admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

adding add'l fields

Browse Source
This commit is contained in:
Dez Beck
2022-10-09 15:13:04 -04:00
parent 2d13f77362
commit 939b5ffa8d
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-behavioral-analysis/sandbox-detection.md
+9 -9
View File
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.3</b></td>
<td><b>1.2</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -60,15 +60,15 @@ Methods
Detection
---------
|Tool: capa|Mapping|
|---|---|
|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)](./b0007.005.md)|
|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/modules/signatures/antisandbox_cuckoo_files/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|
|Tool: capa|Mapping|APIs|
|---|---|---|
|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)](./b0007.005.md)|CreateFile|
|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle|
|Tool: CAPE|Mapping|
|---|---|
|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|B0007.002|
|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|B0007.002|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|B0007.002|--|
|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|B0007.002|--|
<a name="snippet"></a>Code Snippets
-------------