admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Newsletter, editing E1510, E1560 (#137)

Browse Source 
* Adding Newsletter

* Create 12182023.md

* Update README.md

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>

* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
This commit is contained in:
Ryan Xu
2023-12-18 11:36:14 -05:00
committed by ryan
parent d423b5a5fa
commit a92e8ffdfd
15 changed files with 45 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
collection/README.md
+2 -1
View File
@@ -8,7 +8,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>29 November 2022</b></td>
<td><b>18 December 2023</b></td>
</tr>
</table>
@@ -17,6 +17,7 @@
Behaviors that enable malware to identify and gather information, such as sensitive files, from a machine or network. Sources often targeted include drives, browsers, audio/video, and email. Often the malware's next objective is to exfiltrate the information gathered.
* **Archive Collected Data** [E1560](../collection/archive-collected-data.md)
* **Cryptocurrency** [B0028](../collection/cryptocurrency.md)
* **Hijack Execution Flow** [F0015](../defense-evasion/hijack-execution-flow.md)
* **Input Capture** [E1056](../collection/input-capture.md)
exfiltration/archive-collected-data.md → collection/archive-collected-data.md
+4 -4
View File
@@ -5,7 +5,7 @@
</tr>
<tr>
<td><b>Objective(s)</b></td>
<td><b><a href="../exfiltration">Exfiltration</a></b></td>
<td><b><a href="../collection">Collection</a></b></td>
</tr>
<tr>
<td><b>Related ATT&CK Techniques</b></td>
@@ -13,7 +13,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>3.0</b></td>
<td><b>4.0</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -21,14 +21,14 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>1 March 2023</b></td>
<td><b>18 December 2023</b></td>
</tr>
</table>
# Archive Collected Data
Malware may obfuscate data via encryption or encoding before exfiltration.
Malware may collect and package (or archive) the information they have gathered from a compromised system. Once collected, the data is often compressed and encrypted into an archive file using various tools or utilities. Common formats for archive files include .zip, .tar, .rar, or .7z. This helps the attack by reducing the size of the data, making it easier and quicker to exfiltrate, and helps avoid detection, since many security tools may not inspect the contents of compressed or encrypted files.
See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org/techniques/T1560/))**.
discovery/application-window-discovery.md
+2 -2
View File
@@ -21,14 +21,14 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>13 September 2023</b></td>
<td><b>18 December 2023</b></td>
</tr>
</table>
# Application Window Discovery
Malware may attempt to get a listing of open application windows.
Malware may attempt to gain information about the operating system and applications running on a system by enumerating open application windows.
## Methods
execution/command-and-scripting-interpreter.md
+2 -2
View File
@@ -21,14 +21,14 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>13 September 2023</b></td>
<td><b>18 December 2023</b></td>
</tr>
</table>
# Command and Scripting Interpreter
Malware may abuse command and script interpreters to execute commands, scripts, or binaries.
Malware may abuse command and script interpreters to execute commands, scripts, or binaries. This is often done to carry out various malicious activities, such as exploring the system, escalating privileges, or exfiltrating data. Built-in command-line interpreters or scripting environments of the operating system, such as cmd.exe or Powershell on Windows, or Bash on Unix-like systems, are often used. Additionally, adversaries may use other scripting languages like Python, Perl, or Javascript.
See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))**.
exfiltration/README.md
+1 -2
View File
@@ -8,7 +8,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>29 November 2022</b></td>
<td><b>18 December 2023</b></td>
</tr>
</table>
@@ -18,4 +18,3 @@
Behaviors that enable malware to steal data from a system. This includes stored data, such as files, as well as data input into applications, such as web browsers.
* **Automated Exfiltration** [E1020](../exfiltration/automated-exfiltration.md)
* **Archive Collected Data** [E1560](../exfiltration/archive-collected-data.md)
exfiltration/automated-exfiltration.md
+2 -2
View File
@@ -21,14 +21,14 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>17 August 2023</b></td>
<td><b>18 December 2023</b></td>
</tr>
</table>
# Automated Exfiltration
Malware may exfiltrate data via automated processing or scripting.
Malware may automatically transfer, or exfiltrate, collected data from a compromised system to a remote location controlled by the attacker through automated processes or scripting. This is often done to minimize the attacker's manual interaction with the system and to maintain a low profile, thereby reducing the chances of detection.
See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org/techniques/T1020/))**.
impact/clipboard-modification.md
+5 -3
View File
@@ -9,7 +9,7 @@
</tr>
<tr>
<td><b>Related ATT&CK Techniques</b></td>
<td><b>Data Manipulation: Transmitted Data Manipulation (<a href="https://attack.mitre.org/techniques/T1641/001/">T1641.001</a>)</b></td>
<td><b>Clipboard Data (<a href="https://attack.mitre.org/techniques/T1115/">T1115</a>), Data Manipulation: Transmitted Data Manipulation (<a href="https://attack.mitre.org/techniques/T1641/001/">T1641.001</a>)</b></td>
</tr>
<tr>
<td><b>Impact Type</b></td>
@@ -17,7 +17,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.0</b></td>
<td><b>3.0</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -25,7 +25,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>13 September 2023</b></td>
<td><b>5 December 2023</b></td>
</tr>
</table>
@@ -34,6 +34,8 @@
ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform.
After E1510 was defined, T1510 was replaced by T1610.001, and Clipboard Data (<a href="https://attack.mitre.org/techniques/T1115/">T1115</a>) was updated to include content modification.
## Use in Malware
|Name|Date|Method|Description|
impact/data-destruction.md
+2 -2
View File
@@ -25,14 +25,14 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>13 September 2023</b></td>
<td><b>18 December 2023</b></td>
</tr>
</table>
# Data Destruction
Data, system files, or other files are destroyed. Individual files are selected, as opposed to wiping an entire sector.
Malware may deliberately delete or otherwise render inaccessible data on a compromised system. This is often done to disrupt the victim's operations, cover the attacker's tracks, or exert pressure on the victim.
See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T1485/))**.
impact/data-encrypted-for-impact.md
+3 -3
View File
@@ -9,7 +9,7 @@
</tr>
<tr>
<td><b>Related ATT&CK Techniques</b></td>
<td><b>Data Encrypted for Impact (<a href="https://attack.mitre.org/techniques/T1486/">T1486</a>), Data Encrypted for Impact {Mobile} (<a href="https://attack.mitre.org/techniques/T1471/">T1471</a>) </b></td>
<td><b>Data Encrypted for Impact (<a href="https://attack.mitre.org/techniques/T1486/">T1486</a>), Data Encrypted for Impact (Mobile) (<a href="https://attack.mitre.org/techniques/T1471/">T1471</a>) </b></td>
</tr>
<tr>
<td><b>Impact Type</b></td>
@@ -17,7 +17,7 @@
</tr>
<tr>
<td><b>Version</b></td>
<td><b>2.1</b></td>
<td><b>2.2</b></td>
</tr>
<tr>
<td><b>Created</b></td>
@@ -25,7 +25,7 @@
</tr>
<tr>
<td><b>Last Modified</b></td>
<td><b>31 August 2023</b></td>
<td><b>5 December 2023</b></td>
</tr>
</table>
mbc_summary.md
+1 -1
View File
@@ -153,7 +153,7 @@
| ID | Technique | Objective(s) |
|----|-----------|--------------|
|E1010|**[Application Window Discovery](https://github.com/MBCProject/mbc-markdown/blob/main/discovery/application-window-discovery.md)**|DISCOVERY|
|E1560|**[Archive Collected Data](https://github.com/MBCProject/mbc-markdown/blob/main/exfiltration/archive-collected-data.md)**|EXFILTRATION|
|E1560|**[Archive Collected Data](https://github.com/MBCProject/mbc-markdown/blob/main/collection/archive-collected-data.md)**|COLLECTION|
|E1020|**[Automated Exfiltration](https://github.com/MBCProject/mbc-markdown/blob/main/exfiltration/automated-exfiltration.md)**|EXFILTRATION|
|E1510|**[Clipboard Modification](https://github.com/MBCProject/mbc-markdown/blob/main/impact/clipboard-modification.md)**|IMPACT|
|E1059|**[Command and Scripting Interpreter](https://github.com/MBCProject/mbc-markdown/blob/main/execution/command-and-scripting-interpreter.md)**|EXECUTION|
xample-malware/matanbuchus.md
+1 -1
View File
@@ -47,7 +47,7 @@ A commercial loader that consists of 2 stages used to download and execute paylo
|[Defense Evasion::Hidden Files and Directories::Extension (F0005.001)](../defense-evasion/hidden-files-and-directories.md)|The malware appends the filename and the extension .ocx to the ProgramData folder path. [[1]](#1)|
|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|The malware downloads DLLs from a hardcoded URL/remote server. [[1]](#1)|
|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware verifies that the working folder from the first stage loader exists on the system. The malware checks for the path for the Opera web browser; if it exists, the malware exits. [[1]](#1) [[2]](#2)|
|[Exfiltration::Archive Collected Data::Encoding-Standard Encoding (E1560.m03)](../exfiltration/archive-collected-data.md)|The malware sends data as a Base64 string of JSON. [[2]](#2)|
|[Collection::Archive Collected Data::Encoding-Standard Encoding (E1560.m03)](../collection/archive-collected-data.md)|The malware sends data as a Base64 string of JSON. [[2]](#2)|
## MBC Behaviors
xample-malware/stuxnet.md
+1 -1
View File
@@ -44,7 +44,7 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/
|[Defense Evasion::Obfuscated Files or Information::Encoding (E1027.m01)](../defense-evasion/obfuscated-files-or-information.md)|The configuration data block is encoded with a NOT XOR 0xFF operation. [[1]](#1)|
|[Defense Evasion::Rootkit::Kernel Mode Rootkit (E1014.m16)](../defense-evasion/rootkit.md)|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate. [[1]](#1)|
|[Defense Evasion::Process Injection::Injection and Persistence via Registry Modification (E1055.m02)](../defense-evasion/process-injection.md)|Stuxnet uses Mrxcls.sys driver for persistence. It is registered as a boot start service by creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys". [[1]](#1)|
|[Exfiltration::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../exfiltration/archive-collected-data.md)|Stuxnet exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[1]](#1)|
|[Collection::Archive Collected Data::Encoding - Custom Encoding (E1560.m04)](../collection/archive-collected-data.md)|Stuxnet exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[1]](#1)|
|[Defense Evasion::Hide Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications, such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removable drives. [[1]](#1)|
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell. [[1]](#1)|
|[Defense Evasion::Hijack Execution Flow::Procedure Hooking (F0015.007)](../defense-evasion/hijack-execution-flow.md)|WTR4141.tmp hooks APIs from kernel32.dll and ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[1]](#1)|
xample-malware/trickbot.md
+1 -1
View File
@@ -43,7 +43,7 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266
|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into svchost.exe. [[2]](#2)|
|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The malware has an auto-start service that allows it to run whenever the machine boots. [[3]](#3)|
|[Defense Evasion::Disable or Evade Security Tool (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|The malware terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[3]](#3)|
|[Exfiltration::Archive Collected Data::Encryption (E1560.m02)](../exfiltration/archive-collected-data.md)|The malware uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt. [[4]](#4)|
|[Collection::Archive Collected Data::Encryption (E1560.m02)](../collection/archive-collected-data.md)|The malware uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt. [[4]](#4)|
|[Defense Evasion::Bootkit (F0013)](../defense-evasion/bootkit.md)|The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [[5]](#5)|
|[Lateral Movement::Supply Chain Compromise (E1195)](../lateral-movement/supply-chain-compromise.md)|TrickBot comes with a signed downloader component. [[5]](#5)|
|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|The malware collects information about the computer, resources, services, installed programs, firmware, and operating system versions. [[1]](#1)|
ynewsletters/12182023.md
+15
View File
@@ -0,0 +1,15 @@
# <a name="faq"></a>Malware Behavior Catalog Newsletter #
**December 18, 2023**
Hello all!
Here are recent MBC developments:
* Released [MBC 3.0](https://github.com/MBCProject/mbc-markdown/releases/tag/v3.0).
* Released the [STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1) for MBC 3.0, which is based on the new [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior).
* Tagged malware corpus with malware type.
* Updated MBC for ATT&CK v14.
* Added CAPE signature information to behavior pages (detection section).
* Submitted a [PR to capa](https://github.com/mandiant/capa-rules/pull/862).
Please post questions or comments in [Discussions](https://github.com/MBCProject/mbc-markdown/discussions) on GitHub, or email us at mbc@mitre.org. Your feedback is always appreciated!
ynewsletters/README.md
+1
View File
@@ -1,5 +1,6 @@
## <a name="faq"></a>Malware Behavior Catalog Newsletters ##
<a href="./12182023.md">December 2023</a>
<a href="./09152023.md">September 2023</a>