Changed Markdown headers to atx-style

2026-06-08 11:36:36 +00:00 · 2022-11-10 12:02:12 -05:00
parent acf14afd3c
commit 9c69facf0f
142 changed files with 494 additions and 485 deletions
@@ -29,8 +29,8 @@ Behaviors that prevent, obstruct, or evade behavioral analysis of malware--for e
 * **Software Packing** [F0001](../anti-static-analysis/software-packing.md)
 * **Virtual Machine Detection** [B0009](../anti-behavioral-analysis/virtual-machine-detection.md)

-References
----------
+## References
+
 <a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map

 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
@@ -34,8 +34,8 @@ Capture Evasion
 ===============
 Malware has characteristics enabling it to evade capture from the infected system.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Encrypted Payloads**|B0036.002|Decryption key is stored external to the executable or never touches the disk.|
@@ -36,8 +36,8 @@ Malware detects whether it's being executed inside a debugger. If so, conditiona

 Details on methods of detecting debuggers are given in the references; many are listed below.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**API Hook Detection**|B0001.001|Module bounds based [[7]](#7).|
@@ -78,8 +78,8 @@ Methods
 |**UnhandledExceptionFilter**|B0001.030|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.|
 |**WudfIsAnyDebuggerPresent**|B0001.031|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Redhip**](../xample-malware/rebhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
@@ -88,8 +88,8 @@ Malware Examples
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy Variant checks for breakpoints and exits immediately if found [[10]](#10)|


-References
----------
+## References
+
 <a name="1">[1]</a> Alexander Antukh, "Anti-debugging Techniques Cheat Sheet," 19 January 2015.  http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet. 

 <a name="2">[2]</a> Joshua Cannell, Malwarebytes Labs, "Five Anti-Analysis Tricks that sometimes Fool Analysts," 31 March 2016. https://blog.malwarebytes.com/threat-analysis/2014/09/five-anti-debugging-tricks-that-sometimes-fool-analysts.
@@ -38,8 +38,8 @@ A thorough reference for anti-debugging, both detection and evasion, is given in

 The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T1622/))** ATT&CK technique was defined subsequent to this MBC behavior.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Block Interrupts**|B0002.001|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.|
@@ -73,16 +73,16 @@ Methods
 |**Thread Timeout**|B0002.029|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.|
 |**Use Interrupts**|B0002.030|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)|
 |**Dridex**|March 2015|[[3]](#3)|
 |[**Redhip**](../xample-malware/rebhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf

 <a name="2">[2]</a> https://www.synack.com/2016/02/17/analyzing-the-anti-analysis-logic-of-an-adware-installer/
@@ -38,8 +38,8 @@ See **Emulator Evasion ([B0004](../anti-behavioral-analysis/emulator-evasion.md)

 The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Alternative ntdll.dll**|B0003.001|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.|
@@ -56,8 +56,8 @@ Methods
 |**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Ursnif**](../xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
@@ -69,8 +69,8 @@ Malware Examples
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [[6]](#6)|


-References
----------
+## References
+
 <a name="1">[1]</a> http://joe4security.blogspot.com/2013/06/overloading-sandboxes-new-generic.html

 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
@@ -34,8 +34,8 @@ Emulator Detection
 ==================
 Detects whether the malware instance is being executed inside an emulator. If so, conditional execution selects a benign execution path.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Check Emulator-related Registry Keys**|B0004.003|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)|
@@ -43,16 +43,19 @@ Methods
 |**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
 |**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|

+## Detection
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|

+## Use in Malware

-Malware Examples
----------------
 |Name|Date|Description|
 |---|---|---|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/

 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
@@ -30,8 +30,8 @@ Emulator Evasion
 ================
 Behaviors that obstruct analysis in an emulator.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Different Opcode Sets**|B0005.001|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.|
@@ -39,8 +39,8 @@ Methods
 |**Undocumented Opcodes**|B0005.002|Use rare or undocumented opcodes to block non-exhaustive emulators.|
 |**Unusual/Undocumented API Calls**|B0005.003|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
@@ -50,6 +50,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor
 |**Patch MmGetPhysicalMemoryRanges**|[B0006.011](#b0006011)|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|

 ## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[Kraken](../xample-malware/kraken.md)|April 2008|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
@@ -66,7 +66,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t

 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)](./b0007.005.md)|CreateFile|
+|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)|CreateFile|
 |[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle|

 |Tool: CAPE|Mapping|APIs|
@@ -90,6 +90,12 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |[**Emotet**](../xample-malware/emotet.md)|2018|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[7]](#7)|


+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|
+

 ## Code Snippets

@@ -25,8 +25,8 @@ Behaviors and code characteristics that prevent or hinder static analysis of the
 * **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscated-files-or-information.md)
 * **Software Packing** [F0001](../anti-static-analysis/software-packing.md)

-References
----------
+## References
+
 <a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map/sandbox-evasion/

 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
@@ -34,15 +34,15 @@ Call Graph Generation Evasion
 =============================
 Malware code evades accurate call graph generation during disassembly. Call graphs are used by malware similarity tools and algorithms ([[1]](#1), [[4]](#4)), as well as for malware detection [[2]](#2).

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)|
 |**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[3]](#3)|

-References
----------
+## References
+
 <a name="1">[1]</a> K. Blokhin, D. Mentis, J. Saxe, "Malware Similarity Identification Using Call Graph Based System Call Subsequence Features," 2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, July 2013. https://www.researchgate.net/publication/269326967_Malware_Similarity_Identification_Using_Call_Graph_Based_System_Call_Subsequence_Features

 <a name="2">[2]</a> P. Deshpande, M. Stamp, "Metamorphic Malware Detection Using Function Call Graph Analysis," MIS Review Vol. 21, Nos. 1/2, September(2015)/March(2016). https://pdfs.semanticscholar.org/8db2/69106ea6e1f59e4dac0889665dd3336ee9b1.pdf
@@ -34,14 +34,14 @@ Data Flow Analysis Evasion
 ==========================
 Malware code evades data flow analysis (also known as information flow analysis and taint-tracking).

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Control Dependence**|B0045.001|Data is propagated via an if-then-else clause instead of direct assignment.[[1]](#1)|
 |**Implicit Flows**|B0045.002|Data is propagated via semantic relationships, for example one variable not changing its state could imply the state of another variable.[[1]](#1)|
 |**Arbitrary Memory Corruption**|B0045.003|Data is propagated by corrupting memory, for example overwriting a region of stack space where a file pointer is held.[[1]](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> http://www.seclab.cs.sunysb.edu/seclab/pubs/antitaint.pdf
@@ -34,8 +34,8 @@ Disassembler Evasion
 ====================
 Malware code evades disassembly in a recursive or linear disassembler. Some methods apply to both types of disassemblers; others apply to one type and not the other.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
@@ -44,8 +44,8 @@ Methods
 |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.|
 |**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.|

-References
----------
+## References
+
 <a name="1">[1]</a> http://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf

 <a name="2">[2]</a> http://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf
@@ -34,13 +34,13 @@ Executable Code Optimization
 ============================
 Code is optimized, making it harder to statically analyze.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Jump/Call Absolute Address**|B0034.001|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.|
 |**Minification**|B0034.002|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.|

-References
----------
+## References
+
 <a name="1">[1]</a> https://en.wikipedia.org/wiki/Minification_(programming)
@@ -36,20 +36,20 @@ Original executable code is virtualized by translating the code into a special f

 Virtualized code is a software protection technique. Themida is a commercial tool; VMProtect is an open source tool. [[1]](#1) 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Multiple VMs**|B0008.001|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Locky Bart**](../xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://github.com/xiaoweime/WProtect

 <a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/
@@ -35,8 +35,8 @@ This code characteristic - Software Packing - can make static and behavioral ana

 This description refines the ATT&CK **Obfuscated Files or Information: Software Packing ([T1027.002](https://attack.mitre.org/techniques/T1027/002/), [T1406.002](https://attack.mitre.org/techniques/T1406/002/))** techniques.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Armadillo**|F0001.012|Uses Armadillo.|
@@ -53,8 +53,8 @@ Methods
 |**UPX**|F0001.008|Uses UPX packer.|
 |**VMProtect**|F0001.010|Uses VMProtect.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Redhip**](../xample-malware/rebhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|
@@ -64,8 +64,8 @@ Malware Examples
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Has a custom packer to obfuscate itself  [[7]](#7)|
 |[**Emotet**](../xample-malware/emotet.md)|2018|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads [[8]](#8)|

-References
----------
+## References
+
 <a name="1">[1]</a> Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf

 <a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.
@@ -30,8 +30,8 @@ Cryptocurrency
 ==============
 Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Bitcoin**|B0028.001|Access Bitcoin data.|
@@ -32,14 +32,14 @@ Malware captures user input.

 See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [T1417](https://attack.mitre.org/techniques/T1417/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Mouse Events**|E1056.m01|Mouse events are captured.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|The malware injects itself into a browser and captures user input data [[1]](#1)|
@@ -47,8 +47,8 @@ Malware Examples
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can capture audio and video [[3]](#3)|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Can capture audio and video  [[4]](#4)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://blogs.cisco.com/security/talos/rombertik

 <a name="2">[2]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279
@@ -32,16 +32,16 @@ Malware captures user keyboard input.

 See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/techniques/T1056/001), [T1417.001](https://attack.mitre.org/techniques/T1417/001/))**

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Application Hook**|F0002.001|Keystrokes are captured with an application hook.|
 |**Polling**|F0002.002|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|Certain variants of the malware may have keylogging functionality [[1]](#1)|
@@ -50,8 +50,8 @@ Malware Examples
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|DarkComet can capture keystrokes [[4]](#4)|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Can capture keystrokes  [[5]](#5)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml

 <a name="2">[2]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
@@ -32,23 +32,23 @@ Malware takes screen captures of the desktop.

 See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**WinAPI**|E1113.m01|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR is capable of capturing screenshots. [[1]](#1)|
 |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|Screenshot plugin allows for collection of screenshots  [[2]](#2)|
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can take screenshots of victim's computer [[3]](#3)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

 <a name="2">[2]</a> https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/
@@ -20,13 +20,13 @@ Behaviors that enable malware to communicate with systems such as C2 servers or
 * **Ingress Tool Transfer** [E1105](../command-and-control/ingress-tool-transfer.md)


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../command-and-control/README.md)|2016| new email addresses are collected automatically from the victim's address books [[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/
@@ -32,8 +32,8 @@ Malware generates the domain name of the controller to which it connects. Access

 The related **Dynamic Resolution: Domain Generation Algorithms ([T1568.002](https://attack.mitre.org/techniques/T1568/002/))** ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Kraken**](../xample-malware/kraken.md)|April 2008|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
@@ -41,8 +41,8 @@ Malware Examples
 |[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|The malware sends a hash value generated from system information [[4]](#4|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|Ursnif has used a Domain name generation algorithm in the past [[5]](#5)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/

 <a name="2">[2]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
@@ -34,8 +34,8 @@ Note that this behavior is separate from possible execution (installation) of th

 See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques/T1105/))**.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -45,8 +45,8 @@ Malware Examples
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can download files from remote repository upon instruction  [[4]](#4)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|Creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory  [[5]](#5)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

 <a name="2">[2]</a> https://www.secureworks.com/research/cryptolocker-ransomware
@@ -37,15 +37,15 @@ Methods
 |**Fileless Malware**|B0027.001|Stores itself in memory.|
 |**Registry Install**|B0027.002|Stores itself in the Windows registry.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Kovter**](../xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
 |[**SYNfulKnock**](../xample-malware/synful-knock.md)|2015|100 memory-resident modules can be installed  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan

 <a name="2">[2]</a> https://www.mandiant.com/resources/synful-knock-acis
@@ -32,15 +32,15 @@ The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)).

 The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect. (As of 2020, ATT&CK also associates the technique with Persistence.) 

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Mebromi**](../xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware  [[2]](#24)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/

 <a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
@@ -36,14 +36,14 @@ Methods
 |---|---|---|
 |**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|TrickBot has come with a signed downloader component  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce

 <a name="2">[2]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
@@ -30,8 +30,8 @@ Covert Location
 ===============
 Malware may hide data or binary files within other files, the registry, etc. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Hide Data in Registry**|B0040.001|Malware may use a registry key to store a long sequence of bytes.|
@@ -34,8 +34,8 @@ Malware-related methods extending ATT&CK's definition are below.

 See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://attack.mitre.org/techniques/T1562/001), [T1629.003](https://attack.mitre.org/techniques/T1629/003/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).|
@@ -48,16 +48,16 @@ Methods
 |**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.|
 |**Disable Code Integrity**|F0004.009|Malware disables Code Integrity driver.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**DNSChanger**](../xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
@@ -32,8 +32,8 @@ Malware may hide files and folders to avoid detection and/or to persist on the s

 See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://attack.mitre.org/techniques/T1564/001/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Attribute**|F0005.003|Malware may change or choose an attribute to hide a file or directory.|
@@ -42,15 +42,15 @@ Methods
 |**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|Modifies target files' time to August 2012 as an antiforensic trick  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

 <a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/
@@ -32,8 +32,8 @@ Malware may hide artifacts to evade detection and/or to persist on the system. S

 See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/), [T1628](https://attack.mitre.org/techniques/T1628/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Hidden Userspace Libraries**|E1564.m01|Hides userspace libraries used by the malware instance. Technique refers to hiding libraries loaded in memory (not disk). For example, a userspace library may be injected into a system process such that memory scanning tools may be prevented from finding them. This technique is different than DLL injection, in which the DLL will continue to show up in process metadata that tracks what is stored in memory. This technique involves clearing that metadata or making it inaccessible to security and inspection tools.|
@@ -43,15 +43,15 @@ Methods
 |**Hidden Services**|E1564.m04|Hides any system services that the malware instance creates or injects itself into. Services can be hidden by hiding associated registry keys.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**YiSpecter**](../xample-malware/yispecter.md)|2015|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removalbe drives  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
@@ -42,8 +42,8 @@ For hooking related to memory dump evasion, see **Memory Dump Evasion ([B0006](.

 See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques/T1574), [T1625](https://attack.mitre.org/techniques/T1625))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Abuse Windows Function Calls**|F0015.006|Malware abuses native Windows function calls to transfer execution to shellcode that it loads into memory. A pointer to the callback function is used to supply the memory address of the shellcode. Functions that can be abused include EnumResourceTypesA and EnumUILanguagesW. [[4]](#4)|
@@ -54,8 +54,8 @@ Methods
 |**Shadow System Service Dispatch Table Hooking**|F0015.004|The Shadow System Service Dispatch Table (SSDT) can be hooked similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).[[3]](#3)|
 |**System Service Dispatch Table Hooking**|F0015.005|Malware (e.g. rootkit, malicious drivers) may hook the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.[[3]](#3)|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[6]](#6)|
@@ -66,8 +66,8 @@ Malware Examples
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|Escalates privilege by impersonating the token. First uses LogonUser and ImpersonateLoggedOnUser, then ImpersonateNamedPipeClient. [[10]](#10)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet.  [[11]](#11)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf

 <a name="2">[2]</a> https://www.oreilly.com/library/view/learning-malware-analysis/9781788392501/a0a506d6-d062-48c1-a0a8-57d6acb77785.xhtml
@@ -32,15 +32,15 @@ Malware blocks indicators or events that would indicate malicious activity. Meth

 See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mitre.org/techniques/T1562/006/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Remove SMS Warning Messages**|F0006.001|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|Clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system  [[1]](#1)|
@@ -48,8 +48,8 @@ Malware Examples
 |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can disable security center functions like anti-virus and firewall [[3]](#3)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV) [[4]](#4)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf

 <a name="2">[2]</a> https://en.wikipedia.org/wiki/Conficker
@@ -30,12 +30,12 @@ Install Insecure or Malicious Configuration
 ===========================================
 Malware may install malicious configuration settings or may modify existing configuration settings. For example, malware may change configuration settings associated with security mechanisms to make it difficult to detect or change configuration settings to maintain a foothold on the network.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Black Energy**](../xample-malware/blackenergy.md)|2007|Configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component [[1]](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
@@ -33,8 +33,8 @@ Malware may make changes to the Windows Registry to hide execution or to persist

 See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112/))**.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -45,8 +45,8 @@ Malware Examples
 |[**Kovter**](../xample-malware/kovter.md)|2016|The malware modifies the registry during execution [[5]](#5)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|Disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy  [[6]](#6)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
@@ -42,8 +42,8 @@ See ATT&CK: **Obfuscated Files or Information ([T1027](https://attack.mitre.org/

 Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
@@ -56,8 +56,8 @@ Methods
 |**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -66,8 +66,8 @@ Malware Examples
 |[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|The malware will use a key to decrypt text from a URL to create more malicious code [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

 <a name="2">[2]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
@@ -30,14 +30,14 @@ Polymorphic Code
 ================
 Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic Code behavior is typically identified through analysis of related samples.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Call Indirections**|B0029.002|[[1]](#1)|
 |**Code Reordering**|B0029.003|[[1]](#1)|
 |**Packer Stub**|B0029.001|A packer stub can generate polymorphic code.|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
@@ -53,8 +53,8 @@ Methods
 |**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)|
 |**Patch Process Command Line**|E1055.m04|Malware patches the PEB of a process to spoof the arguments.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**UP007**](../xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)|
@@ -66,8 +66,8 @@ Malware Examples
 |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|Bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution  [[8]](#8)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet injects the entire DLL into another process and then just calls the particular export  [[9]](#9)|

-References
----------
+## References
+
 <a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process

 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -46,8 +46,8 @@ Methods
 |**Kernel Mode Rootkit**|E1014.m16|Rootkit operates by adding or replacing code in OS, device drivers, loadable kernel modules (LKM). Related to ATT&CK: [Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006/)|
 |**Memory Rootkit**|E1014.m17|A memory rootkit hids in RAM. Behaviors may include methods to prevent memory access. The lifespan of a memory rootkit is short because it disappears after a system reboot.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
@@ -61,8 +61,8 @@ Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts,

 Rootkits can also be detected via memory dump analysis or virtual machine introspection.

-References
----------
+## References
+
 <a name="1">[1]</a> https://en.wikipedia.org/wiki/Rootkit

 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -35,20 +35,20 @@ Malware may uninstall itself to avoid detection.

 See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630.001](https://attack.mitre.org/techniques/T1630/001/)), Indicator Removal on Host: File Deletion ([T1070.004](https://attack.mitre.org/techniques/T1070/004/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**COMSPEC Environment Variable**|F0007.001|Uninstalls self via COMSPEC environment variable.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Terminator**](../xample-malware/terminator.md)|2013|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
@@ -32,8 +32,8 @@ Malware can employ various means to detect whether analysis tools are present or

 This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](../anti-behavioral-analysis) objective.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Known File Location**|B0013.008|Malware may detect an analysis tool by the presence of a file in a known location.|
@@ -47,15 +47,15 @@ Methods
 |**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.|
 |**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Emotet**](../xample-malware/emotet.md)|2018|If it recieves a response from the c2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits [[1]](#1)|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one fo the analysis tools is running.  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1

 <a name="2">[2]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
@@ -30,8 +30,8 @@ Application Window Discovery
 ============================
 Malware may attempt to get a listing of open application windows.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.|
@@ -30,8 +30,8 @@ Code Discovery
 ==============
 Malware may inspect code or enumerate aspects.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Enumerate PE Sections**|B0046.001|Malware enumerates virtual offsets of code sections.|
@@ -30,23 +30,23 @@ File and Directory Discovery
 ============================
 Malware may enumerate files and directories or may search for specific files or in specific locations.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Log File**|E1083.m01|Malware may look for system log files.|
 |**Filter by Extension**|E1083.m02|Malware may filter by extension (common in ransomware).|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**CryptoWall**](../xample-malware/cryptowall.md)|2014| [[1]](#1)|
 |[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|The malware searches for user files before encrypting them [[2]](#2)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Collects local files with specified file extensions and information from the victim's machine [[3]](#3)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/

 <a name="2">[2]</a> https://www.secureworks.com/research/cryptolocker-ransomware
@@ -32,14 +32,14 @@ Malware may attempt to get detailed information about the system.

 See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/techniques/T1082/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -50,8 +50,8 @@ Malware Examples
 |[**Emotet**](../xample-malware/emotet.md)|2018|Collects information related to OS, processes, and sometimes mail client information and sends it to c2 [[4]](#4)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself  [[5]](#5)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_URSNIF.A2?_ga=2.131425807.1462021705.1559742358-1202584019.1549394279

 <a name="2">[2]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
@@ -32,8 +32,8 @@ Malware may abuse command and script interpreters to execute commands, scripts,

 See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))**.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
@@ -44,8 +44,8 @@ Malware Examples
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion [[5]](#5)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell  [[6]](#6)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
@@ -38,8 +38,8 @@ This behavior is related to the **Dynamic Analysis Evasion ([B0003](../anti-beha

 Some aspects of this Conditional Execution behavior are related to the [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480) ATT&CK technique; however the ATT&CK technique is not focused on anti-behavioral analysis behaviors.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
@@ -51,8 +51,8 @@ Methods
 |**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
 |**Token Check**|B0025.006|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
@@ -60,8 +60,8 @@ Malware Examples
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.) [1] [[3]](#3)|
 |[**Mebromi**](../xample-malware/mebromi.md)|2011|Malware only proceeds if it detects the BIOS ROM is Award BIOS [[4]](#4)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="2">[2]</a> 
@@ -36,8 +36,8 @@ Software is exploited - either because of a vulnerability or through its designe

 See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.org/techniques/T1203))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**File Transfer Protocol (FTP) Servers**|E1203.m03|Malware leverages an FTP server.|
@@ -47,12 +47,12 @@ Methods
 |**Sysinternals**|E1203.m05|Sysinternals tools are used for additional command line functionality.|
 |**Windows Utilities**|E1203.m06|One or more Windows utilities are used.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**SamSam**](../xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/
@@ -32,8 +32,8 @@ Installs another, different program on the system. The additional program can be

 Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the **Ingress Tool Transfer ([E1105](../command-and-control/ingress-tool-transfer.md))** behavior.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**WebCobra**](../xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)|
@@ -44,8 +44,8 @@ Malware Examples
 |[**YiSpecter**](../xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.|
 |[**UP007**](../xample-malware/up007.md)|2016|The malware is a dropper that creates multiple files [[4]](#4)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="2">[2]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-driver-based-mitm-malware-itranslator.html
@@ -30,12 +30,12 @@ Prevent Concurrent Execution
 ============================
 To avoid running multiple instances of itself, malware may check a system to see if it is already running.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Bagle**](../xample-malware/bagle.md)|2004|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_bagle.u
@@ -38,8 +38,8 @@ It may be useful to capture remote commands along with related behaviors because

 Autonomous behaviors - those done by the malware without an active attacker - should not be captured with *Execution:Remote Commands*. For example, malware that *automatically* destroys data would be tagged with the **Impact: Data Destruction ([E1485](../impact/data-destruction.md))** behavior.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Delete File**|B0011.001||
@@ -51,16 +51,16 @@ Methods
 |**Upload File**|B0011.007||


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|Commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, upload a log file which contains stolen information  [[1]](#1)|
 |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|infected bots receive commands from botmaster to load plugins associated with botmaster's goals [[2]](#2)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Receives various commands from c2 server.  [[3]](#3)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279

 <a name="2">[2]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
@@ -32,8 +32,8 @@ Sends an email message from the system on which the malware is executing to one

 This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/techniques/T1566/))** ATT&CK technique defined under ATT&CK's Initial Access tactic.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Gamut**](../xample-malware/gamut.md)|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
@@ -41,8 +41,8 @@ Malware Examples
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**Emotet**](../xample-malware/emotet.md)|2018|spam email with the Emotet loader is sent automatically [[3]](#3)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/

 <a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
@@ -30,14 +30,14 @@ Send Poisoned Text Message
 ==========================
 A malicious attachment is sent via spam SMS or MMS messages. When the user clicks the link, malware is installed.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**MazarBot**](../xample-malware/mazarbot.md)||MazarBot is delivered via a poisoned SMS message. [[1]](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html

 <a name="2">[2]</a> https://www.player.one/new-android-sms-malware-can-completely-own-your-phone-just-one-text-how-avoid-mazar-512363
@@ -32,13 +32,13 @@ Malware may abuse system services or daemons to execute.

 See ATT&CK: **System Services ([T1569](https://attack.mitre.org/techniques/T1569/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**MSDTC**|E1569.m01|The Distributed Transaction Coordinator (MSDTC) coordinates transaction across multiple resource managers (databases, message queues and file systems). This legitimate Microsoft service is part of Windows 2000 and later and can be used to import and load DLLs. Malware may abuse MSDTC to import and load DLLs.[[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://support.resolver.com/hc/en-ca/articles/207161116-Configure-Microsoft-Distributed-Transaction-Coordinator-MSDTC-
@@ -32,8 +32,8 @@ Malware may include code that relies on specific actions by a user to execute. N

 See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniques/T1204/))**.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -41,8 +41,8 @@ Malware Examples
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|The malware relies on a victim to execute itself [[2]](#2)|
 |[**Terminator**](../xample-malware/terminator.md)|2013|The malware relies on user interaction to execute [[3]](#3)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

 <a name="2">[2]</a> https://blogs.cisco.com/security/talos/rombertik
@@ -32,8 +32,8 @@ Malware may obfuscate data via encryption or encoding before exfiltration.

 See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org/techniques/T1560/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Encoding**|E1560.m01|Data is encoded.|
@@ -44,16 +44,16 @@ Methods
 |**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt  [[1]](#1)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers  [[2]](#2)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/

 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
@@ -32,8 +32,8 @@ Malware may exfiltrate data via automated processing or scripting.

 See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org/techniques/T1020/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Exfiltrate via File Hosting Service**|E1020.m01|Malware may exfiltrate files to a file hosting location.|
@@ -36,16 +36,16 @@ Data, system files, or other files are destroyed. Individual files are selected,

 See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T1485/))**.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Delete Application/Software**|E1485.m03|An application or software is deleted.|
 |**Delete Shadow Copies**|E1485.m04|Deletes shadow drive data, which is related to ransomware.|
 |**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)|
@@ -54,8 +54,8 @@ Malware Examples
 |[**Conficker**](../xample-malware/conficker.md)|2008|resets system restore points and deletes backup files [[4]](#4)|
 |[**MazarBot**](../xample-malware/mazarbot.md)|2016|Can erase phone data  [[5]](#5)|

-References
----------
+## References
+
 <a name="1">[1]</a> http://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509

 <a name="2">[2]</a> https://blogs.cisco.com/security/talos/rombertik
@@ -36,14 +36,14 @@ Malware may encrypt files stored on the system to prevent user access until a ra

 See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techniques/T1486/))** and **Data Encrypted for Impact (Mobile) ([T1471](https://attack.mitre.org/techniques/T1471/))**

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Ransom Note**|E1486.001|Ransomware displays a ransom note. Ransom notes are sometimes used to link instances of ransomware, even when the code or anti-analysis techniques change.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**CryptoWall**](../xample-malware/cryptowall.md)|2014|[[1]](#1)|
@@ -51,8 +51,8 @@ Malware Examples
 |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|Encrypts files for ransom without any connection to the Internet.|
 |[**SamSam**](../xample-malware/samsam.md)|2015|Ransomware.|

-References
----------
+## References
+
 <a name="1">[1]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptowall-ransomware/

 <a name="2">[2]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptolocker-ransomware/
@@ -38,15 +38,15 @@ Endpoint denial of service behaviors are captured by the **Endpoint Denial of Se

 The related **Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498/))** ATT&CK technique was defined subsequent to this MBC behavior.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**BlackEnergy**](../xample-malware/blackenergy.md)|October 2007|Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
 |[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf
 
 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
@@ -34,12 +34,12 @@ Destroy Hardware
 ================
 Destroys a physical piece of hardware. For example, malware may cause hardware to overheat.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.bbc.com/timelines/zc6fbk7
@@ -35,13 +35,13 @@ Malware may erase the content of storage devices. This behavior is different tha

 This description refines the ATT&CK **Disk Wipe ([T1203](https://attack.mitre.org/techniques/T1561/)**] sub-technique.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|An overwrite component will overwrite the MBR so that the compromised computer can no longer start  [[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
@@ -36,12 +36,12 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver

 See related ATT&CK Technique: **Exploit Public-Facing Application ([T1190](https://attack.mitre.org/techniques/T1190))**, which relates to Initial Access. Under the Impact objective, exploit behaviors are considered more broadly in MBC.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Ursnif**](../xample-malware/ursnif.md)||Ursnif is sometimes delivered via exploit kit. [[1]](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
@@ -34,22 +34,22 @@ Generate Traffic from Victim
 =======================================
 Malware may generate traffic from the victim system such as clicks of advertising links that generate fraudulent ad revenue. The ATT&CK technique, **Generate Traffic from Victim ([T1643](https://attack.mitre.org/techniques/T1643/))**, is only associated with the mobile platform, but the behavior is applicable to other platforms as well.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Advertisement Replacement Fraud**|E1643.m02|Malware injects ad windows onto websites the user views. [[2]](#2)|
 |**Click Hijacking**|E1643.m01|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**DNSChanger**](../xample-malware/dnschanger.md)|November 2011|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.itworld.com/article/2734253/security/behind-the--massive--malware-ad-revenue-fraud-case.html

 <a name="2">[2]</a> https://www.fipp.com/news/insightnews/what-are-the-nine-types-of-digital-ad-fraud
@@ -36,13 +36,13 @@ Malware intercepts and manipulates network traffic, typically accessing or modif

 The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](https://attack.mitre.org/techniques/T1565/002/))** ATT&CK sub-technique was defined subsequent to this MBC behavior.

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|Intercepts encrypted web traffic to inject adds. [[1]](#1)|
 |[**MazarBot**](../xample-malware/mazarbot.md)|2016|Intercepts data coming into and going out of device.|

-References
----------
+## References
+
 <a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
@@ -34,8 +34,8 @@ Modify Hardware
 ===============
 Malware modifies hardware.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**CDROM**|B0042.001|The CD-ROM is modified.|
@@ -38,22 +38,22 @@ A RAT (Remote Access Trojan) is an example of malware that provides a degree of

 Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques/T1105/))** technique defined under the Command and Control tactic is no longer specific to "legitimate desktop support and remote access software” as it was under a previous version of ATT&CK. However, *Ingress Tool Transfer* relates only to files copied; this MBC behavior is broader, allowing for remote access behaviors beyond file transfers (i.e., *Impact:Remote Access* and *Command and Control: Ingress Tool Transfer* are not equivalent).

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Reverse Shell**|B0022.001|Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
 |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|Allows an attacker to control the system via a GUI.|
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|The malware acts as a backdoor [[4]](#4)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://en.wikipedia.org/wiki/Remote_access_trojan

 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -36,23 +36,23 @@ Uses system resources for other purposes; as a result, the system may not be ava

 The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1496/))** ATT&CK technique was defined subsequent to this MBC behavior.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Cryptojacking**|B0018.002|Consume system resources to mine for cryptocurrency (e.g., Bitcoin, Litecoin, etc.).|
 |**Password Cracking**|B0018.001|Consume system resources for the purpose of password cracking.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)|
 |Adylkuzz|May 2017|Consumes system resources to mine for cryptocurrency. [[2]](#2)|
 |[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[3]](#3)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="2">[2]</a> https://blog.trendmicro.com/trendlabs-security-intelligence/wannacry-uiwix-ransomware-monero-mining-malware-follow-suit/
@@ -34,15 +34,15 @@ Spamming
 ========
 Malware may use a victim machine to create and send spam. 

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|July 2019|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
 |[**Gamut**](../xample-malware/gamut.md)|2014|If port 25 is open, the bot uses a spam template and email list to send spam. [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://techcrunch.com/2019/07/12/trickbot-spam-millions-emails/

 <a name="2">[2]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
@@ -30,19 +30,19 @@ Supply Chain Compromise
 =======================
 The supply chain may be compromised to enable initial malware infection. MBC objectives don't encompass initial infection, but the malware-related methods are listed below supplement the information available defined in ATT&CK and allow for lateral movement: **Supply Chain Compromise ([T1195](https://attack.mitre.org/techniques/T1195/), [T1474](https://attack.mitre.org/techniques/T1474/))**.  

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Abuse Enterprise Certificates**|E1195.m01|Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see *Exploit Private APIs* below).|
 |**Exploit Private APIs**|E1195.m02|Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.|

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**YiSpecter**](../xample-malware/yispecter.md)|October 2015|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)|

-References
----------
+## References
+
 <a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
@@ -30,8 +30,8 @@ DNS Communication
 =================
 The DNS Communication micro-behavior focuses on DNS communication. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**DDNS Domain Connect**|C0011.003|Connects to dynamic DNS domain.|
@@ -30,8 +30,8 @@ FTP Communication
 =================
 The FTP Communication micro-behavior focuses on FTP communication. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Send File**|C0004.001|Send FTP file.|
@@ -32,8 +32,8 @@ This micro-behavior is related to HTTP communication.

 Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Server**|C0002.001|General HTTP server behavior.|
@@ -30,8 +30,8 @@ ICMP Communication
 ==================
 This micro-behavior is related to ICMP communication. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Echo Request**|C0014.002|Send ICMP echo request.|
@@ -30,8 +30,8 @@ Interprocess Communication
 ==========================
 The Interprocess Communication micro-behavior focuses on interprocess communication. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Connect Pipe**|C0003.002||
@@ -30,8 +30,8 @@ SMTP Communication
 ==================
 This micro-behavior focuses on SMTP communication. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Request**|C0012.002|Makes SMTP request.|
@@ -32,8 +32,8 @@ This micro-behavior focuses on socket (TCP, UDP) communication.

 Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Set Socket Config**|C0001.001|Configure socket.|
@@ -55,13 +55,13 @@ Methods
 |**UDP Client**|C0001.013|UDP client behavior.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router  [[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://www.mandiant.com/resources/synful-knock-acis
@@ -32,8 +32,8 @@ The Windows Internet (WinINet) application programming interface (API) is used b

 The methods below are those of most interest in malware analysis. Details can be found at [[1]](#1). 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**InternetConnect**|C0005.001|Opens an FTP or HTTP session for a given site.|
@@ -42,6 +42,6 @@ Methods
 |**InternetReadFile**|C0005.004|Reads data from an open Internet file (URL data).|
 |**InternetWriteFile**|C0005.005|Writes data to an open Internet file.|

-References
----------
+## References
+
 <a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions
@@ -30,8 +30,8 @@ Crypto Library
 ==============
 Malware uses a crypto library.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**API Call**|C0059.001|Malware uses crypto API calls.|
@@ -30,8 +30,8 @@ Cryptographic Hash
 ==================
 Malware may use a cryptographic hash. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**MD5**|C0029.001|Malware uses an MD5 hash.|
@@ -30,8 +30,8 @@ Encryption Key
 ==============
 Malware may import, generate, or otherwise use an encryption key. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Import Public Key**|C0028.001|Malware imports a public key.|
@@ -30,8 +30,8 @@ Generate Pseudo-random Sequence
 ===============================
 The Generate Pseudo-random Sequence microbehavior can be used for a number of purposes. The methods below include specific functions, as well as pseudorandom number generators (PRNG).

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**GetTickCount**|C0021.001|Malware generates a pseudo-random sequence using GetTickCount.|
@@ -30,8 +30,8 @@ Checksum
 ========
 Malware may derive a checksum from some block of data. The checksum is often used for data validation.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Adler**|C0032.005|Malware computes an Adler checksum.|
@@ -30,8 +30,8 @@ Compress Data
 =============
 Malware may compress data.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**IEncodingFilterFactory**|C0024.002|Malware compresses data using IEncodingFilterFactory.|
@@ -30,8 +30,8 @@ Decode Data
 ===========
 Malware may decode data.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Base64**|C0053.001|Malware may decode data using Base64.|
@@ -30,8 +30,8 @@ Decompress Data
 ===============
 Malware may decompress data.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**aPLib**|C0025.003|Malware decompresses data using aPLib.|
@@ -30,8 +30,8 @@ Encode Data
 ===========
 Malware may encode data.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Base64**|C0026.001|Malware may encode data using Base64.|
@@ -30,8 +30,8 @@ Non-Cryptographic Hash
 ======================
 Malware may use a non-cryptographic hash. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**dhash**|C0030.004|Malware uses the dhash hash function.|
@@ -30,8 +30,8 @@ Alter File Extension
 ====================
 Malware alters a file extension. This could be done for many reasons, including to hide the file or as part of a ransomware's encryption process. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Append Extension**|C0015.001|A new extension is appended.|
@@ -30,8 +30,8 @@ Create File
 ===========
 Malware creates a file. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Create Office Document**|C0016.001|An Office document is created.|
@@ -30,8 +30,8 @@ Install Driver
 ==============
 Malware installs a driver or minifilter.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Minifilter**|C0037.001|Malware registers a minifilter.|
@@ -30,8 +30,8 @@ Load Driver
 ===========
 Malware loads a device driver or minifilter.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Minifilter**|C0023.001|Malware starts a minifilter.|
@@ -30,8 +30,8 @@ Simulate Hardware
 =================
 Malware simulates hardware.

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Ctrl-Alt-Del**|C0057.001|Malware simulates Ctrl-Alt-Del.|
@@ -30,23 +30,23 @@ Change Memory Protection
 ========================
 Malware may change memory protection. For example, read-write memory may be changed to read-execute. Changing memory protection may exploits (e.g., bypass Data Execution Prevention).

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Executable Heap**|C0008.002|The heap is made executable.|
 |**Executable Stack**|C0008.001|The stack is made executable.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Ursnif**](../../xample-malware/ursnif.md)|2016|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion  [[1]](#1)|
 |[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|Modifies the translation lookaside buffer (TLB) Read/Write attributes  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html

 <a name="2">[2]</a> https://www.mandiant.com/resources/synful-knock-acis
@@ -31,13 +31,13 @@ Overflow Buffer
 Malware may overflow the buffer for various purposes.


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Conficker**](../../xample-malware/conficker.md)|2008|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer  [[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://en.wikipedia.org/wiki/Conficker
@@ -30,8 +30,8 @@ Environment Variable
 ====================
 Malware modifies environment variables. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Set Variable**|C0034.001|Malware sets an environment variable.|
@@ -30,8 +30,8 @@ Registry
 ========
 Malware modifies the registry. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Create Registry Key**|C0036.004|Malware creates a registry key.|
@@ -30,13 +30,13 @@ Check Mutex
 ===========
 Malware checks a mutex. 

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists [[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
@@ -30,15 +30,15 @@ Create Mutex
 ============
 Malware creates a mutex. 

-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy has a default process mutex, but can be altered at build time [2] [[1]](#1)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Creates global mutexes signal that rootkit installation has occurred successfully  [[2]](#2)|

-References
----------
+## References
+
 <a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
@@ -30,8 +30,8 @@ Create Process
 ==============
 Malware creates a process. 

-Methods
-------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Create Process via Shellcode**|C0017.001|Malware uses shellcode to create a process.|
@@ -39,13 +39,13 @@ Methods
 |**Create Suspended Process**|C0017.003|Malware created a suspended process.|


-Malware Examples
----------------
+## Use in Malware
+
 |Name|Date|Description|
 |---|---|---|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share  [[1]](#1)|


-References
----------
+## References
+
 <a name="1">[1]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
--- a/Show More
+++ b/Show More