admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

updated based on capa mapping

Browse Source
This commit is contained in:
Desiree Beck
2020-09-25 14:25:18 -04:00
parent a9db388317
commit 8841eb32d4
9 changed files with 63 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
micro-behaviors/communication/README.md
+2 -3
View File
@@ -12,8 +12,7 @@ Micro-behaviors that enable malware to communicate.
|[**FTP Communication**](../communication/ftp-comm.md)|C0004||
|[**HTTP Communication**](../communication/http-comm.md)|C0002||
|[**ICMP Communication**](../communication/icmp-comm.md)|C0014||
|[**Inter-process Communication**](../communication/inter-process.md)|C0003||
|[**SMTP Communication**](../communication/smtp-comm.md)|C0012||
|[**TCP Communication**](../communication/tcp-comm.md)|C0001||
|[**UDP Communication**](../communication/udp-comm.md)|C0013||
|[**Interprocess Communication**](../communication/inter-process.md)|C0003||
|[**Socket Communication**](../communication/tcp-comm.md)|C0001||
|[**WinINet Communication**](../communication/wininet.md)|C0005||
micro-behaviors/communication/ftp-comm.md
+2 -2
View File
@@ -13,5 +13,5 @@ Methods
-------
|Name|ID|Description|
|---|---|---|
|**Put**|C0004.001|FTP Put|
|**WinINet API**|C0004.002|Send FTP command via WinINet.|
|**Send File**|C0004.001|Send FTP file.|
|**WinINet**|C0004.002|Send FTP command via WinINet.|
micro-behaviors/communication/http-comm.md
+17 -11
View File
@@ -13,15 +13,21 @@ Methods
-------
|Name|ID|Description|
|---|---|---|
|**Client**|C0002.002|General HTTP client behavior.|
|**GET Request**|C0002.004|HTTP Get request.|
|**IHTMLDocument**|C0002.011|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.|
|**IHTMLElement**|C0002.012|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.|
|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
|**POST Request**|C0002.005|HTTP Post request.|
|**PUT Request**|C0002.006|HTTP Put request.|
|**Request**|C0002.003|Non-specific HTTP request.|
|**Server**|C0002.001|General HTTP server behavior.|
|**URLMON Function**|C0002.009|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.|
|**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
|**Client**|C0002.002|General HTTP client behavior.|
|**Connect to Server**|C0002.009|HTTP client connects to HTTP server.|
|**Open URL**|C0002.004|HTTP client connects to a URL.|
|**Download URL**|C0002.006|HTTP client downloads URL to file.|
|**Extract Body**|C0002.011|HTTP client extracts HTTP body.|
|**Create Request**|C0002.012|HTTP client creates request.|
|**Send Request**|C0002.003|HTTP client sends request (GET).|
|**Send Data**|C0002.005|HTTP clients sends data to a server (POST/PUT).|
|**Receive Request**|C0002.015|HTTP server receives request.|
|**Send Response**|C0002.016|HTTP server sends response.|
|**Get Response**|C0002.017|HTTP client receives response.|
|**Start Server**|C0002.018|HTTP server is started.|
|**Set Header**|C0002.013|HTTP header is set.|
|**Read Header**|C0002.014|HTTP read header.|
|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
|**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
micro-behaviors/communication/icmp-comm.md
+1
View File
@@ -14,3 +14,4 @@ Methods
|Name|ID|Description|
|---|---|---|
|**Generate Traffic**|C0014.001|Generate ICMP traffic.|
|**Echo Request**|C0014.002|Send ICMP echo request.|
micro-behaviors/communication/socket-comm.md
+39
View File
@@ -0,0 +1,39 @@
|||
|---|---|
|**ID**|**C0001**|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
Socket Communication
====================
This micro-behavior focuses on socket (TCP, UDP) communication.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**Set Socket Config**|C0001.001|Configure socket.|
|**Initialize Winsock Library**|C0001.009|Winsock is initialized for TCP communication.|
|**Start TCP Server**|C0001.005|A TCP server listens for client requests.|
|**Create Socket**|C0001.003|A server or client creates a UDP or TCP socket.|
|**Create UDP Socket**|C0001.010|A UDP socket is created.|
|**Create TCP Socket**|C0001.011|A TCP socket is created.|
|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
|**Get Socket Status**|C0001.012|Get socket status.|
|**Send Data**|C0001.007|Send data on socket.|
|**Send TCP Data**|C0001.014|Send TCP data.|
|**Send UDP Data**|C0001.015|Send UDP data.|
|**Receive Data**|C0001.006|Receive data on socket.|
|**Receive TCP Data**|C0001.016|Receive TCP data.|
|**Receive UDP Data**|C0001.017|Receive UDP data.|
|**TCP Server**|C0001.002|TCP server behavior.|
|**TCP Client**|C0001.008|TCP client behavior.|
|**UDP Client**|C0001.013|UDP client behavior.|
micro-behaviors/communication/tcp-comm.md
-22
View File
@@ -1,22 +0,0 @@
|||
|---|---|
|**ID**|**C0001**|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
TCP Communication
=================
This micro-behavior focuses on TCP communication.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**Client**|C0001.001|General TCP client behavior.|
|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
|**Create Socket**|C0001.003|A server or client creates a TCP socket.|
|**Listen Socket**|C0001.005|A server listens for client requests.|
|**Receive Data**|C0001.006|Receive data on socket.|
|**Send Data**|C0001.007|Send data on socket.|
|**Server**|C0001.002|General TCP server behavior.|
micro-behaviors/communication/udp-comm.md
-16
View File
@@ -1,16 +0,0 @@
|||
|---|---|
|**ID**|**C0013**|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
UDP Communication
=================
The micro-behavior is related to UDP communication.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**STUN Server**|C0013.001|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.|
micro-behaviors/hardware/README.md
+1 -1
View File
@@ -8,4 +8,4 @@ Micro-behaviors related to hardware.
|Name|ID|Description|
|---|---|---|
|[**Load Driver**](../hardware/load-driver.md)|C0023||
|[**Load Driver**](../hardware/load-driver.md)|C0013||
micro-behaviors/hardware/load-driver.md
+1 -1
View File
@@ -1,6 +1,6 @@
|||
|---|---|
|**ID**|**C0023**|
|**ID**|**C0013**|
|**Objective(s)**|[Processes](../processes)|
|**Related ATT&CK Technique**|None|