diff --git a/anti-behavioral-analysis/capture-evasion.md b/anti-behavioral-analysis/capture-evasion.md index d8db336..8618b30 100644 --- a/anti-behavioral-analysis/capture-evasion.md +++ b/anti-behavioral-analysis/capture-evasion.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index 5a4d17f..a48dd71 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Detection + + Version 2.0 diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index 6d7dbd7..3b8d021 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -12,6 +12,10 @@ Debugger Evasion (T1622) +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md index 8ffa645..88085e5 100644 --- a/anti-behavioral-analysis/dynamic-analysis-evasion.md +++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md @@ -12,6 +12,10 @@ Virtualization/Sandbox Evasion (T1497, T1633) +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-behavioral-analysis/emulator-detection.md b/anti-behavioral-analysis/emulator-detection.md index 63f26a3..0836854 100644 --- a/anti-behavioral-analysis/emulator-detection.md +++ b/anti-behavioral-analysis/emulator-detection.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Detection + + Version 2.0 diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md index b80f5db..ffc018a 100644 --- a/anti-behavioral-analysis/memory-dump-evasion.md +++ b/anti-behavioral-analysis/memory-dump-evasion.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index 9b77077..75b3895 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -12,6 +12,10 @@ Virtualization/Sandbox Evasion Checks (T1497.001, T1633.001), Virtualization/Sandbox Evasion: User Activity Based Checks (T1497.002) +Anti-Analysis Type +Detection + + Version 2.0 diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index 0545e48..c4b87cf 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -12,6 +12,10 @@ Virtualization/Sandbox Evasion (T1497, T1633) +Anti-Analysis Type +Detection + + Version 2.0 diff --git a/anti-static-analysis/call-graph-generation-evasion.md b/anti-static-analysis/call-graph-generation-evasion.md index 6c58acb..15eff6d 100644 --- a/anti-static-analysis/call-graph-generation-evasion.md +++ b/anti-static-analysis/call-graph-generation-evasion.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-static-analysis/data-flow-analysis-evasion.md b/anti-static-analysis/data-flow-analysis-evasion.md index 5ed69bf..3a4abba 100644 --- a/anti-static-analysis/data-flow-analysis-evasion.md +++ b/anti-static-analysis/data-flow-analysis-evasion.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index b4f7f22..9c2ee43 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index 9e55967..e3c9e2d 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-static-analysis/executable-code-optimization.md b/anti-static-analysis/executable-code-optimization.md index 099a06e..01594d0 100644 --- a/anti-static-analysis/executable-code-optimization.md +++ b/anti-static-analysis/executable-code-optimization.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-static-analysis/executable-code-virtualization.md b/anti-static-analysis/executable-code-virtualization.md index abdfbbb..26a43d7 100644 --- a/anti-static-analysis/executable-code-virtualization.md +++ b/anti-static-analysis/executable-code-virtualization.md @@ -12,6 +12,10 @@ None +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index 37f0ab4..7bc1142 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -12,6 +12,10 @@ Obfuscated Files or Information: Software Packing (T1027.002, T1406.002) +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index 76bcf68..cd9e6e1 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -12,6 +12,10 @@ Hijack Execution Flow (T1574, T1625) +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md index d9bdd06..5edaafc 100644 --- a/defense-evasion/obfuscated-files-or-information.md +++ b/defense-evasion/obfuscated-files-or-information.md @@ -12,6 +12,10 @@ Obfuscated Files or Information (T1027, T1406) +Anti-Analysis Type +Evasion + + Version 2.0 diff --git a/execution/conditional-execution.md b/execution/conditional-execution.md index 4d5bf32..fed3b1a 100644 --- a/execution/conditional-execution.md +++ b/execution/conditional-execution.md @@ -12,6 +12,10 @@ Execution Guardrails (T1480) +Anti-Analysis Type +Evasion + + Version 3.0 diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md index 058ebf8..2debf06 100644 --- a/execution/exploitation-for-client-execution.md +++ b/execution/exploitation-for-client-execution.md @@ -12,6 +12,10 @@ Exploitation for Client Execution (T1203) +Impact Type +Breach + + Version 3.0 diff --git a/impact/clipboard-modification.md b/impact/clipboard-modification.md index 612dae6..661a140 100644 --- a/impact/clipboard-modification.md +++ b/impact/clipboard-modification.md @@ -12,6 +12,10 @@ Clipboard Modification (T1510) +Impact Type +Integrity + + Version 2.0 diff --git a/impact/compromise-data-integrity.md b/impact/compromise-data-integrity.md index 34ac2e2..536e9f2 100644 --- a/impact/compromise-data-integrity.md +++ b/impact/compromise-data-integrity.md @@ -12,6 +12,10 @@ Data Manipulation: Stored Data Manipulation (T1565.001) +Impact Type +Integrity + + Version 2.0 diff --git a/impact/data-destruction.md b/impact/data-destruction.md index ac47181..47bfaf1 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -12,6 +12,10 @@ Data Destruction (T1485) +Impact Type +Availability + + Version 2.0 diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index 71e04fc..196363a 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -12,6 +12,10 @@ Data Encrypted for Impact (T1486), Data Encrypted for Impact (Mobile) (T1471) +Impact Type +Availability + + Version 2.0 diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index d6aaa26..2e6b158 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -12,6 +12,10 @@ Network Denial of Service (T1498) +Impact Type +Availability + + Version 2.0 diff --git a/impact/destroy-hardware.md b/impact/destroy-hardware.md index 7a3d32f..ff07439 100644 --- a/impact/destroy-hardware.md +++ b/impact/destroy-hardware.md @@ -12,6 +12,10 @@ None +Impact Type +Availability + + Version 2.0 diff --git a/impact/disk-wipe.md b/impact/disk-wipe.md index 3c2590b..e52f812 100644 --- a/impact/disk-wipe.md +++ b/impact/disk-wipe.md @@ -12,6 +12,10 @@ Disk Wipe (T1561) +Impact Type +Availability + + Version 3.0 diff --git a/impact/exploit-kit.md b/impact/exploit-kit.md index e71a181..d144d35 100644 --- a/impact/exploit-kit.md +++ b/impact/exploit-kit.md @@ -12,6 +12,10 @@ Exploit Public-Facing Application (T1190) +Impact Type +Breach + + Version 2.0 diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md index e80f342..4ca7f60 100644 --- a/impact/generate-traffic-from-victim.md +++ b/impact/generate-traffic-from-victim.md @@ -12,6 +12,10 @@ Generate Traffic from Victim (T1643) +Impact Type +Breach + + Version 2.0 diff --git a/impact/manipulate-network-traffic.md b/impact/manipulate-network-traffic.md index d09e017..9636d8b 100644 --- a/impact/manipulate-network-traffic.md +++ b/impact/manipulate-network-traffic.md @@ -12,6 +12,10 @@ Data Manipulation: Transmitted Data Manipulation (T1565.002) +Impact Type +Integrity + + Version 2.0 diff --git a/impact/modify-hardware.md b/impact/modify-hardware.md index 151993b..c83cc4d 100644 --- a/impact/modify-hardware.md +++ b/impact/modify-hardware.md @@ -12,6 +12,10 @@ None +Impact Type +Breach + + Version 2.0 diff --git a/impact/remote-access.md b/impact/remote-access.md index ec47769..16ab72e 100644 --- a/impact/remote-access.md +++ b/impact/remote-access.md @@ -12,6 +12,10 @@ None +Impact Type +Breach + + Version 2.0 diff --git a/impact/resource-hijacking.md b/impact/resource-hijacking.md index 48cd06a..7869483 100644 --- a/impact/resource-hijacking.md +++ b/impact/resource-hijacking.md @@ -12,6 +12,10 @@ Resource Hijacking (T1496) +Impact Type +Breach + + Version 2.0 diff --git a/impact/spamming.md b/impact/spamming.md index 5a377a0..510e7d5 100644 --- a/impact/spamming.md +++ b/impact/spamming.md @@ -12,6 +12,10 @@ None +Impact Type +Breach + + Version 2.0 diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index d170699..52b07e6 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -12,6 +12,10 @@ Pre-OS Boot: Component Firmware (1542.002) +Impact Type +Breach + + Version 2.0 diff --git a/zscript/fill_header.py b/zscript/fill_header.py index 171c44d..d674316 100644 --- a/zscript/fill_header.py +++ b/zscript/fill_header.py @@ -8,7 +8,8 @@ import argparse from fuzzywuzzy import fuzz # pip install fuzzywuzzy python-Levenshtein objective_list = ['anti-behavioral-analysis', 'anti-static-analysis', 'collection', 'command-and-control', 'credential-access', 'defense-evasion', 'discovery', 'execution', 'exfiltration', 'impact', 'lateral-movement', 'micro-behaviors', 'persistence', 'privilege-escalation'] - +anti_analysis_types = ['Evasion', 'Detection'] +impact_types = ['Integrity', 'Breach', 'Availability'] # Checks if 'string' in 'l' at index 'line_num'. If missing, insert 'string' into 'l' at index 'line_num' # Return possibly modified 'l' @@ -36,6 +37,7 @@ def main(): parser.add_argument("-i", "--id", help = "ID (B0001)") parser.add_argument("-o", "--objective", nargs='+', help = "Objectives separated by spaces, replace spaces within the name with underscore (Anti-Behavioral_Analysis Anti-Static_Analysis)") parser.add_argument("-a", "--attack", nargs='+', help = "Related ATT&CK Techniques grouped by name and ID (Debugger_Evasion,T1622 Virtualization/Standbox_Evasion_Checks,T1497.001,T1633.001)") + parser.add_argument("-t", "--type", help = "Anti-Analysis or Impact Types (Evasion, Detection, Integrity, Breach, Availability)") parser.add_argument("-v", "--version", help="Version") parser.add_argument("-c", "--created", help="Method Creation Date (1_August_2019)") parser.add_argument("-m", "--last_modified", help="Last modified date (1_August_2019)") @@ -49,6 +51,8 @@ def main(): lines = f.readlines() f.close() + offset = 0 # Handles unique fields such as anti-analysis/impact type + # Some files have an empty line 1, delete that if lines[0] == '\n': lines.pop(0) @@ -115,34 +119,52 @@ def main(): lines.insert(12, "\n") print(attack_str) + # Adding Anti-Analysis/Impact Type + if args.type: + if args.type in impact_types: + lines.insert(13, "\n") + lines = insert_if_missing(lines, 14, "Impact Type\n") + + elif args.type in anti_analysis_types: + lines.insert(13, "\n") + lines = insert_if_missing(lines, 14, "Anti-Analysis Type\n") + + else: + raise Exception("Anti-Analysis/Impact Type is not valid") + + lines.insert(15, "{}\n".format(args.type)) + lines.insert(16, "\n") + + offset += 4 + # Adding version field if args.version: - lines = insert_if_missing(lines, 13, "\n") - lines = insert_if_missing(lines, 14, "Version\n") + lines = insert_if_missing(lines, 13+offset, "\n") + lines = insert_if_missing(lines, 14+offset, "Version\n") - lines.insert(15, "{}\n".format(args.version)) - lines.insert(16, "\n") + lines.insert(15+offset, "{}\n".format(args.version)) + lines.insert(16+offset, "\n") # Adding Created field if args.created: - lines = insert_if_missing(lines, 17, "\n") - lines = insert_if_missing(lines, 18, "Created\n") + lines = insert_if_missing(lines, 17+offset, "\n") + lines = insert_if_missing(lines, 18+offset, "Created\n") created = args.created.replace('_', ' ') - lines.insert(19, "{}\n".format(created)) - lines.insert(20, "\n") + lines.insert(19+offset, "{}\n".format(created)) + lines.insert(20+offset, "\n") # Adding Last Modified Field if args.last_modified: - lines = insert_if_missing(lines, 21, "\n") - lines = insert_if_missing(lines, 22, "Last Modified\n") + lines = insert_if_missing(lines, 21+offset, "\n") + lines = insert_if_missing(lines, 22+offset, "Last Modified\n") last_modified = args.last_modified.replace('_', ' ') - lines.insert(23, "{}\n".format(last_modified)) - lines.insert(24, "\n") + lines.insert(23+offset, "{}\n".format(last_modified)) + lines.insert(24+offset, "\n") - lines = insert_if_missing(lines, 25, "\n") - lines = insert_if_missing(lines, 26, "\n") + lines = insert_if_missing(lines, 25+offset, "\n") + lines = insert_if_missing(lines, 26+offset, "\n") # Now that modifications are complete, write to file with open(file, "w") as f: