add capa rule distribution info

2026-06-08 11:36:36 +00:00 · 2022-08-15 11:06:02 -04:00
parent ff57a87f7f
commit 6d560ed105
2 changed files with 411 additions and 1 deletions
@@ -9,7 +9,7 @@ Check out the MBC presentations:
 We've also mapped MBC (and ATT&CK) to two open-source malware analysis tools:

 * [Cuckoo community signatures](https://github.com/MBCProject/community)
-* [capa rules](https://github.com/fireeye/capa-rules)
+* [capa rules](https://github.com/fireeye/capa-rules) - see the [mapping distribution](./capa.md)

 To join the **MBC mailing list**, please send a request to mbc@mitre.org.

@@ -0,0 +1,410 @@
+# capa Rule Distribution (15 August 2022)#
+
+## ATT&CK MAPPINGS ##
+
+###Collection:###
+  num: 7
+  rule:
+  - Archive Collected Data::Archive via Library [T1560.002]
+  - Clipboard Data [T1115]
+  - Video Capture [T1125]
+  - Input Capture::Keylogging [T1056.001]
+  - Data from Information Repositories [T1213]
+  - Audio Capture [T1123]
+  - Screen Capture [T1113]
+###Command and Control:###
+  num: 1
+  rule:
+  - Ingress Tool Transfer [T1105]
+###Credential Access:###
+  num: 4
+  rule:
+  - Credentials from Password Stores::Windows Credential Manager [T1555.004]
+  - Credentials from Password Stores::Password Managers [T1555.005]
+  - Credentials from Password Stores [T1555]
+  - Credentials from Password Stores::Credentials from Web Browsers [T1555.003]
+###Defense Evasion:###
+  num: 32
+  rule:
+  - Obfuscated Files or Information::Software Packing [T1027.002]
+  - Virtualization/Sandbox Evasion::System Checks [T1497.001]
+  - Impair Defenses::Disable or Modify Tools [T1562.001]
+  - Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
+  - Virtualization/Sandbox Evasion [T1497]
+  - Indicator Removal on Host [T1070]
+  - Impair Defenses::Disable Windows Event Logging [T1562.002]
+  - Process Injection [T1055]
+  - Access Token Manipulation::Parent PID Spoofing [T1134.004]
+  - Indicator Removal on Host::Clear Windows Event Logs [T1070.001]
+  - Indicator Removal on Host::File Deletion [T1070.004]
+  - Indicator Removal on Host::Timestomp [T1070.006]
+  - Obfuscated Files or Information [T1027]
+  - Obfuscated Files or Information::Indicator Removal from Tools [T1027.005]
+  - Deobfuscate/Decode Files or Information [T1140]
+  - Obfuscated Files or Information [T1027.002]
+  - Subvert Trust Controls::Mark-of-the-Web Bypass [T1553.005]
+  - File and Directory Permissions Modification [T1222]
+  - Hide Artifacts::Hidden Window [T1564.003]
+  - Hide Artifacts [T1564]
+  - "Process Injection::Process Doppelg\xE4nging [T1055.013]"
+  - Process Injection::Portable Executable Injection [T1055.002]
+  - Process Injection::Dynamic-link Library Injection [T1055.001]
+  - Process Injection::Thread Execution Hijacking [T1055.003]
+  - Process Injection::Asynchronous Procedure Call [T1055.004]
+  - Process Injection::Process Hollowing [T1055.012]
+  - Modify Registry [T1112]
+  - Impair Defenses::Safe Mode Boot [T1562.009]
+  - Subvert Trust Controls::Code Signing Policy Modification [T1553.006]
+  - Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002]
+  - Hijack Execution Flow [T1574]
+  - BITS Jobs [T1197]
+###Discovery:###
+  num: 17
+  rule:
+  - File and Directory Discovery [T1083]
+  - System Information Discovery [T1082]
+  - Process Discovery [T1057]
+  - System Location Discovery::System Language Discovery [T1614.001]
+  - System Service Discovery [T1007]
+  - Application Window Discovery [T1010]
+  - System Owner/User Discovery [T1033]
+  - Account Discovery [T1087]
+  - Query Registry [T1012]
+  - Software Discovery::Security Software Discovery [T1518.001]
+  - Software Discovery [T1518]
+  - System Network Configuration Discovery::Internet Connection Discovery [T1016.001]
+  - System Network Configuration Discovery [T1016]
+  - Network Sniffing [T1040]
+  - System Location Discovery [T1614]
+  - Group Policy Discovery [T1615]
+  - Domain Trust Discovery [T1482]
+###Execution:###
+  num: 8
+  rule:
+  - Command and Scripting Interpreter [T1059]
+  - Windows Management Instrumentation [T1047]
+  - System Services::Service Execution [T1569.002]
+  - Command and Scripting Interpreter::PowerShell [T1059.001]
+  - Shared Modules [T1129]
+  - Command and Scripting Interpreter::Python [T1059.006]
+  - Command and Scripting Interpreter::Unix Shell [T1059.004]
+  - Command and Scripting Interpreter::Windows Command Shell [T1059.003]
+###Exfiltration:###
+  num: 0
+  rule: []
+###Impact:###
+  num: 5
+  rule:
+  - Endpoint Denial of Service [T1499]
+  - System Shutdown/Reboot [T1529]
+  - Data Manipulation::Transmitted Data Manipulation [T1565.002]
+  - Inhibit System Recovery [T1490]
+  - Disk Wipe::Disk Structure Wipe [T1561.002]
+###Initial Access:###
+  num: 0
+  rule: []
+###Lateral Movement:###
+  num: 0
+  rule: []
+###Persistence:###
+  num: 13
+  rule:
+  - Create or Modify System Process::Windows Service [T1543.003]
+  - Event Triggered Execution::Unix Shell Configuration Modification [T1546.004]
+  - Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013]
+  - Server Software Component::IIS Components [T1505.004]
+  - Modify Authentication Process [T1556]
+  - Modify Authentication Process::Password Filter DLL [T1556.002]
+  - Boot or Logon Initialization Scripts::RC Scripts [T1037.004]
+  - Scheduled Task/Job::Scheduled Task [T1053.005]
+  - Boot or Logon Autostart Execution::Active Setup [T1547.014]
+  - Event Triggered Execution::AppInit DLLs [T1546.010]
+  - Event Triggered Execution [T1546]
+  - Boot or Logon Autostart Execution::Winlogon Helper DLL [T1547.004]
+  - Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]
+###Privilege Escalation:###
+  num: 1
+  rule:
+  - Access Token Manipulation [T1134]
+###Reconnaissance:###
+  num: 0
+  rule: []
+###Resource Development:###
+  num: 0
+  rule: []
+  
+  ##ATT&CK MAPPING HISTOGRAM##
+Reconnaissance        [ 0]
+Resource Development  [ 0]
+Initial Access        [ 0]
+Execution             [ 8]  **********
+Persistence           [13]  *****************
+Privilege Escalation  [ 1]  **
+Defense Evasion       [32]  ****************************************
+Credential Access     [ 4]  *****
+Discovery             [17]  **********************
+Lateral Movement      [ 0]
+Collection            [ 7]  *********
+Command and Control   [ 1]  **
+Exfiltration          [ 0]
+Impact                [ 5]  *******
+
+## MBC MAPPINGS ##
+###Anti-Behavioral Analysis:###
+  num: 20
+  rule:
+  - Emulator Detection [B0004]
+  - Virtual Machine Detection [B0009]
+  - Virtual Machine Detection::Human User Check [B0009.012]
+  - Sandbox Detection::Product Key/ID Testing [B0007.005]
+  - Debugger Detection [B0001]
+  - Debugger Detection::Software Breakpoints [B0001.025]
+  - Debugger Detection::Process Environment Block BeingDebugged [B0001.035]
+  - Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]
+  - Debugger Detection::SetHandleInformation [B0001.024]
+  - Debugger Detection::OutputDebugString [B0001.016]
+  - Debugger Detection::Memory Write Watching [B0001.010]
+  - Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033]
+  - Debugger Detection::Hardware Breakpoints [B0001.005]
+  - Debugger Detection::NtQueryInformationProcess [B0001.012]
+  - Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]
+  - Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]
+  - Debugger Detection::Anti-debugging Instructions [B0001.034]
+  - Conditional Execution::Runs as Service [B0025.007]
+  - Debugger Detection::Process Environment Block [B0001.019]
+  - Dynamic Analysis Evasion::Delayed Execution [B0003.003]
+###Anti-Static Analysis:###
+  num: 9
+  rule:
+  - Disassembler Evasion [B0012]
+  - Software Packing [F0001]
+  - Software Packing::Themida [F0001.011]
+  - Software Packing::VMProtect [F0001.010]
+  - Software Packing::Standard Compression [F0001.002]
+  - Software Packing::Confuser [F0001.009]
+  - Software Packing::UPX [F0001.008]
+  - Executable Code Obfuscation [B0032]
+  - Disassembler Evasion::Argument Obfuscation [B0012.001]
+###Collection:###
+  num: 4
+  rule:
+  - Keylogging::Polling [F0002.002]
+  - Keylogging::Application Hook [F0002.001]
+  - Screen Capture::WinAPI [E1113.m01]
+  - Screen Capture [E1113]
+###Command and Control:###
+  num: 3
+  rule:
+  - C2 Communication::Send Data [B0030.001]
+  - C2 Communication::Receive Data [B0030.002]
+  - C2 Communication::Server to Client File Transfer [B0030.003]
+###Credential Access:###
+  num: 0
+  rule: []
+###Defense Evasion:###
+  num: 13
+  rule:
+  - Disable or Evade Security Tools::Heavens Gate [F0004.008]
+  - Disable or Evade Security Tools::Modify Policy [F0004.005]
+  - Process Injection::Patch Process Command Line [E1055.m04]
+  - Self Deletion::COMSPEC Environment Variable [F0007.001]
+  - Obfuscated Files or Information::Encryption [E1027.m04]
+  - Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
+  - Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]
+  - Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007]
+  - Process Injection [E1055]
+  - Disable or Evade Security Tools::Disable Code Integrity [F0004.009]
+  - Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
+  - Process Injection::Injection via Windows Fibers [E1055.m05]
+  - Hijack Execution Flow::Import Address Table (IAT) Hooking [F0015.003]
+###Discovery:###
+  num: 6
+  rule:
+  - Analysis Tool Discovery::Process detection [B0013.001]
+  - Application Window Discovery::Window Text [E1010.m01]
+  - Taskbar Discovery [B0043]
+  - File and Directory Discovery::Log File [E1083.m01]
+  - Code Discovery::Enumerate PE Sections [B0046.001]
+  - Code Discovery::Inspect Section Memory Permissions [B0046.002]
+###Execution:###
+  num: 1
+  rule:
+  - Install Additional Program [B0023]
+###Exfiltration:###
+  num: 0
+  rule: []
+###Impact:###
+  num: 5
+  rule:
+  - Modify Hardware::Mouse [B0042.002]
+  - Modify Hardware::CDROM [B0042.001]
+  - Clipboard Modification [E1510]
+  - Data Destruction::Delete Shadow Copies [E1485.m04]
+  - Remote Access::Reverse Shell [B0022.001]
+###Lateral Movement:###
+  num: 0
+  rule: []
+###Persistence:###
+  num: 0
+  rule: []
+###Privilege Escalation:###
+  num: 0
+  rule: []
+  
+##MBC MAPPING HISTOGRAM##
+Anti-Behavioral Analysis  [20]  ****************************************
+Anti-Static Analysis      [ 9]  ******************
+Collection                [ 4]  ********
+Command and Control       [ 3]  ******
+Credential Access         [ 0]
+Defense Evasion           [13]  **************************
+Discovery                 [ 6]  ************
+Execution                 [ 1]  **
+Exfiltration              [ 0]
+Impact                    [ 5]  **********
+Lateral Movement          [ 0]
+Persistence               [ 0]
+Privilege Escalation      [ 0]
+
+##MBC MICRO-BEHAVIOR MAPPINGS##
+###Communication:###
+  num: 34
+  rule:
+  - DNS Communication::Resolve [C0011.001]
+  - HTTP Communication::Read Header [C0002.014]
+  - HTTP Communication::WinHTTP [C0002.008]
+  - HTTP Communication::IWebBrowser [C0002.010]
+  - HTTP Communication::Set Header [C0002.013]
+  - HTTP Communication::Start Server [C0002.018]
+  - HTTP Communication::Receive Request [C0002.015]
+  - HTTP Communication::Send Response [C0002.016]
+  - HTTP Communication::Get Response [C0002.017]
+  - HTTP Communication::Send Request [C0002.003]
+  - HTTP Communication::Download URL [C0002.006]
+  - HTTP Communication::Create Request [C0002.012]
+  - HTTP Communication::Send Data [C0002.005]
+  - HTTP Communication::Open URL [C0002.004]
+  - HTTP Communication::Connect to Server [C0002.009]
+  - HTTP Communication::Extract Body [C0002.011]
+  - Socket Communication::Start TCP Server [C0001.005]
+  - Socket Communication::TCP Client [C0001.008]
+  - Interprocess Communication::Create Pipe [C0003.001]
+  - Interprocess Communication::Write Pipe [C0003.004]
+  - Interprocess Communication::Connect Pipe [C0003.002]
+  - Interprocess Communication::Read Pipe [C0003.003]
+  - FTP Communication::Send File [C0004.001]
+  - DNS Communication::Server Connect [C0011.002]
+  - Socket Communication::Get Socket Status [C0001.012]
+  - Socket Communication::Set Socket Config [C0001.001]
+  - Socket Communication::Initialize Winsock Library [C0001.009]
+  - Socket Communication::Connect Socket [C0001.004]
+  - Socket Communication::Create TCP Socket [C0001.011]
+  - Socket Communication::Send TCP Data [C0001.014]
+  - Socket Communication::Create UDP Socket [C0001.010]
+  - Socket Communication::Send Data [C0001.007]
+  - Socket Communication::Receive Data [C0001.006]
+  - ICMP Communication::Echo Request [C0014.002]
+###Cryptography:###
+  num: 16
+  rule:
+  - Encryption Key::Import Public Key [C0028.001]
+  - Decrypt Data [C0031]
+  - Encryption Key [C0028]
+  - Decrypt Data::AES [C0031.001]
+  - Encrypt Data [C0027]
+  - Encrypt Data::RC4 [C0027.009]
+  - Cryptographic Hash [C0029]
+  - Cryptographic Hash::Tiger [C0029.005]
+  - Cryptographic Hash::SHA1 [C0029.002]
+  - Cryptographic Hash::SHA256 [C0029.003]
+  - Cryptographic Hash::MD5 [C0029.001]
+  - Cryptographic Hash::SHA224 [C0029.004]
+  - Hashed Message Authentication Code [C0061]
+  - Generate Pseudo-random Sequence::Use API [C0021.003]
+  - Generate Pseudo-random Sequence::Mersenne Twister [C0021.005]
+  - Crypto Library [C0059]
+###Data:###
+  num: 15
+  rule:
+  - Checksum::CRC32 [C0032.001]
+  - Checksum::Luhn [C0032.002]
+  - Checksum::Adler [C0032.005]
+  - Non-Cryptographic Hash::MurmurHash [C0030.001]
+  - Non-Cryptographic Hash::FNV [C0030.005]
+  - Non-Cryptographic Hash [C0030]
+  - Encode Data::Base64 [C0026.001]
+  - Decompress Data::aPLib [C0025.003]
+  - Decompress Data::IEncodingFilterFactory [C0025.002]
+  - Compress Data [C0024]
+  - Decompress Data::QuickLZ [C0025.001]
+  - Decompress Data [C0025]
+  - Check String [C0019]
+  - Modulo [C0058]
+  - Compression Library [C0060]
+###File System:###
+  num: 11
+  rule:
+  - Set File Attributes [C0050]
+  - Create Directory [C0046]
+  - Delete File [C0047]
+  - Delete Directory [C0048]
+  - Get File Attributes [C0049]
+  - Move File [C0063]
+  - Writes File [C0052]
+  - Copy File [C0045]
+  - Read File [C0051]
+  - Read Virtual Disk [C0056]
+  - Create File [C0016]
+###Hardware:###
+  num: 4
+  rule:
+  - Simulate Hardware::Ctrl-Alt-Del [C0057.001]
+  - Install Driver [C0037]
+  - Install Driver::Minifilter [C0037.001]
+  - Load Driver::Minifilter [C0023.001]
+###Memory:###
+  num: 2
+  rule:
+  - Free Memory [C0044]
+  - Allocate Memory [C0007]
+###Operating System:###
+  num: 11
+  rule:
+  - Environment Variable::Set Variable [C0034.001]
+  - Environment Variable::Get Variable [C0034.002]
+  - Wallpaper [C0035]
+  - Console [C0033]
+  - Registry::Set Registry Key [C0036.001]
+  - Registry::Create Registry Key [C0036.004]
+  - Registry::Open Registry Key [C0036.003]
+  - Registry::Query Registry Key [C0036.005]
+  - Registry::Query Registry Value [C0036.006]
+  - Registry::Delete Registry Key [C0036.002]
+  - Registry::Delete Registry Value [C0036.007]
+###Process:###
+  num: 14
+  rule:
+  - Create Thread [C0038]
+  - Suspend Thread [C0055]
+  - Terminate Thread [C0039]
+  - Resume Thread [C0054]
+  - Enumerate Threads [C0064]
+  - Create Mutex [C0042]
+  - Check Mutex [C0043]
+  - Allocate Thread Local Storage [C0040]
+  - Set Thread Local Storage Value [C0041]
+  - Create Process [C0017]
+  - Create Process::Create Suspended Process [C0017.003]
+  - Terminate Process [C0018]
+  - Open Process [C0065]
+  - Open Thread [C0066]
+  
+##MBC MICRO-BEHAVIOR MAPPING HISTOGRAM##
+Communication     [34]  ****************************************
+Cryptography      [16]  *******************
+Data              [15]  ******************
+File System       [11]  *************
+Hardware          [ 4]  *****
+Memory            [ 2]  ***
+Operating System  [11]  *************
+Process           [14]  *****************