diff --git a/collection/README.md b/collection/README.md index f0034cb..5d4ed93 100644 --- a/collection/README.md +++ b/collection/README.md @@ -8,7 +8,7 @@ Last Modified -29 November 2022 +18 December 2023 @@ -17,6 +17,7 @@ Behaviors that enable malware to identify and gather information, such as sensitive files, from a machine or network. Sources often targeted include drives, browsers, audio/video, and email. Often the malware's next objective is to exfiltrate the information gathered. +* **Archive Collected Data** [E1560](../collection/archive-collected-data.md) * **Cryptocurrency** [B0028](../collection/cryptocurrency.md) * **Hijack Execution Flow** [F0015](../defense-evasion/hijack-execution-flow.md) * **Input Capture** [E1056](../collection/input-capture.md) diff --git a/exfiltration/archive-collected-data.md b/collection/archive-collected-data.md similarity index 85% rename from exfiltration/archive-collected-data.md rename to collection/archive-collected-data.md index 23085d9..1373225 100644 --- a/exfiltration/archive-collected-data.md +++ b/collection/archive-collected-data.md @@ -5,7 +5,7 @@ Objective(s) -Exfiltration +Collection Related ATT&CK Techniques @@ -13,7 +13,7 @@ Version -3.0 +4.0 Created @@ -21,14 +21,14 @@ Last Modified -1 March 2023 +18 December 2023 # Archive Collected Data -Malware may obfuscate data via encryption or encoding before exfiltration. +Malware may collect and package (or archive) the information they have gathered from a compromised system. Once collected, the data is often compressed and encrypted into an archive file using various tools or utilities. Common formats for archive files include .zip, .tar, .rar, or .7z. This helps the attack by reducing the size of the data, making it easier and quicker to exfiltrate, and helps avoid detection, since many security tools may not inspect the contents of compressed or encrypted files. See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org/techniques/T1560/))**. diff --git a/discovery/application-window-discovery.md b/discovery/application-window-discovery.md index 22acc1b..569f4eb 100644 --- a/discovery/application-window-discovery.md +++ b/discovery/application-window-discovery.md @@ -21,14 +21,14 @@ Last Modified -13 September 2023 +18 December 2023 # Application Window Discovery -Malware may attempt to get a listing of open application windows. +Malware may attempt to gain information about the operating system and applications running on a system by enumerating open application windows. ## Methods diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md index 9f998ea..3fa374a 100644 --- a/execution/command-and-scripting-interpreter.md +++ b/execution/command-and-scripting-interpreter.md @@ -21,14 +21,14 @@ Last Modified -13 September 2023 +18 December 2023 # Command and Scripting Interpreter -Malware may abuse command and script interpreters to execute commands, scripts, or binaries. +Malware may abuse command and script interpreters to execute commands, scripts, or binaries. This is often done to carry out various malicious activities, such as exploring the system, escalating privileges, or exfiltrating data. Built-in command-line interpreters or scripting environments of the operating system, such as cmd.exe or Powershell on Windows, or Bash on Unix-like systems, are often used. Additionally, adversaries may use other scripting languages like Python, Perl, or Javascript. See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))**. diff --git a/exfiltration/README.md b/exfiltration/README.md index 710afcc..ea6dc94 100644 --- a/exfiltration/README.md +++ b/exfiltration/README.md @@ -8,7 +8,7 @@ Last Modified -29 November 2022 +18 December 2023 @@ -18,4 +18,3 @@ Behaviors that enable malware to steal data from a system. This includes stored data, such as files, as well as data input into applications, such as web browsers. * **Automated Exfiltration** [E1020](../exfiltration/automated-exfiltration.md) -* **Archive Collected Data** [E1560](../exfiltration/archive-collected-data.md) diff --git a/exfiltration/automated-exfiltration.md b/exfiltration/automated-exfiltration.md index 9145c4b..df838d7 100644 --- a/exfiltration/automated-exfiltration.md +++ b/exfiltration/automated-exfiltration.md @@ -21,14 +21,14 @@ Last Modified -17 August 2023 +18 December 2023 # Automated Exfiltration -Malware may exfiltrate data via automated processing or scripting. +Malware may automatically transfer, or exfiltrate, collected data from a compromised system to a remote location controlled by the attacker through automated processes or scripting. This is often done to minimize the attacker's manual interaction with the system and to maintain a low profile, thereby reducing the chances of detection. See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org/techniques/T1020/))**. diff --git a/impact/clipboard-modification.md b/impact/clipboard-modification.md index e1c716b..73fb54a 100644 --- a/impact/clipboard-modification.md +++ b/impact/clipboard-modification.md @@ -9,7 +9,7 @@ Related ATT&CK Techniques -Data Manipulation: Transmitted Data Manipulation (T1641.001) +Clipboard Data (T1115), Data Manipulation: Transmitted Data Manipulation (T1641.001) Impact Type @@ -17,7 +17,7 @@ Version -2.0 +3.0 Created @@ -25,14 +25,16 @@ Last Modified -13 September 2023 +5 December 2023 # Clipboard Modification -ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform. +ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform. + +After E1510 was defined, T1510 was replaced by T1610.001, and Clipboard Data (T1115) was updated to include content modification. ## Use in Malware diff --git a/impact/data-destruction.md b/impact/data-destruction.md index 7d8b0a4..764ed41 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -25,14 +25,14 @@ Last Modified -13 September 2023 +18 December 2023 # Data Destruction -Data, system files, or other files are destroyed. Individual files are selected, as opposed to wiping an entire sector. +Malware may deliberately delete or otherwise render inaccessible data on a compromised system. This is often done to disrupt the victim's operations, cover the attacker's tracks, or exert pressure on the victim. See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T1485/))**. diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index fdbb32f..04a3858 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -9,7 +9,7 @@ Related ATT&CK Techniques -Data Encrypted for Impact (T1486), Data Encrypted for Impact {Mobile} (T1471) +Data Encrypted for Impact (T1486), Data Encrypted for Impact (Mobile) (T1471) Impact Type @@ -17,7 +17,7 @@ Version -2.1 +2.2 Created @@ -25,7 +25,7 @@ Last Modified -31 August 2023 +5 December 2023 diff --git a/mbc_summary.md b/mbc_summary.md index ae8e1a2..c0e35e7 100644 --- a/mbc_summary.md +++ b/mbc_summary.md @@ -153,7 +153,7 @@ | ID | Technique | Objective(s) | |----|-----------|--------------| |E1010|**[Application Window Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/application-window-discovery.md)**|DISCOVERY| -|E1560|**[Archive Collected Data](https://github.com/MBCProject/mbc-markdown/blob/main/exfiltration/archive-collected-data.md)**|EXFILTRATION| +|E1560|**[Archive Collected Data](https://github.com/MBCProject/mbc-markdown/blob/main/collection/archive-collected-data.md)**|COLLECTION| |E1020|**[Automated Exfiltration](https://github.com/MBCProject/mbc-markdown/blob/main/exfiltration/automated-exfiltration.md)**|EXFILTRATION| |E1510|**[Clipboard Modification](https://github.com/MBCProject/mbc-markdown/blob/main/impact/clipboard-modification.md)**|IMPACT| |E1059|**[Command and Scripting Interpreter](https://github.com/MBCProject/mbc-markdown/blob/main/execution/command-and-scripting-interpreter.md)**|EXECUTION| diff --git a/xample-malware/matanbuchus.md b/xample-malware/matanbuchus.md index 8452feb..4ac0951 100644 --- a/xample-malware/matanbuchus.md +++ b/xample-malware/matanbuchus.md @@ -47,7 +47,7 @@ A commercial loader that consists of 2 stages used to download and execute paylo |[Defense Evasion::Hidden Files and Directories::Extension (F0005.001)](../defense-evasion/hidden-files-and-directories.md)|The malware appends the filename and the extension .ocx to the ProgramData folder path. [[1]](#1)| |[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|The malware downloads DLLs from a hardcoded URL/remote server. [[1]](#1)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware verifies that the working folder from the first stage loader exists on the system. The malware checks for the path for the Opera web browser; if it exists, the malware exits. [[1]](#1) [[2]](#2)| -|[Exfiltration::Archive Collected Data::Encoding-Standard Encoding (E1560.m03)](../exfiltration/archive-collected-data.md)|The malware sends data as a Base64 string of JSON. [[2]](#2)| +|[Collection::Archive Collected Data::Encoding-Standard Encoding (E1560.m03)](../collection/archive-collected-data.md)|The malware sends data as a Base64 string of JSON. [[2]](#2)| ## MBC Behaviors diff --git a/xample-malware/stuxnet.md b/xample-malware/stuxnet.md index 6ade05d..30d87fa 100644 --- a/xample-malware/stuxnet.md +++ b/xample-malware/stuxnet.md @@ -44,7 +44,7 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/ |[Defense Evasion::Obfuscated Files or Information::Encoding (E1027.m01)](../defense-evasion/obfuscated-files-or-information.md)|The configuration data block is encoded with a NOT XOR 0xFF operation. [[1]](#1)| |[Defense Evasion::Rootkit::Kernel Mode Rootkit (E1014.m16)](../defense-evasion/rootkit.md)|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate. [[1]](#1)| |[Defense Evasion::Process Injection::Injection and Persistence via Registry Modification (E1055.m02)](../defense-evasion/process-injection.md)|Stuxnet uses Mrxcls.sys driver for persistence. It is registered as a boot start service by creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys". [[1]](#1)| -|[Exfiltration::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../exfiltration/archive-collected-data.md)|Stuxnet exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[1]](#1)| +|[Collection::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../collection/archive-collected-data.md)|Stuxnet exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[1]](#1)| |[Defense Evasion::Hide Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications, such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removable drives. [[1]](#1)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell. [[1]](#1)| |[Defense Evasion::Hijack Execution Flow::Procedure Hooking (F0015.007)](../defense-evasion/hijack-execution-flow.md)|WTR4141.tmp hooks APIs from kernel32.dll and ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[1]](#1)| diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md index d9c1614..088f9cd 100644 --- a/xample-malware/trickbot.md +++ b/xample-malware/trickbot.md @@ -43,7 +43,7 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266 |[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into svchost.exe. [[2]](#2)| |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware has an auto-start service that allows it to run whenever the machine boots. [[3]](#3)| |[Defense Evasion::Disable or Evade Security Tool (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|The malware terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[3]](#3)| -|[Exfiltration::Archive Collected Data::Encryption (E1560.m02)](../exfiltration/archive-collected-data.md)|The malware uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt. [[4]](#4)| +|[Collection::Archive Collected Data::Encryption (E1560.m02)](../collection/archive-collected-data.md)|The malware uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt. [[4]](#4)| |[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [[5]](#5)| |[Lateral Movement::Supply Chain Compromise (E1195)](../lateral-movement/supply-chain-compromise.md)|TrickBot comes with a signed downloader component. [[5]](#5)| |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|The malware collects information about the computer, resources, services, installed programs, firmware, and operating system versions. [[1]](#1)| diff --git a/ynewsletters/12182023.md b/ynewsletters/12182023.md new file mode 100644 index 0000000..434c868 --- /dev/null +++ b/ynewsletters/12182023.md @@ -0,0 +1,15 @@ +# Malware Behavior Catalog Newsletter # +**December 18, 2023** + +Hello all! + +Here are recent MBC developments: + +* Released [MBC 3.0](https://github.com/MBCProject/mbc-markdown/releases/tag/v3.0). +* Released the [STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1) for MBC 3.0, which is based on the new [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior). +* Tagged malware corpus with malware type. +* Updated MBC for ATT&CK v14. +* Added CAPE signature information to behavior pages (detection section). +* Submitted a [PR to capa](https://github.com/mandiant/capa-rules/pull/862). + +Please post questions or comments in [Discussions](https://github.com/MBCProject/mbc-markdown/discussions) on GitHub, or email us at mbc@mitre.org. Your feedback is always appreciated! diff --git a/ynewsletters/README.md b/ynewsletters/README.md index 6d38270..4b38f13 100644 --- a/ynewsletters/README.md +++ b/ynewsletters/README.md @@ -1,5 +1,6 @@ ## Malware Behavior Catalog Newsletters ## +December 2023 September 2023 @@ -9,4 +10,4 @@ December 2022 -September 2022 \ No newline at end of file +September 2022