From 843e9527f071ed0b9ee136ef623cd75ff8cac4bf Mon Sep 17 00:00:00 2001 From: Dez Beck Date: Thu, 29 Sep 2022 13:53:29 -0400 Subject: [PATCH] adding add'l fields --- anti-behavioral-analysis/b0007.005.md | 5 ++--- anti-behavioral-analysis/sandbox-detection.md | 4 ++-- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/anti-behavioral-analysis/b0007.005.md b/anti-behavioral-analysis/b0007.005.md index 1f357c6..71eb91b 100644 --- a/anti-behavioral-analysis/b0007.005.md +++ b/anti-behavioral-analysis/b0007.005.md @@ -37,9 +37,8 @@ Use in Malware Detection --------- -|capa| -|---| -|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/1fee68e72e5da3cf05cbf349d8b4df13dcf47a85/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)| +**capa** +[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/1fee68e72e5da3cf05cbf349d8b4df13dcf47a85/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml) Code Snippets ------------- diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index 3ce8682..7d49ae9 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -60,12 +60,12 @@ Methods Detection --------- -|capa|map| +|capa|Mapping| |---|---| |[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)](./b0007.005.md)| |[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/modules/signatures/antisandbox_cuckoo_files/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)| -|CAPE|map| +|CAPE|Mapping| |---|---| |[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|B0007.002| |[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|B0007.002|