From f3fbf1f51bfe1ab647287cce0a5640ca8530639d Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Fri, 27 Sep 2024 11:58:19 -0400 Subject: [PATCH 01/14] Update decrypt-data.md Added class to CAPE mapping --- micro-behaviors/cryptography/decrypt-data.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md index 43a4998..3e6b812 100644 --- a/micro-behaviors/cryptography/decrypt-data.md +++ b/micro-behaviors/cryptography/decrypt-data.md @@ -63,9 +63,9 @@ Malware may decrypt data. |[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey| |[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)|--| -|Tool: CAPE|Mapping|APIs| -|---|---|---| -|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decrypt Data (C0031)|CryptDecrypt| +|Tool: CAPE|Class|Mapping|APIs| +|---|--|---|---| +|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Decryption|Decrypt Data (C0031)|CryptDecrypt| ## Code Snippets From 1317809f48b3264e2c99107458fbdf25a72cdf93 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Fri, 27 Sep 2024 12:08:35 -0400 Subject: [PATCH 02/14] Update decompress-data.md --- micro-behaviors/data/decompress-data.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/micro-behaviors/data/decompress-data.md b/micro-behaviors/data/decompress-data.md index 8c72867..631e6db 100644 --- a/micro-behaviors/data/decompress-data.md +++ b/micro-behaviors/data/decompress-data.md @@ -54,9 +54,9 @@ Malware may decompress data. |[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)|--| |[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)|--| -|Tool: CAPE|Mapping|APIs| -|---|---|---| -|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decompress Data (C0025)|RtlDecompressBuffer| +|Tool: CAPE|Class|Mapping|APIs| +|---|--|---|---| +|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Compression|Decompress Data (C0025)|RtlDecompressBuffer| ## References From 4874fd4b35f4a172fbd9b2feb455e93f0c75eba1 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:02:25 -0400 Subject: [PATCH 03/14] Update terminate-process.md Added new link and CAPE class for rule --- micro-behaviors/process/terminate-process.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/micro-behaviors/process/terminate-process.md b/micro-behaviors/process/terminate-process.md index b658727..5dc7ad0 100644 --- a/micro-behaviors/process/terminate-process.md +++ b/micro-behaviors/process/terminate-process.md @@ -52,9 +52,9 @@ Malware terminates a process. |[terminate process via kill](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process-via-kill.yml)|Terminate Process (C0018)|kill| |[terminate process](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process.yml)|Terminate Process (C0018)|System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess| -|Tool: CAPE|Mapping|APIs| -|---|---|---| -|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess| +|Tool: CAPE|Class|Mapping|APIs| +|---|--|---|---| +|[terminates_remote_process](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/terminates_process.py)|TerminatesRemoteProcess|Terminate Process (C0018)|NtTerminateProcess| ### C0018 Snippet
From 91ec7133ff71190ca7789ed90b2bba412f967a58 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:06:44 -0400 Subject: [PATCH 04/14] Update allocate-memory.md Updated bad CAPA rule link --- micro-behaviors/memory/allocate-memory.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micro-behaviors/memory/allocate-memory.md b/micro-behaviors/memory/allocate-memory.md index 357d8b8..ae5dfb7 100644 --- a/micro-behaviors/memory/allocate-memory.md +++ b/micro-behaviors/memory/allocate-memory.md @@ -48,7 +48,7 @@ Malware allocates memory, often to unpack itself. |Tool: capa|Mapping|APIs| |---|---|---| -|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)|--| +|[allocate or change RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-or-change-rwx-memory.yml)|Allocate Memory (C0007)|--| |[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory| |[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--| |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--| From 2965436b62ffbc8c18fafc5942f32283cb470cc6 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:17:55 -0400 Subject: [PATCH 05/14] Update allocate-memory.md Fixed bad CAPA link --- micro-behaviors/memory/allocate-memory.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micro-behaviors/memory/allocate-memory.md b/micro-behaviors/memory/allocate-memory.md index ae5dfb7..32ab6ab 100644 --- a/micro-behaviors/memory/allocate-memory.md +++ b/micro-behaviors/memory/allocate-memory.md @@ -50,7 +50,7 @@ Malware allocates memory, often to unpack itself. |---|---|---| |[allocate or change RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-or-change-rwx-memory.yml)|Allocate Memory (C0007)|--| |[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory| -|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--| +|[allocate or change RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-or-change-rw-memory.yml)|Allocate Memory (C0007)|--| |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--| |Tool: CAPE|Mapping|APIs| From 44a35ab0d8cdff63c6766a521098de09c70f5f6f Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:26:32 -0400 Subject: [PATCH 06/14] Update allocate-memory.md Updated CAPE link and class --- micro-behaviors/memory/allocate-memory.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/micro-behaviors/memory/allocate-memory.md b/micro-behaviors/memory/allocate-memory.md index 32ab6ab..3bcf76e 100644 --- a/micro-behaviors/memory/allocate-memory.md +++ b/micro-behaviors/memory/allocate-memory.md @@ -53,9 +53,9 @@ Malware allocates memory, often to unpack itself. |[allocate or change RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-or-change-rw-memory.yml)|Allocate Memory (C0007)|--| |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--| -|Tool: CAPE|Mapping|APIs| -|---|---|---| -|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|Tool: CAPE|Class|Mapping|APIs| +|---|--|---|---| +|[Unpacker](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Unpacker|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| ### C0007 Snippet
From e7a3dae7e69d0db8600751f3d4cd991922d779f1 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:28:36 -0400 Subject: [PATCH 07/14] Update move-file.md Updated CAPE link and CAPE class --- micro-behaviors/file-system/move-file.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/micro-behaviors/file-system/move-file.md b/micro-behaviors/file-system/move-file.md index 7235f75..d205a65 100644 --- a/micro-behaviors/file-system/move-file.md +++ b/micro-behaviors/file-system/move-file.md @@ -47,9 +47,9 @@ Malware moves a file. |---|---|---| |[move file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/move/move-file.yml)|Move File (C0063)|kernel32.MoveFile, kernel32.MoveFileEx, MoveFileWithProgress, MoveFileTransacted, rename, _wrename, System.IO.FileInfo::MoveTo, System.IO.File::Move, kernel32.SHFileOperation| -|Tool: CAPE|Mapping|APIs| -|---|---|---| -|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW| +|Tool: CAPE|Class|Mapping|APIs| +|---|--|---|---| +|[move_file_on_reboot](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/move_file_on_reboot.py)|move_file_on_reboot|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW| ### C0063 Snippet
From 8dd14afae3a17419d40cb2ec6fe84ea663802728 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:40:52 -0400 Subject: [PATCH 08/14] Update create-mutex.md Updated Zeus P2P link --- micro-behaviors/process/create-mutex.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micro-behaviors/process/create-mutex.md b/micro-behaviors/process/create-mutex.md index ccbe4ba..a5e0f33 100644 --- a/micro-behaviors/process/create-mutex.md +++ b/micro-behaviors/process/create-mutex.md @@ -56,7 +56,7 @@ Malware creates a mutex. Mutexes may be created for synchronization purposes (tw |[banker_cridex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_cridex.py)|Cridex|Create Mutex (C0042)|--| |[deepfreeze_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deepfreeze_mutex.py)|DeepFreezeMutex|Create Mutex (C0042)|--| |[bot_russkill](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bot_russkill.py)|Ruskill|Create Mutex (C0042)|--| -|[banker_zeus_p2p](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_zeus_p2p.py)|ZeusP2P|Create Mutex (C0042)|--| +|[banker_zeus_p2p](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/banker_zeus_p2p.py)|ZeusP2P|Create Mutex (C0042)|--| |[carberp_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/carberp_mutex.py)|CarberpMutexes|Create Mutex (C0042)|--| |[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Create Mutex (C0042)|--| |[rat_plugx_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_plugx_mutex.py)|PlugxMutexes|Create Mutex (C0042)|--| From 2ba3797884555995062b8b2646eec6a76f9b7c3e Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:49:09 -0400 Subject: [PATCH 09/14] Update registry.md Updated neshta signature link --- micro-behaviors/operating-system/registry.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md index a6f09f3..fb509d7 100644 --- a/micro-behaviors/operating-system/registry.md +++ b/micro-behaviors/operating-system/registry.md @@ -193,7 +193,7 @@ Malware modifies the registry. |[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry::Query Registry Key (C0036.005)|--| |[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry::Query Registry Key (C0036.005)|--| |[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry::Query Registry Key (C0036.005)|--| -|[virus_neshta](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_neshta.py)|NeshtaRegKeys|Registry (C0036)| RegSetValueExA, RegSetValueExW| +|[virus_neshta](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|NeshtaRegKeys|Registry (C0036)| RegSetValueExA, RegSetValueExW| |[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry::Query Registry Key (C0036.005)|--| |[hides_recyclebin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/hides_recyclebin_icon.py)|HidesRecycleBinIcon|Registry (C0036)|--| |[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry::Query Registry Key (C0036.005)|--| From 95ff87565fab5c78c66e27f321d44fe362870c5e Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 10:52:33 -0400 Subject: [PATCH 10/14] Update set-thread-local-storage-value.md Updated link to CAPA rule --- micro-behaviors/process/set-thread-local-storage-value.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micro-behaviors/process/set-thread-local-storage-value.md b/micro-behaviors/process/set-thread-local-storage-value.md index da8e420..ac1d9ed 100644 --- a/micro-behaviors/process/set-thread-local-storage-value.md +++ b/micro-behaviors/process/set-thread-local-storage-value.md @@ -45,7 +45,7 @@ Malware allocates thread local storage. |Tool: capa|Mapping|APIs| |---|---|---| -|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue| +|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue| ### C0041 Snippet
From b9021def4201dd125a84adf372e67806a105cb3c Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 11:01:10 -0400 Subject: [PATCH 11/14] Update exploitation-for-client-execution.md Updated link to Windows utilities --- execution/exploitation-for-client-execution.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md index e355e29..623cd5f 100644 --- a/execution/exploitation-for-client-execution.md +++ b/execution/exploitation-for-client-execution.md @@ -67,8 +67,8 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or |[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory| |[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateFile| |[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW| -|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| -|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| +|[uses_windows_utilities](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| +|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| |[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile| |[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll| |[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile| From 7321acd0a1eae7c6a11e1ff2b43f1a797016e7c9 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 11:06:59 -0400 Subject: [PATCH 12/14] Update process-injection.md New link for silent process exit --- defense-evasion/process-injection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index d7f8c03..a4b304d 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -100,7 +100,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan |[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction| |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--| |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--| -|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_silent_process_exit.py)|Process Injection (E1055)|--| +|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--| |[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| |[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|Process Injection::Injection using Shims (E1055.m03)|--| |[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_runpe.py)|Process Injection (E1055)|--| From 9cdd9337450d0d1bbc3616a9889eeda6f2a10a17 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 11:10:24 -0400 Subject: [PATCH 13/14] Update allocate-thread-local-storage.md Changed allocate TLS detection to new CAPA link --- micro-behaviors/process/allocate-thread-local-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/micro-behaviors/process/allocate-thread-local-storage.md b/micro-behaviors/process/allocate-thread-local-storage.md index 365b0a2..92f43bd 100644 --- a/micro-behaviors/process/allocate-thread-local-storage.md +++ b/micro-behaviors/process/allocate-thread-local-storage.md @@ -41,7 +41,7 @@ Malware allocates thread local storage. |Tool: capa|Mapping|APIs| |---|---|---| -|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc| +|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc| ### C0040 Snippet
From 03571e42e7b20c4d2560ec99d64fddfbb6be8ac2 Mon Sep 17 00:00:00 2001 From: brightmt <50853930+brightmt@users.noreply.github.com> Date: Wed, 2 Oct 2024 11:48:36 -0400 Subject: [PATCH 14/14] Update modify-registry.md Found and repaired last broken link --- defense-evasion/modify-registry.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md index 819e5da..af9f461 100644 --- a/defense-evasion/modify-registry.md +++ b/defense-evasion/modify-registry.md @@ -79,7 +79,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112 |[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|Modify Registry (E1112)|--| |[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Modify Registry (E1112)|--| |[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Modify Registry (E1112)|--| -|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW| +|[neshta_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW| |[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey| |[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Modify Registry (E1112)|--| |[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|