href="https://attack.mitre.org/techniques/T1190">T1190</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/generate-traffic-from-victim.md

@@ -12,6 +12,10 @@
 <td><b>Generate Traffic from Victim (<a href="https://attack.mitre.org/techniques/T1643/">T1643</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/manipulate-network-traffic.md

@@ -12,6 +12,10 @@
 <td><b>Data Manipulation: Transmitted Data Manipulation (<a href="https://attack.mitre.org/techniques/T1565/002/">T1565.002</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Integrity</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/modify-hardware.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/remote-access.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/resource-hijacking.md

@@ -12,6 +12,10 @@
 <td><b>Resource Hijacking (<a href="https://attack.mitre.org/techniques/T1496/">T1496</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

impact/spamming.md

@@ -12,6 +12,10 @@
 <td><b>None</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

persistence/component-firmware.md

@@ -12,6 +12,10 @@
 <td><b>Pre-OS Boot: Component Firmware (<a href="https://attack.mitre.org/techniques/T1542/002/">1542.002</a>)</b></td>
 </tr>
 <tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
 <td><b>Version</b></td>
 <td><b>2.0</b></td>
 </tr>

zscript/fill_header.py

@@ -8,7 +8,8 @@ import argparse
 from fuzzywuzzy import fuzz  # pip install fuzzywuzzy python-Levenshtein
 
 objective_list = ['anti-behavioral-analysis', 'anti-static-analysis', 'collection', 'command-and-control', 'credential-access', 'defense-evasion', 'discovery', 'execution', 'exfiltration', 'impact', 'lateral-movement', 'micro-behaviors', 'persistence', 'privilege-escalation']
-
+anti_analysis_types = ['Evasion', 'Detection']
+impact_types = ['Integrity', 'Breach', 'Availability']
 
 # Checks if 'string' in 'l' at index 'line_num'. If missing, insert 'string' into 'l' at index 'line_num'
 # Return possibly modified 'l'
@@ -36,6 +37,7 @@ def main():
     parser.add_argument("-i", "--id", help = "ID (B0001)")
     parser.add_argument("-o", "--objective", nargs='+', help = "Objectives separated by spaces, replace spaces within the name with underscore (Anti-Behavioral_Analysis Anti-Static_Analysis)")
     parser.add_argument("-a", "--attack", nargs='+', help = "Related ATT&CK Techniques grouped by name and ID (Debugger_Evasion,T1622 Virtualization/Standbox_Evasion_Checks,T1497.001,T1633.001)")
+    parser.add_argument("-t", "--type", help = "Anti-Analysis or Impact Types (Evasion, Detection, Integrity, Breach, Availability)")
     parser.add_argument("-v", "--version", help="Version")
     parser.add_argument("-c", "--created", help="Method Creation Date (1_August_2019)")
     parser.add_argument("-m", "--last_modified", help="Last modified date (1_August_2019)")
@@ -49,6 +51,8 @@ def main():
         lines = f.readlines()
         f.close()
 
+    offset = 0  # Handles unique fields such as anti-analysis/impact type
+
     # Some files have an empty line 1, delete that
     if lines[0] == '\n':
         lines.pop(0)
@@ -115,34 +119,52 @@ def main():
         lines.insert(12, "</tr>\n")
         print(attack_str)
 
+    # Adding Anti-Analysis/Impact Type
+    if args.type:
+        if args.type in impact_types:
+            lines.insert(13, "<tr>\n")
+            lines = insert_if_missing(lines, 14, "<td><b>Impact Type</b></td>\n")
+
+        elif args.type in anti_analysis_types:
+            lines.insert(13, "<tr>\n")
+            lines = insert_if_missing(lines, 14, "<td><b>Anti-Analysis Type</b></td>\n")
+
+        else:
+            raise Exception("Anti-Analysis/Impact Type is not valid")
+        
+        lines.insert(15, "<td><b>{}</b></td>\n".format(args.type))
+        lines.insert(16, "</tr>\n")
+
+        offset += 4
+
     # Adding version field
     if args.version:
-        lines = insert_if_missing(lines, 13, "<tr>\n")
-        lines = insert_if_missing(lines, 14, "<td><b>Version</b></td>\n")
+        lines = insert_if_missing(lines, 13+offset, "<tr>\n")
+        lines = insert_if_missing(lines, 14+offset, "<td><b>Version</b></td>\n")
 
-        lines.insert(15, "<td><b>{}</b></td>\n".format(args.version))
-        lines.insert(16, "</tr>\n")
+        lines.insert(15+offset, "<td><b>{}</b></td>\n".format(args.version))
+        lines.insert(16+offset, "</tr>\n")
 
     # Adding Created field
     if args.created:
-        lines = insert_if_missing(lines, 17, "<tr>\n")
-        lines = insert_if_missing(lines, 18, "<td><b>Created</b></td>\n")
+        lines = insert_if_missing(lines, 17+offset, "<tr>\n")
+        lines = insert_if_missing(lines, 18+offset, "<td><b>Created</b></td>\n")
 
         created = args.created.replace('_', ' ')
-        lines.insert(19, "<td><b>{}</b></td>\n".format(created))
-        lines.insert(20, "</tr>\n")
+        lines.insert(19+offset, "<td><b>{}</b></td>\n".format(created))
+        lines.insert(20+offset, "</tr>\n")
     
     # Adding Last Modified Field
     if args.last_modified:
-        lines = insert_if_missing(lines, 21, "<tr>\n")
-        lines = insert_if_missing(lines, 22, "<td><b>Last Modified</b></td>\n")
+        lines = insert_if_missing(lines, 21+offset, "<tr>\n")
+        lines = insert_if_missing(lines, 22+offset, "<td><b>Last Modified</b></td>\n")
 
         last_modified = args.last_modified.replace('_', ' ')
-        lines.insert(23, "<td><b>{}</b></td>\n".format(last_modified))
-        lines.insert(24, "</tr>\n")
+        lines.insert(23+offset, "<td><b>{}</b></td>\n".format(last_modified))
+        lines.insert(24+offset, "</tr>\n")
 
-    lines = insert_if_missing(lines, 25, "</table>\n")
-    lines = insert_if_missing(lines, 26, "\n")
+    lines = insert_if_missing(lines, 25+offset, "</table>\n")
+    lines = insert_if_missing(lines, 26+offset, "\n")
 
     # Now that modifications are complete, write to file
     with open(file, "w") as f: