From 9c69facf0fac220253bbdcec79a52b8e31fefe6b Mon Sep 17 00:00:00 2001 From: ryan Date: Thu, 10 Nov 2022 12:02:12 -0500 Subject: [PATCH] Changed Markdown headers to atx-style --- anti-behavioral-analysis/README.md | 4 ++-- anti-behavioral-analysis/capture-evasion.md | 4 ++-- anti-behavioral-analysis/debugger-detection.md | 12 ++++++------ anti-behavioral-analysis/debugger-evasion.md | 12 ++++++------ .../dynamic-analysis-evasion.md | 12 ++++++------ anti-behavioral-analysis/emulator-detection.md | 15 +++++++++------ anti-behavioral-analysis/emulator-evasion.md | 8 ++++---- anti-behavioral-analysis/memory-dump-evasion.md | 1 + anti-behavioral-analysis/sandbox-detection.md | 2 +- .../virtual-machine-detection.md | 6 ++++++ anti-static-analysis/README.md | 4 ++-- .../call-graph-generation-evasion.md | 8 ++++---- .../data-flow-analysis-evasion.md | 8 ++++---- anti-static-analysis/disassembler-evasion.md | 8 ++++---- .../executable-code-optimization.md | 8 ++++---- .../executable-code-virtualization.md | 12 ++++++------ anti-static-analysis/software-packing.md | 12 ++++++------ collection/cryptocurrency.md | 4 ++-- collection/input-capture.md | 12 ++++++------ collection/keylogging.md | 12 ++++++------ collection/screen-capture.md | 12 ++++++------ command-and-control/README.md | 8 ++++---- command-and-control/domain-name-generation.md | 8 ++++---- command-and-control/ingress-tool-transfer.md | 8 ++++---- .../alternative-installation-location.md | 8 ++++---- defense-evasion/bootkit.md | 8 ++++---- .../bypass-data-execution-prevention.md | 8 ++++---- defense-evasion/covert-location.md | 4 ++-- .../disable-or-evade-security-tools.md | 12 ++++++------ defense-evasion/hidden-files-and-directories.md | 12 ++++++------ defense-evasion/hide-artifacts.md | 12 ++++++------ defense-evasion/hijack-execution-flow.md | 12 ++++++------ defense-evasion/indicator-blocking.md | 12 ++++++------ ...install-insecure-or-malicious-configuration.md | 8 ++++---- defense-evasion/modify-registry.md | 8 ++++---- .../obfuscated-files-or-information.md | 12 ++++++------ defense-evasion/polymorphic-code.md | 8 ++++---- defense-evasion/process-injection.md | 8 ++++---- defense-evasion/rootkit.md | 8 ++++---- defense-evasion/self-deletion.md | 12 ++++++------ discovery/analysis-tool-discovery.md | 12 ++++++------ discovery/application-window-discovery.md | 4 ++-- discovery/code-discovery.md | 4 ++-- discovery/file-and-directory-discovery.md | 12 ++++++------ discovery/system-information-discovery.md | 12 ++++++------ execution/command-and-scripting-interpreter.md | 8 ++++---- execution/conditional-execution.md | 12 ++++++------ execution/exploitation-for-client-execution.md | 12 ++++++------ execution/install-additional-program.md | 8 ++++---- execution/prevent-concurrent-execution.md | 8 ++++---- execution/remote-commands.md | 12 ++++++------ execution/send-email.md | 8 ++++---- execution/send-poisoned-text-message.md | 8 ++++---- execution/system-services.md | 8 ++++---- execution/user-execution.md | 8 ++++---- exfiltration/archive-collected-data.md | 12 ++++++------ exfiltration/automated-exfiltration.md | 4 ++-- impact/data-destruction.md | 12 ++++++------ impact/data-encrypted-for-impact.md | 12 ++++++------ impact/denial-of-service.md | 8 ++++---- impact/destroy-hardware.md | 8 ++++---- impact/disk-wipe.md | 8 ++++---- impact/exploit-kit.md | 8 ++++---- impact/generate-traffic-from-victim.md | 12 ++++++------ impact/manipulate-network-traffic.md | 8 ++++---- impact/modify-hardware.md | 4 ++-- impact/remote-access.md | 12 ++++++------ impact/resource-hijacking.md | 12 ++++++------ impact/spamming.md | 8 ++++---- lateral-movement/supply-chain-compromise.md | 12 ++++++------ .../communication/dns-communication.md | 4 ++-- .../communication/ftp-communication.md | 4 ++-- .../communication/http-communication.md | 4 ++-- .../communication/icmp-communication.md | 4 ++-- .../communication/interprocess-communication.md | 4 ++-- .../communication/smtp-communication.md | 4 ++-- .../communication/socket-communication.md | 12 ++++++------ micro-behaviors/communication/wininet.md | 8 ++++---- micro-behaviors/cryptography/crypto-lib.md | 4 ++-- .../cryptography/cryptographic-hash.md | 4 ++-- micro-behaviors/cryptography/encryption-key.md | 4 ++-- .../generate-pseudorandom-sequence.md | 4 ++-- micro-behaviors/data/checksum.md | 4 ++-- micro-behaviors/data/compress-data.md | 4 ++-- micro-behaviors/data/decode-data.md | 4 ++-- micro-behaviors/data/decompress-data.md | 4 ++-- micro-behaviors/data/encode-data.md | 4 ++-- micro-behaviors/data/noncryptographic-hash.md | 4 ++-- .../file-system/alter-file-extension.md | 4 ++-- micro-behaviors/file-system/create-file.md | 4 ++-- micro-behaviors/hardware/install-driver.md | 4 ++-- micro-behaviors/hardware/load-driver.md | 4 ++-- micro-behaviors/hardware/simulate-hardware.md | 4 ++-- .../memory/change-memory-protection.md | 12 ++++++------ micro-behaviors/memory/overflow-buffer.md | 8 ++++---- .../operating-system/environment-variable.md | 4 ++-- micro-behaviors/operating-system/registry.md | 4 ++-- micro-behaviors/process/check-mutex.md | 8 ++++---- micro-behaviors/process/create-mutex.md | 8 ++++---- micro-behaviors/process/create-process.md | 12 ++++++------ micro-behaviors/process/synchronization.md | 4 ++-- persistence/component-firmware.md | 12 ++++++------ persistence/kernel-modules-and-extensions.md | 4 ++-- persistence/malicious-network-driver.md | 8 ++++---- persistence/modify-existing-service.md | 8 ++++---- persistence/registry-run-keys-startup-folder.md | 8 ++++---- persistence/shutdown-event.md | 4 ++-- privilege-escalation/install-certificate.md | 8 ++++---- xample-malware/bagle.md | 4 ++-- xample-malware/blackenergy.md | 4 ++-- xample-malware/conficker.md | 4 ++-- xample-malware/cryptolocker.md | 4 ++-- xample-malware/cryptowall.md | 4 ++-- xample-malware/dark-comet.md | 4 ++-- xample-malware/dnschanger.md | 4 ++-- xample-malware/emotet.md | 4 ++-- xample-malware/gamut.md | 4 ++-- xample-malware/geneio.md | 4 ++-- xample-malware/gobotkr.md | 4 ++-- xample-malware/gravity-rat.md | 4 ++-- xample-malware/heriplor.md | 4 ++-- xample-malware/hupigon.md | 4 ++-- xample-malware/kovter.md | 4 ++-- xample-malware/kraken.md | 4 ++-- xample-malware/locky-bart.md | 4 ++-- xample-malware/mazarbot.md | 4 ++-- xample-malware/mebromi.md | 4 ++-- xample-malware/poison-ivy.md | 4 ++-- xample-malware/rebhip.md | 4 ++-- xample-malware/rombertik.md | 4 ++-- xample-malware/samsam.md | 4 ++-- xample-malware/searchawesome.md | 4 ++-- xample-malware/shamoon.md | 4 ++-- xample-malware/stuxnet.md | 4 ++-- xample-malware/synful-knock.md | 4 ++-- xample-malware/terminator.md | 4 ++-- xample-malware/trickbot.md | 3 +-- xample-malware/up007.md | 4 ++-- xample-malware/ursnif.md | 4 ++-- xample-malware/webcobra.md | 4 ++-- xample-malware/yispecter.md | 4 ++-- yfaq/README.md | 4 ++-- 142 files changed, 494 insertions(+), 485 deletions(-) diff --git a/anti-behavioral-analysis/README.md b/anti-behavioral-analysis/README.md index b98a903..d5ee36b 100644 --- a/anti-behavioral-analysis/README.md +++ b/anti-behavioral-analysis/README.md @@ -29,8 +29,8 @@ Behaviors that prevent, obstruct, or evade behavioral analysis of malware--for e * **Software Packing** [F0001](../anti-static-analysis/software-packing.md) * **Virtual Machine Detection** [B0009](../anti-behavioral-analysis/virtual-machine-detection.md) -References ----------- +## References + [1] Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map [2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking diff --git a/anti-behavioral-analysis/capture-evasion.md b/anti-behavioral-analysis/capture-evasion.md index 8618b30..9c32568 100644 --- a/anti-behavioral-analysis/capture-evasion.md +++ b/anti-behavioral-analysis/capture-evasion.md @@ -34,8 +34,8 @@ Capture Evasion =============== Malware has characteristics enabling it to evade capture from the infected system. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Encrypted Payloads**|B0036.002|Decryption key is stored external to the executable or never touches the disk.| diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index a48dd71..543890e 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -36,8 +36,8 @@ Malware detects whether it's being executed inside a debugger. If so, conditiona Details on methods of detecting debuggers are given in the references; many are listed below. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**API Hook Detection**|B0001.001|Module bounds based [[7]](#7).| @@ -78,8 +78,8 @@ Methods |**UnhandledExceptionFilter**|B0001.030|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.| |**WudfIsAnyDebuggerPresent**|B0001.031|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Redhip**](../xample-malware/rebhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)| @@ -88,8 +88,8 @@ Malware Examples |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy Variant checks for breakpoints and exits immediately if found [[10]](#10)| -References ----------- +## References + [1] Alexander Antukh, "Anti-debugging Techniques Cheat Sheet," 19 January 2015. http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet. [2] Joshua Cannell, Malwarebytes Labs, "Five Anti-Analysis Tricks that sometimes Fool Analysts," 31 March 2016. https://blog.malwarebytes.com/threat-analysis/2014/09/five-anti-debugging-tricks-that-sometimes-fool-analysts. diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index 3b8d021..42b4e1f 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -38,8 +38,8 @@ A thorough reference for anti-debugging, both detection and evasion, is given in The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T1622/))** ATT&CK technique was defined subsequent to this MBC behavior. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Block Interrupts**|B0002.001|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.| @@ -73,16 +73,16 @@ Methods |**Thread Timeout**|B0002.029|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.| |**Use Interrupts**|B0002.030|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)| |**Dridex**|March 2015|[[3]](#3)| |[**Redhip**](../xample-malware/rebhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)| -References ----------- +## References + [1] https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf [2] https://www.synack.com/2016/02/17/analyzing-the-anti-analysis-logic-of-an-adware-installer/ diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md index 88085e5..60f8f6e 100644 --- a/anti-behavioral-analysis/dynamic-analysis-evasion.md +++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md @@ -38,8 +38,8 @@ See **Emulator Evasion ([B0004](../anti-behavioral-analysis/emulator-evasion.md) The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Alternative ntdll.dll**|B0003.001|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.| @@ -56,8 +56,8 @@ Methods |**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Ursnif**](../xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)| @@ -69,8 +69,8 @@ Malware Examples |[**TrickBot**](../xample-malware/trickbot.md)|2016|Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [[6]](#6)| -References ----------- +## References + [1] http://joe4security.blogspot.com/2013/06/overloading-sandboxes-new-generic.html [2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif diff --git a/anti-behavioral-analysis/emulator-detection.md b/anti-behavioral-analysis/emulator-detection.md index 0836854..75f1d04 100644 --- a/anti-behavioral-analysis/emulator-detection.md +++ b/anti-behavioral-analysis/emulator-detection.md @@ -34,8 +34,8 @@ Emulator Detection ================== Detects whether the malware instance is being executed inside an emulator. If so, conditional execution selects a benign execution path. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Check Emulator-related Registry Keys**|B0004.003|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)| @@ -43,16 +43,19 @@ Methods |**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.| |**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.| +## Detection +|Tool: capa|Mapping|APIs| +|---|---|---| +|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress| +## Use in Malware -Malware Examples ----------------- |Name|Date|Description| |---|---|---| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution [[2]](#2)| -References ----------- +## References + [1] https://search.unprotect.it/map/sandbox-evasion/ [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/anti-behavioral-analysis/emulator-evasion.md b/anti-behavioral-analysis/emulator-evasion.md index 9e62787..0baaf27 100644 --- a/anti-behavioral-analysis/emulator-evasion.md +++ b/anti-behavioral-analysis/emulator-evasion.md @@ -30,8 +30,8 @@ Emulator Evasion ================ Behaviors that obstruct analysis in an emulator. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Different Opcode Sets**|B0005.001|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.| @@ -39,8 +39,8 @@ Methods |**Undocumented Opcodes**|B0005.002|Use rare or undocumented opcodes to block non-exhaustive emulators.| |**Unusual/Undocumented API Calls**|B0005.003|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**WebCobra**](../xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)| diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md index ffc018a..0b004b9 100644 --- a/anti-behavioral-analysis/memory-dump-evasion.md +++ b/anti-behavioral-analysis/memory-dump-evasion.md @@ -50,6 +50,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor |**Patch MmGetPhysicalMemoryRanges**|[B0006.011](#b0006011)|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)| ## Use in Malware + |Name|Date|Description| |---|---|---| |[Kraken](../xample-malware/kraken.md)|April 2008|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)| diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index 75b3895..d6a09d2 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -66,7 +66,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |Tool: capa|Mapping|APIs| |---|---|---| -|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)](./b0007.005.md)|CreateFile| +|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|[Sandbox Detection::Product Key/ID Testing (B0007.005)|CreateFile| |[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle| |Tool: CAPE|Mapping|APIs| diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index c4b87cf..fe48300 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -90,6 +90,12 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |[**Emotet**](../xample-malware/emotet.md)|2018|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[7]](#7)| +## Detection + +|Tool: capa|Mapping|APIs| +|---|---|---| +|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress| + ## Code Snippets diff --git a/anti-static-analysis/README.md b/anti-static-analysis/README.md index 0acd1ef..627cc15 100644 --- a/anti-static-analysis/README.md +++ b/anti-static-analysis/README.md @@ -25,8 +25,8 @@ Behaviors and code characteristics that prevent or hinder static analysis of the * **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscated-files-or-information.md) * **Software Packing** [F0001](../anti-static-analysis/software-packing.md) -References ----------- +## References + [1] Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map/sandbox-evasion/ [2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking diff --git a/anti-static-analysis/call-graph-generation-evasion.md b/anti-static-analysis/call-graph-generation-evasion.md index 15eff6d..d633735 100644 --- a/anti-static-analysis/call-graph-generation-evasion.md +++ b/anti-static-analysis/call-graph-generation-evasion.md @@ -34,15 +34,15 @@ Call Graph Generation Evasion ============================= Malware code evades accurate call graph generation during disassembly. Call graphs are used by malware similarity tools and algorithms ([[1]](#1), [[4]](#4)), as well as for malware detection [[2]](#2). -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)| |**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[3]](#3)| -References ----------- +## References + [1] K. Blokhin, D. Mentis, J. Saxe, "Malware Similarity Identification Using Call Graph Based System Call Subsequence Features," 2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, July 2013. https://www.researchgate.net/publication/269326967_Malware_Similarity_Identification_Using_Call_Graph_Based_System_Call_Subsequence_Features [2] P. Deshpande, M. Stamp, "Metamorphic Malware Detection Using Function Call Graph Analysis," MIS Review Vol. 21, Nos. 1/2, September(2015)/March(2016). https://pdfs.semanticscholar.org/8db2/69106ea6e1f59e4dac0889665dd3336ee9b1.pdf diff --git a/anti-static-analysis/data-flow-analysis-evasion.md b/anti-static-analysis/data-flow-analysis-evasion.md index 3a4abba..eab316d 100644 --- a/anti-static-analysis/data-flow-analysis-evasion.md +++ b/anti-static-analysis/data-flow-analysis-evasion.md @@ -34,14 +34,14 @@ Data Flow Analysis Evasion ========================== Malware code evades data flow analysis (also known as information flow analysis and taint-tracking). -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Control Dependence**|B0045.001|Data is propagated via an if-then-else clause instead of direct assignment.[[1]](#1)| |**Implicit Flows**|B0045.002|Data is propagated via semantic relationships, for example one variable not changing its state could imply the state of another variable.[[1]](#1)| |**Arbitrary Memory Corruption**|B0045.003|Data is propagated by corrupting memory, for example overwriting a region of stack space where a file pointer is held.[[1]](#1)| -References ----------- +## References + [1] http://www.seclab.cs.sunysb.edu/seclab/pubs/antitaint.pdf diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index 9c2ee43..07041ae 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -34,8 +34,8 @@ Disassembler Evasion ==================== Malware code evades disassembly in a recursive or linear disassembler. Some methods apply to both types of disassemblers; others apply to one type and not the other. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.| @@ -44,8 +44,8 @@ Methods |**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.| |**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.| -References ----------- +## References + [1] http://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf [2] http://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf diff --git a/anti-static-analysis/executable-code-optimization.md b/anti-static-analysis/executable-code-optimization.md index 01594d0..df5d89b 100644 --- a/anti-static-analysis/executable-code-optimization.md +++ b/anti-static-analysis/executable-code-optimization.md @@ -34,13 +34,13 @@ Executable Code Optimization ============================ Code is optimized, making it harder to statically analyze. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Jump/Call Absolute Address**|B0034.001|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.| |**Minification**|B0034.002|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.| -References ----------- +## References + [1] https://en.wikipedia.org/wiki/Minification_(programming) diff --git a/anti-static-analysis/executable-code-virtualization.md b/anti-static-analysis/executable-code-virtualization.md index 26a43d7..be40e2c 100644 --- a/anti-static-analysis/executable-code-virtualization.md +++ b/anti-static-analysis/executable-code-virtualization.md @@ -36,20 +36,20 @@ Original executable code is virtualized by translating the code into a special f Virtualized code is a software protection technique. Themida is a commercial tool; VMProtect is an open source tool. [[1]](#1) -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Multiple VMs**|B0008.001|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Locky Bart**](../xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)| -References ----------- +## References + [1] https://github.com/xiaoweime/WProtect [2] https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/ diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index 7bc1142..60ede24 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -35,8 +35,8 @@ This code characteristic - Software Packing - can make static and behavioral ana This description refines the ATT&CK **Obfuscated Files or Information: Software Packing ([T1027.002](https://attack.mitre.org/techniques/T1027/002/), [T1406.002](https://attack.mitre.org/techniques/T1406/002/))** techniques. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Armadillo**|F0001.012|Uses Armadillo.| @@ -53,8 +53,8 @@ Methods |**UPX**|F0001.008|Uses UPX packer.| |**VMProtect**|F0001.010|Uses VMProtect.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Redhip**](../xample-malware/rebhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)| @@ -64,8 +64,8 @@ Malware Examples |[**TrickBot**](../xample-malware/trickbot.md)|2016|Has a custom packer to obfuscate itself [[7]](#7)| |[**Emotet**](../xample-malware/emotet.md)|2018|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads [[8]](#8)| -References ----------- +## References + [1] Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf [2] Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771. diff --git a/collection/cryptocurrency.md b/collection/cryptocurrency.md index f2f6a6c..93f16c7 100644 --- a/collection/cryptocurrency.md +++ b/collection/cryptocurrency.md @@ -30,8 +30,8 @@ Cryptocurrency ============== Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Bitcoin**|B0028.001|Access Bitcoin data.| diff --git a/collection/input-capture.md b/collection/input-capture.md index ace8a4e..821c8e5 100644 --- a/collection/input-capture.md +++ b/collection/input-capture.md @@ -32,14 +32,14 @@ Malware captures user input. See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [T1417](https://attack.mitre.org/techniques/T1417/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Mouse Events**|E1056.m01|Mouse events are captured.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Rombertik**](../xample-malware/rombertik.md)|2015|The malware injects itself into a browser and captures user input data [[1]](#1)| @@ -47,8 +47,8 @@ Malware Examples |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can capture audio and video [[3]](#3)| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Can capture audio and video [[4]](#4)| -References ----------- +## References + [1] https://blogs.cisco.com/security/talos/rombertik [2] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279 diff --git a/collection/keylogging.md b/collection/keylogging.md index c62e752..59ddd9c 100644 --- a/collection/keylogging.md +++ b/collection/keylogging.md @@ -32,16 +32,16 @@ Malware captures user keyboard input. See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/techniques/T1056/001), [T1417.001](https://attack.mitre.org/techniques/T1417/001/))** -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Application Hook**|F0002.001|Keystrokes are captured with an application hook.| |**Polling**|F0002.002|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Hupigon**](../xample-malware/hupigon.md)|2013|Certain variants of the malware may have keylogging functionality [[1]](#1)| @@ -50,8 +50,8 @@ Malware Examples |[**DarkComet**](../xample-malware/dark-comet.md)|2008|DarkComet can capture keystrokes [[4]](#4)| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Can capture keystrokes [[5]](#5)| -References ----------- +## References + [1] https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml [2] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/ diff --git a/collection/screen-capture.md b/collection/screen-capture.md index 88b28a1..98356d6 100644 --- a/collection/screen-capture.md +++ b/collection/screen-capture.md @@ -32,23 +32,23 @@ Malware takes screen captures of the desktop. See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**WinAPI**|E1113.m01|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR is capable of capturing screenshots. [[1]](#1)| |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|Screenshot plugin allows for collection of screenshots [[2]](#2)| |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can take screenshots of victim's computer [[3]](#3)| -References ----------- +## References + [1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ [2] https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/ diff --git a/command-and-control/README.md b/command-and-control/README.md index 9006415..5352430 100644 --- a/command-and-control/README.md +++ b/command-and-control/README.md @@ -20,13 +20,13 @@ Behaviors that enable malware to communicate with systems such as C2 servers or * **Ingress Tool Transfer** [E1105](../command-and-control/ingress-tool-transfer.md) -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../command-and-control/README.md)|2016| new email addresses are collected automatically from the victim's address books [[1]](#1)| -References ----------- +## References + [1] https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/ diff --git a/command-and-control/domain-name-generation.md b/command-and-control/domain-name-generation.md index 244db7e..fff0b0a 100644 --- a/command-and-control/domain-name-generation.md +++ b/command-and-control/domain-name-generation.md @@ -32,8 +32,8 @@ Malware generates the domain name of the controller to which it connects. Access The related **Dynamic Resolution: Domain Generation Algorithms ([T1568.002](https://attack.mitre.org/techniques/T1568/002/))** ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Kraken**](../xample-malware/kraken.md)|April 2008|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)| @@ -41,8 +41,8 @@ Malware Examples |[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|The malware sends a hash value generated from system information [[4]](#4| |[**Ursnif**](../xample-malware/ursnif.md)|2016|Ursnif has used a Domain name generation algorithm in the past [[5]](#5)| -References ----------- +## References + [1] https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/ [2] http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html diff --git a/command-and-control/ingress-tool-transfer.md b/command-and-control/ingress-tool-transfer.md index c1c3bc6..77d4911 100644 --- a/command-and-control/ingress-tool-transfer.md +++ b/command-and-control/ingress-tool-transfer.md @@ -34,8 +34,8 @@ Note that this behavior is separate from possible execution (installation) of th See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques/T1105/))**. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| @@ -45,8 +45,8 @@ Malware Examples |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can download files from remote repository upon instruction [[4]](#4)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|Creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory [[5]](#5)| -References ----------- +## References + [1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy [2] https://www.secureworks.com/research/cryptolocker-ransomware diff --git a/defense-evasion/alternative-installation-location.md b/defense-evasion/alternative-installation-location.md index f9fa502..5b9fb04 100644 --- a/defense-evasion/alternative-installation-location.md +++ b/defense-evasion/alternative-installation-location.md @@ -37,15 +37,15 @@ Methods |**Fileless Malware**|B0027.001|Stores itself in memory.| |**Registry Install**|B0027.002|Stores itself in the Windows registry.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Kovter**](../xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)| |[**SYNfulKnock**](../xample-malware/synful-knock.md)|2015|100 memory-resident modules can be installed [[2]](#2)| -References ----------- +## References + [1] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan [2] https://www.mandiant.com/resources/synful-knock-acis diff --git a/defense-evasion/bootkit.md b/defense-evasion/bootkit.md index 0f18dcb..32cb277 100644 --- a/defense-evasion/bootkit.md +++ b/defense-evasion/bootkit.md @@ -32,15 +32,15 @@ The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect. (As of 2020, ATT&CK also associates the technique with Persistence.) -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Mebromi**](../xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware [[2]](#24)| -References ----------- +## References + [1] https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/ [2] https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf diff --git a/defense-evasion/bypass-data-execution-prevention.md b/defense-evasion/bypass-data-execution-prevention.md index 794081b..b599713 100644 --- a/defense-evasion/bypass-data-execution-prevention.md +++ b/defense-evasion/bypass-data-execution-prevention.md @@ -36,14 +36,14 @@ Methods |---|---|---| |**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|TrickBot has come with a signed downloader component [[2]](#2)| -References ----------- +## References + [1] https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce [2] https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware diff --git a/defense-evasion/covert-location.md b/defense-evasion/covert-location.md index 131117f..d49032b 100644 --- a/defense-evasion/covert-location.md +++ b/defense-evasion/covert-location.md @@ -30,8 +30,8 @@ Covert Location =============== Malware may hide data or binary files within other files, the registry, etc. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Hide Data in Registry**|B0040.001|Malware may use a registry key to store a long sequence of bytes.| diff --git a/defense-evasion/disable-or-evade-security-tools.md b/defense-evasion/disable-or-evade-security-tools.md index ccf2101..5c90094 100644 --- a/defense-evasion/disable-or-evade-security-tools.md +++ b/defense-evasion/disable-or-evade-security-tools.md @@ -34,8 +34,8 @@ Malware-related methods extending ATT&CK's definition are below. See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://attack.mitre.org/techniques/T1562/001), [T1629.003](https://attack.mitre.org/techniques/T1629/003/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).| @@ -48,16 +48,16 @@ Methods |**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.| |**Disable Code Integrity**|F0004.009|Malware disables Code Integrity driver.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**WebCobra**](../xample-malware/webcobra.md)|2018|Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| |[**DNSChanger**](../xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)| -References ----------- +## References + [1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html diff --git a/defense-evasion/hidden-files-and-directories.md b/defense-evasion/hidden-files-and-directories.md index 1e194ab..dba0a70 100644 --- a/defense-evasion/hidden-files-and-directories.md +++ b/defense-evasion/hidden-files-and-directories.md @@ -32,8 +32,8 @@ Malware may hide files and folders to avoid detection and/or to persist on the s See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://attack.mitre.org/techniques/T1564/001/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Attribute**|F0005.003|Malware may change or choose an attribute to hide a file or directory.| @@ -42,15 +42,15 @@ Methods |**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|Modifies target files' time to August 2012 as an antiforensic trick [[2]](#2)| -References ----------- +## References + [1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ [2] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/ diff --git a/defense-evasion/hide-artifacts.md b/defense-evasion/hide-artifacts.md index 40b3140..b339a33 100644 --- a/defense-evasion/hide-artifacts.md +++ b/defense-evasion/hide-artifacts.md @@ -32,8 +32,8 @@ Malware may hide artifacts to evade detection and/or to persist on the system. S See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/), [T1628](https://attack.mitre.org/techniques/T1628/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Hidden Userspace Libraries**|E1564.m01|Hides userspace libraries used by the malware instance. Technique refers to hiding libraries loaded in memory (not disk). For example, a userspace library may be injected into a system process such that memory scanning tools may be prevented from finding them. This technique is different than DLL injection, in which the DLL will continue to show up in process metadata that tracks what is stored in memory. This technique involves clearing that metadata or making it inaccessible to security and inspection tools.| @@ -43,15 +43,15 @@ Methods |**Hidden Services**|E1564.m04|Hides any system services that the malware instance creates or injects itself into. Services can be hidden by hiding associated registry keys.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**YiSpecter**](../xample-malware/yispecter.md)|2015|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removalbe drives [[2]](#2)| -References ----------- +## References + [1] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index cd9e6e1..56fa706 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -42,8 +42,8 @@ For hooking related to memory dump evasion, see **Memory Dump Evasion ([B0006](. See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques/T1574), [T1625](https://attack.mitre.org/techniques/T1625))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Abuse Windows Function Calls**|F0015.006|Malware abuses native Windows function calls to transfer execution to shellcode that it loads into memory. A pointer to the callback function is used to supply the memory address of the shellcode. Functions that can be abused include EnumResourceTypesA and EnumUILanguagesW. [[4]](#4)| @@ -54,8 +54,8 @@ Methods |**Shadow System Service Dispatch Table Hooking**|F0015.004|The Shadow System Service Dispatch Table (SSDT) can be hooked similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).[[3]](#3)| |**System Service Dispatch Table Hooking**|F0015.005|Malware (e.g. rootkit, malicious drivers) may hook the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.[[3]](#3)| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[6]](#6)| @@ -66,8 +66,8 @@ Malware Examples |[**Shamoon**](../xample-malware/shamoon.md)|2012|Escalates privilege by impersonating the token. First uses LogonUser and ImpersonateLoggedOnUser, then ImpersonateNamedPipeClient. [[10]](#10)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[11]](#11)| -References ----------- +## References + [1] https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf [2] https://www.oreilly.com/library/view/learning-malware-analysis/9781788392501/a0a506d6-d062-48c1-a0a8-57d6acb77785.xhtml diff --git a/defense-evasion/indicator-blocking.md b/defense-evasion/indicator-blocking.md index 11a5b8e..04ce62f 100644 --- a/defense-evasion/indicator-blocking.md +++ b/defense-evasion/indicator-blocking.md @@ -32,15 +32,15 @@ Malware blocks indicators or events that would indicate malicious activity. Meth See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mitre.org/techniques/T1562/006/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Remove SMS Warning Messages**|F0006.001|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|Clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system [[1]](#1)| @@ -48,8 +48,8 @@ Malware Examples |[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can disable security center functions like anti-virus and firewall [[3]](#3)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV) [[4]](#4)| -References ----------- +## References + [1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf [2] https://en.wikipedia.org/wiki/Conficker diff --git a/defense-evasion/install-insecure-or-malicious-configuration.md b/defense-evasion/install-insecure-or-malicious-configuration.md index a4460b5..ee4b15c 100644 --- a/defense-evasion/install-insecure-or-malicious-configuration.md +++ b/defense-evasion/install-insecure-or-malicious-configuration.md @@ -30,12 +30,12 @@ Install Insecure or Malicious Configuration =========================================== Malware may install malicious configuration settings or may modify existing configuration settings. For example, malware may change configuration settings associated with security mechanisms to make it difficult to detect or change configuration settings to maintain a foothold on the network. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Black Energy**](../xample-malware/blackenergy.md)|2007|Configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component [[1]](#1)| -References ----------- +## References + [1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md index 3ee68c8..c50ad9c 100644 --- a/defense-evasion/modify-registry.md +++ b/defense-evasion/modify-registry.md @@ -33,8 +33,8 @@ Malware may make changes to the Windows Registry to hide execution or to persist See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112/))**. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| @@ -45,8 +45,8 @@ Malware Examples |[**Kovter**](../xample-malware/kovter.md)|2016|The malware modifies the registry during execution [[5]](#5)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|Disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy [[6]](#6)| -References ----------- +## References + [1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md index 5edaafc..9ac89d9 100644 --- a/defense-evasion/obfuscated-files-or-information.md +++ b/defense-evasion/obfuscated-files-or-information.md @@ -42,8 +42,8 @@ See ATT&CK: **Obfuscated Files or Information ([T1027](https://attack.mitre.org/ Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.| @@ -56,8 +56,8 @@ Methods |**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| @@ -66,8 +66,8 @@ Malware Examples |[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)| |[**Kovter**](../xample-malware/kovter.md)|2016|The malware will use a key to decrypt text from a URL to create more malicious code [[2]](#2)| -References ----------- +## References + [1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ [2] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan diff --git a/defense-evasion/polymorphic-code.md b/defense-evasion/polymorphic-code.md index 096236d..ab63289 100644 --- a/defense-evasion/polymorphic-code.md +++ b/defense-evasion/polymorphic-code.md @@ -30,14 +30,14 @@ Polymorphic Code ================ Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic Code behavior is typically identified through analysis of related samples. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Call Indirections**|B0029.002|[[1]](#1)| |**Code Reordering**|B0029.003|[[1]](#1)| |**Packer Stub**|B0029.001|A packer stub can generate polymorphic code.| -References ----------- +## References + [1] https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index 0bf2327..d786911 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -53,8 +53,8 @@ Methods |**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)| |**Patch Process Command Line**|E1055.m04|Malware patches the PEB of a process to spoof the arguments.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**UP007**](../xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)| @@ -66,8 +66,8 @@ Malware Examples |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|Bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution [[8]](#8)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet injects the entire DLL into another process and then just calls the particular export [[9]](#9)| -References ----------- +## References + [1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process [2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy diff --git a/defense-evasion/rootkit.md b/defense-evasion/rootkit.md index 4c9b015..9bfb819 100644 --- a/defense-evasion/rootkit.md +++ b/defense-evasion/rootkit.md @@ -46,8 +46,8 @@ Methods |**Kernel Mode Rootkit**|E1014.m16|Rootkit operates by adding or replacing code in OS, device drivers, loadable kernel modules (LKM). Related to ATT&CK: [Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006/)| |**Memory Rootkit**|E1014.m17|A memory rootkit hids in RAM. Behaviors may include methods to prevent memory access. The lifespan of a memory rootkit is short because it disappears after a system reboot.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)| @@ -61,8 +61,8 @@ Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Rootkits can also be detected via memory dump analysis or virtual machine introspection. -References ----------- +## References + [1] https://en.wikipedia.org/wiki/Rootkit [2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index f048586..db9e15d 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -35,20 +35,20 @@ Malware may uninstall itself to avoid detection. See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630.001](https://attack.mitre.org/techniques/T1630/001/)), Indicator Removal on Host: File Deletion ([T1070.004](https://attack.mitre.org/techniques/T1070/004/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**COMSPEC Environment Variable**|F0007.001|Uninstalls self via COMSPEC environment variable.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Terminator**](../xample-malware/terminator.md)|2013|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)| -References ----------- +## References + [1] https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes diff --git a/discovery/analysis-tool-discovery.md b/discovery/analysis-tool-discovery.md index 4324db2..55e56d0 100644 --- a/discovery/analysis-tool-discovery.md +++ b/discovery/analysis-tool-discovery.md @@ -32,8 +32,8 @@ Malware can employ various means to detect whether analysis tools are present or This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](../anti-behavioral-analysis) objective. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Known File Location**|B0013.008|Malware may detect an analysis tool by the presence of a file in a known location.| @@ -47,15 +47,15 @@ Methods |**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.| |**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Emotet**](../xample-malware/emotet.md)|2018|If it recieves a response from the c2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits [[1]](#1)| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one fo the analysis tools is running. [[2]](#2)| -References ----------- +## References + [1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1 [2] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf diff --git a/discovery/application-window-discovery.md b/discovery/application-window-discovery.md index 87569bd..6f4e58f 100644 --- a/discovery/application-window-discovery.md +++ b/discovery/application-window-discovery.md @@ -30,8 +30,8 @@ Application Window Discovery ============================ Malware may attempt to get a listing of open application windows. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.| \ No newline at end of file diff --git a/discovery/code-discovery.md b/discovery/code-discovery.md index 9e7d0c8..bcc91db 100644 --- a/discovery/code-discovery.md +++ b/discovery/code-discovery.md @@ -30,8 +30,8 @@ Code Discovery ============== Malware may inspect code or enumerate aspects. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Enumerate PE Sections**|B0046.001|Malware enumerates virtual offsets of code sections.| diff --git a/discovery/file-and-directory-discovery.md b/discovery/file-and-directory-discovery.md index 7adbfb3..aa39759 100644 --- a/discovery/file-and-directory-discovery.md +++ b/discovery/file-and-directory-discovery.md @@ -30,23 +30,23 @@ File and Directory Discovery ============================ Malware may enumerate files and directories or may search for specific files or in specific locations. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Log File**|E1083.m01|Malware may look for system log files.| |**Filter by Extension**|E1083.m02|Malware may filter by extension (common in ransomware).| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**CryptoWall**](../xample-malware/cryptowall.md)|2014| [[1]](#1)| |[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|The malware searches for user files before encrypting them [[2]](#2)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Collects local files with specified file extensions and information from the victim's machine [[3]](#3)| -References ----------- +## References + [1] https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/ [2] https://www.secureworks.com/research/cryptolocker-ransomware diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md index 0e67ae3..aa59c42 100644 --- a/discovery/system-information-discovery.md +++ b/discovery/system-information-discovery.md @@ -32,14 +32,14 @@ Malware may attempt to get detailed information about the system. See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/techniques/T1082/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| @@ -50,8 +50,8 @@ Malware Examples |[**Emotet**](../xample-malware/emotet.md)|2018|Collects information related to OS, processes, and sometimes mail client information and sends it to c2 [[4]](#4)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself [[5]](#5)| -References ----------- +## References + [1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_URSNIF.A2?_ga=2.131425807.1462021705.1559742358-1202584019.1549394279 [2] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md index 1af15d0..a2cf5ba 100644 --- a/execution/command-and-scripting-interpreter.md +++ b/execution/command-and-scripting-interpreter.md @@ -32,8 +32,8 @@ Malware may abuse command and script interpreters to execute commands, scripts, See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))**. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)| @@ -44,8 +44,8 @@ Malware Examples |[**Shamoon**](../xample-malware/shamoon.md)|2012|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion [[5]](#5)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell [[6]](#6)| -References ----------- +## References + [1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/execution/conditional-execution.md b/execution/conditional-execution.md index fed3b1a..f36bb64 100644 --- a/execution/conditional-execution.md +++ b/execution/conditional-execution.md @@ -38,8 +38,8 @@ This behavior is related to the **Dynamic Analysis Evasion ([B0003](../anti-beha Some aspects of this Conditional Execution behavior are related to the [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480) ATT&CK technique; however the ATT&CK technique is not focused on anti-behavioral analysis behaviors. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.| @@ -51,8 +51,8 @@ Methods |**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).| |**Token Check**|B0025.006|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)| @@ -60,8 +60,8 @@ Malware Examples |[**Ursnif**](../xample-malware/ursnif.md)|2016|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.) [1] [[3]](#3)| |[**Mebromi**](../xample-malware/mebromi.md)|2011|Malware only proceeds if it detects the BIOS ROM is Award BIOS [[4]](#4)| -References ----------- +## References + [1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md index 2debf06..4bb0fa9 100644 --- a/execution/exploitation-for-client-execution.md +++ b/execution/exploitation-for-client-execution.md @@ -36,8 +36,8 @@ Software is exploited - either because of a vulnerability or through its designe See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.org/techniques/T1203))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**File Transfer Protocol (FTP) Servers**|E1203.m03|Malware leverages an FTP server.| @@ -47,12 +47,12 @@ Methods |**Sysinternals**|E1203.m05|Sysinternals tools are used for additional command line functionality.| |**Windows Utilities**|E1203.m06|One or more Windows utilities are used.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**SamSam**](../xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)| -References ----------- +## References + [1] https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/ diff --git a/execution/install-additional-program.md b/execution/install-additional-program.md index f597201..e00d577 100644 --- a/execution/install-additional-program.md +++ b/execution/install-additional-program.md @@ -32,8 +32,8 @@ Installs another, different program on the system. The additional program can be Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the **Ingress Tool Transfer ([E1105](../command-and-control/ingress-tool-transfer.md))** behavior. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**WebCobra**](../xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)| @@ -44,8 +44,8 @@ Malware Examples |[**YiSpecter**](../xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.| |[**UP007**](../xample-malware/up007.md)|2016|The malware is a dropper that creates multiple files [[4]](#4)| -References ----------- +## References + [1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://www.fortinet.com/blog/threat-research/deep-analysis-of-driver-based-mitm-malware-itranslator.html diff --git a/execution/prevent-concurrent-execution.md b/execution/prevent-concurrent-execution.md index bcae0c9..f531ab4 100644 --- a/execution/prevent-concurrent-execution.md +++ b/execution/prevent-concurrent-execution.md @@ -30,12 +30,12 @@ Prevent Concurrent Execution ============================ To avoid running multiple instances of itself, malware may check a system to see if it is already running. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Bagle**](../xample-malware/bagle.md)|2004|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)| -References ----------- +## References + [1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_bagle.u diff --git a/execution/remote-commands.md b/execution/remote-commands.md index ecc0166..dc25ef0 100644 --- a/execution/remote-commands.md +++ b/execution/remote-commands.md @@ -38,8 +38,8 @@ It may be useful to capture remote commands along with related behaviors because Autonomous behaviors - those done by the malware without an active attacker - should not be captured with *Execution:Remote Commands*. For example, malware that *automatically* destroys data would be tagged with the **Impact: Data Destruction ([E1485](../impact/data-destruction.md))** behavior. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Delete File**|B0011.001|| @@ -51,16 +51,16 @@ Methods |**Upload File**|B0011.007|| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Ursnif**](../xample-malware/ursnif.md)|2016|Commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, upload a log file which contains stolen information [[1]](#1)| |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|infected bots receive commands from botmaster to load plugins associated with botmaster's goals [[2]](#2)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Receives various commands from c2 server. [[3]](#3)| -References ----------- +## References + [1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279 [2] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf diff --git a/execution/send-email.md b/execution/send-email.md index 46cc08f..ce0c255 100644 --- a/execution/send-email.md +++ b/execution/send-email.md @@ -32,8 +32,8 @@ Sends an email message from the system on which the malware is executing to one This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/techniques/T1566/))** ATT&CK technique defined under ATT&CK's Initial Access tactic. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Gamut**](../xample-malware/gamut.md)|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)| @@ -41,8 +41,8 @@ Malware Examples |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| |[**Emotet**](../xample-malware/emotet.md)|2018|spam email with the Emotet loader is sent automatically [[3]](#3)| -References ----------- +## References + [1] https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/ [2] https://en.wikipedia.org/wiki/Bagle_(computer_worm) diff --git a/execution/send-poisoned-text-message.md b/execution/send-poisoned-text-message.md index 52805c0..d040cd4 100644 --- a/execution/send-poisoned-text-message.md +++ b/execution/send-poisoned-text-message.md @@ -30,14 +30,14 @@ Send Poisoned Text Message ========================== A malicious attachment is sent via spam SMS or MMS messages. When the user clicks the link, malware is installed. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**MazarBot**](../xample-malware/mazarbot.md)||MazarBot is delivered via a poisoned SMS message. [[1]](#1)| -References ----------- +## References + [1] https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html [2] https://www.player.one/new-android-sms-malware-can-completely-own-your-phone-just-one-text-how-avoid-mazar-512363 diff --git a/execution/system-services.md b/execution/system-services.md index 342dbd4..8c8d6a2 100644 --- a/execution/system-services.md +++ b/execution/system-services.md @@ -32,13 +32,13 @@ Malware may abuse system services or daemons to execute. See ATT&CK: **System Services ([T1569](https://attack.mitre.org/techniques/T1569/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**MSDTC**|E1569.m01|The Distributed Transaction Coordinator (MSDTC) coordinates transaction across multiple resource managers (databases, message queues and file systems). This legitimate Microsoft service is part of Windows 2000 and later and can be used to import and load DLLs. Malware may abuse MSDTC to import and load DLLs.[[1]](#1)| -References ----------- +## References + [1] https://support.resolver.com/hc/en-ca/articles/207161116-Configure-Microsoft-Distributed-Transaction-Coordinator-MSDTC- \ No newline at end of file diff --git a/execution/user-execution.md b/execution/user-execution.md index 1c0679d..0de2b43 100644 --- a/execution/user-execution.md +++ b/execution/user-execution.md @@ -32,8 +32,8 @@ Malware may include code that relies on specific actions by a user to execute. N See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniques/T1204/))**. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| @@ -41,8 +41,8 @@ Malware Examples |[**Rombertik**](../xample-malware/rombertik.md)|2015|The malware relies on a victim to execute itself [[2]](#2)| |[**Terminator**](../xample-malware/terminator.md)|2013|The malware relies on user interaction to execute [[3]](#3)| -References ----------- +## References + [1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ [2] https://blogs.cisco.com/security/talos/rombertik diff --git a/exfiltration/archive-collected-data.md b/exfiltration/archive-collected-data.md index 9811012..2c919a6 100644 --- a/exfiltration/archive-collected-data.md +++ b/exfiltration/archive-collected-data.md @@ -32,8 +32,8 @@ Malware may obfuscate data via encryption or encoding before exfiltration. See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org/techniques/T1560/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Encoding**|E1560.m01|Data is encoded.| @@ -44,16 +44,16 @@ Methods |**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt [[1]](#1)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers [[2]](#2)| -References ----------- +## References + [1] https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/ [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/exfiltration/automated-exfiltration.md b/exfiltration/automated-exfiltration.md index 4d62c33..6b38c94 100644 --- a/exfiltration/automated-exfiltration.md +++ b/exfiltration/automated-exfiltration.md @@ -32,8 +32,8 @@ Malware may exfiltrate data via automated processing or scripting. See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org/techniques/T1020/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Exfiltrate via File Hosting Service**|E1020.m01|Malware may exfiltrate files to a file hosting location.| diff --git a/impact/data-destruction.md b/impact/data-destruction.md index 47bfaf1..226c099 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -36,16 +36,16 @@ Data, system files, or other files are destroyed. Individual files are selected, See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T1485/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Delete Application/Software**|E1485.m03|An application or software is deleted.| |**Delete Shadow Copies**|E1485.m04|Deletes shadow drive data, which is related to ransomware.| |**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Shamoon**](../xample-malware/shamoon.md)|2012|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)| @@ -54,8 +54,8 @@ Malware Examples |[**Conficker**](../xample-malware/conficker.md)|2008|resets system restore points and deletes backup files [[4]](#4)| |[**MazarBot**](../xample-malware/mazarbot.md)|2016|Can erase phone data [[5]](#5)| -References ----------- +## References + [1] http://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509 [2] https://blogs.cisco.com/security/talos/rombertik diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index 196363a..ec74e75 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -36,14 +36,14 @@ Malware may encrypt files stored on the system to prevent user access until a ra See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techniques/T1486/))** and **Data Encrypted for Impact (Mobile) ([T1471](https://attack.mitre.org/techniques/T1471/))** -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Ransom Note**|E1486.001|Ransomware displays a ransom note. Ransom notes are sometimes used to link instances of ransomware, even when the code or anti-analysis techniques change.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**CryptoWall**](../xample-malware/cryptowall.md)|2014|[[1]](#1)| @@ -51,8 +51,8 @@ Malware Examples |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|Encrypts files for ransom without any connection to the Internet.| |[**SamSam**](../xample-malware/samsam.md)|2015|Ransomware.| -References ----------- +## References + [1] http://www.secureworks.com/cyber-threat-intelligence/threats/cryptowall-ransomware/ [2] http://www.secureworks.com/cyber-threat-intelligence/threats/cryptolocker-ransomware/ diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index 2e6b158..0e3fb1d 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -38,15 +38,15 @@ Endpoint denial of service behaviors are captured by the **Endpoint Denial of Se The related **Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498/))** ATT&CK technique was defined subsequent to this MBC behavior. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**BlackEnergy**](../xample-malware/blackenergy.md)|October 2007|Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)| |[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)| -References ----------- +## References + [1] http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/impact/destroy-hardware.md b/impact/destroy-hardware.md index ff07439..23fc255 100644 --- a/impact/destroy-hardware.md +++ b/impact/destroy-hardware.md @@ -34,12 +34,12 @@ Destroy Hardware ================ Destroys a physical piece of hardware. For example, malware may cause hardware to overheat. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)| -References ----------- +## References + [1] https://www.bbc.com/timelines/zc6fbk7 diff --git a/impact/disk-wipe.md b/impact/disk-wipe.md index e52f812..32ebcc6 100644 --- a/impact/disk-wipe.md +++ b/impact/disk-wipe.md @@ -35,13 +35,13 @@ Malware may erase the content of storage devices. This behavior is different tha This description refines the ATT&CK **Disk Wipe ([T1203](https://attack.mitre.org/techniques/T1561/)**] sub-technique. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Shamoon**](../xample-malware/shamoon.md)|2012|An overwrite component will overwrite the MBR so that the compromised computer can no longer start [[1]](#1)| -References ----------- +## References + [1] https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments diff --git a/impact/exploit-kit.md b/impact/exploit-kit.md index d144d35..8135e48 100644 --- a/impact/exploit-kit.md +++ b/impact/exploit-kit.md @@ -36,12 +36,12 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver See related ATT&CK Technique: **Exploit Public-Facing Application ([T1190](https://attack.mitre.org/techniques/T1190))**, which relates to Initial Access. Under the Impact objective, exploit behaviors are considered more broadly in MBC. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Ursnif**](../xample-malware/ursnif.md)||Ursnif is sometimes delivered via exploit kit. [[1]](#1)| -References ----------- +## References + [1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md index 4ca7f60..4c15957 100644 --- a/impact/generate-traffic-from-victim.md +++ b/impact/generate-traffic-from-victim.md @@ -34,22 +34,22 @@ Generate Traffic from Victim ======================================= Malware may generate traffic from the victim system such as clicks of advertising links that generate fraudulent ad revenue. The ATT&CK technique, **Generate Traffic from Victim ([T1643](https://attack.mitre.org/techniques/T1643/))**, is only associated with the mobile platform, but the behavior is applicable to other platforms as well. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Advertisement Replacement Fraud**|E1643.m02|Malware injects ad windows onto websites the user views. [[2]](#2)| |**Click Hijacking**|E1643.m01|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**DNSChanger**](../xample-malware/dnschanger.md)|November 2011|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)| |[**Kovter**](../xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)| -References ----------- +## References + [1] https://www.itworld.com/article/2734253/security/behind-the--massive--malware-ad-revenue-fraud-case.html [2] https://www.fipp.com/news/insightnews/what-are-the-nine-types-of-digital-ad-fraud diff --git a/impact/manipulate-network-traffic.md b/impact/manipulate-network-traffic.md index 9636d8b..de3e3cb 100644 --- a/impact/manipulate-network-traffic.md +++ b/impact/manipulate-network-traffic.md @@ -36,13 +36,13 @@ Malware intercepts and manipulates network traffic, typically accessing or modif The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](https://attack.mitre.org/techniques/T1565/002/))** ATT&CK sub-technique was defined subsequent to this MBC behavior. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|Intercepts encrypted web traffic to inject adds. [[1]](#1)| |[**MazarBot**](../xample-malware/mazarbot.md)|2016|Intercepts data coming into and going out of device.| -References ----------- +## References + [1] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ diff --git a/impact/modify-hardware.md b/impact/modify-hardware.md index c83cc4d..b3ff118 100644 --- a/impact/modify-hardware.md +++ b/impact/modify-hardware.md @@ -34,8 +34,8 @@ Modify Hardware =============== Malware modifies hardware. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**CDROM**|B0042.001|The CD-ROM is modified.| diff --git a/impact/remote-access.md b/impact/remote-access.md index 16ab72e..702cf30 100644 --- a/impact/remote-access.md +++ b/impact/remote-access.md @@ -38,22 +38,22 @@ A RAT (Remote Access Trojan) is an example of malware that provides a degree of Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques/T1105/))** technique defined under the Command and Control tactic is no longer specific to "legitimate desktop support and remote access software” as it was under a previous version of ATT&CK. However, *Ingress Tool Transfer* relates only to files copied; this MBC behavior is broader, allowing for remote access behaviors beyond file transfers (i.e., *Impact:Remote Access* and *Command and Control: Ingress Tool Transfer* are not equivalent). -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Reverse Shell**|B0022.001|Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)| |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|Allows an attacker to control the system via a GUI.| |[**Hupigon**](../xample-malware/hupigon.md)|2013|The malware acts as a backdoor [[4]](#4)| -References ----------- +## References + [1] https://en.wikipedia.org/wiki/Remote_access_trojan [2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy diff --git a/impact/resource-hijacking.md b/impact/resource-hijacking.md index 7869483..21a67ef 100644 --- a/impact/resource-hijacking.md +++ b/impact/resource-hijacking.md @@ -36,23 +36,23 @@ Uses system resources for other purposes; as a result, the system may not be ava The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1496/))** ATT&CK technique was defined subsequent to this MBC behavior. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Cryptojacking**|B0018.002|Consume system resources to mine for cryptocurrency (e.g., Bitcoin, Litecoin, etc.).| |**Password Cracking**|B0018.001|Consume system resources for the purpose of password cracking.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)| |Adylkuzz|May 2017|Consumes system resources to mine for cryptocurrency. [[2]](#2)| |[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[3]](#3)| -References ----------- +## References + [1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://blog.trendmicro.com/trendlabs-security-intelligence/wannacry-uiwix-ransomware-monero-mining-malware-follow-suit/ diff --git a/impact/spamming.md b/impact/spamming.md index 510e7d5..8d7ac63 100644 --- a/impact/spamming.md +++ b/impact/spamming.md @@ -34,15 +34,15 @@ Spamming ======== Malware may use a victim machine to create and send spam. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|July 2019|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)| |[**Gamut**](../xample-malware/gamut.md)|2014|If port 25 is open, the bot uses a spam template and email list to send spam. [[2]](#2)| -References ----------- +## References + [1] https://techcrunch.com/2019/07/12/trickbot-spam-millions-emails/ [2] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/ diff --git a/lateral-movement/supply-chain-compromise.md b/lateral-movement/supply-chain-compromise.md index e62fa9b..40e13c2 100644 --- a/lateral-movement/supply-chain-compromise.md +++ b/lateral-movement/supply-chain-compromise.md @@ -30,19 +30,19 @@ Supply Chain Compromise ======================= The supply chain may be compromised to enable initial malware infection. MBC objectives don't encompass initial infection, but the malware-related methods are listed below supplement the information available defined in ATT&CK and allow for lateral movement: **Supply Chain Compromise ([T1195](https://attack.mitre.org/techniques/T1195/), [T1474](https://attack.mitre.org/techniques/T1474/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Abuse Enterprise Certificates**|E1195.m01|Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see *Exploit Private APIs* below).| |**Exploit Private APIs**|E1195.m02|Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**YiSpecter**](../xample-malware/yispecter.md)|October 2015|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)| -References ----------- +## References + [1] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/micro-behaviors/communication/dns-communication.md b/micro-behaviors/communication/dns-communication.md index ed81b4d..18e937f 100644 --- a/micro-behaviors/communication/dns-communication.md +++ b/micro-behaviors/communication/dns-communication.md @@ -30,8 +30,8 @@ DNS Communication ================= The DNS Communication micro-behavior focuses on DNS communication. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**DDNS Domain Connect**|C0011.003|Connects to dynamic DNS domain.| diff --git a/micro-behaviors/communication/ftp-communication.md b/micro-behaviors/communication/ftp-communication.md index 70ff90d..8ff23c9 100644 --- a/micro-behaviors/communication/ftp-communication.md +++ b/micro-behaviors/communication/ftp-communication.md @@ -30,8 +30,8 @@ FTP Communication ================= The FTP Communication micro-behavior focuses on FTP communication. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Send File**|C0004.001|Send FTP file.| diff --git a/micro-behaviors/communication/http-communication.md b/micro-behaviors/communication/http-communication.md index cb28e31..f9895b1 100644 --- a/micro-behaviors/communication/http-communication.md +++ b/micro-behaviors/communication/http-communication.md @@ -32,8 +32,8 @@ This micro-behavior is related to HTTP communication. Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Server**|C0002.001|General HTTP server behavior.| diff --git a/micro-behaviors/communication/icmp-communication.md b/micro-behaviors/communication/icmp-communication.md index 6b48215..953bd40 100644 --- a/micro-behaviors/communication/icmp-communication.md +++ b/micro-behaviors/communication/icmp-communication.md @@ -30,8 +30,8 @@ ICMP Communication ================== This micro-behavior is related to ICMP communication. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Echo Request**|C0014.002|Send ICMP echo request.| diff --git a/micro-behaviors/communication/interprocess-communication.md b/micro-behaviors/communication/interprocess-communication.md index c705e11..6496f3b 100644 --- a/micro-behaviors/communication/interprocess-communication.md +++ b/micro-behaviors/communication/interprocess-communication.md @@ -30,8 +30,8 @@ Interprocess Communication ========================== The Interprocess Communication micro-behavior focuses on interprocess communication. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Connect Pipe**|C0003.002|| diff --git a/micro-behaviors/communication/smtp-communication.md b/micro-behaviors/communication/smtp-communication.md index 4b834fc..270e181 100644 --- a/micro-behaviors/communication/smtp-communication.md +++ b/micro-behaviors/communication/smtp-communication.md @@ -30,8 +30,8 @@ SMTP Communication ================== This micro-behavior focuses on SMTP communication. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Request**|C0012.002|Makes SMTP request.| diff --git a/micro-behaviors/communication/socket-communication.md b/micro-behaviors/communication/socket-communication.md index dabec22..74fc12e 100644 --- a/micro-behaviors/communication/socket-communication.md +++ b/micro-behaviors/communication/socket-communication.md @@ -32,8 +32,8 @@ This micro-behavior focuses on socket (TCP, UDP) communication. Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Set Socket Config**|C0001.001|Configure socket.| @@ -55,13 +55,13 @@ Methods |**UDP Client**|C0001.013|UDP client behavior.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)| -References ----------- +## References + [1] https://www.mandiant.com/resources/synful-knock-acis diff --git a/micro-behaviors/communication/wininet.md b/micro-behaviors/communication/wininet.md index ce36658..c41b8bb 100644 --- a/micro-behaviors/communication/wininet.md +++ b/micro-behaviors/communication/wininet.md @@ -32,8 +32,8 @@ The Windows Internet (WinINet) application programming interface (API) is used b The methods below are those of most interest in malware analysis. Details can be found at [[1]](#1). -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**InternetConnect**|C0005.001|Opens an FTP or HTTP session for a given site.| @@ -42,6 +42,6 @@ Methods |**InternetReadFile**|C0005.004|Reads data from an open Internet file (URL data).| |**InternetWriteFile**|C0005.005|Writes data to an open Internet file.| -References ----------- +## References + [1] https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions diff --git a/micro-behaviors/cryptography/crypto-lib.md b/micro-behaviors/cryptography/crypto-lib.md index f177449..0542ded 100644 --- a/micro-behaviors/cryptography/crypto-lib.md +++ b/micro-behaviors/cryptography/crypto-lib.md @@ -30,8 +30,8 @@ Crypto Library ============== Malware uses a crypto library. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**API Call**|C0059.001|Malware uses crypto API calls.| diff --git a/micro-behaviors/cryptography/cryptographic-hash.md b/micro-behaviors/cryptography/cryptographic-hash.md index cdf60de..faf2a17 100644 --- a/micro-behaviors/cryptography/cryptographic-hash.md +++ b/micro-behaviors/cryptography/cryptographic-hash.md @@ -30,8 +30,8 @@ Cryptographic Hash ================== Malware may use a cryptographic hash. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**MD5**|C0029.001|Malware uses an MD5 hash.| diff --git a/micro-behaviors/cryptography/encryption-key.md b/micro-behaviors/cryptography/encryption-key.md index 539186a..5d0ccd0 100644 --- a/micro-behaviors/cryptography/encryption-key.md +++ b/micro-behaviors/cryptography/encryption-key.md @@ -30,8 +30,8 @@ Encryption Key ============== Malware may import, generate, or otherwise use an encryption key. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Import Public Key**|C0028.001|Malware imports a public key.| diff --git a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md index 538debe..a0fcea7 100644 --- a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md +++ b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md @@ -30,8 +30,8 @@ Generate Pseudo-random Sequence =============================== The Generate Pseudo-random Sequence microbehavior can be used for a number of purposes. The methods below include specific functions, as well as pseudorandom number generators (PRNG). -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**GetTickCount**|C0021.001|Malware generates a pseudo-random sequence using GetTickCount.| diff --git a/micro-behaviors/data/checksum.md b/micro-behaviors/data/checksum.md index bacd8bb..190ded4 100644 --- a/micro-behaviors/data/checksum.md +++ b/micro-behaviors/data/checksum.md @@ -30,8 +30,8 @@ Checksum ======== Malware may derive a checksum from some block of data. The checksum is often used for data validation. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Adler**|C0032.005|Malware computes an Adler checksum.| diff --git a/micro-behaviors/data/compress-data.md b/micro-behaviors/data/compress-data.md index 192af58..419cdd7 100644 --- a/micro-behaviors/data/compress-data.md +++ b/micro-behaviors/data/compress-data.md @@ -30,8 +30,8 @@ Compress Data ============= Malware may compress data. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**IEncodingFilterFactory**|C0024.002|Malware compresses data using IEncodingFilterFactory.| diff --git a/micro-behaviors/data/decode-data.md b/micro-behaviors/data/decode-data.md index af0d431..2c75131 100644 --- a/micro-behaviors/data/decode-data.md +++ b/micro-behaviors/data/decode-data.md @@ -30,8 +30,8 @@ Decode Data =========== Malware may decode data. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Base64**|C0053.001|Malware may decode data using Base64.| diff --git a/micro-behaviors/data/decompress-data.md b/micro-behaviors/data/decompress-data.md index 057a123..62f639c 100644 --- a/micro-behaviors/data/decompress-data.md +++ b/micro-behaviors/data/decompress-data.md @@ -30,8 +30,8 @@ Decompress Data =============== Malware may decompress data. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**aPLib**|C0025.003|Malware decompresses data using aPLib.| diff --git a/micro-behaviors/data/encode-data.md b/micro-behaviors/data/encode-data.md index 332f9ba..6a2ea61 100644 --- a/micro-behaviors/data/encode-data.md +++ b/micro-behaviors/data/encode-data.md @@ -30,8 +30,8 @@ Encode Data =========== Malware may encode data. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Base64**|C0026.001|Malware may encode data using Base64.| diff --git a/micro-behaviors/data/noncryptographic-hash.md b/micro-behaviors/data/noncryptographic-hash.md index 872e0aa..bd588da 100644 --- a/micro-behaviors/data/noncryptographic-hash.md +++ b/micro-behaviors/data/noncryptographic-hash.md @@ -30,8 +30,8 @@ Non-Cryptographic Hash ====================== Malware may use a non-cryptographic hash. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**dhash**|C0030.004|Malware uses the dhash hash function.| diff --git a/micro-behaviors/file-system/alter-file-extension.md b/micro-behaviors/file-system/alter-file-extension.md index ef911dc..607eda3 100644 --- a/micro-behaviors/file-system/alter-file-extension.md +++ b/micro-behaviors/file-system/alter-file-extension.md @@ -30,8 +30,8 @@ Alter File Extension ==================== Malware alters a file extension. This could be done for many reasons, including to hide the file or as part of a ransomware's encryption process. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Append Extension**|C0015.001|A new extension is appended.| diff --git a/micro-behaviors/file-system/create-file.md b/micro-behaviors/file-system/create-file.md index 7d530be..d255ca6 100644 --- a/micro-behaviors/file-system/create-file.md +++ b/micro-behaviors/file-system/create-file.md @@ -30,8 +30,8 @@ Create File =========== Malware creates a file. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Create Office Document**|C0016.001|An Office document is created.| diff --git a/micro-behaviors/hardware/install-driver.md b/micro-behaviors/hardware/install-driver.md index b3d4dc1..19dc8d0 100644 --- a/micro-behaviors/hardware/install-driver.md +++ b/micro-behaviors/hardware/install-driver.md @@ -30,8 +30,8 @@ Install Driver ============== Malware installs a driver or minifilter. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Minifilter**|C0037.001|Malware registers a minifilter.| \ No newline at end of file diff --git a/micro-behaviors/hardware/load-driver.md b/micro-behaviors/hardware/load-driver.md index 748c3fa..eda92b6 100644 --- a/micro-behaviors/hardware/load-driver.md +++ b/micro-behaviors/hardware/load-driver.md @@ -30,8 +30,8 @@ Load Driver =========== Malware loads a device driver or minifilter. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Minifilter**|C0023.001|Malware starts a minifilter.| \ No newline at end of file diff --git a/micro-behaviors/hardware/simulate-hardware.md b/micro-behaviors/hardware/simulate-hardware.md index 0ee7a54..641a693 100644 --- a/micro-behaviors/hardware/simulate-hardware.md +++ b/micro-behaviors/hardware/simulate-hardware.md @@ -30,8 +30,8 @@ Simulate Hardware ================= Malware simulates hardware. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Ctrl-Alt-Del**|C0057.001|Malware simulates Ctrl-Alt-Del.| diff --git a/micro-behaviors/memory/change-memory-protection.md b/micro-behaviors/memory/change-memory-protection.md index 4644e28..6cbbe69 100644 --- a/micro-behaviors/memory/change-memory-protection.md +++ b/micro-behaviors/memory/change-memory-protection.md @@ -30,23 +30,23 @@ Change Memory Protection ======================== Malware may change memory protection. For example, read-write memory may be changed to read-execute. Changing memory protection may exploits (e.g., bypass Data Execution Prevention). -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Executable Heap**|C0008.002|The heap is made executable.| |**Executable Stack**|C0008.001|The stack is made executable.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Ursnif**](../../xample-malware/ursnif.md)|2016|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion [[1]](#1)| |[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[2]](#2)| -References ----------- +## References + [1] https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html [2] https://www.mandiant.com/resources/synful-knock-acis diff --git a/micro-behaviors/memory/overflow-buffer.md b/micro-behaviors/memory/overflow-buffer.md index 8e7ada6..2bd5f3e 100644 --- a/micro-behaviors/memory/overflow-buffer.md +++ b/micro-behaviors/memory/overflow-buffer.md @@ -31,13 +31,13 @@ Overflow Buffer Malware may overflow the buffer for various purposes. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Conficker**](../../xample-malware/conficker.md)|2008|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer [[1]](#1)| -References ----------- +## References + [1] https://en.wikipedia.org/wiki/Conficker diff --git a/micro-behaviors/operating-system/environment-variable.md b/micro-behaviors/operating-system/environment-variable.md index 9bede9f..74455dd 100644 --- a/micro-behaviors/operating-system/environment-variable.md +++ b/micro-behaviors/operating-system/environment-variable.md @@ -30,8 +30,8 @@ Environment Variable ==================== Malware modifies environment variables. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Set Variable**|C0034.001|Malware sets an environment variable.| diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md index a9a8f46..face7b4 100644 --- a/micro-behaviors/operating-system/registry.md +++ b/micro-behaviors/operating-system/registry.md @@ -30,8 +30,8 @@ Registry ======== Malware modifies the registry. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Create Registry Key**|C0036.004|Malware creates a registry key.| diff --git a/micro-behaviors/process/check-mutex.md b/micro-behaviors/process/check-mutex.md index 2a2612a..cf89b89 100644 --- a/micro-behaviors/process/check-mutex.md +++ b/micro-behaviors/process/check-mutex.md @@ -30,13 +30,13 @@ Check Mutex =========== Malware checks a mutex. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists [[1]](#1)| -References ----------- +## References + [1] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf diff --git a/micro-behaviors/process/create-mutex.md b/micro-behaviors/process/create-mutex.md index 5892257..70292ca 100644 --- a/micro-behaviors/process/create-mutex.md +++ b/micro-behaviors/process/create-mutex.md @@ -30,15 +30,15 @@ Create Mutex ============ Malware creates a mutex. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy has a default process mutex, but can be altered at build time [2] [[1]](#1)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Creates global mutexes signal that rootkit installation has occurred successfully [[2]](#2)| -References ----------- +## References + [1] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/micro-behaviors/process/create-process.md b/micro-behaviors/process/create-process.md index 50a1b23..5a42b5f 100644 --- a/micro-behaviors/process/create-process.md +++ b/micro-behaviors/process/create-process.md @@ -30,8 +30,8 @@ Create Process ============== Malware creates a process. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Create Process via Shellcode**|C0017.001|Malware uses shellcode to create a process.| @@ -39,13 +39,13 @@ Methods |**Create Suspended Process**|C0017.003|Malware created a suspended process.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share [[1]](#1)| -References ----------- +## References + [1] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/micro-behaviors/process/synchronization.md b/micro-behaviors/process/synchronization.md index 9326c05..e5a15c5 100644 --- a/micro-behaviors/process/synchronization.md +++ b/micro-behaviors/process/synchronization.md @@ -30,8 +30,8 @@ Synchronization =============== Malware enables two or more processes/threads to share a resource. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Create Mutex**|C0022.001|Malware creates a mutex to enable synchronization.| diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index 52b07e6..3be69b6 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -36,22 +36,22 @@ Malware may overwrite the flash memory of firmware outside of the main system fi See ATT&CK: **Pre-OS Boot: Component Firmware ([T1542.002](https://attack.mitre.org/techniques/T1542/002/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Router Firmware**|F0009.001|Cisco routers can have their firmware images modified in order to maliciously infect and persist on end-user machines in a network. This is accomplished by using default or acquired credentials to gain access to a router and to install a backdoor. The implant resides within a modified Cisco IOS image and, when loaded, maintains its persistence in the environment, even after a system reboot. However, any further modules loaded by the attacker will only exist in the router's volatile memory and will not be available for use after reboot. Known affected hardware includes Cisco routers 1841, 2811, and 3825.| -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[2]](#2)| |[**YiSpecter**](../xample-malware/yispecter.md)|2015|Displays brief advertisements whenever the user opens applications on their phone [[3]](#3)| |[**SYNfulKnock**](../xample-malware/synful-knock.md)|2015|Modification of the router's firmware image that can be used to maintain persistence within a victim's network [[4]](#4)| -References ----------- +## References + [1] https://www.scmagazine.com/home/opinions/are-synful-knock-style-router-attacks-set-to-become-the-new-normal/ [2] https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html diff --git a/persistence/kernel-modules-and-extensions.md b/persistence/kernel-modules-and-extensions.md index 4c75560..0e67ecc 100644 --- a/persistence/kernel-modules-and-extensions.md +++ b/persistence/kernel-modules-and-extensions.md @@ -32,8 +32,8 @@ Malware may use loadable kernel modules to persist on a system. For example, one See ATT&CK: **Boot or Logon Autostart Execution: Kernel Modules and Extensions ([T1547.006](https://attack.mitre.org/techniques/T1547/006/))**. -Methods -------- +## Methods + |Name|ID|Description| |---|---|---| |**Device Driver**|F0010.001|Allows kernel to access hardware connected to the system.| diff --git a/persistence/malicious-network-driver.md b/persistence/malicious-network-driver.md index 73ad665..f7e92d8 100644 --- a/persistence/malicious-network-driver.md +++ b/persistence/malicious-network-driver.md @@ -32,12 +32,12 @@ Malicious network drivers can be installed on several machines on a network via A malicious network driver can tunnel outside traffic into the network, allowing the attackers to access remote desktop sessions or to connect to servers inside the domain by using previously acquired credentials. Using the credentials, they can re-deploy the entire platform following a massive shutdown or power loss and as a result, the malware will persist on network-connected machines even after reboot: after the machine connects to the server, the malware repopulates itself on the server; this, in turn, (re)infects the remaining machines on the network. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |Malicious NDISProxy drivers|June 2018|The LuckyMouse APT (aka APT27) spreads Trojans via malicious NDISProxy drivers. [[1]](#1)| -References ----------- +## References + [1] https://www.zdnet.com/article/luckymouse-targets-govt-entities-through-malicious-ndisproxy-driver/ diff --git a/persistence/modify-existing-service.md b/persistence/modify-existing-service.md index 9e1c8a6..c9214c5 100644 --- a/persistence/modify-existing-service.md +++ b/persistence/modify-existing-service.md @@ -32,8 +32,8 @@ Malware may modify an existing service to gain persistence. Modification may inc See ATT&CK: **Create or Modify System Process::Windows Service ([T1543.003](https://attack.mitre.org/techniques/T1543/003/))**. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)| @@ -42,8 +42,8 @@ Malware Examples |[**Conficker**](../xample-malware/conficker.md)|2008|Copies itself into the $systemroot%\system32 directory and registers as a service [[4]](#4)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|Shamoon enables the RemoteRegistry service to allow remote registry modification [[5]](#5)| -References ----------- +## References + [1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy [2] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/persistence/registry-run-keys-startup-folder.md b/persistence/registry-run-keys-startup-folder.md index 363edb5..7915fdd 100644 --- a/persistence/registry-run-keys-startup-folder.md +++ b/persistence/registry-run-keys-startup-folder.md @@ -32,8 +32,8 @@ Malware may add an entry to the Windows Registry run keys or startup folder to e See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder ([T1547.001](https://attack.mitre.org/techniques/T1547/001/))**. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.| @@ -51,8 +51,8 @@ Malware Examples |[**Emotet**](../xample-malware/emotet.md)|2018|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence [[13]](#13)| |[**Bagle**](../xample-malware/bagle.md)|2004|Adds registry keys to enable its automatic execution at every system startup [[14]](#14)| -References ----------- +## References + [1] https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html [2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy diff --git a/persistence/shutdown-event.md b/persistence/shutdown-event.md index b21286f..44428e2 100644 --- a/persistence/shutdown-event.md +++ b/persistence/shutdown-event.md @@ -30,6 +30,6 @@ Shutdown Event ============== Malware can register the shutdown event triggered by WinLogon to allow a malicious DLL to execute every time the machine shuts down: when the machine is shutdown the malware will be loaded into memory; then it will download the primary malware and reinfect the machine. The malware will also lie dormant during incident reporting processes. To check whether malware has registered for login events, check the registry key: HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotify. If a subkey with any name exists and it has a "shutdown" value then the dll in the "DLLName" key will be launched during the shutdown process. [[1]](#1) -References ----------- +## References + [1] https://isc.sans.edu/diary/Wipe+the+drive!++Stealthy+Malware+Persistence+-+Part+4/15460 diff --git a/privilege-escalation/install-certificate.md b/privilege-escalation/install-certificate.md index 30593cc..c57e329 100644 --- a/privilege-escalation/install-certificate.md +++ b/privilege-escalation/install-certificate.md @@ -30,13 +30,13 @@ Install Certificate ============== Malware may install a certificate to gain access to https traffic. -Malware Examples ----------------- +## Use in Malware + |Name|Date|Description| |---|---|---| |[**SearchAwesome**](../xample-malware/searchawesome.md)|2015|The malware installs a certificate. [[1]](#1)| -References ----------- +## References + [1] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ \ No newline at end of file diff --git a/xample-malware/bagle.md b/xample-malware/bagle.md index 557a97c..3f41373 100644 --- a/xample-malware/bagle.md +++ b/xample-malware/bagle.md @@ -45,8 +45,8 @@ Indicators of Compromise SHA256 Hashes - a1b08bc8fd95d6f7415a9394bf76abed3e7860a5eda380cb863ab2d5fc6b65a5 -References ----------- +## References + [1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/WORM_BAGLE.U/ [2] https://en.wikipedia.org/wiki/Bagle_(computer_worm) [3] https://www.joesandbox.com/analysis/561298/0/html diff --git a/xample-malware/blackenergy.md b/xample-malware/blackenergy.md index 94bdd86..7e260ba 100644 --- a/xample-malware/blackenergy.md +++ b/xample-malware/blackenergy.md @@ -72,8 +72,8 @@ SHA256 Hashes - 01425582aa5001342b985270a365fd92d909be011384247e81872bff586fa142 -References ----------- +## References + [1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf [2] https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/ diff --git a/xample-malware/conficker.md b/xample-malware/conficker.md index 578902b..5fc9573 100644 --- a/xample-malware/conficker.md +++ b/xample-malware/conficker.md @@ -51,8 +51,8 @@ Indicators of Compromise SHA256 Hashes - 1192482f9f8f87a01977b4dd3e185d4b60319175b789b3e7a60ad6554c120a0d -References ----------- +## References + [1] https://en.wikipedia.org/wiki/Conficker [2] http://www.csl.sri.com/users/vinod/papers/Conficker/ diff --git a/xample-malware/cryptolocker.md b/xample-malware/cryptolocker.md index 0e92de6..1087f53 100644 --- a/xample-malware/cryptolocker.md +++ b/xample-malware/cryptolocker.md @@ -60,6 +60,6 @@ SHA256 Hashes - a2bc3059283d7cc7bc574ce32cb6b8bfd27e02ac3810a21bd3a9b84c17f18a72 - 0be1f445537f124b5175e1f2d1da87e2e57aa4ba09ea5fe72b7bafaf0b8f9ad2 -References ----------- +## References + [1] https://www.secureworks.com/research/cryptolocker-ransomware diff --git a/xample-malware/cryptowall.md b/xample-malware/cryptowall.md index fac670a..6d928ee 100644 --- a/xample-malware/cryptowall.md +++ b/xample-malware/cryptowall.md @@ -58,7 +58,7 @@ SHA256 Hashes - 03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66 - 7ed58ef4fd3dc4efaea9e595614553445afb055c0c675b692f12a5629251b040 -References ----------- +## References + [1] https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/ [2] https://www.secureworks.com/research/cryptowall-ransomware \ No newline at end of file diff --git a/xample-malware/dark-comet.md b/xample-malware/dark-comet.md index bb7d78a..6f6dc93 100644 --- a/xample-malware/dark-comet.md +++ b/xample-malware/dark-comet.md @@ -55,8 +55,8 @@ Indicators of Compromise SHA256 Hashes - 0369aa99d731d2de260bc63b6c4f85d997eb189155c362df478d8f5afaa655b0 -References ----------- +## References + [1] https://en.wikipedia.org/wiki/DarkComet [2] https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/ [3] https://bazaar.abuse.ch/browse/signature/DarkComet/ \ No newline at end of file diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index 817f373..a069f3c 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -39,7 +39,7 @@ Indicators of Compromise SHA256 Hashes - c2ef46a1b6292f28c0caf08013577e8559c4b0a71bf6fc058968061a3d71ede2 -References ----------- +## References + [1] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html [2] https://www.joesandbox.com/analysis/258032/0/html \ No newline at end of file diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index 2355a33..8204e42 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -52,8 +52,8 @@ Indicators of Compromise SHA256 Hashes - eea5a1c7b3cc8350f8d5a95b6e2b7e3701d22cb362f8b988e815789f95c32eca -References ----------- +## References + [1] https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ [2] https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md index bc8a205..eaf5eec 100644 --- a/xample-malware/gamut.md +++ b/xample-malware/gamut.md @@ -58,8 +58,8 @@ Indicators of Compromise SHA256 Hashes - a56162bc623841102301df8e5c918f27fe8c2a58ae049d81c838fcf256654932 -References ----------- +## References + [1] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/ [2] https://any.run/report/a56162bc623841102301df8e5c918f27fe8c2a58ae049d81c838fcf256654932/1a6f6db3-83d5-442e-8f0d-42cfab2e0d34 \ No newline at end of file diff --git a/xample-malware/geneio.md b/xample-malware/geneio.md index 156d3f1..1831716 100644 --- a/xample-malware/geneio.md +++ b/xample-malware/geneio.md @@ -61,8 +61,8 @@ Indicators of Compromise SHA256 Hashes - 56b1d33fde65ab520a6c8afe9b3f304c50b581d3e46a9baa56fb9694d4d7effc -References ----------- +## References + [1] https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/ [2] https://macpaw.com/how-to/remove-genieo-malware-mac diff --git a/xample-malware/gobotkr.md b/xample-malware/gobotkr.md index 4727ac7..8e87689 100644 --- a/xample-malware/gobotkr.md +++ b/xample-malware/gobotkr.md @@ -81,6 +81,6 @@ Indicators of Compromise SHA256 Hashes - 492e8ee240492768232b717a60a880f216fd936b6ed9f5b6f67fe83db3bbc7d4 -References ----------- +## References + [1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/xample-malware/gravity-rat.md b/xample-malware/gravity-rat.md index d5a0451..d81797e 100644 --- a/xample-malware/gravity-rat.md +++ b/xample-malware/gravity-rat.md @@ -55,8 +55,8 @@ SHA256 Hashes - c39270febb9097def21777c994d10738ba2a915c88f516fb1e896e5d7240cc0d - 71264d9c67800d3bedc6facb6915e855f7531c12445af58f47167e81c735c892 -References ----------- +## References + [1] https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/ [2] https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html diff --git a/xample-malware/heriplor.md b/xample-malware/heriplor.md index d1fc797..dcf2058 100644 --- a/xample-malware/heriplor.md +++ b/xample-malware/heriplor.md @@ -39,8 +39,8 @@ Indicators of Compromise SHA256 Hashes - 1b17ce735512f3104557afe3becacd05ac802b2af79dab5bb1a7ac8d10dccffd -References ----------- +## References + [1] https://insights.sei.cmu.edu/blog/api-hashing-tool-imagine-that/ [2] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_heriplor.a diff --git a/xample-malware/hupigon.md b/xample-malware/hupigon.md index 81be10c..7696e80 100644 --- a/xample-malware/hupigon.md +++ b/xample-malware/hupigon.md @@ -56,8 +56,8 @@ Indicators of Compromise SHA256 Hashes - 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db -References ----------- +## References + [1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HUPIGON [2] https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml diff --git a/xample-malware/kovter.md b/xample-malware/kovter.md index 7769d8b..cb6079b 100644 --- a/xample-malware/kovter.md +++ b/xample-malware/kovter.md @@ -60,8 +60,8 @@ SHA256 Hashes - 15c237f6b74af2588b07912bf18e2734594251787871c9638104e4bf5de46589 - bffe7ccbcf69e7c787ff10d1dc7dbf6044bffcb13b95d851f4a735917b3a6fdf -References ----------- +## References + [1] https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ [2] https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem. diff --git a/xample-malware/kraken.md b/xample-malware/kraken.md index 2892f6e..a06f1a9 100644 --- a/xample-malware/kraken.md +++ b/xample-malware/kraken.md @@ -46,6 +46,6 @@ Indicators of Compromise SHA256 Hashes - 466892a38785c1a499140d208a101f908e7c9589f126b87e9e20d8c916555306 -References ----------- +## References + [1] http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html diff --git a/xample-malware/locky-bart.md b/xample-malware/locky-bart.md index 97e21e0..f37c135 100644 --- a/xample-malware/locky-bart.md +++ b/xample-malware/locky-bart.md @@ -52,6 +52,6 @@ Indicators of Compromise SHA256 Hashes - c285e376201e2941154ec1a9acd8658cd5e0ea975c694a3fe3e9a9897efc2680 -References ----------- +## References + [1] https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/ diff --git a/xample-malware/mazarbot.md b/xample-malware/mazarbot.md index 827f5bb..7569778 100644 --- a/xample-malware/mazarbot.md +++ b/xample-malware/mazarbot.md @@ -51,8 +51,8 @@ Indicators of Compromise SHA256 Hashes - 0432a460b1af4a31c0b0ab12106886ff9e5fd1b7a109c1a9e5ab29b4fafd6719 -References ----------- +## References + [1] https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html [2] https://www.player.one/new-android-sms-malware-can-completely-own-your-phone-just-one-text-how-avoid-mazar-512363 diff --git a/xample-malware/mebromi.md b/xample-malware/mebromi.md index 5fac568..aab3beb 100644 --- a/xample-malware/mebromi.md +++ b/xample-malware/mebromi.md @@ -52,6 +52,6 @@ Indicators of Compromise SHA256 Hashes - 4968ae59a46b60c290cf5db8b3d6749df06ceb4be668009a609e1139fe91a9ee -References ----------- +## References + [1] https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/ diff --git a/xample-malware/poison-ivy.md b/xample-malware/poison-ivy.md index b25c432..6d080b0 100644 --- a/xample-malware/poison-ivy.md +++ b/xample-malware/poison-ivy.md @@ -61,8 +61,8 @@ SHA256 Hashes - 84d90250568f26328394ac2941fe7be266d43b71309caf40eb8863b38a39a506 - 4d43c64d776a52ac5a0831aa879305c0eabb452ac5131e1b381598ad7e83cc77 -References ----------- +## References + [1] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy [2] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf diff --git a/xample-malware/rebhip.md b/xample-malware/rebhip.md index d3e3e92..9c1cce3 100644 --- a/xample-malware/rebhip.md +++ b/xample-malware/rebhip.md @@ -48,6 +48,6 @@ Indicators of Compromise SHA256 Hashes - 07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365 -References ----------- +## References + [1] https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html diff --git a/xample-malware/rombertik.md b/xample-malware/rombertik.md index 6298dac..2c5c084 100644 --- a/xample-malware/rombertik.md +++ b/xample-malware/rombertik.md @@ -69,6 +69,6 @@ SHA256 Hashes Command-and-Control Servers - www.centozos[.]org[.]in -References ----------- +## References + [1] https://blogs.cisco.com/security/talos/rombertik diff --git a/xample-malware/samsam.md b/xample-malware/samsam.md index 7b486d8..3bc8445 100644 --- a/xample-malware/samsam.md +++ b/xample-malware/samsam.md @@ -65,8 +65,8 @@ Tor Onion Service - jcmi5n4c3mvgtyt5.onion -References ----------- +## References + [1] https://www.cisa.gov/uscert/ncas/alerts/AA18-337A [2] https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index 3896ea1..1bed199 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -66,6 +66,6 @@ SHA256 Hashes - Unavailable -References ----------- +## References + [1] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ diff --git a/xample-malware/shamoon.md b/xample-malware/shamoon.md index 49e9720..29656f3 100644 --- a/xample-malware/shamoon.md +++ b/xample-malware/shamoon.md @@ -50,8 +50,8 @@ Indicators of Compromise SHA256 Hashes - c617120895646f73bc880c0aca18990deda3db9be03f6b3564013e26dedfa3f9 -References ----------- +## References + [1] https://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow [2] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/ diff --git a/xample-malware/stuxnet.md b/xample-malware/stuxnet.md index d80298f..edb4105 100644 --- a/xample-malware/stuxnet.md +++ b/xample-malware/stuxnet.md @@ -61,6 +61,6 @@ Indicators of Compromise SHA256 Hashes - 1e7d6cb0b1c29bf2caeb6983da647eb253d4764415ae8dfc493a75053dffe85f -References ----------- +## References + [1] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/xample-malware/synful-knock.md b/xample-malware/synful-knock.md index 1cbf6c7..b92a300 100644 --- a/xample-malware/synful-knock.md +++ b/xample-malware/synful-knock.md @@ -48,6 +48,6 @@ Indicators of Compromise SHA256 Hashes - Unavailable -References ----------- +## References + [1] https://www.mandiant.com/resources/synful-knock-acis diff --git a/xample-malware/terminator.md b/xample-malware/terminator.md index 4b7936f..d7687fd 100644 --- a/xample-malware/terminator.md +++ b/xample-malware/terminator.md @@ -55,8 +55,8 @@ Indicators of Compromise SHA256 Hashes - 1f97d32674964528db46021a0466138dd01458bfa79f7450e2b222ae1de8ac1f -References ----------- +## References + [1] https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes [2] https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md index f169f8f..6b7c19e 100644 --- a/xample-malware/trickbot.md +++ b/xample-malware/trickbot.md @@ -73,8 +73,7 @@ Yara Rules - rule MALW_dllinject_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = " Detects dllinject module from Trickbot Trojan" strings: $str_dllinj_01 = "user_pref(" $str_dllinj_02 = "" $str_dllinj_03 = "" $str_dllinj_04 = "" condition: all of ($str_ dllinj_*) } - rule MALW_mailsercher_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = " Detects mailsearcher module from Trickbot Trojan" strings: $str_mails_01 = "mailsearcher" $str_mails_02 = "handler" $str_mails_03 = "conf" $str_mails_04 = "ctl" $str_mails_05 = "SetConf" $str_mails_06 = "file" $str_mails_07 = "needinfo" $str_mails_08 = "mailconf" condition: all of ($str_mails_*) } -References ----------- +## References [1] https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf diff --git a/xample-malware/up007.md b/xample-malware/up007.md index 07e7f54..a4dcab4 100644 --- a/xample-malware/up007.md +++ b/xample-malware/up007.md @@ -73,6 +73,6 @@ IP Addresses - 59.188.12[.]123 -References ----------- +## References + [1] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/ diff --git a/xample-malware/ursnif.md b/xample-malware/ursnif.md index 9037495..fa0ad65 100644 --- a/xample-malware/ursnif.md +++ b/xample-malware/ursnif.md @@ -75,8 +75,8 @@ URLS, IPs, and Domains - hxxp://deekayallday[.]com/data/office -References ----------- +## References + [1] https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques [2] https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality diff --git a/xample-malware/webcobra.md b/xample-malware/webcobra.md index 235de10..33e714d 100644 --- a/xample-malware/webcobra.md +++ b/xample-malware/webcobra.md @@ -67,8 +67,8 @@ SHA256 Hashes - 5e14478931e31cf804e08a09e8dffd091db9abd684926792dbebea9b827c9f37 -References ----------- +## References + [1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://www.forbes.com/sites/rachelwolfson/2018/11/13/cryptojacking-on-the-rise-webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/#16f5542cc336 diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index a45f9ab..3543ee3 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -69,6 +69,6 @@ C2 Server: - dp.bb800[.]com: used to download promoted iOS apps - iosads.cdn.bb800[.]com: used to download promoted iOS apps and malicious components -References ----------- +## References + [1] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/yfaq/README.md b/yfaq/README.md index 451a9ac..8195a6f 100644 --- a/yfaq/README.md +++ b/yfaq/README.md @@ -186,8 +186,8 @@ Yes. Sometimes an ATT&CK technique does not provide enough granularity for malwa For example, MBC defines separate behaviors for detecting sandboxes ([Sandbox Detection](../anti-behavioral-analysis/sandbox-detection.md)) and virtual machines ([Virtual Machine Detection](../anti-behavioral-analysis/virtual-machine-detection.md)). When ATT&CK was updated to include the [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/) technique, which includes detection of virtualization and sandboxes (although not obstruction in the sense of MBC's Dynamic Analysis Evasion behavior), the MBC behaviors were not combined. Rather, both were updated to show a relationship to the new ATT&CK technique. -References ----------- +## References + [1] MITRE ATT&CK(TM): Design and Philosophy, https://www.mitre.org/sites/default/files/publications/pr-18-0944-11-mitre-attack-design-and-philosophy.pdf [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/