admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17 from MBCProject/mbc-2.1-updates

Browse Source 
Updates to MBC communication micro-behaviors
This commit is contained in:
Emmanuelle Vargas-Gonzalez
2020-09-30 11:48:57 -04:00
committed by GitHub
parent a3edfa54e8 536f884758
commit a828f02795
8 changed files with 59 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-static-analysis/software-packing.md
+1
View File
@@ -15,6 +15,7 @@ Methods
|Name|ID|Description|
|---|---|---|
|**Armadillo**|F0001.012|Uses Armadillo.|
|**ASPack**|F0001.013|Uses ASPack.|
|**Confuser**|F0001.009|Uses Confuser packer.|
|**Custom Compression**|F0001.005|Uses a custom algorithm to compress an executable file.|
|**Custom Compression of Code**|F0001.006|Uses a custom algorithm to compress opcode mnemonics.|
micro-behaviors/communication/README.md
+2 -3
View File
@@ -12,8 +12,7 @@ Micro-behaviors that enable malware to communicate.
|[**FTP Communication**](../communication/ftp-comm.md)|C0004||
|[**HTTP Communication**](../communication/http-comm.md)|C0002||
|[**ICMP Communication**](../communication/icmp-comm.md)|C0014||
|[**Inter-process Communication**](../communication/inter-process.md)|C0003||
|[**Interprocess Communication**](../communication/inter-process.md)|C0003||
|[**SMTP Communication**](../communication/smtp-comm.md)|C0012||
|[**TCP Communication**](../communication/tcp-comm.md)|C0001||
|[**UDP Communication**](../communication/udp-comm.md)|C0013||
|[**Socket Communication**](../communication/socket-comm.md)|C0001||
|[**WinINet Communication**](../communication/wininet.md)|C0005||
micro-behaviors/communication/ftp-comm.md
+2 -2
View File
@@ -13,5 +13,5 @@ Methods
-------
|Name|ID|Description|
|---|---|---|
|**Put**|C0004.001|FTP Put|
|**WinINet API**|C0004.002|Send FTP command via WinINet.|
|**Send File**|C0004.001|Send FTP file.|
|**WinINet**|C0004.002|Send FTP command via WinINet.|
micro-behaviors/communication/http-comm.md
+19 -11
View File
@@ -9,19 +9,27 @@ HTTP Communication
==================
This micro-behavior is related to HTTP communication.
Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**Client**|C0002.002|General HTTP client behavior.|
|**GET Request**|C0002.004|HTTP Get request.|
|**IHTMLDocument**|C0002.011|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.|
|**IHTMLElement**|C0002.012|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.|
|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
|**POST Request**|C0002.005|HTTP Post request.|
|**PUT Request**|C0002.006|HTTP Put request.|
|**Request**|C0002.003|Non-specific HTTP request.|
|**Server**|C0002.001|General HTTP server behavior.|
|**URLMON Function**|C0002.009|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.|
|**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
|**Client**|C0002.002|General HTTP client behavior.|
|**Connect to Server**|C0002.009|HTTP client connects to HTTP server.|
|**Open URL**|C0002.004|HTTP client connects to a URL.|
|**Download URL**|C0002.006|HTTP client downloads URL to file.|
|**Extract Body**|C0002.011|HTTP client extracts HTTP body.|
|**Create Request**|C0002.012|HTTP client creates request.|
|**Send Request**|C0002.003|HTTP client sends request (GET).|
|**Send Data**|C0002.005|HTTP clients sends data to a server (POST/PUT).|
|**Receive Request**|C0002.015|HTTP server receives request.|
|**Send Response**|C0002.016|HTTP server sends response.|
|**Get Response**|C0002.017|HTTP client receives response.|
|**Start Server**|C0002.018|HTTP server is started.|
|**Set Header**|C0002.013|HTTP header is set.|
|**Read Header**|C0002.014|HTTP read header.|
|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
|**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
micro-behaviors/communication/icmp-comm.md
+1
View File
@@ -13,4 +13,5 @@ Methods
-------
|Name|ID|Description|
|---|---|---|
|**Echo Request**|C0014.002|Send ICMP echo request.|
|**Generate Traffic**|C0014.001|Generate ICMP traffic.|
micro-behaviors/communication/socket-comm.md
+34
View File
@@ -0,0 +1,34 @@
|||
|---|---|
|**ID**|**C0001**|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
Socket Communication
====================
This micro-behavior focuses on socket (TCP, UDP) communication.
Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**Set Socket Config**|C0001.001|Configure socket.|
|**Initialize Winsock Library**|C0001.009|Winsock is initialized for TCP communication.|
|**Start TCP Server**|C0001.005|A TCP server listens for client requests.|
|**Create Socket**|C0001.003|A server or client creates a UDP or TCP socket.|
|**Create UDP Socket**|C0001.010|A UDP socket is created.|
|**Create TCP Socket**|C0001.011|A TCP socket is created.|
|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
|**Get Socket Status**|C0001.012|Get socket status.|
|**Send Data**|C0001.007|Send data on socket.|
|**Send TCP Data**|C0001.014|Send TCP data.|
|**Send UDP Data**|C0001.015|Send UDP data.|
|**Receive Data**|C0001.006|Receive data on socket.|
|**Receive TCP Data**|C0001.016|Receive TCP data.|
|**Receive UDP Data**|C0001.017|Receive UDP data.|
|**TCP Server**|C0001.002|TCP server behavior.|
|**TCP Client**|C0001.008|TCP client behavior.|
|**UDP Client**|C0001.013|UDP client behavior.|
micro-behaviors/communication/tcp-comm.md
-22
View File
@@ -1,22 +0,0 @@
|||
|---|---|
|**ID**|**C0001**|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
TCP Communication
=================
This micro-behavior focuses on TCP communication.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**Client**|C0001.001|General TCP client behavior.|
|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
|**Create Socket**|C0001.003|A server or client creates a TCP socket.|
|**Listen Socket**|C0001.005|A server listens for client requests.|
|**Receive Data**|C0001.006|Receive data on socket.|
|**Send Data**|C0001.007|Send data on socket.|
|**Server**|C0001.002|General TCP server behavior.|
micro-behaviors/communication/udp-comm.md
-16
View File
@@ -1,16 +0,0 @@
|||
|---|---|
|**ID**|**C0013**|
|**Objective(s)**|[Communication](../communication)|
|**Related ATT&CK Technique**|None|
UDP Communication
=================
The micro-behavior is related to UDP communication.
Methods
-------
|Name|ID|Description|
|---|---|---|
|**STUN Server**|C0013.001|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.|