mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Merge pull request #13 from MBCProject/minor-fixes-in-content-normalizing-text
Content Normalization & Overall Improvements
This commit is contained in:
Desiree Beck
@@ -1,5 +1,5 @@
|
||||
# <a name="mbc"></a>Malware Behavior Catalog v2.0 #
|
||||
The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-markdown/blob/master/yfaq/README.md) page for answers to common questions.
|
||||
The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions.
|
||||
|
||||
Check out the [MBC presentation](https://www.youtube.com/watch?v=KY8Ty-0sdVU) given at BSides DC (October 2019).
|
||||
|
||||
@@ -17,25 +17,25 @@ Methods are associated with behaviors and serve different roles, depending on th
|
||||
Note that a method cannot be used without a behavior.
|
||||
|
||||
### Micro-behaviors ###
|
||||
Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/README.md) for details.
|
||||
Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](./micro-behaviors/README.md) for details.
|
||||
|
||||
### <a name="ids"></a>Identifiers ###
|
||||
As shown below, the letter of an identifier relays information about a behavior.
|
||||
|
||||
|**Letter**|**Example**|**Description**|
|
||||
|----------------|----------------------|-------------|
|
||||
| **B** | *B0040* | An MBC behavior. |
|
||||
| **C** | *C0015* | An MBC micro-behavior.|
|
||||
| **T** | *T1234* | An ATT&CK technique.|
|
||||
| **E** | *E1234* | An ATT&CK technique that has been enhanced with malware-specific details. The numerical portion of the identifier will match the ATT&CK ID (e.g., E1234 enhances T1234).|
|
||||
| **F** | *F0004* | An ATT&CK sub-technique that has been enhanced with malware-specific details.|
|
||||
|---|---|---|
|
||||
|**B**|*B0040*|An MBC behavior.|
|
||||
|**C**|*C0015*|An MBC micro-behavior.|
|
||||
|**T**|*T1234*|An ATT&CK technique.|
|
||||
|**E**|*E1234*|An ATT&CK technique that has been enhanced with malware-specific details. The numerical portion of the identifier will match the ATT&CK ID (e.g., E1234 enhances T1234).|
|
||||
|**F**|*F0004*|An ATT&CK sub-technique that has been enhanced with malware-specific details.|
|
||||
|
||||
Two letters of an identifier relay information about an objective.
|
||||
|
||||
|**Letter**|**Example**|**Description**|
|
||||
|----------------|----------------------|-------------|
|
||||
| **OB** | *OB0001* | An MBC objective.|
|
||||
| **OC** | *OC0003* | An MBC micro-objective.|
|
||||
|---|---|---|
|
||||
|**OB**|*OB0001*|An MBC objective.|
|
||||
|**OC**|*OC0003*|An MBC micro-objective.|
|
||||
|
||||
Identifiers of methods are formatted in the same say as ATT&CK sub-techniques. If MBC defines a new method for an existing ATT&CK technique, the identifier is changed from "T" to "E" and an "m" identifier is added (e.g., a method added to T1234 would be denoted *E1234.m01* and is different than *T1234.001*, although both refer to the T1234 ATT&CK technique). Method identifiers of "B", "C", and "F" behaviors are defined without the "m" (e.g., *B0008.009*; *C0005.002*; *F0001.005*).
|
||||
|
||||
@@ -47,27 +47,26 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**.
|
||||
Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.
|
||||
|
||||
### Example Malware ###
|
||||
The MBC also contains a collection of [example malware](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/) that are characterized with malware behaviors.
|
||||
The MBC also contains a collection of [example malware](./xample-malware/README.md) that are characterized with malware behaviors.
|
||||
|
||||
## Micro-behavior Objectives ##
|
||||
[Micro-behaviors](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/README.md) and their associated objectives are under development.
|
||||
[Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.
|
||||
|
||||
## Malware Objective Descriptions ##
|
||||
Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors.
|
||||
|
||||
|**Objective**|**Description**|
|
||||
|------------------------------------------------------------------|----------------------------|
|
||||
|[**Anti-Behavioral Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/README.md) |Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
|
||||
|[**Anti-Static Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/README.md)| Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
|
||||
|[**Collection**](https://github.com/MBCProject/mbc-markdown/blob/master/collection/README.md) | Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
|
||||
|[**Command and Control**](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/README.md) |Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
|
||||
|[**Credential Access**](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
|
||||
|[**Defense Evasion**](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
|
||||
|[**Discovery**](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
|
||||
|[**Execution**](https://github.com/MBCProject/mbc-markdown/blob/master/execution/README.md)| Malware aims to execute its code on a system to achieve a variety of goals.|
|
||||
|[**Exfiltration**](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/README.md)| Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
|
||||
|[**Impact**](https://github.com/MBCProject/mbc-markdown/blob/master/impact/README.md)| Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
|
||||
|[**Lateral Movement**](https://github.com/MBCProject/mbc-markdown/blob/master/lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
|
||||
|[**Persistence**](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/README.md)|Malware aims to remain on a system regardless of system events.|
|
||||
|[**Privilege Escalation**](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
|
||||
|
||||
|---|---|
|
||||
|[**Anti-Behavioral Analysis**](./anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
|
||||
|[**Anti-Static Analysis**](./anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
|
||||
|[**Collection**](./collection/README.md)|Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
|
||||
|[**Command and Control**](./command-and-control/README.md)|Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
|
||||
|[**Credential Access**](./credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
|
||||
|[**Defense Evasion**](./defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
|
||||
|[**Discovery**](./discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
|
||||
|[**Execution**](./execution/README.md)|Malware aims to execute its code on a system to achieve a variety of goals.|
|
||||
|[**Exfiltration**](./exfiltration/README.md)|Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
|
||||
|[**Impact**](./impact/README.md)|Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
|
||||
|[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
|
||||
|[**Persistence**](./persistence/README.md)|Malware aims to remain on a system regardless of system events.|
|
||||
|[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
|
||||
|
||||
@@ -1,30 +1,29 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0001**|
|
||||
|
||||
|
||||
# Anti-Behavioral Analysis
|
||||
Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger).
|
||||
|
||||
Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).
|
||||
|
||||
* **Capture Evasion** [B0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-capture.md)
|
||||
* **Debugger Detection** [B0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-debugger.md)
|
||||
* **Debugger Evasion** [B0002](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-debugger.md)
|
||||
* **Dynamic Analysis Evasion** [B0003](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md)
|
||||
* **Emulator Detection** [B0004](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-emulator.md)
|
||||
* **Emulator Evasion** [B0005](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-emulator.md)
|
||||
* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
|
||||
* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
|
||||
* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
|
||||
* **Memory Dump Evasion** [B0006](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md)
|
||||
* **Sandbox Detection** [B0007](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-sandbox.md)
|
||||
* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
|
||||
* **Virtual Machine Detection** [B0009](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-vm.md)
|
||||
* **Capture Evasion** [B0036](../anti-behavioral-analysis/evade-capture.md)
|
||||
* **Debugger Detection** [B0001](../anti-behavioral-analysis/detect-debugger.md)
|
||||
* **Debugger Evasion** [B0002](../anti-behavioral-analysis/evade-debugger.md)
|
||||
* **Dynamic Analysis Evasion** [B0003](../anti-behavioral-analysis/evade-dynamic-analysis.md)
|
||||
* **Emulator Detection** [B0004](../anti-behavioral-analysis/detect-emulator.md)
|
||||
* **Emulator Evasion** [B0005](../anti-behavioral-analysis/evade-emulator.md)
|
||||
* **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
|
||||
* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
|
||||
* **Hooking** [F0003](../credential-access/hooking.md)
|
||||
* **Memory Dump Evasion** [B0006](../anti-behavioral-analysis/evade-memory-dump.md)
|
||||
* **Sandbox Detection** [B0007](../anti-behavioral-analysis/detect-sandbox.md)
|
||||
* **Software Packing** [F0001](../anti-static-analysis/software-packing.md)
|
||||
* **Virtual Machine Detection** [B0009](../anti-behavioral-analysis/detect-vm.md)
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project
|
||||
|
||||
<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0001**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -13,51 +13,51 @@ Details on methods of detecting debuggers are given in the references; many are
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0001.001|**API Hook Detection**|Module bounds based [[7]](#7).|
|
||||
|B0001.034|**Anti-debugging Instructions**|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).|
|
||||
|B0001.002|**CheckRemoteDebuggerPresent**|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).|
|
||||
|B0001.003|**CloseHandle**|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)|
|
||||
|B0001.004|**Debugger Artifacts**|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
|
||||
|B0001.005|**Hardware Breakpoints**|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.|
|
||||
|B0001.006|**Interrupt 0x2d**|If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.|
|
||||
|B0001.007|**Interrupt 1**|[[7]](#7)|
|
||||
|B0001.008|**IsDebuggerPresent**|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.|
|
||||
|B0001.009|**Memory Breakpoints**|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.|
|
||||
|B0001.010|**Memory Write Watching**|[[7]](#7)|
|
||||
|B0001.011|**Monitoring Thread**|Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.|
|
||||
|B0001.012|**NtQueryInformationProcess**|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).|
|
||||
|B0001.013|**NtQueryObject**|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.|
|
||||
|B0001.014|**NtSetInformationThread**|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)|
|
||||
|B0001.015|**NtYieldExecution/SwitchToThread**| [[7]](#7)|
|
||||
|B0001.016|**OutputDebugString**|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.|
|
||||
|B0001.017|**Page Exception Breakpoint Detection**| [[7]](#7).|
|
||||
|B0001.018|**Parent Process**|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)|
|
||||
|B0001.019|**Process Environment Block**|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method).|
|
||||
|B0001.035|**Process Environment Block BeingDebugged**|The BeingDebugged field is tested to determine whether the process is being debugged.|
|
||||
|B0001.036|**Process Environment Block NtGlobalFlag**|The NtGlobalFlag field is tested to determine whether the process is being debugged.|
|
||||
|B0001.037|**Process Environment Block IsDebugged**|The IsDebugged field is tested to determine whether the process is being debugged.|
|
||||
|B0001.020|**Process Jobs**|[[7]](#7)|
|
||||
|B0001.021|**ProcessHeap**|Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).|
|
||||
|B0001.022|**RtlAdjustPrivilege**|Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).|
|
||||
|B0001.023|**SeDebugPrivilege**|(Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)|
|
||||
|B0001.024|**SetHandleInformation**|(Protected Handle)|
|
||||
|B0001.025|**Software Breakpoints**|(INT3/0xCC)|
|
||||
|B0001.026|**Stack Canary**|Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.|
|
||||
|B0001.027|**TIB Aware**|Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).|
|
||||
|B0001.028|**Timing/Delay Check**|Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging.|
|
||||
|B0001.032|**Timing/Delay Check GetTickCount**|Malware uses GetTickCount function in a timing/delay check.|
|
||||
|B0001.033|**Timing/Delay Check QueryPerformanceCounter**|Malware uses QueryPerformanceCounter in a timing/delay check.|
|
||||
|B0001.029|**TLS Callbacks**|[[7]](#7)|
|
||||
|B0001.030|**UnhandledExceptionFilter**|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.|
|
||||
|B0001.031|**WudfIsAnyDebuggerPresent**|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**API Hook Detection**|B0001.001|Module bounds based [[7]](#7).|
|
||||
|**Anti-debugging Instructions**|B0001.034|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).|
|
||||
|**CheckRemoteDebuggerPresent**|B0001.002|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).|
|
||||
|**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)|
|
||||
|**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
|
||||
|**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.|
|
||||
|**Interrupt 0x2d**|B0001.006|If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.|
|
||||
|**Interrupt 1**|B0001.007|[[7]](#7)|
|
||||
|**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.|
|
||||
|**Memory Breakpoints**|B0001.009|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.|
|
||||
|**Memory Write Watching**|B0001.010|[[7]](#7)|
|
||||
|**Monitoring Thread**|B0001.011|Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.|
|
||||
|**NtQueryInformationProcess**|B0001.012|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).|
|
||||
|**NtQueryObject**|B0001.013|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.|
|
||||
|**NtSetInformationThread**|B0001.014|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)|
|
||||
|**NtYieldExecution/SwitchToThread**|B0001.015|[[7]](#7)|
|
||||
|**OutputDebugString**|B0001.016|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.|
|
||||
|**Page Exception Breakpoint Detection**|B0001.017|[[7]](#7)|
|
||||
|**Parent Process**|B0001.018|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)|
|
||||
|**Process Environment Block**|B0001.019|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method).|
|
||||
|**Process Environment Block BeingDebugged**|B0001.035|The BeingDebugged field is tested to determine whether the process is being debugged.|
|
||||
|**Process Environment Block IsDebugged**|B0001.037|The IsDebugged field is tested to determine whether the process is being debugged.|
|
||||
|**Process Environment Block NtGlobalFlag**|B0001.036|The NtGlobalFlag field is tested to determine whether the process is being debugged.|
|
||||
|**Process Jobs**|B0001.020|[[7]](#7)|
|
||||
|**ProcessHeap**|B0001.021|Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).|
|
||||
|**RtlAdjustPrivilege**|B0001.022|Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).|
|
||||
|**SeDebugPrivilege**|B0001.023|(Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)|
|
||||
|**SetHandleInformation**|B0001.024|(Protected Handle)|
|
||||
|**Software Breakpoints**|B0001.025|(INT3/0xCC)|
|
||||
|**Stack Canary**|B0001.026|Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.|
|
||||
|**TIB Aware**|B0001.027|Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).|
|
||||
|**TLS Callbacks**|B0001.029|[[7]](#7)|
|
||||
|**Timing/Delay Check**|B0001.028|Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging.|
|
||||
|**Timing/Delay Check GetTickCount**|B0001.032|Malware uses GetTickCount function in a timing/delay check.|
|
||||
|**Timing/Delay Check QueryPerformanceCounter**|B0001.033|Malware uses QueryPerformanceCounter in a timing/delay check.|
|
||||
|**UnhandledExceptionFilter**|B0001.030|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.|
|
||||
|**WudfIsAnyDebuggerPresent**|B0001.031|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|ID|Description|
|
||||
|-----------------------------|--------|--------|-----------------------------|
|
||||
|[**Redhip**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/redhip.md)|January 2011|M0001.034, M0001.019|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -74,4 +74,3 @@ References
|
||||
<a name="6">[6]</a> Nicolas Falliere, Symantec, "Windows Anti-Debug Reference," 11 September 2007. https://www.symantec.com/connect/articles/windows-anti-debug-reference.
|
||||
|
||||
<a name="7">[7]</a> Anti Debugging Tricks, Al-Khaser. https://github.com/LordNoteworthy/al-khaser/wiki/Anti-Debugging-Tricks
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0004**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,15 +11,13 @@ Detects whether the malware instance is being executed inside an emulator. If so
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0004.001|**Check for Emulator-related Files**|Checks whether particular files (e.g., QEMU files) exist.|
|
||||
|B0004.002|**Check for WINE Version**|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
|
||||
|B0004.003|**Check Emulator-related Registry Keys**|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)|
|
||||
|B0004.004|**Failed Network Connections**|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Check Emulator-related Registry Keys**|B0004.003|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)|
|
||||
|**Check for Emulator-related Files**|B0004.001|Checks whether particular files (e.g., QEMU files) exist.|
|
||||
|**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
|
||||
|**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0007**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Sub-techniques**|[Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/), [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/)|
|
||||
|
||||
|
||||
@@ -9,30 +9,30 @@ Sandbox Detection
|
||||
=================
|
||||
Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.
|
||||
|
||||
The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
|
||||
The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0007.001|**Check Clipboard Data**|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
|
||||
|B0007.002|**Check Files**|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
|
||||
|B0007.003|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
|
||||
|B0007.004|**Injected DLL Testing**|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
|
||||
|B0007.005|**Product Key/ID Testing**|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
|
||||
|B0007.006|**Screen Resolution Testing**|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|
|
||||
|B0007.007|**Self Check**|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.|
|
||||
|B0007.008|**Timing/Date Check**|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|B0007.009|**Timing/Uptime Check**|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Check Clipboard Data**|B0007.001|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
|
||||
|**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
|
||||
|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
|
||||
|**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
|
||||
|**Product Key/ID Testing**|B0007.005|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
|
||||
|**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|
|
||||
|**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.|
|
||||
|**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|**Timing/Uptime Check**|B0007.009|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
|
||||
|[**Rombertik**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/rombertik.md)|May 2015|[[2]](#2)|
|
||||
|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4) |
|
||||
|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|
|
||||
|---|---|---|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|May 2015|[[2]](#2)|
|
||||
|[**Terminator**](../xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -42,4 +42,4 @@ References
|
||||
|
||||
<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
|
||||
|
||||
<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
|
||||
<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0009**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
|
||||
|
||||
|
||||
@@ -9,88 +9,67 @@ Virtual Machine Detection
|
||||
=========================
|
||||
Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)
|
||||
|
||||
The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
|
||||
The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0009.001|**Check File and Directory Artifacts**|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)|
|
||||
|B0009.002|**Check Memory Artifacts**|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)|
|
||||
|B0009.003|**Check Named System Objects**|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.|
|
||||
|B0009.004|**Check Processes**|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)|
|
||||
|B0009.005|**Check Registry Keys**|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)|
|
||||
|B0009.006|**Check Running Services**|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)|
|
||||
|B0009.007|**Check Software**|Malware may check software version; for example, to determine whether the software is relatively current.|
|
||||
|B0009.008|**Check Virtual Devices**|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)|
|
||||
|B0009.009|**Check Windows**|Malware may check windows for VM-related characteristics.|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |B0009.020|*Window size*| Tiny window size may indicate a VM.|
|
||||
| |B0009.021|*Unique windows*|May check for the presence of known windows from analysis tools running in a VM.|
|
||||
| |B0009.022|*Title bars*|May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
|
||||
|
||||
| | | |
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0009.010|**Guest Process Testing**|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
|
||||
|B0009.011|**HTML5 Performance Object Check**|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
|
||||
|B0009.012|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
|
||||
|B0009.013|**Modern Specs Check**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |B0009.014|*Total physical memory*|Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
|
||||
| |B0009.015|*Drive size*|Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
|
||||
| |B0009.016|*USB drive*|Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
|
||||
| |B0009.017|*Printer*|Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
|
||||
| |B0009.018|*Processor count*|Checks number of processors; single CPU machines are suspect.|
|
||||
| |B0009.019|*Keyboard layout*|Check keyboard layout.|
|
||||
|
||||
| | | |
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0009.023|**Unique Hardware/Firmware Check**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Items checked include:|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |B0009.024|*BIOS*|Characteristics of the BIOS, such as version, can indicate virtualization.|
|
||||
| |B0009.025|*I/O Communication Port*|VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
|
||||
| |B0009.026|*CPU Name*|Checks the CPU name to determine virtualization.|
|
||||
| |B0009.027|*CPU Location*|When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
|
||||
| |B0009.028|*MAC Address*|VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
|
||||
|
||||
| | | |
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0009.029|**Instruction Testing**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |B0009.030|*SIDT (red pill)*|Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
|
||||
| |B0009.031|*SGDT/SLDT (no pill)*|The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.
|
||||
| |B0009.032|*SMSW*| |
|
||||
| |B0009.033|*STR*| |
|
||||
| |B0009.034|*CPUID*|Checking the CPU ID found within the registry can provide information to system type.|
|
||||
| |B0009.035|*IN*| |
|
||||
| |B0009.036|*RDTSC*| |
|
||||
| |B0009.037|*VMCPUID*| |
|
||||
| |B0009.038|*VPCEXT*| |
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Check File and Directory Artifacts**|B0009.001|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)|
|
||||
|**Check Memory Artifacts**|B0009.002|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)|
|
||||
|**Check Named System Objects**|B0009.003|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.|
|
||||
|**Check Processes**|B0009.004|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)|
|
||||
|**Check Registry Keys**|B0009.005|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)|
|
||||
|**Check Running Services**|B0009.006|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)|
|
||||
|**Check Software**|B0009.007|Malware may check software version; for example, to determine whether the software is relatively current.|
|
||||
|**Check Virtual Devices**|B0009.008|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)|
|
||||
|**Check Windows**|B0009.009|Malware may check windows for VM-related characteristics.|
|
||||
|**Check Windows - Title bars**|B0009.022|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
|
||||
|**Check Windows - Unique windows**|B0009.021|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.|
|
||||
|**Check Windows - Window size**|B0009.020|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.|
|
||||
|**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
|
||||
|**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
|
||||
|**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
|
||||
|**Instruction Testing**|B0009.029|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.|
|
||||
|**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|**Instruction Testing - SGDT/SLDT (no pill)**|B0009.031|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.|
|
||||
|**Instruction Testing - SIDT (red pill)**|B0009.030|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
|
||||
|**Instruction Testing - SMSW**|B0009.032|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|**Instruction Testing - STR**|B0009.033|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|**Instruction Testing - VMCPUID**|B0009.037|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|**Instruction Testing - VPCEXT**|B0009.038|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
|
||||
|**Modern Specs Check**|B0009.013|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.|
|
||||
|**Modern Specs Check - Drive size**|B0009.015|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
|
||||
|**Modern Specs Check - Keyboard layout**|B0009.019|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Check keyboard layout.|
|
||||
|**Modern Specs Check - Printer**|B0009.017|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
|
||||
|**Modern Specs Check - Processor count**|B0009.018|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks number of processors; single CPU machines are suspect.|
|
||||
|**Modern Specs Check - Total physical memory**|B0009.014|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
|
||||
|**Modern Specs Check - USB drive**|B0009.016|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
|
||||
|**Unique Hardware/Firmware Check**|B0009.023|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment.|
|
||||
|**Unique Hardware/Firmware Check - BIOS**|B0009.024|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Characteristics of the BIOS, such as version, can indicate virtualization.|
|
||||
|**Unique Hardware/Firmware Check - CPU Location**|B0009.027|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
|
||||
|**Unique Hardware/Firmware Check - CPU Name**|B0009.026|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Checks the CPU name to determine virtualization.|
|
||||
|**Unique Hardware/Firmware Check - I/O Communication Port**|B0009.025|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
|
||||
|**Unique Hardware/Firmware Check - MAC Address**|B0009.028|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**GravityRAT**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
|
||||
|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
|
||||
|---|---|---|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
|
||||
<a name="2">[2]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion
|
||||
|
||||
<a name="3">[3]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
|
||||
|
||||
|
||||
<a name="4">[4]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
|
||||
|
||||
<a name="5">[5]</a> https://github.com/LordNoteworthy/al-khaser
|
||||
|
||||
@@ -1,20 +1,18 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0036**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Capture Evasion
|
||||
===============
|
||||
Malware has characteristics enabling it to evade capture from the infected system.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0036.001|**Memory-only Payload**|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).|
|
||||
|B0036.002|**Encrypted Payloads**|Decryption key is stored external to the executable or never touches the disk.|
|
||||
|B0036.003|**Multiple Stages of Loaders**: Multiple stages of loaders are used with an encoded payload.|
|
||||
|
||||
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Encrypted Payloads**|B0036.002|Decryption key is stored external to the executable or never touches the disk.|
|
||||
|**Memory-only Payload**|B0036.001|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).|
|
||||
|**Multiple Stages of Loaders**|B0036.003|Multiple stages of loaders are used with an encoded payload.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0002**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -13,46 +13,46 @@ A thorough reference for anti-debugging, both detection and evasion, is given in
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0002.001|**Block Interrupts**|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.|
|
||||
|B0002.002|**Break Point Clearing**|Intentionally clearing software or hardware breakpoints.|
|
||||
|B0002.003|**Byte Stealing**|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.|
|
||||
|B0002.004|**Change SizeOfImage**|Changinging this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.|
|
||||
|B0002.005|**Code Integrity Check**|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.|
|
||||
|B0002.006|**Exception Misdirection**|Using exception handling (SEH) to cause flow of program to non-obvious paths.|
|
||||
|B0002.007|**Get Base Indirectly**|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.|
|
||||
|B0002.008|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
|
||||
|B0002.009|**Hook Interrupt**|Modification of interrupt vector or descriptor tables.|
|
||||
|B0002.010|**Import Obfuscation**: Add obfuscation between imports calls and APIs.|
|
||||
|B0002.011|**Inlining**|Variation of static linking where full API code inserted everywhere it would have been called.|
|
||||
|B0002.012|**Loop Escapes**|Use SEH or other methods to break out of a loop instead of a conditional jump.|
|
||||
|B0002.013|**Malloc Use**|Instead of unpacking into a pre-defined section/segment (ex: .text) of the binary, use malloc() / VirtualAlloc() to create a new segment. This makes keeping track of memory locations across different runs more difficult, as there is no guarantee that malloc/VirtualAlloc will assign the same address range each time.|
|
||||
|B0002.014|**Modify PE Header**|Any part of the header is changed or erased.|
|
||||
|B0002.015|**Nanomites**|int3 with code replacement table; debugs itself.|
|
||||
|B0002.016|**Obfuscate Library Use**|LoadLibrary API calls or direct access of kernel32 via PEB (fs[0]) pointers, used to rebuild IAT or just obfuscate library use.|
|
||||
|B0002.017|**Parallel Threads**|Use several parallel threads to make analysis harder.|
|
||||
|B0002.018|**Pipeline Misdirection**|Take advantage of pipelining in modern processors to misdirect debugging, emulation, or static analysis tools. An unpacker can assume a certain number of opcodes will be cached and then proceed to overwrite them in memory, causing a debugger/emulator/analyzer to follow different code than is normally executed.|
|
||||
|B0002.019|**Pre-Debug**|Prevents debugger from attaching to process or to break until after the code of interest has been executed.|
|
||||
|B0002.020|**Relocate API Code**|Relocate API code in separate buffer (calls don’t lead to imported DLLs).|
|
||||
|B0002.021|**Return Obfuscation**|Overwrite the RET address on the stack or the code at the RET address. Variation seen that writes to the start-up code or main module that called the malware's WinMain or DllMain.|
|
||||
|B0002.022|**RtlAdjustPrivilege**|Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached.|
|
||||
|B0002.023|**Section Misalignment**|Some analysis tools cannot handle binaries with misaligned sections.|
|
||||
|B0002.024|**Self-Debugging**|Debug itself to prevent another debugger to be attached.|
|
||||
|B0002.025|**Self-Unmapping**|UnmapViewOfFile() on itself.|
|
||||
|B0002.026|**Static Linking**|Copy locally the whole content of API code.|
|
||||
|B0002.027|**Stolen API Code**|A variation of "byte stealing" where the first few instructions or bytes of an API are executed in user code, allowing the IAT to point into the middle of an API function. This confuses IAT rebuilders such as ImpRec and Scylla and may bypass breakpoints.|
|
||||
|B0002.028|**Tampering**|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
|
||||
|B0002.029|**Thread Timeout**|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.|
|
||||
|B0002.030|**Use Interrupts**|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Block Interrupts**|B0002.001|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.|
|
||||
|**Break Point Clearing**|B0002.002|Intentionally clearing software or hardware breakpoints.|
|
||||
|**Byte Stealing**|B0002.003|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.|
|
||||
|**Change SizeOfImage**|B0002.004|Changing this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.|
|
||||
|**Code Integrity Check**|B0002.005|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.|
|
||||
|**Exception Misdirection**|B0002.006|Using exception handling (SEH) to cause flow of program to non-obvious paths.|
|
||||
|**Get Base Indirectly**|B0002.007|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.|
|
||||
|**Guard Pages**|B0002.008|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
|
||||
|**Hook Interrupt**|B0002.009|Modification of interrupt vector or descriptor tables.|
|
||||
|**Import Obfuscation**|B0002.010|Add obfuscation between imports calls and APIs.|
|
||||
|**Inlining**|B0002.011|Variation of static linking where full API code inserted everywhere it would have been called.|
|
||||
|**Loop Escapes**|B0002.012|Use SEH or other methods to break out of a loop instead of a conditional jump.|
|
||||
|**Malloc Use**|B0002.013|Instead of unpacking into a pre-defined section/segment (ex: .text) of the binary, use malloc() / VirtualAlloc() to create a new segment. This makes keeping track of memory locations across different runs more difficult, as there is no guarantee that malloc/VirtualAlloc will assign the same address range each time.|
|
||||
|**Modify PE Header**|B0002.014|Any part of the header is changed or erased.|
|
||||
|**Nanomites**|B0002.015|int3 with code replacement table; debugs itself.|
|
||||
|**Obfuscate Library Use**|B0002.016|LoadLibrary API calls or direct access of kernel32 via PEB (fs[0]) pointers, used to rebuild IAT or just obfuscate library use.|
|
||||
|**Parallel Threads**|B0002.017|Use several parallel threads to make analysis harder.|
|
||||
|**Pipeline Misdirection**|B0002.018|Take advantage of pipelining in modern processors to misdirect debugging, emulation, or static analysis tools. An unpacker can assume a certain number of opcodes will be cached and then proceed to overwrite them in memory, causing a debugger/emulator/analyzer to follow different code than is normally executed.|
|
||||
|**Pre-Debug**|B0002.019|Prevents debugger from attaching to process or to break until after the code of interest has been executed.|
|
||||
|**Relocate API Code**|B0002.020|Relocate API code in separate buffer (calls don’t lead to imported DLLs).|
|
||||
|**Return Obfuscation**|B0002.021|Overwrite the RET address on the stack or the code at the RET address. Variation seen that writes to the start-up code or main module that called the malware's WinMain or DllMain.|
|
||||
|**RtlAdjustPrivilege**|B0002.022|Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached.|
|
||||
|**Section Misalignment**|B0002.023|Some analysis tools cannot handle binaries with misaligned sections.|
|
||||
|**Self-Debugging**|B0002.024|Debug itself to prevent another debugger to be attached.|
|
||||
|**Self-Unmapping**|B0002.025|UnmapViewOfFile() on itself.|
|
||||
|**Static Linking**|B0002.026|Copy locally the whole content of API code.|
|
||||
|**Stolen API Code**|B0002.027|A variation of "byte stealing" where the first few instructions or bytes of an API are executed in user code, allowing the IAT to point into the middle of an API function. This confuses IAT rebuilders such as ImpRec and Scylla and may bypass breakpoints.|
|
||||
|**Tampering**|B0002.028|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
|
||||
|**Thread Timeout**|B0002.029|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.|
|
||||
|**Use Interrupts**|B0002.030|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|---|---|---|
|
||||
|**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)|
|
||||
|**Dridex**|March 2015|[[3]](#3)|
|
||||
|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -65,5 +65,5 @@ References
|
||||
<a name="4">[4]</a> http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/
|
||||
|
||||
<a name="5">[5]</a> http://unprotect.tdgt.org/index.php/Unprotect_Project
|
||||
|
||||
<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
|
||||
<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
|
||||
@@ -1,40 +1,41 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0003**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
|
||||
|
||||
|
||||
Dynamic Analysis Evasion
|
||||
========================
|
||||
Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine.
|
||||
|
||||
See [Emulator Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-emulator.md) for an emulator-specific evasion behavior, and see [Execution Guardrails](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions.
|
||||
See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an emulator-specific evasion behavior, and see [Execution Guardrails](../anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0003.001|**Alternative ntdll.dll**|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.|
|
||||
|B0003.002|**Data Flood**|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)|
|
||||
|B0003.003|**Delayed Execution**|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.|
|
||||
|B0003.004|**Demo Mode**|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.|
|
||||
|B0003.005|**Drop Code**|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).|
|
||||
|B0003.006|**Encode File**|Encode a file on disk, such as an implant's config file.|
|
||||
|B0003.007|**Hook File System**|Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.|
|
||||
|B0003.008|**Hook Interrupt**|Modification of interrupt vector or descriptor tables.|
|
||||
|B0003.009|**Illusion**|Creates an illusion; makes the analyst think something happened when it didn't.|
|
||||
|B0003.010|**Restart**|Restarts or shuts down system to bypass sandboxing.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Alternative ntdll.dll**|B0003.001|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.|
|
||||
|**Data Flood**|B0003.002|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)|
|
||||
|**Delayed Execution**|B0003.003|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.|
|
||||
|**Demo Mode**|B0003.004|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.|
|
||||
|**Drop Code**|B0003.005|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).|
|
||||
|**Encode File**|B0003.006|Encode a file on disk, such as an implant's config file.|
|
||||
|**Hook File System**|B0003.007|Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.|
|
||||
|**Hook Interrupt**|B0003.008|Modification of interrupt vector or descriptor tables.|
|
||||
|**Illusion**|B0003.009|Creates an illusion; makes the analyst think something happened when it didn't.|
|
||||
|**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.|
|
||||
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
|
||||
|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|October 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
|
||||
|---|---|---|
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
|
||||
|[**Terminator**](../xample-malware/terminator.md)|October 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
|
||||
|**Nap**|2013|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
|
||||
|**Smokeloader**|2019|Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [[4]](#4)|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades dynamic analysis.)|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Evades dynamic analysis.)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,24 +1,25 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0005**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Emulator Evasion
|
||||
================
|
||||
Behaviors that obstruct analysis in an emulator.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0005.001|**Different Opcode Sets**|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.|
|
||||
|B0005.002|**Undocumented Opcodes**|Use rare or undocumented opcodes to block non-exhaustive emulators.|
|
||||
|B0005.003|**Unusual/Undocumented API Calls**|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).|
|
||||
|B0005.004|**Extra Loops/Time Locks**|Add extra loops to make time-constraint emulators give up.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Different Opcode Sets**|B0005.001|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.|
|
||||
|**Extra Loops/Time Locks**|B0005.004|Add extra loops to make time-constraint emulators give up.|
|
||||
|**Undocumented Opcodes**|B0005.002|Use rare or undocumented opcodes to block non-exhaustive emulators.|
|
||||
|**Unusual/Undocumented API Calls**|B0005.003|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
|
||||
|---|---|---|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
|
||||
|
||||
@@ -1,32 +1,33 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0006**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Memory Dump Evasion
|
||||
===================
|
||||
Malware hinders retrieval and/or discovery of the contents of the physical memory of the system on which the malware instance is executing [[1]](#1).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0006.001|**Code Encryption in Memory**|Encrypt the executing malware instance code in memory.|
|
||||
|B0006.002|**Erase the PE header**|Erase PE header from memory.|
|
||||
|B0006.003|**Hide virtual memory**|Hide arbitrary segments of virtual memory.|
|
||||
|B0006.004|**SizeOfImage**|Set the SizeOfImage field of PEB.LoaderData to be huge.|
|
||||
|B0006.005|**Tampering**|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
|
||||
|B0006.006|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
|
||||
|B0006.007|**On-the-Fly APIs**|Resolve API addresses before each use to prevent complete dumping.|
|
||||
|B0006.008|**Feed Misinformation**|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md).|
|
||||
|B0006.009|**Flow Opcode Obstruction**|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Code Encryption in Memory**|B0006.001|Encrypt the executing malware instance code in memory.|
|
||||
|**Erase the PE header**|B0006.002|Erase PE header from memory.|
|
||||
|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](../credential-access/hooking.md).|
|
||||
|**Flow Opcode Obstruction**|B0006.009|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).|
|
||||
|**Guard Pages**|B0006.006|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
|
||||
|**Hide virtual memory**|B0006.003|Hide arbitrary segments of virtual memory.|
|
||||
|**On-the-Fly APIs**|B0006.007|Resolve API addresses before each use to prevent complete dumping.|
|
||||
|**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.|
|
||||
|**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[Kraken](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md)| April 2008| Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
|
||||
|---|---|---|
|
||||
|[Kraken](../xample-malware/kraken.md)|April 2008|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -37,5 +38,3 @@ References
|
||||
<a name="3">[3]</a> http://waleedassar.blogspot.com/search/label/anti-dump
|
||||
|
||||
<a name="4">[4]</a> https://www.gironsec.com/code/packers.pdf
|
||||
|
||||
|
||||
|
||||
@@ -1,25 +1,23 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1480**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
|
||||
|
||||
|
||||
Execution Guardrails
|
||||
====================
|
||||
Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
|
||||
Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
|
||||
|
||||
**See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1480.m01|**Deposited Keys**|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
|
||||
|E1480.m02|**Environmental Keys**|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
|
||||
|E1480.m03|**GetVolumeInformation**|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|E1480.m04|**Host Fingerprint Check**| Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
|
||||
|E1480.m05|**Secure Triggers**|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
|
||||
|E1480.m06|**Token Check**|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
|
||||
|
||||
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Deposited Keys**|E1480.m01|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
|
||||
|**Environmental Keys**|E1480.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
|
||||
|**GetVolumeInformation**|E1480.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
|
||||
|**Host Fingerprint Check**|E1480.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
|
||||
|**Secure Triggers**|E1480.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
|
||||
|**Token Check**|E1480.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
|
||||
|
||||
@@ -1,23 +1,23 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0002**|
|
||||
|
||||
|
||||
# Anti-Static Analysis
|
||||
Behaviors and code characteristics that prevent static analysis or make it more difficult. Simple static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.
|
||||
|
||||
Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).
|
||||
|
||||
* **Call Graph Generation Evasion** [B0010](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-call-graph.md)
|
||||
* **Disassembler Evasion** [B0012](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-disassembler.md)
|
||||
* **Executable Code Obfuscation** [B0032](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md)
|
||||
* **Executable Code Optimization** [B0034](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-optimize.md)
|
||||
* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
|
||||
* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
|
||||
* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
|
||||
|
||||
* **Call Graph Generation Evasion** [B0010](../anti-static-analysis/evade-call-graph.md)
|
||||
* **Disassembler Evasion** [B0012](../anti-static-analysis/evade-disassembler.md)
|
||||
* **Executable Code Obfuscation** [B0032](../anti-static-analysis/exe-code-obfuscate.md)
|
||||
* **Executable Code Optimization** [B0034](../anti-static-analysis/exe-code-optimize.md)
|
||||
* **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
|
||||
* **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscate-files.md)
|
||||
* **Software Packing** [F0001](../anti-static-analysis/software-packing.md)
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project
|
||||
|
||||
<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
|
||||
<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0010**|
|
||||
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,10 +11,10 @@ Malware code evades accurate call graph generation during disassembly. Call grap
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0010.001|**Two-layer Function Return**|Two layer jumping confuses tools plotting call graphs. [[3]](#3)|
|
||||
|B0010.002|**Invoke NTDLL System Calls via Encoded Table**|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)|
|
||||
|**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[3]](#3)|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -24,4 +24,4 @@ References
|
||||
|
||||
<a name="3">[3]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html
|
||||
|
||||
<a name="4">[4]</a> S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. http://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf
|
||||
<a name="4">[4]</a> S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. http://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0012**|
|
||||
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,13 +11,13 @@ Malware code evades disassembly in a recursive or linear disassembler. Some meth
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0012.001|**Argument Obfuscation**|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
|
||||
|B0012.002|**Conditional Misdirection**|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
|
||||
|B0012.003|**Value Dependent Jumps**|Explicit use of computed values for control flow, often many times in the same basic block or function.|
|
||||
|B0012.004|**Variable Recomposition**|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.|
|
||||
|B0012.005|**VBA Stomping**|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
|
||||
|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
|
||||
|**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
|
||||
|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.|
|
||||
|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -27,4 +27,4 @@ References
|
||||
|
||||
<a name="3">[3]</a> https://isc.sans.edu/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870
|
||||
|
||||
<a name="4">[4]</a> https://boingboing.net/2019/05/05/p-code-r-us.html
|
||||
<a name="4">[4]</a> https://boingboing.net/2019/05/05/p-code-r-us.html
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0032**|
|
||||
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -9,43 +9,43 @@ Executable Code Obfuscation
|
||||
===========================
|
||||
Executable code can be obfuscated to hinder disassembly and static code analysis. This behavior is specific to a malware sample's executable code (data and text sections).
|
||||
|
||||
For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see [**Obfuscated Files or Information**](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md).
|
||||
For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see [**Obfuscated Files or Information**](../defense-evasion/obfuscate-files.md).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0032.001|**API Hashing**|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)|
|
||||
|M0032.002 |**Code Insertion**|Insert code to impede disassembly.|
|
||||
|B0032.003|*Dead Code Insertion*|Include "dead" code with no real functionality.|
|
||||
|B0032.004|*Fake Code Insertion*|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.|
|
||||
|B0032.005|*Jump Insertion*|Insert jumps to make analysis visually harder.|
|
||||
|B0032.006|*Thunk Code Insertion*|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
|
||||
|B0032.007|*Junk Code Insertion*|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
|
||||
|B0032.008|**Data Value Obfuscation**|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*. [NEEDS REVIEW]|
|
||||
|B0032.009|**Entry Point Obfuscation**|Obfuscate the entry point of the malware executable.|
|
||||
|B0032.010|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
|
||||
|B0032.011|**Import Address Table Obfuscation**|Obfuscate the import address table.|
|
||||
|B0032.012|**Import Compression**|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.|
|
||||
|B0032.013|**Instruction Overlap**|Jump after the first byte of an instruction to confuse disassembler.|
|
||||
|B0032.014|**Interleaving Code**|Split code into sections that may be rearranged and are connected by unconditional jumps.|
|
||||
|B0032.015|**Merged Code Sections**|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.|
|
||||
|B0032.016|**Structured Exception Handling (SEH)**|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).|
|
||||
|B0032.017|**Stack Strings**|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
|
||||
|B0032.018|**Symbol Obfuscation**|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**API Hashing**|B0032.001|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)|
|
||||
|**Code Insertion**|B0032.002|Insert code to impede disassembly.|
|
||||
|**Data Value Obfuscation**|B0032.008|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*. [NEEDS REVIEW]|
|
||||
|**Dead Code Insertion**|B0032.003|Include "dead" code with no real functionality.|
|
||||
|**Entry Point Obfuscation**|B0032.009|Obfuscate the entry point of the malware executable.|
|
||||
|**Fake Code Insertion**|B0032.004|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.|
|
||||
|**Guard Pages**|B0032.010|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
|
||||
|**Import Address Table Obfuscation**|B0032.011|Obfuscate the import address table.|
|
||||
|**Import Compression**|B0032.012|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.|
|
||||
|**Instruction Overlap**|B0032.013|Jump after the first byte of an instruction to confuse disassembler.|
|
||||
|**Interleaving Code**|B0032.014|Split code into sections that may be rearranged and are connected by unconditional jumps.|
|
||||
|**Jump Insertion**|B0032.005|Insert jumps to make analysis visually harder.|
|
||||
|**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
|
||||
|**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.|
|
||||
|**Stack Strings**|B0032.017|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
|
||||
|**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3).|
|
||||
|**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.|
|
||||
|**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------------------------|--------|-----------------------------|
|
||||
|[**Heriplor**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
|
||||
|[**Emotet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|---|---|---|
|
||||
|[**Heriplor**](../xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
|
||||
|[**Emotet**](../xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html
|
||||
<a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html
|
||||
|
||||
<a name="2">[2]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/
|
||||
<a name="2">[2]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/
|
||||
|
||||
<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons
|
||||
<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0034**|
|
||||
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,12 +11,11 @@ Code is optimized, making it harder to statically analyze.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0034.001|**Jump/Call Absolute Address**|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.|
|
||||
|B0034.002|**Minification**|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Jump/Call Absolute Address**|B0034.001|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.|
|
||||
|**Minification**|B0034.002|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Minification_(programming)
|
||||
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Minification_(programming)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0008**|
|
||||
|**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Anti-Static Analysis](../anti-static-analysis)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -13,15 +13,15 @@ Virtualized code is a software protection technique. Themida is a commercial too
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0008.001|**Multiple VMs**|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Multiple VMs**|B0008.001|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Locky Bart**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|
|
||||
|---|---|---|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0001**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Technique**|[Obfuscated Files or Information: Software Packing](https://attack.mitre.org/techniques/T1027/002)|
|
||||
|
||||
Software Packing
|
||||
@@ -12,31 +12,31 @@ This description refines the ATT&CK [**Obfuscated Files or Information: Software
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|F0001.001|**Nested Packing**|The malware is packed by one packer, the result is packed, etc.|
|
||||
|F0001.002|**Standard Compression**|Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.|
|
||||
|F0001.003|**Standard Compression of Code**|Uses a standard algorithm to compress the opcode mnemonics.|
|
||||
|F0001.004|**Standard Compression of Data**|Uses a standard algorithm to compress strings and variables (executable file data).|
|
||||
|F0001.005|**Custom Compression**|Uses a custom algorithm to compress an executable file.|
|
||||
|F0001.006|**Custom Compression of Code**|Uses a custom algorithm to compress opcode mnemonics.|
|
||||
|F0001.007|**Custom Compression of Data**|Uses a custom algorithm to compress strings and variables (executable file data).|
|
||||
|F0001.008|**UPX**|Uses UPX packer.|
|
||||
|F0001.009|**Confuser**|Uses Confuser packer.|
|
||||
|F0001.010|**VMProtect**|Uses VMProtect.|
|
||||
|F0001.011|**Themida**|Uses Themida.|
|
||||
|F0001.012|**Armadillo**|Uses Armadillo.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Armadillo**|F0001.012|Uses Armadillo.|
|
||||
|**Confuser**|F0001.009|Uses Confuser packer.|
|
||||
|**Custom Compression**|F0001.005|Uses a custom algorithm to compress an executable file.|
|
||||
|**Custom Compression of Code**|F0001.006|Uses a custom algorithm to compress opcode mnemonics.|
|
||||
|**Custom Compression of Data**|F0001.007|Uses a custom algorithm to compress strings and variables (executable file data).|
|
||||
|**Nested Packing**|F0001.001|The malware is packed by one packer, the result is packed, etc.|
|
||||
|**Standard Compression**|F0001.002|Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.|
|
||||
|**Standard Compression of Code**|F0001.003|Uses a standard algorithm to compress the opcode mnemonics.|
|
||||
|**Standard Compression of Data**|F0001.004|Uses a standard algorithm to compress strings and variables (executable file data).|
|
||||
|**Themida**|F0001.011|Uses Themida.|
|
||||
|**UPX**|F0001.008|Uses UPX packer.|
|
||||
|**VMProtect**|F0001.010|Uses VMProtect.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|
|
||||
|---|---|---|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf
|
||||
|
||||
<a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.
|
||||
|
||||
|
||||
<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0003**|
|
||||
|
||||
|
||||
# Collection #
|
||||
Behaviors that identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.
|
||||
|
||||
* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-markdown/blob/master/collection/cryptocurrency.md)
|
||||
* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
|
||||
* **Input Capture** [E1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
|
||||
* **Keylogging** [F0002](https://github.com/MBCProject/mbc-markdown/blob/master/collection/keylogging.md)
|
||||
* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
|
||||
* **Cryptocurrency** [B0028](../collection/cryptocurrency.md)
|
||||
* **Hooking** [F0003](../credential-access/hooking.md)
|
||||
* **Input Capture** [E1056](../collection/input-capture.md)
|
||||
* **Keylogging** [F0002](../collection/keylogging.md)
|
||||
* **Screen Capture** [E1113](../collection/screen-capture.md)
|
||||
|
||||
@@ -1,17 +1,18 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0028**|
|
||||
|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Cryptocurrency
|
||||
==============
|
||||
Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0028.001|**Bitcoin**|Access Bitcoin data.|
|
||||
|B0028.002|**Ethereum**|Access Ethereum data.|
|
||||
|B0028.003|**Zcash**|Access Zcash data.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Bitcoin**|B0028.001|Access Bitcoin data.|
|
||||
|**Ethereum**|B0028.002|Access Ethereum data.|
|
||||
|**Zcash**|B0028.003|Access Zcash data.|
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1056**|
|
||||
|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Technique**|[Input Capture](https://attack.mitre.org/techniques/T1056)|
|
||||
|
||||
|
||||
Input Capture
|
||||
=============
|
||||
Malware captures user input.
|
||||
@@ -12,12 +13,12 @@ Malware captures user input.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1056.m01|**Mouse Events**|Mouse events are captured.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Mouse Events**|E1056.m01|Mouse events are captured.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/poison-ivy.md)|2005|Captures input.|
|
||||
|---|---|---|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|Captures input.|
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0002**|
|
||||
|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Sub-Technique**|[Input Capture: Keylogging](https://attack.mitre.org/techniques/T1056/001)|
|
||||
|
||||
|
||||
Keylogging
|
||||
==========
|
||||
Malware captures user keyboard input.
|
||||
@@ -12,7 +13,7 @@ Malware captures user keyboard input.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|F0002.001|**Application Hook**|Keystrokes are captured with an application hook.|
|
||||
|F0002.002|**Polling**|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Application Hook**|F0002.001|Keystrokes are captured with an application hook.|
|
||||
|**Polling**|F0002.002|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).|
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1113**|
|
||||
|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
|
||||
|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
|
||||
|**Related ATT&CK Technique**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|
|
||||
|
||||
|
||||
Screen Capture
|
||||
=============
|
||||
Malware takes screen captures of the desktop.
|
||||
@@ -12,6 +13,6 @@ Malware takes screen captures of the desktop.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1113.m01|**WinAPI**|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**WinAPI**|E1113.m01|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).|
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0004**|
|
||||
|
||||
|
||||
# Command and Control
|
||||
Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.
|
||||
|
||||
* **Command and Control Communication** [B0030](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md)
|
||||
* **Domain Name Generation** [B0031](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/domain-name-generate.md)
|
||||
* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
|
||||
* **Command and Control Communication** [B0030](../command-and-control/command-control-comm.md)
|
||||
* **Domain Name Generation** [B0031](../command-and-control/domain-name-generate.md)
|
||||
* **Remote File Copy** [E1105](../command-and-control/remote-file-copy.md)
|
||||
|
||||
@@ -1,26 +1,27 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0030**|
|
||||
|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
|
||||
|**Objective(s)**|[Command and Control](../command-and-control)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
C2 Communication
|
||||
================
|
||||
All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md).
|
||||
All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](../command-and-control/remote-file-copy.md).
|
||||
|
||||
Command and Control Communication relates to *autonomous* client/server communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md) under the Execution objective).
|
||||
Command and Control Communication relates to *autonomous* client/server communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](../execution/remote-commands.md) under the Execution objective).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0030.001|**Send Data**|Send data to a C2 server.|
|
||||
|B0030.002|**Receive Data**|Receive data from a C2 server.|
|
||||
|B0030.003|**Server to Client File Transfer**|File is transferred from server to client.|
|
||||
|B0030.004|**Client to Server File Transfer**|File is transferred from client to server.|
|
||||
|B0030.005|**Check for Payload**|Check for payload.|
|
||||
|B0030.006|**Send System Information**|Client sends system information.|
|
||||
|B0030.007|**Send Heartbeat**|Heartbeat sent.|
|
||||
|B0030.008|**Request Command**|Client requests a command.|
|
||||
|B0030.009|**Request Email Template**|Request email template.|
|
||||
|B0030.010|**Request Email Address List**|Request email address list.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Check for Payload**|B0030.005|Check for payload.|
|
||||
|**Client to Server File Transfer**|B0030.004|File is transferred from client to server.|
|
||||
|**Receive Data**|B0030.002|Receive data from a C2 server.|
|
||||
|**Request Command**|B0030.008|Client requests a command.|
|
||||
|**Request Email Address List**|B0030.010|Request email address list.|
|
||||
|**Request Email Template**|B0030.009|Request email template.|
|
||||
|**Send Data**|B0030.001|Send data to a C2 server.|
|
||||
|**Send Heartbeat**|B0030.007|Heartbeat sent.|
|
||||
|**Send System Information**|B0030.006|Client sends system information.|
|
||||
|**Server to Client File Transfer**|B0030.003|File is transferred from server to client.|
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0031**|
|
||||
|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
|
||||
|**Objective(s)**|[Command and Control](../command-and-control)|
|
||||
|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/)|
|
||||
|
||||
|
||||
Domain Name Generation
|
||||
======================
|
||||
Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
|
||||
@@ -13,9 +14,9 @@ The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Genera
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Kraken**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md) | April 2008 | Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
|
||||
|[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)| November 2008| Conficker uses a domain name generator. [[3]](#3)
|
||||
|---|---|---|
|
||||
|[**Kraken**](../xample-malware/kraken.md)|April 2008|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
|
||||
|[**Conficker**](../xample-malware/conficker.md)|November 2008|Conficker uses a domain name generator. [[3]](#3)|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -23,4 +24,4 @@ References
|
||||
|
||||
<a name="2">[2]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
|
||||
|
||||
<a name="3">[3]</a> https://en.wikipedia.org/wiki/Conficker
|
||||
<a name="3">[3]</a> https://en.wikipedia.org/wiki/Conficker
|
||||
|
||||
@@ -1,23 +1,24 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1105**|
|
||||
|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
|
||||
|**Objective(s)**|[Command and Control](../command-and-control), [Lateral Movement](../lateral-movement), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)|
|
||||
|
||||
|
||||
Remote File Copy
|
||||
================
|
||||
Malware may copy files from one system to another.
|
||||
|
||||
Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md) behavior.
|
||||
Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](../execution/install-prog.md) behavior.
|
||||
|
||||
**See ATT&CK:** [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1105/).
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,15 +1,13 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0005**|
|
||||
|
||||
|
||||
# Credential Access
|
||||
Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.
|
||||
|
||||
* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-markdown/blob/master/collection/cryptocurrency.md)
|
||||
* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
|
||||
* **Input Capture** [E1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
|
||||
* **Keylogging** [F0002](https://github.com/MBCProject/mbc-markdown/blob/master/collection/keylogging.md)
|
||||
* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
|
||||
|
||||
|
||||
|
||||
* **Cryptocurrency** [B0028](../collection/cryptocurrency.md)
|
||||
* **Hooking** [F0003](../credential-access/hooking.md)
|
||||
* **Input Capture** [E1056](../collection/input-capture.md)
|
||||
* **Keylogging** [F0002](../collection/keylogging.md)
|
||||
* **Screen Capture** [E1113](../collection/screen-capture.md)
|
||||
|
||||
@@ -1,39 +1,39 @@
|
||||
|||
|
||||
|------------------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0003**|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
|
||||
|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Collection](../collection), [Credential Access](../credential-access), [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
|
||||
|**Related ATT&CK Sub-Technique**|[Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)|
|
||||
|
||||
|
||||
Hooking
|
||||
=======
|
||||
Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md).
|
||||
Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md).
|
||||
|
||||
For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/).
|
||||
|
||||
Note that in MBC, Hooking is also associated with the [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation), and [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis) objectives.
|
||||
Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|F0003.001|**Patch MmGetPhysicalMemoryRanges**| Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
|
||||
|F0003.002|**Hook memory mapping APIs**|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
|
||||
|F0003.003|**Hook procedures**|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)|
|
||||
|F0003.004|**Import Address Hooking (IAT) Hooking**|Uses modifications to a process's IAT where pointers to imported API functions are stored.|
|
||||
|F0003.005|**Inline Hooking**|Overwrites the first bytes in an API function to redirect code flow.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Hook memory mapping APIs**|F0003.002|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
|
||||
|**Hook procedures**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)|
|
||||
|**Import Address Hooking (IAT) Hooking**|F0003.004|Uses modifications to a process's IAT where pointers to imported API functions are stored.|
|
||||
|**Inline Hooking**|F0003.005|Overwrites the first bytes in an API function to redirect code flow.|
|
||||
|**Patch MmGetPhysicalMemoryRanges**|F0003.001|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|**Kronos**|June 2014 |Kronos hooks the API of processes to prevent detection. [[2]](#2)|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|---|---|---|
|
||||
|**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[2]](#2)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf
|
||||
|
||||
<a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
|
||||
<a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
|
||||
|
||||
<a name="3">[3]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
|
||||
<a name="3">[3]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
|
||||
|
||||
+20
-19
@@ -1,25 +1,26 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0006**|
|
||||
|
||||
|
||||
# Defense Evasion #
|
||||
Behaviors that evade detection or avoid other defenses.
|
||||
|
||||
* **Alternative Installation Location** [B0027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/alter-install-location.md)
|
||||
* **Bootkit** [F0013](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/boot-sector-mod.md)
|
||||
* **Bypass DEP** [B0037](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-dep.md)
|
||||
* **Component Firmware** [F0009](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md)
|
||||
* **Covert Location** [B0040](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/covert-location.md)
|
||||
* **Disable Security Tools** [F0004](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)
|
||||
* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
|
||||
* **Hidden Files and Directories** [F0005](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/hidden-files.md)
|
||||
* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
|
||||
* **Indicator Blocking** [F0006](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indicator-blocking.md)
|
||||
* **Install Insecure or Malicious Configuration** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md)
|
||||
* **Modify Registry** [E1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
|
||||
* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
|
||||
* **Polymorphic Code** [B0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md)
|
||||
* **Process Injection** [E1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md)
|
||||
* **Rootkit** [E1014](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rootkit-behavior.md)
|
||||
* **Self Deletion** [F0007](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/self-deletion.md)
|
||||
* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
|
||||
* **Alternative Installation Location** [B0027](../defense-evasion/alter-install-location.md)
|
||||
* **Bootkit** [F0013](../defense-evasion/boot-sector-mod.md)
|
||||
* **Bypass DEP** [B0037](../defense-evasion/bypass-dep.md)
|
||||
* **Component Firmware** [F0009](../persistence/component-firmware.md)
|
||||
* **Covert Location** [B0040](../defense-evasion/covert-location.md)
|
||||
* **Disable Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
|
||||
* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
|
||||
* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files.md)
|
||||
* **Hooking** [F0003](../credential-access/hooking.md)
|
||||
* **Indicator Blocking** [F0006](../defense-evasion/indicator-blocking.md)
|
||||
* **Install Insecure or Malicious Configuration** [E1478](../defense-evasion/config-mod.md)
|
||||
* **Modify Registry** [E1112](../defense-evasion/modify-reg.md)
|
||||
* **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscate-files.md)
|
||||
* **Polymorphic Code** [B0029](../defense-evasion/polymorphic-code.md)
|
||||
* **Process Injection** [E1055](../defense-evasion/process-inject.md)
|
||||
* **Rootkit** [E1014](../defense-evasion/rootkit-behavior.md)
|
||||
* **Self Deletion** [F0007](../defense-evasion/self-deletion.md)
|
||||
* **Software Packing** [F0001](../anti-static-analysis/software-packing.md)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0027**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,17 +11,17 @@ Malware may install itself not as a file on the hard drive. [[1]](#1)
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0027.001|**Fileless Malware**|Stores itself in memory.|
|
||||
|B0027.002|**Registry Install**|Stores itself in the Windows registry.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Fileless Malware**|B0027.001|Stores itself in memory.|
|
||||
|**Registry Install**|B0027.002|Stores itself in the Windows registry.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Kovter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
|
||||
<a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0013**|
|
||||
|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Sub-Technique**|[Pre-OS Boot: Bootkit](https://attack.mitre.org/techniques/T1542/003)|
|
||||
|
||||
|
||||
Bootkit
|
||||
=======
|
||||
The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: [**Pre-OS Boot: Bootkit**](https://attack.mitre.org/techniques/T1067/).
|
||||
@@ -13,10 +14,9 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**Mebromi**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0037**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,10 +11,10 @@ Malware may bypass Data Execution Prevention (DEP).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0037.001|**ROP Chains**| Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce
|
||||
<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1478**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)|
|
||||
|
||||
|
||||
@@ -9,4 +9,4 @@ Install Insecure or Malicious Configuration
|
||||
===========================================
|
||||
Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective.
|
||||
|
||||
See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).
|
||||
See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0040**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@ Malware may hide data or binary files within other files, the registry, etc.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0040.001|**Hide Data in Registry**|Malware may use a registry key to store a long sequence of bytes.|
|
||||
|B0040.002|**Steganography**|Malware may store information in an image.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Hide Data in Registry**|B0040.001|Malware may use a registry key to store a long sequence of bytes.|
|
||||
|**Steganography**|B0040.002|Malware may store information in an image.|
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0004**|
|
||||
|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|
|
||||
|
||||
|
||||
Disable Security Tools
|
||||
========================
|
||||
Malware may disable security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities.
|
||||
@@ -14,24 +15,24 @@ See ATT&CK: [**Impair Defenses: Disable or Modify Tools**](https://attack.mitre.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|F0004.001|**Disable Kernel Patch Protection**|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
|
||||
|F0004.002|**Disable System File Overwrite Protection**|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
|
||||
|F0004.003|**Unhook APIs**|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
|
||||
|F0004.004|**AMSI Bypass**|Malware bypasses AMSI (Anti-malware Scan Interface).|
|
||||
|F0004.005|**Modify Policy**|Malware may modify policies to make software less effective.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).|
|
||||
|**Disable Kernel Patch Protection**|F0004.001|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
|
||||
|**Disable System File Overwrite Protection**|F0004.002|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
|
||||
|**Modify Policy**|F0004.005|Malware may modify policies to make software less effective.|
|
||||
|**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|
|
||||
|---|---|---|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
|
||||
|
||||
<a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
|
||||
<a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0005**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Sub-Technique**|[Hide Artifacts: Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001/)|
|
||||
|
||||
|
||||
@@ -13,7 +13,7 @@ See ATT&CK: [**Hide Artifacts: Hidden Files and Directories**](https://attack.mi
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|F0005.001|**File Extension Change**|Malware may change the file extension of a file.|
|
||||
|F0005.002|**Change File Location**|Malware may change the location of itself or another file to prevent detection.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Change File Location**|F0005.002|Malware may change the location of itself or another file to prevent detection.|
|
||||
|**File Extension Change**|F0005.001|Malware may change the file extension of a file.|
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0006**|
|
||||
|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Technique**|[Impair Defenses: Indicator Blocking](https://attack.mitre.org/techniques/T1562/006/)|
|
||||
|
||||
|
||||
Indicator Blocking
|
||||
==================
|
||||
Malware blocks indicators or events that would indicate malicious activity. Methods relevant to the malware domain are below.
|
||||
@@ -12,6 +13,6 @@ See ATT&CK: [**Impair Defenses: Indicator Blocking**](https://attack.mitre.org/t
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|F0006.001|**Remove SMS Warning Messages**|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Remove SMS Warning Messages**|F0006.001|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1112**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|
|
||||
|
||||
|
||||
@@ -14,9 +14,9 @@ See ATT&CK: [**Modify Registry**](https://attack.mitre.org/techniques/T1112).
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1027**|
|
||||
|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)|
|
||||
|
||||
|
||||
@@ -9,39 +9,29 @@ Obfuscated Files or Information
|
||||
===============================
|
||||
Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself can be encoded or encrypted (i.e., encoding/encryption is a code characteristic).
|
||||
|
||||
A related MBC behavior, associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis/exe-code-obfuscate.md).
|
||||
A related MBC behavior, associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](../anti-static-analysis/exe-code-obfuscate.md).
|
||||
|
||||
See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1027.m01|**Encoding**|The malware sample, file, or other information is encoded.|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |E1027.m02|*Standard Encoding*|A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
|
||||
| |E1027.m03|*Custom Encoding*|A custom algorithm is used to encode the malware sample, a file, or other information.|
|
||||
|
||||
| | | |
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1027.m04|**Encryption**|The malware sample, file, or other information is encrypted.|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |E1027.m05|*Standard Encryption*|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|
||||
| |E1027.m06|*Standard Encryption of Code*|A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|
||||
| |E1027.m07|*Standard Encryption of Data*|A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|
||||
| |E1027.m08|*Custom Encryption*|A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|
||||
| |E1027.m09|*Custom Encryption of Code*|A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|
||||
| |E1027.m10|*Custom Encryption of Data*|A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Encoding**|E1027.m01|The malware sample, file, or other information is encoded.|
|
||||
|**Encoding - Custom Encoding**|E1027.m03|The malware sample, file, or other information is encoded. A custom algorithm is used to encode the malware sample, a file, or other information.|
|
||||
|**Encoding - Standard Encoding**|E1027.m02|The malware sample, file, or other information is encoded. A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
|
||||
|**Encryption**|E1027.m04|The malware sample, file, or other information is encrypted.|
|
||||
|**Encryption - Custom Encryption**|E1027.m08|The malware sample, file, or other information is encrypted. A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|
||||
|**Encryption - Custom Encryption of Code**|E1027.m09|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|
||||
|**Encryption - Custom Encryption of Data**|E1027.m10|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|
||||
|**Encryption - Standard Encryption**|E1027.m05|The malware sample, file, or other information is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
|
||||
|**Encryption - Standard Encryption of Code**|E1027.m06|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
|
||||
|**Encryption - Standard Encryption of Data**|E1027.m07|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|Obfuscates files.|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Obfuscates files.|
|
||||
|---|---|---|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|Obfuscates files.|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Obfuscates files.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0029**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,12 +11,12 @@ Polymorphic code, a file with the same functionality but different execution, is
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0029.001|**Packer Stub**|A packer stub can generate polymorphic code.|
|
||||
|B0029.002|**Call Indirections**|[[1]](#1).
|
||||
|B0029.003|**Code Reordering**|[[1]](#1).
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Call Indirections**|B0029.002|[[1]](#1)|
|
||||
|**Code Reordering**|B0029.003|[[1]](#1)|
|
||||
|**Packer Stub**|B0029.001|A packer stub can generate polymorphic code.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
|
||||
<a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1055**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion), [Privilege Escalation](../privilege-escalation)|
|
||||
|**Related ATT&CK Technique**|[Process Injection](https://attack.mitre.org/techniques/T1055)|
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ Malware may execute code in the address space of a separate process.
|
||||
See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on sub-techniques in the context of [[1]](#1) are in as follows:
|
||||
|
||||
|ID|ATT&CK Sub-Technique|Notes|
|
||||
|---------------|--------|---------------------------|
|
||||
|---|---|---|
|
||||
|T1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
|
||||
|T1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
|
||||
|T1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
|
||||
@@ -20,32 +20,31 @@ See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055).
|
||||
|T1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
|
||||
|T1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|
|
||||
|
||||
Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md) behavior.
|
||||
Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hooking](../credential-access/hooking.md) behavior.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1055.m01|**Hook Injection via SetWindowsHooksEx**|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)|
|
||||
|E1055.m02|**Injection and Persistence via Registry Modification**|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
|
||||
|E1055.m03|**Injection using Shims**|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Hook Injection via SetWindowsHooksEx**|E1055.m01|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)|
|
||||
|**Injection and Persistence via Registry Modification**|E1055.m02|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
|
||||
|**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**UP007**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Injects minor code into a running process.|
|
||||
|---|---|---|
|
||||
|[**UP007**](../xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Injects minor code into a running process.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
|
||||
<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
|
||||
|
||||
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
|
||||
|
||||
<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
|
||||
<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
|
||||
|
||||
<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
|
||||
<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1014**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Technique**|[Rootkit](https://attack.mitre.org/techniques/T1014)|
|
||||
|
||||
|
||||
@@ -13,25 +13,25 @@ See ATT&CK: [**Rootkit**](https://attack.mitre.org/techniques/T1014).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1014.m01|**Hide Kernel Modules**|Hides the usage of any kernel modules by the malware instance.|
|
||||
|E1014.m02|**Hide Services**|Hides any system services that the malware instance creates or injects itself into.|
|
||||
|E1014.m04|**Hide Threads**|Hides one or more threads that belong to the malware instance.|
|
||||
|E1014.m05|**Hide Userspace Libraries**|Hides the usage of userspace libraries by the malware instance.|
|
||||
|E1014.m06|**Prevent API Unhooking**|Prevents the API hooks installed by the malware instance from being removed.|
|
||||
|E1014.m07|**Prevent Registry Access**|Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.|
|
||||
|E1014.m08|**Prevent Registry Deletion**|Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.|
|
||||
|E1014.m09|**Prevent File Access**|Prevents access to the file system, including to specific files and/or directories associated with the malware instance.|
|
||||
|E1014.m10|**Prevent File Deletion**|Prevents files and/or directories associated with the malware instance from being deleted from a system.|
|
||||
|E1014.m11|**Prevent Memory Access**|Prevents access to system memory where the malware instance may be storing code or data.|
|
||||
|E1014.m12|**Prevent Native API Hooking**|Prevents other software from hooking native system APIs.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Hide Kernel Modules**|E1014.m01|Hides the usage of any kernel modules by the malware instance.|
|
||||
|**Hide Services**|E1014.m02|Hides any system services that the malware instance creates or injects itself into.|
|
||||
|**Hide Threads**|E1014.m04|Hides one or more threads that belong to the malware instance.|
|
||||
|**Hide Userspace Libraries**|E1014.m05|Hides the usage of userspace libraries by the malware instance.|
|
||||
|**Prevent API Unhooking**|E1014.m06|Prevents the API hooks installed by the malware instance from being removed.|
|
||||
|**Prevent File Access**|E1014.m09|Prevents access to the file system, including to specific files and/or directories associated with the malware instance.|
|
||||
|**Prevent File Deletion**|E1014.m10|Prevents files and/or directories associated with the malware instance from being deleted from a system.|
|
||||
|**Prevent Memory Access**|E1014.m11|Prevents access to system memory where the malware instance may be storing code or data.|
|
||||
|**Prevent Native API Hooking**|E1014.m12|Prevents other software from hooking native system APIs.|
|
||||
|**Prevent Registry Access**|E1014.m07|Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.|
|
||||
|**Prevent Registry Deletion**|E1014.m08|Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|
||||
|---|---|---|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**F0007**|
|
||||
|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
|
||||
|**Objective(s)**|[Defense Evasion](../defense-evasion)|
|
||||
|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)|
|
||||
|
||||
|
||||
@@ -13,7 +13,6 @@ See ATT&CK: [**Indicator Removal on Host: File Deletion**](https://attack.mitre.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|F0007.001|**COMSPEC Environment Variable**|Uninstalls self via COMSPEC environment variable.|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**COMSPEC Environment Variable**|F0007.001|Uninstalls self via COMSPEC environment variable.|
|
||||
|
||||
+6
-5
@@ -1,11 +1,12 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0007**|
|
||||
|
||||
|
||||
# Discovery #
|
||||
Behaviors that aim to gain knowledge about the system and internal network.
|
||||
|
||||
* **Analysis Tool Discovery** [B0013](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/analysis-tool-discover.md)
|
||||
* **Self Discovery** [B0038](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/self-discover.md)
|
||||
* **SMTP Connection Discovery** [B0014](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/smtp-connect-discover.md)
|
||||
* **System Information Discovery** [E1082](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-info-discover.md)
|
||||
* **Analysis Tool Discovery** [B0013](../discovery/analysis-tool-discover.md)
|
||||
* **Self Discovery** [B0038](../discovery/self-discover.md)
|
||||
* **SMTP Connection Discovery** [B0014](../discovery/smtp-connect-discover.md)
|
||||
* **System Information Discovery** [E1082](../discovery/system-info-discover.md)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0013**|
|
||||
|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -9,24 +9,18 @@ Analysis Tool Discovery
|
||||
=======================
|
||||
Malware can employ various means to detect whether analysis tools are present or running on the system on which it is executing. Note that analysis tools are used to *analyze* malware whereas security software (see [Software Discovery: Security Software Discovery](https://attack.mitre.org/techniques/T1518/001/)) aims to *detect/mitigate* malware on a system or network.
|
||||
|
||||
This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis) objective.
|
||||
This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](../anti-behavioral-analysis) objective.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0013.001|**Process detection**|Malware can scan for the process name associated with common analysis tools.|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |B0013.002|*Debuggers*|OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
|
||||
| |B0013.003|*SysInternals Suite Tools*|Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|
|
||||
| |B0013.004|*PCAP Utilities*|Wireshark / Dumpcap|
|
||||
| |B0013.005|*Process Utilities*|ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
|
||||
| |B0013.006|*PE Utilities*|ImportREC / PETools / LordPE|
|
||||
| |B0013.007|*Sandboxes*|Joe Sandbox, etc.|
|
||||
|
||||
| | | |
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0013.008|**Known File Location**|Malware may detect an analysis tool by the presence of a file in a known location.|
|
||||
|B0013.009|**Known Window**|Malware may detect an analysis tool via the presence of a known window.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Known File Location**|B0013.008|Malware may detect an analysis tool by the presence of a file in a known location.|
|
||||
|**Known Window**|B0013.009|Malware may detect an analysis tool via the presence of a known window.|
|
||||
|**Process detection**|B0013.001|Malware can scan for the process name associated with common analysis tools.|
|
||||
|**Process detection - Debuggers**|B0013.002|Malware can scan for the process name associated with common analysis tools. OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
|
||||
|**Process detection - PCAP Utilities**|B0013.004|Malware can scan for the process name associated with common analysis tools. Wireshark / Dumpcap|
|
||||
|**Process detection - PE Utilities**|B0013.006|Malware can scan for the process name associated with common analysis tools. ImportREC / PETools / LordPE|
|
||||
|**Process detection - Process Utilities**|B0013.005|Malware can scan for the process name associated with common analysis tools. ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
|
||||
|**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.|
|
||||
|**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0038**|
|
||||
|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Self Discovery
|
||||
==============
|
||||
Malware may gather information about itself, such as its filename or size on disk.
|
||||
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0014**|
|
||||
|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
SMTP Connection Discovery
|
||||
=========================
|
||||
Malware may test whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction.
|
||||
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1082**|
|
||||
|**Objective(s)**| [Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
|
||||
|**Related ATT&CK Technique**|[System Information Discovery](https://attack.mitre.org/techniques/T1082)
|
||||
|**Objective(s)**|[Discovery](../discovery)|
|
||||
|**Related ATT&CK Technique**|[System Information Discovery](https://attack.mitre.org/techniques/T1082)|
|
||||
|
||||
|
||||
System Information Discovery
|
||||
============================
|
||||
@@ -12,13 +13,13 @@ See ATT&CK: [**System Information Discovery**](https://attack.mitre.org/techniqu
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1082.m01|**Generate Windows Exception**|Malware may trigger an exception as a way of gathering system details.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Learns about the system so it can drop compatible miner software.|
|
||||
|---|---|---|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Learns about the system so it can drop compatible miner software.|
|
||||
|
||||
+10
-10
@@ -1,16 +1,16 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0009**|
|
||||
|
||||
# Execution #
|
||||
Behaviors that execute code on a system to achieve a variety of goals.
|
||||
|
||||
* **Command and Scripting Interpreter** [E1059](https://github.com/MBCProject/mbc-markdown/blob/master/execution/command-line.md)
|
||||
* **Conditional Execution** [B0025](https://github.com/MBCProject/mbc-markdown/blob/master/execution/conditional-execute.md)
|
||||
* **Exploitation for Client Execution** [E1203](https://github.com/MBCProject/mbc-markdown/blob/master/execution/exploit-software.md)
|
||||
* **Install Additional Program** [B0023](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md)
|
||||
* **Prevent Concurrent Execution** [B0024](https://github.com/MBCProject/mbc-markdown/blob/master/execution/prevent-concurrent-exe.md)
|
||||
* **Remote Commands** [B0011](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md)
|
||||
* **Send Email** [B0020](https://github.com/MBCProject/mbc-markdown/blob/master/execution/send-email.md)
|
||||
* **Send Poisoned Text Message** [B0021](https://github.com/MBCProject/mbc-markdown/blob/master/execution/send-poison-text-msg.md)
|
||||
* **User Execution** [E1204](https://github.com/MBCProject/mbc-markdown/blob/master/execution/user-interaction.md)
|
||||
* **Command and Scripting Interpreter** [E1059](../execution/command-line.md)
|
||||
* **Conditional Execution** [B0025](../execution/conditional-execute.md)
|
||||
* **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
|
||||
* **Install Additional Program** [B0023](../execution/install-prog.md)
|
||||
* **Prevent Concurrent Execution** [B0024](../execution/prevent-concurrent-exe.md)
|
||||
* **Remote Commands** [B0011](../execution/remote-commands.md)
|
||||
* **Send Email** [B0020](../execution/send-email.md)
|
||||
* **Send Poisoned Text Message** [B0021](../execution/send-poison-text-msg.md)
|
||||
* **User Execution** [E1204](../execution/user-interaction.md)
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1059**|
|
||||
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|[Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)|
|
||||
|
||||
|
||||
Command and Scripting Interpreter
|
||||
=================================
|
||||
Malware may abuse command and script interpreters to execute commands, scripts, or binaries.
|
||||
@@ -13,9 +14,9 @@ Malware may abuse command and script interpreters to execute commands, scripts,
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,25 +1,26 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0025**|
|
||||
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Conditional Execution
|
||||
=====================
|
||||
Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution happens autonomously, not because of an attacker's command.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0025.001|**Suicide Exit**|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
|
||||
|[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)|2008|A routine causes the process to suicide exit if the keyboard language is set to Ukranian.|
|
||||
|---|---|---|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
|
||||
|[**Conficker**](../xample-malware/conficker.md)|2008|A routine causes the process to suicide exit if the keyboard language is set to Ukranian.|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1203**|
|
||||
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Related ATT&CK Technique**| [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|
|
||||
|**Objective(s)**|[Execution](../execution), [Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|
|
||||
|
||||
|
||||
Exploitation for Client Execution
|
||||
=================================
|
||||
@@ -12,20 +13,20 @@ Software is exploited - either because of a vulnerability or through its designe
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1203.m01|**Remote Desktop Protocols (RDP)**| RDP is used by malware.|
|
||||
|E1203.m02|**Java-based Web Servers**| |
|
||||
|E1203.m03|**File Transfer Protocol (FTP) Servers**|Malware leverages an FTP server.|
|
||||
|E1203.m04|**Red Hat JBoss Enterprise Products**| |
|
||||
|E1203.m05|**Sysinternals**| Sysinternals tools are used for additional command line functionality.|
|
||||
|E1203.m06|**Windows Utilities**|One or more Windows utilities are used.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**File Transfer Protocol (FTP) Servers**|E1203.m03|Malware leverages an FTP server.|
|
||||
|**Java-based Web Servers**|E1203.m02||
|
||||
|**Red Hat JBoss Enterprise Products**|E1203.m04||
|
||||
|**Remote Desktop Protocols (RDP)**|E1203.m01|RDP is used by malware.|
|
||||
|**Sysinternals**|E1203.m05|Sysinternals tools are used for additional command line functionality.|
|
||||
|**Windows Utilities**|E1203.m06|One or more Windows utilities are used.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**SamSam**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**SamSam**](../xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
+10
-10
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0023**|
|
||||
|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -9,18 +9,18 @@ Install Additional Program
|
||||
==========================
|
||||
Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps.
|
||||
|
||||
Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the [Remote File Copy](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md) behavior).
|
||||
Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the [Remote File Copy](../command-and-control/remote-file-copy.md) behavior).
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)|
|
||||
|[**Geneio**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/geneio.md)|August 2015|Tricks OS X keychain to create application files.|
|
||||
|[**GotBotKR**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gotbotkr.md)|July 2019 |GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
|
||||
|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md)|2016|Installs a backdoor.|
|
||||
|[**Mebromi**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mebromi.md)|2011|A Trojan downloader.|
|
||||
|[**YiSpecter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.|
|
||||
|---|---|---|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)|
|
||||
|[**Geneio**](../xample-malware/geneio.md)|August 2015|Tricks OS X keychain to create application files.|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|July 2019|GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
|
||||
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|Installs a backdoor.|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|A Trojan downloader.|
|
||||
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0024**|
|
||||
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Prevent Concurrent Execution
|
||||
============================
|
||||
To avoid running multiple instances of itself, malware may check a system to see if it is already running.
|
||||
@@ -11,9 +12,9 @@ To avoid running multiple instances of itself, malware may check a system to see
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Bagle**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/bagle.md)|2004|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)|
|
||||
|---|---|---|
|
||||
|[**Bagle**](../xample-malware/bagle.md)|2004|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_bagle.u
|
||||
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_bagle.u
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0011**|
|
||||
|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Remote Commands
|
||||
===============
|
||||
Malware may provide an attacker with explicit commands. This behavior differs from the [Remote Access](https://github.com/MBCProject/mbc-markdown/blob/master/impact/remote-access.md) behavior under the [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact) objective in that *Impact: Remote Access* is potentially much broader and may include full remote access.
|
||||
Malware may provide an attacker with explicit commands. This behavior differs from the [Remote Access](../impact/remote-access.md) behavior under the [Impact](../impact) objective in that *Impact: Remote Access* is potentially much broader and may include full remote access.
|
||||
|
||||
Given an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., "delete file").
|
||||
|
||||
@@ -15,17 +15,16 @@ Commands provided by the malware can be captured with the methods defined below.
|
||||
|
||||
It may be useful to capture remote commands along with related behaviors because the associated descriptions could provide details of how the malware implements the command. For example, *Defense Evasion:File Deletion* could be used to provide details and context to *Execution:Remote Commands:Delete File*.
|
||||
|
||||
Autonomous behaviors - those done by the malware without an active attacker - should not be captured with *Execution:Remote Commands*. For example, malware that *automatically* destroys data would be tagged with the [Impact: Data Destruction](https://github.com/MBCProject/mbc-markdown/blob/master/impact/data-destruction.md) behavior.
|
||||
Autonomous behaviors - those done by the malware without an active attacker - should not be captured with *Execution:Remote Commands*. For example, malware that *automatically* destroys data would be tagged with the [Impact: Data Destruction](../impact/data-destruction.md) behavior.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0011.001|**Delete File**| |
|
||||
|B0011.002|**Download File**| |
|
||||
|B0011.003|**Execute**| |
|
||||
|B0011.004|**Shutdown**| |
|
||||
|B0011.005|**Sleep**| |
|
||||
|B0011.006|**Uninstall**| |
|
||||
|B0011.007|**Upload File**| |
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Delete File**|B0011.001||
|
||||
|**Download File**|B0011.002||
|
||||
|**Execute**|B0011.003||
|
||||
|**Shutdown**|B0011.004||
|
||||
|**Sleep**|B0011.005||
|
||||
|**Uninstall**|B0011.006||
|
||||
|**Upload File**|B0011.007||
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0020**|
|
||||
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
|
||||
|**Objective(s)**|[Execution](../execution), [Lateral Movement](../lateral-movement)|
|
||||
|**Related ATT&CK Technique**|[Phishing](https://attack.mitre.org/techniques/T1566/)|
|
||||
|
||||
|
||||
Send Email
|
||||
==========
|
||||
Sends an email message from the system on which the malware is executing to one or more recipients, mostly commonly for the purpose of spamming or for distributing a malicious attachment or URL (malspamming).
|
||||
@@ -13,13 +14,13 @@ Sends an email message from the system on which the malware is executing to one
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|--------------|--------------------------|-----------------------------|
|
||||
|[**Gamut**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gamut.md)|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
|
||||
|[**Bagle**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/bagle.md)|2004|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|---|---|---|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
|
||||
|[**Bagle**](../xample-malware/bagle.md)|2004|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/
|
||||
|
||||
<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
|
||||
<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0021**|
|
||||
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/)|
|
||||
|**Related ATT&CK Technique**| None |
|
||||
|**Objective(s)**|[Execution](../execution), [Lateral Movement](../lateral-movement)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Send Poisoned Text Message
|
||||
@@ -12,8 +12,8 @@ A malicious attachment is sent via spam SMS or MMS messages. When the user click
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md) | | MazarBot is delivered via a poisoned SMS message. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**MazarBot**](../xample-malware/mazarbot.md)||MazarBot is delivered via a poisoned SMS message. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1204**|
|
||||
|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
|
||||
|**Objective(s)**|[Execution](../execution)|
|
||||
|**Related ATT&CK Technique**|[User Execution](https://attack.mitre.org/techniques/T1204)|
|
||||
|
||||
|
||||
User Interaction
|
||||
================
|
||||
Malware may include code that relies on specific actions by a user to execute. Note that this MBC behavior differs from [User Execution](https://attack.mitre.org/techniques/T1204) in that it does do not include direct code execution (user action for *initial* execution) - MBE does not encompass ATT&CK's Initial Access Tactic.
|
||||
@@ -13,5 +14,5 @@ Malware may include code that relies on specific actions by a user to execute. N
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|---|---|---|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|
||||
@@ -1,9 +1,10 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0010**|
|
||||
|
||||
|
||||
# Exfiltration #
|
||||
Behaviors that steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).
|
||||
|
||||
* **Automated Exfiltration** [E1020](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/auto-exfiltrate.md)
|
||||
* **Archive Collected Data** [E1560](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/data-encrypted.md)
|
||||
* **Automated Exfiltration** [E1020](../exfiltration/auto-exfiltrate.md)
|
||||
* **Archive Collected Data** [E1560](../exfiltration/data-encrypted.md)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1020**|
|
||||
|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
|
||||
|**Objective(s)**|[Exfiltration](../exfiltration)|
|
||||
|**Related ATT&CK Technique**|[Automated Exfiltration](https://attack.mitre.org/techniques/T1020/)|
|
||||
|
||||
|
||||
@@ -13,7 +13,6 @@ Malware may exfiltrate data via automated processing or scripting.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1020.m01|**Exfiltrate via File Hosting Service**|Malware may exfiltrate files to a file hosting location.|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Exfiltrate via File Hosting Service**|E1020.m01|Malware may exfiltrate files to a file hosting location.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1560**|
|
||||
|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
|
||||
|**Objective(s)**|[Exfiltration](../exfiltration)|
|
||||
|**Related ATT&CK Technique**|[Archive Collected Data](https://attack.mitre.org/techniques/T1560/)|
|
||||
|
||||
|
||||
@@ -13,20 +13,11 @@ Malware may obfuscate data via encryption or encoding before exfiltration.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1560.m01|**Encoding**|Data is encoded.|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |E1560.m03|*Standard Encoding*|A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
|
||||
| |E1560.m04|*Custom Encoding*|A custom algorithm is used to encode the exfiltrated data.|
|
||||
|
||||
| | | |
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1560.m02|**Encryption**|Data is encrypted.|
|
||||
|
||||
| | | | |
|
||||
|----------|-----------------------------|--------|-----------------------------|
|
||||
| |E1560.m05|*Standard Encryption*|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
|
||||
| |E1560.m06|*Custom Encryption*|A custom algorithm is used to encrypt the exfiltrated data.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Encoding**|E1560.m01|Data is encoded.|
|
||||
|**Encoding - Custom Encoding**|E1560.m04|Data is encoded. A custom algorithm is used to encode the exfiltrated data.|
|
||||
|**Encoding - Standard Encoding**|E1560.m03|Data is encoded. A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
|
||||
|**Encryption**|E1560.m02|Data is encrypted.|
|
||||
|**Encryption - Custom Encryption**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.|
|
||||
|**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
|
||||
|
||||
+15
-14
@@ -1,20 +1,21 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0008**|
|
||||
|
||||
|
||||
# Impact #
|
||||
Behaviors that enable malware to achieve its mission of manipulating, interrupting, or destroying systems and/or data.
|
||||
|
||||
* **Component Firmware** [F0009](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md)
|
||||
* **Compromise Data Integrity** [B0016](https://github.com/MBCProject/mbc-markdown/blob/master/impact/compromise-data.md)
|
||||
* **Data Destruction** [E1485](https://github.com/MBCProject/mbc-markdown/blob/master/impact/data-destruction.md)
|
||||
* **Data Encrypted for Impact** [E1486](https://github.com/MBCProject/mbc-markdown/blob/master/impact/encrypt-impact.md)
|
||||
* **Denial of Service** [B0033](https://github.com/MBCProject/mbc-markdown/blob/master/impact/denial-of-service.md)
|
||||
* **Destroy Hardware** [B0017](https://github.com/MBCProject/mbc-markdown/blob/master/impact/destroy-hardware.md)
|
||||
* **Exploit Kit Behavior** [E1190](https://github.com/MBCProject/mbc-markdown/blob/master/impact/exploit-kit-behavior.md)
|
||||
* **Exploitation for Client Execution** [E1203](https://github.com/MBCProject/mbc-markdown/blob/master/execution/exploit-software.md)
|
||||
* **Generate Fraudulent Advertising Revenue** [E1472](https://github.com/MBCProject/mbc-markdown/blob/master/impact/generate-fraud-rev.md)
|
||||
* **Manipulate Network Traffic** [B0019](https://github.com/MBCProject/mbc-markdown/blob/master/impact/manipulate-network-traffic.md)
|
||||
* **Remote Access** [B0022](https://github.com/MBCProject/mbc-markdown/blob/master/impact/remote-access.md)
|
||||
* **Resource Hijacking** [B0018](https://github.com/MBCProject/mbc-markdown/blob/master/impact/hijack-sys-resources.md)
|
||||
* **Spamming** [B0039](https://github.com/MBCProject/mbc-markdown/blob/master/impact/spamming.md)
|
||||
* **Component Firmware** [F0009](../persistence/component-firmware.md)
|
||||
* **Compromise Data Integrity** [B0016](../impact/compromise-data.md)
|
||||
* **Data Destruction** [E1485](../impact/data-destruction.md)
|
||||
* **Data Encrypted for Impact** [E1486](../impact/encrypt-impact.md)
|
||||
* **Denial of Service** [B0033](../impact/denial-of-service.md)
|
||||
* **Destroy Hardware** [B0017](../impact/destroy-hardware.md)
|
||||
* **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md)
|
||||
* **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
|
||||
* **Generate Fraudulent Advertising Revenue** [E1472](../impact/generate-fraud-rev.md)
|
||||
* **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md)
|
||||
* **Remote Access** [B0022](../impact/remote-access.md)
|
||||
* **Resource Hijacking** [B0018](../impact/hijack-sys-resources.md)
|
||||
* **Spamming** [B0039](../impact/spamming.md)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0016**|
|
||||
|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/)|
|
||||
|
||||
|
||||
|
||||
+11
-11
@@ -1,8 +1,8 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1485**|
|
||||
|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/), [Delete Device Data](https://attack.mitre.org/techniques/T1447/)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/), [Delete Device Data](https://attack.mitre.org/techniques/T1447/)|
|
||||
|
||||
|
||||
Data Destruction
|
||||
@@ -13,18 +13,18 @@ see ATT&CK: [**Data Destruction**](https://attack.mitre.org/techniques/T1485/).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1485.m01|**Delete Shadow Drive**|Deletes shadow drive data, which is related to ransomware.|
|
||||
|E1485.m02|**Empty Recycle Bin**|Empties the recycle bin, which can be related to ransomware.|
|
||||
|E1485.m03|**Delete Application/Software**|An application or software is deleted.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Delete Application/Software**|E1485.m03|An application or software is deleted.|
|
||||
|**Delete Shadow Drive**|E1485.m01|Deletes shadow drive data, which is related to ransomware.|
|
||||
|**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**Shamoon**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/shamoon.md)| 2012 |A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> http://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509
|
||||
<a name="1">[1]</a> http://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0033**|
|
||||
|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Network Denial of Device](https://attack.mitre.org/techniques/T1498/)|
|
||||
|
||||
|
||||
@@ -16,12 +16,10 @@ The subsequently defined ATT&CK technique [Network Denial of Device](https://att
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**BlackEnergy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/blackenergy.md)| October 2007| Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|October 2007|Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0017**|
|
||||
|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -12,9 +12,9 @@ Destroys a physical piece of hardware. For example, malware may cause hardware t
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Stuxnet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/stuxnet.md)|2010| Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.bbc.com/timelines/zc6fbk7
|
||||
<a name="1">[1]</a> https://www.bbc.com/timelines/zc6fbk7
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1486**|
|
||||
|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Techniques**|[Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/), [Data Encrypted for Impact (Mobile)](https://attack.mitre.org/techniques/T1471/)|
|
||||
|
||||
|
||||
@@ -14,17 +14,14 @@ See ATT&CK: [**Data Encrypted for Impact**](https://attack.mitre.org/techniques/
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**CryptoWall**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptowall.md)| 2014 | [[1]](#1)|
|
||||
|[**CryptoLocker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptolocker.md)| 2013| [[2]](#2)|
|
||||
|[**Locky Bart**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/locky-bart.md)|2017|Encrypts files for ransom without any connection to the Internet.|
|
||||
|[**SamSam**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/samsam.md)|2015|Ransomware.|
|
||||
|---|---|---|
|
||||
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|[[1]](#1)|
|
||||
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|[[2]](#2)|
|
||||
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|Encrypts files for ransom without any connection to the Internet.|
|
||||
|[**SamSam**](../xample-malware/samsam.md)|2015|Ransomware.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptowall-ransomware/
|
||||
|
||||
<a name="2">[2]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptolocker-ransomware/
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1190**|
|
||||
|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)|
|
||||
|
||||
|
||||
@@ -14,9 +14,9 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)| | Ursnif is sometimes delivered via exploit kit. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)||Ursnif is sometimes delivered via exploit kit. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
|
||||
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1472**|
|
||||
|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Generate Fraudulent Advertising Revenue](https://attack.mitre.org/techniques/T1472/)|
|
||||
|
||||
|
||||
@@ -13,17 +13,17 @@ See ATT&CK: [**Generate Fraudulent Advertising Revenue**](https://attack.mitre.o
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1472.m01|**Click Hijacking**|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)|
|
||||
|E1472.m02|**Advertisement Replacement Fraud**|Malware injects ad windows onto websites the user views. [[2]](#2)|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Advertisement Replacement Fraud**|E1472.m02|Malware injects ad windows onto websites the user views. [[2]](#2)|
|
||||
|**Click Hijacking**|E1472.m01|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)| November 2011| Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
|
||||
|[**Kovter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)|
|
||||
|---|---|---|
|
||||
|[**DNSChanger**](../xample-malware/dnschanger.md)|November 2011|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -34,5 +34,3 @@ References
|
||||
<a name="3">[3]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
|
||||
|
||||
<a name="4">[4]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0018**|
|
||||
|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|[Resource Hijacking](https://attack.mitre.org/techniques/T1496/)|
|
||||
|
||||
|
||||
@@ -13,17 +13,17 @@ The subsequently defined ATT&CK technique [Resource Hijacking](https://attack.mi
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0018.001|**Password Cracking**|Consume system resources for the purpose of password cracking.|
|
||||
|B0018.002|**Cryptojacking**|Consume system resources to mine for cryptocurrency (e.g., Bitcoin, Litecoin, etc.).|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Cryptojacking**|B0018.002|Consume system resources to mine for cryptocurrency (e.g., Bitcoin, Litecoin, etc.).|
|
||||
|**Password Cracking**|B0018.001|Consume system resources for the purpose of password cracking.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)|
|
||||
| Adylkuzz| May 2017| Consumes system resources to mine for cryptocurrency. [[2]](#2)|
|
||||
|---|---|---|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)|
|
||||
|Adylkuzz|May 2017|Consumes system resources to mine for cryptocurrency. [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0019**|
|
||||
|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/)|
|
||||
|
||||
|
||||
@@ -14,10 +14,10 @@ The subsequently defined ATT&CK sub-technique [Data Manipulation: Transmitted Da
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**SearchAwesome**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/searchawesome.md)| 2018| Intercepts encrypted web traffic to inject adds. [[1]](#1)|
|
||||
|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md)|2016|Intercepts data coming into and going out of device.|
|
||||
|---|---|---|
|
||||
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|Intercepts encrypted web traffic to inject adds. [[1]](#1)|
|
||||
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|Intercepts data coming into and going out of device.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
|
||||
|
||||
+10
-10
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0022**|
|
||||
|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
|
||||
|**Objective(s)**|[Impact](../impact), [Persistence](../persistence)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -9,22 +9,22 @@ Remote Access
|
||||
=============
|
||||
Malware may provide an attacker with potentially full access to a system via a remote network connection, which may also provide persistence.
|
||||
|
||||
A RAT (Remote Access Trojan) is an example of malware that provides a degree of remote access. If the malware provides an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., Delete File). Explicit commands provided by the malware can be captured with Methods associated with the [**Execution::Remote Commands**](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md) behavior; examples include *Execution:Remote Commands:Execute* and *Execution:Remote Commands:Delete File*.
|
||||
A RAT (Remote Access Trojan) is an example of malware that provides a degree of remote access. If the malware provides an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., Delete File). Explicit commands provided by the malware can be captured with Methods associated with the [**Execution::Remote Commands**](../execution/remote-commands.md) behavior; examples include *Execution:Remote Commands:Execute* and *Execution:Remote Commands:Delete File*.
|
||||
|
||||
Note that the [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1105/) technique defined under the Command and Control tactic is no longer specific to "legitimate desktop support and remote access software” as it was under a previous version of ATT&CK. However, *Ingress Tool Transfer* relates only to files copied; this MBC behavior is broader, allowing for remote access behaviors beyond file transfers (i.e., *Impact:Remote Access* and *Command and Control: Ingress Tool Transfer* are not equivalent).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|B0022.001|**Reverse Shell**|Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Reverse Shell**|B0022.001|Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|
||||
|[**Dark Comet**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/dark-comet.md)|2008|Allows an attacker to control the system via a GUI.|
|
||||
|---|---|---|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
|
||||
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|Allows an attacker to control the system via a GUI.|
|
||||
|
||||
References
|
||||
----------
|
||||
@@ -32,4 +32,4 @@ References
|
||||
|
||||
<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
|
||||
|
||||
<a name="3">[3]</a> https://en.wikipedia.org/wiki/DarkComet
|
||||
<a name="3">[3]</a> https://en.wikipedia.org/wiki/DarkComet
|
||||
|
||||
+4
-8
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**B0039**|
|
||||
|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
|
||||
|**Objective(s)**|[Impact](../impact)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -9,16 +9,12 @@ Spamming
|
||||
========
|
||||
Malware may use a victim machine to create and send spam.
|
||||
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|**TrickBot**| July 2019 | In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|**TrickBot**|July 2019|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://techcrunch.com/2019/07/12/trickbot-spam-millions-emails/
|
||||
|
||||
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OB0011**|
|
||||
|
||||
|
||||
# Lateral Movement
|
||||
Behaviors that enable propagation through a compromised system or infected files. The malware may move actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).
|
||||
|
||||
* **Malicious Network Driver** [B0026](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/malicious-network-drv.md)
|
||||
* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/remote-file-copy.md)
|
||||
* **Send Email** [B0020](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-email.md)
|
||||
* **Send Poison Text Message** [B0021](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-poison-text-msg.md)
|
||||
* **Supply Chain Compromise** [E1195](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/supply-chain-compromise.md)
|
||||
* **Malicious Network Driver** [B0026](../persistence/malicious-network-drv.md)
|
||||
* **Remote File Copy** [E1105](../command-and-control/remote-file-copy.md)
|
||||
* **Send Email** [B0020](../execution/send-email.md)
|
||||
* **Send Poison Text Message** [B0021](../execution/send-poison-text-msg.md)
|
||||
* **Supply Chain Compromise** [E1195](../lateral-movement/supply-chain-compromise.md)
|
||||
|
||||
@@ -1,26 +1,27 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**E1195**|
|
||||
|**Objective(s)**|[Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
|
||||
|**Objective(s)**|[Lateral Movement](../lateral-movement)|
|
||||
|**Related ATT&CK Technique**|[Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)|
|
||||
|
||||
|
||||
Supply Chain Compromise
|
||||
=======================
|
||||
The supply chain may be compromised to enable initial malware infection. Malware-related methods are listed below to supplement the information available defined in ATT&CK: [**Supply Chain Compromise**](https://attack.mitre.org/techniques/T1195/).
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|E1195.m01|**Abuse Enterprise Certificates**|Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see *Exploit Private APIs* below).|
|
||||
|E1195.m02|**Exploit Private APIs**|Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Abuse Enterprise Certificates**|E1195.m01|Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see *Exploit Private APIs* below).|
|
||||
|**Exploit Private APIs**|E1195.m02|Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.|
|
||||
|
||||
Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|-----------------------------|-----------|-----------------------------|
|
||||
|[**YiSpecter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/yispecter.md)|October 2015|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)|
|
||||
|---|---|---|
|
||||
|[**YiSpecter**](../xample-malware/yispecter.md)|October 2015|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
|
||||
<a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
|
||||
|
||||
@@ -4,10 +4,10 @@ Some malware behaviors are low-level, support many objectives and other behavior
|
||||
Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-behavior objectives are shown below.
|
||||
|
||||
|**Objective**|**Description**|
|
||||
|------------------------------------------------------------------|----------------------------|
|
||||
|[**Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication) |Malware uses various protocols and components to communication.|
|
||||
|[**Cryptography**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/cryptography)|Malware uses elements of cryptography.|
|
||||
|[**Data Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation)| Malware manipulates data.|
|
||||
|[**File Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation) | Malware manipulates files.|
|
||||
|[**Memory Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation) |Malware manipulates memory.|
|
||||
|[**Processes**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/processes)|Malware uses processes.|
|
||||
|---|---|
|
||||
|[**Communication**](./communication)|Malware uses various protocols and components to communication.|
|
||||
|[**Cryptography**](./cryptography)|Malware uses elements of cryptography.|
|
||||
|[**Data Manipulation**](./data-manipulation)|Malware manipulates data.|
|
||||
|[**File Manipulation**](./file-manipulation)|Malware manipulates files.|
|
||||
|[**Memory Manipulation**](./memory-manipulation)|Malware manipulates memory.|
|
||||
|[**Processes**](./processes)|Malware uses processes.|
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OC0006**|
|
||||
|
||||
|
||||
# Communication Micro-objectives #
|
||||
Micro-behaviors that enable malware to communicate.
|
||||
|
||||
|ID|Name|
|
||||
|-----------------------------|--------|
|
||||
|R0011|[**DNS Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/dns-comm.md)|
|
||||
|R0004|[**FTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/ftp-comm.md)|
|
||||
|R0002|[**HTTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/http-comm.md)|
|
||||
|R0014|[**ICMP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/icmp-comm.md)|
|
||||
|R0003|[**Inter-process Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/inter-process.md)|
|
||||
|R0012|[**SMTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/smtp-comm.md)|
|
||||
|R0001|[**TCP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/tcp-comm.md)|
|
||||
|R0013|[**UDP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/udp-comm.md)|
|
||||
|R0005|[**WinINet Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md)|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|[**DNS Communication**](../communication/dns-comm.md)|C0011||
|
||||
|[**FTP Communication**](../communication/ftp-comm.md)|C0004||
|
||||
|[**HTTP Communication**](../communication/http-comm.md)|C0002||
|
||||
|[**ICMP Communication**](../communication/icmp-comm.md)|C0014||
|
||||
|[**Inter-process Communication**](../communication/inter-process.md)|C0003||
|
||||
|[**SMTP Communication**](../communication/smtp-comm.md)|C0012||
|
||||
|[**TCP Communication**](../communication/tcp-comm.md)|C0001||
|
||||
|[**UDP Communication**](../communication/udp-comm.md)|C0013||
|
||||
|[**WinINet Communication**](../communication/wininet.md)|C0005||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0011**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,11 +11,10 @@ The DNS Communication micro-behavior focuses on DNS communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0011.001|**Resolve**|Resolves a domain.|
|
||||
|C0011.002|**Server Connect**|Connects to DNS server.|
|
||||
|C0011.003|**DDNS Domain Connect**|Connects to dynamic DNS domain.|
|
||||
|C0011.004|**Resolve TLD**|Resolves top level domain.|
|
||||
|C0011.005|**Resolve Free Hosting Domain**|Resolves a free hosting domain (e.g., freeiz.com).|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**DDNS Domain Connect**|C0011.003|Connects to dynamic DNS domain.|
|
||||
|**Resolve**|C0011.001|Resolves a domain.|
|
||||
|**Resolve Free Hosting Domain**|C0011.005|Resolves a free hosting domain (e.g., freeiz.com).|
|
||||
|**Resolve TLD**|C0011.004|Resolves top level domain.|
|
||||
|**Server Connect**|C0011.002|Connects to DNS server.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0004**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,9 +11,7 @@ The FTP Communication micro-behavior focuses on FTP communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0004.001|**Put**|FTP Put|
|
||||
|C0004.002|**WinINet API**|Send FTP command via WinINet.|
|
||||
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Put**|C0004.001|FTP Put|
|
||||
|**WinINet API**|C0004.002|Send FTP command via WinINet.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0002**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,18 +11,17 @@ This micro-behavior is related to HTTP communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0002.001|**Server**|General HTTP server behavior.|
|
||||
|C0002.002|**Client**|General HTTP client behavior.|
|
||||
|C0002.003|**Request**|Non-specific HTTP request.|
|
||||
|C0002.004|**GET Request**|HTTP Get request.|
|
||||
|C0002.005|**POST Request**|HTTP Post request.|
|
||||
|C0002.006|**PUT Request**|HTTP Put request.|
|
||||
|C0002.007|**WinINet API**|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md) microbehavior.
|
||||
|C0002.008|**WinHTTP API**|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|
||||
|C0002.008|**URLMON Function**|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.
|
||||
|C0002.008|**IWebBrowser**|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.
|
||||
|C0002.008|**IHTMLDocument**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.
|
||||
|C0002.008|**IHTMLElement**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Client**|C0002.002|General HTTP client behavior.|
|
||||
|**GET Request**|C0002.004|HTTP Get request.|
|
||||
|**IHTMLDocument**|C0002.008|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.|
|
||||
|**IHTMLElement**|C0002.008|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.|
|
||||
|**IWebBrowser**|C0002.008|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
|
||||
|**POST Request**|C0002.005|HTTP Post request.|
|
||||
|**PUT Request**|C0002.006|HTTP Put request.|
|
||||
|**Request**|C0002.003|Non-specific HTTP request.|
|
||||
|**Server**|C0002.001|General HTTP server behavior.|
|
||||
|**URLMON Function**|C0002.008|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.|
|
||||
|**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|
||||
|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0014**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,6 +11,6 @@ This micro-behavior is related to ICMP communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0014.001|**Generate Traffic**|Generate ICMP traffic.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Generate Traffic**|C0014.001|Generate ICMP traffic.|
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0003**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Interprocess Communication
|
||||
===========================
|
||||
==========================
|
||||
The Interprocess Communication micro-behavior focuses on interprocess communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0003.001|**Create Pipe**| |
|
||||
|C0003.002|**Connect Pipe**| |
|
||||
|C0003.003|**Read Pipe**| |
|
||||
|C0003.004|**Write Pipe**| |
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Connect Pipe**|C0003.002||
|
||||
|**Create Pipe**|C0003.001||
|
||||
|**Read Pipe**|C0003.003||
|
||||
|**Write Pipe**|C0003.004||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0012**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@ This micro-behavior focuses on SMTP communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0012.001|**Server Connect**|Connects to an smtp server.|
|
||||
|C0012.002|**Request**|Makes SMTP request.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Request**|C0012.002|Makes SMTP request.|
|
||||
|**Server Connect**|C0012.001|Connects to an smtp server.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0001**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,13 +11,12 @@ This micro-behavior focuses on TCP communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0001.001|**Client**|General TCP client behavior.|
|
||||
|C0001.002|**Server**|General TCP server behavior.|
|
||||
|C0001.003|**Create Socket**|A server or client creates a TCP socket.|
|
||||
|C0001.004|**Connect Socket**|A server or client connects via a TCP socket.|
|
||||
|C0001.005|**Listen Socket**|A server listens for client requests.|
|
||||
|C0001.006|**Receive Data**|Receive data on socket.|
|
||||
|C0001.007|**Send Data**|Send data on socket.|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Client**|C0001.001|General TCP client behavior.|
|
||||
|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
|
||||
|**Create Socket**|C0001.003|A server or client creates a TCP socket.|
|
||||
|**Listen Socket**|C0001.005|A server listens for client requests.|
|
||||
|**Receive Data**|C0001.006|Receive data on socket.|
|
||||
|**Send Data**|C0001.007|Send data on socket.|
|
||||
|**Server**|C0001.002|General TCP server behavior.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0013**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,6 +11,6 @@ The micro-behavior is related to UDP communication.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0013.001|**STUN Server**|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**STUN Server**|C0013.001|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0005**|
|
||||
|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
|
||||
|**Objective(s)**|[Communication](../communication)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -13,15 +13,14 @@ The methods below are those of most interest in malware analysis. Details can be
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0005.001|**InternetConnect**|Opens an FTP or HTTP session for a given site.|
|
||||
|C0005.002|**InternetOpen**|Initializes an application's use of the WinINet functions.|
|
||||
|C0005.003|**InternetOpenURL**|Opens a resource specified by a complete FTP or HTTP URL.|
|
||||
|C0005.004|**InternetReadFile**|Reads data from an open Internet file (URL data).|
|
||||
|C0005.005|**InternetWriteFile**|Writes data to an open Internet file.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**InternetConnect**|C0005.001|Opens an FTP or HTTP session for a given site.|
|
||||
|**InternetOpen**|C0005.002|Initializes an application's use of the WinINet functions.|
|
||||
|**InternetOpenURL**|C0005.003|Opens a resource specified by a complete FTP or HTTP URL.|
|
||||
|**InternetReadFile**|C0005.004|Reads data from an open Internet file (URL data).|
|
||||
|**InternetWriteFile**|C0005.005|Writes data to an open Internet file.|
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions.
|
||||
|
||||
<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OC0005**|
|
||||
|
||||
|
||||
# Cryptography Micro-objectives #
|
||||
Micro-behaviors that enable malware to use crypto.
|
||||
|
||||
|ID|Name|
|
||||
|-----------------------------|--------|
|
||||
|R0021|[**Generate Pseudo-random Sequence**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/cryptography/gen-random.md)|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|[**Generate Pseudo-random Sequence**](../cryptography/gen-random.md)|C0021||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0021**|
|
||||
|**Objective(s)**|[Cryptography](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/cryptography)|
|
||||
|**Objective(s)**|[Cryptography](../cryptography)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,10 +11,8 @@ The Generate Pseudo-random Sequence microbehavior can be used for a number of pu
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0021.001|**GetTickCount**|Generate random using GetTickCount.|
|
||||
|C0021.002|**rand**|Generate random using rand.|
|
||||
|C0021.003|**Use API**|Generate random using a Windows API.|
|
||||
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**GetTickCount**|C0021.001|Generate random using GetTickCount.|
|
||||
|**Use API**|C0021.003|Generate random using a Windows API.|
|
||||
|**rand**|C0021.002|Generate random using rand.|
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OC0004**|
|
||||
|
||||
|
||||
# Data Manipulation Micro-objectives #
|
||||
Micro-behaviors related to malware manipulating data.
|
||||
|
||||
|ID|Name|
|
||||
|-----------------------------|--------|
|
||||
|R0019|[**Check String**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/check-string.md)|
|
||||
|R0020|[**Use Constant**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/use-constant.md)|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|[**Check String**](../data-manipulation/check-string.md)|C0019||
|
||||
|[**Use Constant**](../data-manipulation/use-constant.md)|C0020||
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0019**|
|
||||
|**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/data-manipulation)|
|
||||
|**Objective(s)**|[Data Manipulation](../data-manipulation)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Check String
|
||||
============
|
||||
Malware may check a string for some characteristics, such as being ascii content or length.
|
||||
|
||||
|
||||
@@ -1,13 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0020**|
|
||||
|**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/data-manipulation)|
|
||||
|**Objective(s)**|[Data Manipulation](../data-manipulation)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Use Constant
|
||||
============
|
||||
Malware may manipulate or use a constant value, for example as part of a larger string used by some function.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OC0001**|
|
||||
|
||||
|
||||
# File Manipulation Micro-objectives #
|
||||
Micro-behaviors related to file manipulation.
|
||||
|
||||
|ID|Name|
|
||||
|-----------------------------|--------|
|
||||
|R0015|[**Alter File Extension**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/alter-extend.md)|
|
||||
|R0016|[**Create File**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/create-file.md)|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|[**Alter File Extension**](../file-manipulation/alter-extend.md)|C0015||
|
||||
|[**Create File**](../file-manipulation/create-file.md)|C0016||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0015**|
|
||||
|**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/file-manipulation)|
|
||||
|**Objective(s)**|[File Manipulation](../file-manipulation)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,6 +11,6 @@ Malware alters a file extension. This could be done for many reasons, including
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0015.001|**Append Extension**|A new extension is appended.|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Append Extension**|C0015.001|A new extension is appended.|
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0016**|
|
||||
|**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/file-manipulation)|
|
||||
|**Objective(s)**|[File Manipulation](../file-manipulation)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
@@ -11,8 +11,7 @@ Malware creates a file.
|
||||
|
||||
Methods
|
||||
-------
|
||||
|ID|Name|Description|
|
||||
|-----------------------------|--------|-----------------------------|
|
||||
|C0016.001|**Create Office Document**|An Office document is created.|
|
||||
|C0016.002|**Create Ransomware File**|Create a file used by ransomware.|
|
||||
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|**Create Office Document**|C0016.001|An Office document is created.|
|
||||
|**Create Ransomware File**|C0016.002|Create a file used by ransomware.|
|
||||
|
||||
@@ -1,10 +1,11 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OC0007**|
|
||||
|
||||
|
||||
# Hardware Micro-objectives #
|
||||
Micro-behaviors related to hardware.
|
||||
|
||||
|ID|Name|
|
||||
|-----------------------------|--------|
|
||||
|R0023|[**Load Driver**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/hardware/load-driver.md)|
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|[**Load Driver**](../hardware/load-driver.md)|C0023||
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0023**|
|
||||
|**Objective(s)**|[Processes](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/processes)|
|
||||
|**Objective(s)**|[Processes](../processes)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Load Driver
|
||||
===========
|
||||
Malware loads a device driver.
|
||||
|
||||
|
||||
@@ -1,14 +1,15 @@
|
||||
|||
|
||||
|--|-----|
|
||||
|---|---|
|
||||
|**ID**|**OC0002**|
|
||||
|
||||
|
||||
# Memory Manipulation Micro-objectives #
|
||||
Micro-behaviors related to malware manipulating machine memory.
|
||||
|
||||
|ID|Name|
|
||||
|-----------------------------|--------|
|
||||
|R0007|[**Allocate Memory**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/allocate-memory.md)|
|
||||
|R0006|[**Heap Spray**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/heapspray.md)|
|
||||
|R0008|[**Change Memory Protection**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/memory-protect.md)
|
||||
|R0010|[**Overflow Buffer**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/overflow-buffer.md)
|
||||
|R0009|[**Stack Pivot**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/stack-pivot.md)
|
||||
|Name|ID|Description|
|
||||
|---|---|---|
|
||||
|[**Allocate Memory**](../memory-manipulation/allocate-memory.md)|C0007||
|
||||
|[**Change Memory Protection**](../memory-manipulation/memory-protect.md)|C0008||
|
||||
|[**Heap Spray**](../memory-manipulation/heapspray.md)|C0006||
|
||||
|[**Overflow Buffer**](../memory-manipulation/overflow-buffer.md)|C0010||
|
||||
|[**Stack Pivot**](../stack-pivot.md)|C0009||
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
|||
|
||||
|---------|------------------------|
|
||||
|---|---|
|
||||
|**ID**|**C0007**|
|
||||
|**Objective(s)**|[Memory Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/memory-manipulation)|
|
||||
|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
|
||||
|**Related ATT&CK Technique**|None|
|
||||
|
||||
|
||||
Allocate Memory
|
||||
===============
|
||||
Malware allocates memory, often to unpack itself.
|
||||
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user