admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

couple of relative path fixes for micro-behaviors

Browse Source
This commit is contained in:
Emmanuelle Vargas-Gonzalez
2020-08-21 18:06:30 -04:00
parent b7197c785d
commit a265c73431
32 changed files with 68 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+15 -15
View File
@@ -47,26 +47,26 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**.
Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.
### Example Malware ###
The MBC also contains a collection of [example malware](../xample-malware) that are characterized with malware behaviors.
The MBC also contains a collection of [example malware](./xample-malware) that are characterized with malware behaviors.
## Micro-behavior Objectives ##
[Micro-behaviors](../micro-behaviors/README.md) and their associated objectives are under development.
[Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.
## Malware Objective Descriptions ##
Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors.
|**Objective**|**Description**|
|---|---|
|[**Anti-Behavioral Analysis**](../anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
|[**Anti-Static Analysis**](../anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
|[**Collection**](../collection/README.md)|Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
|[**Command and Control**](../command-and-control/README.md)|Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
|[**Credential Access**](../credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
|[**Defense Evasion**](../defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
|[**Discovery**](../discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
|[**Execution**](../execution/README.md)|Malware aims to execute its code on a system to achieve a variety of goals.|
|[**Exfiltration**](../exfiltration/README.md)|Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
|[**Impact**](../impact/README.md)|Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
|[**Lateral Movement**](../lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
|[**Persistence**](../persistence/README.md)|Malware aims to remain on a system regardless of system events.|
|[**Privilege Escalation**](../privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
|[**Anti-Behavioral Analysis**](./anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
|[**Anti-Static Analysis**](./anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
|[**Collection**](./collection/README.md)|Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
|[**Command and Control**](./command-and-control/README.md)|Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
|[**Credential Access**](./credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
|[**Defense Evasion**](./defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
|[**Discovery**](./discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
|[**Execution**](./execution/README.md)|Malware aims to execute its code on a system to achieve a variety of goals.|
|[**Exfiltration**](./exfiltration/README.md)|Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
|[**Impact**](./impact/README.md)|Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
|[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
|[**Persistence**](./persistence/README.md)|Malware aims to remain on a system regardless of system events.|
|[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
micro-behaviors/README.md
+6 -6
View File
@@ -5,9 +5,9 @@ Like regular MBC behaviors, micro-behaviors are associated with objectives and c
|**Objective**|**Description**|
|---|---|
|[**Communication**](../micro-behaviors/communication)|Malware uses various protocols and components to communication.|
|[**Cryptography**](../micro-behaviors/cryptography)|Malware uses elements of cryptography.|
|[**Data Manipulation**](../micro-behaviors/data-manipulation)|Malware manipulates data.|
|[**File Manipulation**](../micro-behaviors/file-manipulation)|Malware manipulates files.|
|[**Memory Manipulation**](../micro-behaviors/memory-manipulation)|Malware manipulates memory.|
|[**Processes**](../micro-behaviors/processes)|Malware uses processes.|
|[**Communication**](../communication)|Malware uses various protocols and components to communication.|
|[**Cryptography**](../cryptography)|Malware uses elements of cryptography.|
|[**Data Manipulation**](../data-manipulation)|Malware manipulates data.|
|[**File Manipulation**](../file-manipulation)|Malware manipulates files.|
|[**Memory Manipulation**](../memory-manipulation)|Malware manipulates memory.|
|[**Processes**](../processes)|Malware uses processes.|
micro-behaviors/communication/README.md
+9 -9
View File
@@ -8,12 +8,12 @@ Micro-behaviors that enable malware to communicate.
|Name|ID|Description|
|---|---|---|
|[**DNS Communication**](../micro-behaviors/communication/dns-comm.md)|C0011||
|[**FTP Communication**](../micro-behaviors/communication/ftp-comm.md)|C0004||
|[**HTTP Communication**](../micro-behaviors/communication/http-comm.md)|C0002||
|[**ICMP Communication**](../micro-behaviors/communication/icmp-comm.md)|C0014||
|[**Inter-process Communication**](../micro-behaviors/communication/inter-process.md)|C0003||
|[**SMTP Communication**](../micro-behaviors/communication/smtp-comm.md)|C0012||
|[**TCP Communication**](../micro-behaviors/communication/tcp-comm.md)|C0001||
|[**UDP Communication**](../micro-behaviors/communication/udp-comm.md)|C0013||
|[**WinINet Communication**](../micro-behaviors/communication/wininet.md)|C0005||
|[**DNS Communication**](../communication/dns-comm.md)|C0011||
|[**FTP Communication**](../communication/ftp-comm.md)|C0004||
|[**HTTP Communication**](../communication/http-comm.md)|C0002||
|[**ICMP Communication**](../communication/icmp-comm.md)|C0014||
|[**Inter-process Communication**](../communication/inter-process.md)|C0003||
|[**SMTP Communication**](../communication/smtp-comm.md)|C0012||
|[**TCP Communication**](../communication/tcp-comm.md)|C0001||
|[**UDP Communication**](../communication/udp-comm.md)|C0013||
|[**WinINet Communication**](../communication/wininet.md)|C0005||
micro-behaviors/communication/dns-comm.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0011**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/communication/ftp-comm.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0004**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/communication/http-comm.md
+2 -2
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0002**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
@@ -24,4 +24,4 @@ Methods
|**Server**|C0002.001|General HTTP server behavior.|
|**URLMON Function**|C0002.008|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.|
|**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../micro-behaviors/communication/wininet.md) microbehavior.|
|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
micro-behaviors/communication/icmp-comm.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0014**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/communication/inter-process.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0003**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/communication/smtp-comm.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0012**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/communication/tcp-comm.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0001**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/communication/udp-comm.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0013**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/communication/wininet.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0005**|
|**Objective(s)**|[Communication](../micro-behaviors/communication)|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
micro-behaviors/cryptography/README.md
+1 -1
View File
@@ -8,4 +8,4 @@ Micro-behaviors that enable malware to use crypto.
|Name|ID|Description|
|---|---|---|
|[**Generate Pseudo-random Sequence**](../micro-behaviors/cryptography/gen-random.md)|C0021||
|[**Generate Pseudo-random Sequence**](../cryptography/gen-random.md)|C0021||
micro-behaviors/cryptography/gen-random.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0021**|
|**Objective(s)**|[Cryptography](../micro-behaviors/cryptography)|
|**Objective(s)**|[Cryptography](../cryptography)|
|**Related ATT&CK Technique**|None|
micro-behaviors/data-manipulation/README.md
+2 -2
View File
@@ -8,5 +8,5 @@ Micro-behaviors related to malware manipulating data.
|Name|ID|Description|
|---|---|---|
|[**Check String**](../micro-behaviors/data-manipulation/check-string.md)|C0019||
|[**Use Constant**](../micro-behaviors/data-manipulation/use-constant.md)|C0020||
|[**Check String**](../data-manipulation/check-string.md)|C0019||
|[**Use Constant**](../data-manipulation/use-constant.md)|C0020||
micro-behaviors/data-manipulation/check-string.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0019**|
|**Objective(s)**|[Data Manipulation](../micro-behaviors/data-manipulation)|
|**Objective(s)**|[Data Manipulation](../data-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/data-manipulation/use-constant.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0020**|
|**Objective(s)**|[Data Manipulation](../micro-behaviors/data-manipulation)|
|**Objective(s)**|[Data Manipulation](../data-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/file-manipulation/README.md
+2 -2
View File
@@ -8,5 +8,5 @@ Micro-behaviors related to file manipulation.
|Name|ID|Description|
|---|---|---|
|[**Alter File Extension**](../micro-behaviors/file-manipulation/alter-extend.md)|C0015||
|[**Create File**](../micro-behaviors/file-manipulation/create-file.md)|C0016||
|[**Alter File Extension**](../file-manipulation/alter-extend.md)|C0015||
|[**Create File**](../file-manipulation/create-file.md)|C0016||
micro-behaviors/file-manipulation/alter-extend.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0015**|
|**Objective(s)**|[File Manipulation](../micro-behaviors/file-manipulation)|
|**Objective(s)**|[File Manipulation](../file-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/file-manipulation/create-file.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0016**|
|**Objective(s)**|[File Manipulation](../micro-behaviors/file-manipulation)|
|**Objective(s)**|[File Manipulation](../file-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/hardware/README.md
+1 -1
View File
@@ -8,4 +8,4 @@ Micro-behaviors related to hardware.
|Name|ID|Description|
|---|---|---|
|[**Load Driver**](../micro-behaviors/hardware/load-driver.md)|C0023||
|[**Load Driver**](../hardware/load-driver.md)|C0023||
micro-behaviors/hardware/load-driver.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0023**|
|**Objective(s)**|[Processes](../micro-behaviors/processes)|
|**Objective(s)**|[Processes](../processes)|
|**Related ATT&CK Technique**|None|
micro-behaviors/memory-manipulation/README.md
+5 -5
View File
@@ -8,8 +8,8 @@ Micro-behaviors related to malware manipulating machine memory.
|Name|ID|Description|
|---|---|---|
|[**Allocate Memory**](../micro-behaviors/memory-manipulation/allocate-memory.md)|C0007||
|[**Change Memory Protection**](../micro-behaviors/memory-manipulation/memory-protect.md)|C0008||
|[**Heap Spray**](../micro-behaviors/memory-manipulation/heapspray.md)|C0006||
|[**Overflow Buffer**](../micro-behaviors/memory-manipulation/overflow-buffer.md)|C0010||
|[**Stack Pivot**](../micro-behaviors/memory-manipulation/stack-pivot.md)|C0009||
|[**Allocate Memory**](../memory-manipulation/allocate-memory.md)|C0007||
|[**Change Memory Protection**](../memory-manipulation/memory-protect.md)|C0008||
|[**Heap Spray**](../memory-manipulation/heapspray.md)|C0006||
|[**Overflow Buffer**](../memory-manipulation/overflow-buffer.md)|C0010||
|[**Stack Pivot**](../stack-pivot.md)|C0009||
micro-behaviors/memory-manipulation/allocate-memory.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0007**|
|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)|
|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/memory-manipulation/heapspray.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0006**|
|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)|
|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/memory-manipulation/memory-protect.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0008**|
|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)|
|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/memory-manipulation/overflow-buffer.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0010**|
|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)|
|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/memory-manipulation/stack-pivot.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0009**|
|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)|
|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
|**Related ATT&CK Technique**|None|
micro-behaviors/processes/README.md
+3 -3
View File
@@ -8,6 +8,6 @@ Micro-behaviors related to processes.
|Name|ID|Description|
|---|---|---|
|[**Create Process**](../micro-behaviors/processes/create-process.md)|C0017||
|[**Synchronization**](../micro-behaviors/processes/synchronization.md)|C0022||
|[**Terminate Process**](../micro-behaviors/processes/terminate-process.md)|C0018||
|[**Create Process**](../processes/create-process.md)|C0017||
|[**Synchronization**](../processes/synchronization.md)|C0022||
|[**Terminate Process**](../processes/terminate-process.md)|C0018||
micro-behaviors/processes/create-process.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0017**|
|**Objective(s)**|[Processes](../micro-behaviors/processes)|
|**Objective(s)**|[Processes](../processes)|
|**Related ATT&CK Technique**|None|
micro-behaviors/processes/synchronization.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0022**|
|**Objective(s)**|[Processes](../micro-behaviors/processes)|
|**Objective(s)**|[Processes](../processes)|
|**Related ATT&CK Technique**|None|
micro-behaviors/processes/terminate-process.md
+1 -1
View File
@@ -1,7 +1,7 @@
|||
|---|---|
|**ID**|**C0018**|
|**Objective(s)**|[Processes](../micro-behaviors/processes)|
|**Objective(s)**|[Processes](../processes)|
|**Related ATT&CK Technique**|None|