diff --git a/yfaq/mbc_matrix_with_ids.svg b/yfaq/mbc_matrix_with_ids.svg
index c840efb..ab83324 100644
--- a/yfaq/mbc_matrix_with_ids.svg
+++ b/yfaq/mbc_matrix_with_ids.svg
@@ -1 +1,2 @@
-B0036: Capture Evasion B0025: Conditional Execution B0001: Debugger Detection B0002: Debugger Evasion B0003: Dynamic Analysis Evasion B0004: Emulator Detection B0005: Emulator Evasion B0008: Executable Code Virtualization F0003: Hooking B0006: Memory Dump Evasion B0007: Sandbox Detection F0001: Software Packing B0009: Virtual Machine Detection B0036.003: Multiple Stages of Loaders B0036.001: Memory-only Payload B0036.002: Encrypted Payloads B0025.007: Runs as Service B0025.002: Environmental Keys B0025.001: Suicide Exit B0025.003: GetVolumeInformation B0025.005: Secure Triggers B0025.008: Deposited Keys B0025.004: Host Fingerprint Check B0025.006: Token Check B0001.003: CloseHandle B0001.031: WudfIsAnyDebuggerPresent B0001.025: Software Breakpoints B0001.027: TIB Aware B0001.028: Timing/Delay Check B0001.024: SetHandleInformation B0001.007: Interrupt 1 B0001.029: TLS Callbacks B0001.018: Parent Process B0001.009: Memory Breakpoints B0001.026: Stack Canary B0001.033: Timing/Delay Check QueryPerformanceCounter B0001.032: Timing/Delay Check GetTickCount B0001.006: Interrupt 0x2d B0001.017: Page Exception Breakpoint Detection B0001.034: Anti-debugging Instructions B0001.015: NtYieldExecution/SwitchToThread B0001.021: ProcessHeap B0001.037: Process Environment Block IsDebugged B0001.001: API Hook Detection B0001.004: Debugger Artifacts B0001.012: NtQueryInformationProcess B0001.023: SeDebugPrivilege B0001.016: OutputDebugString B0001.008: IsDebuggerPresent B0001.022: RtlAdjustPrivilege B0001.010: Memory Write Watching B0001.036: Process Environment Block NtGlobalFlag B0001.002: CheckRemoteDebuggerPresent B0001.005: Hardware Breakpoints B0001.014: NtSetInformationThread B0001.013: NtQueryObject B0001.030: UnhandledExceptionFilter B0001.011: Monitoring Thread B0001.020: Process Jobs B0001.035: Process Environment Block BeingDebugged B0001.019: Process Environment Block B0002.009: Hook Interrupt B0002.025: Self-Unmapping B0002.007: Get Base Indirectly B0002.005: Code Integrity Check B0002.024: Self-Debugging B0002.004: Change SizeOfImage B0002.013: Malloc Use B0002.026: Static Linking B0002.030: Use Interrupts B0002.021: Return Obfuscation B0002.003: Byte Stealing B0002.011: Inlining B0002.019: Pre-Debug B0002.029: Thread Timeout B0002.023: Section Misalignment B0002.028: Tampering B0002.018: Pipeline Misdirection B0002.002: Break Point Clearing B0002.008: Guard Pages B0002.020: Relocate API Code B0002.006: Exception Misdirection B0002.022: RtlAdjustPrivilege B0002.012: Loop Escapes B0002.014: Modify PE Header B0002.015: Nanomites B0002.017: Parallel Threads B0002.001: Block Interrupts B0002.016: Obfuscate Library Use B0002.027: Stolen API Code B0002.010: Import Obfuscation B0003.007: Hook File System B0003.001: Alternative ntdll.dll B0003.009: Illusion B0003.004: Demo Mode B0003.008: Hook Interrupt B0003.003: Delayed Execution B0003.002: Data Flood B0003.006: Encode File B0003.010: Restart B0003.005: Drop Code B0004.003: Check Emulator-related Registry Keys B0004.001: Check for Emulator-related Files B0004.004: Failed Network Connections B0004.002: Check for WINE Version B0005.004: Extra Loops/Time Locks B0005.001: Different Opcode Sets B0005.002: Undocumented Opcodes B0005.003: Unusual/Undocumented API Calls B0008.001: Multiple VMs F0003.003: Procedure Hooking F0003.005: Shadow SDT Hooking F0003.001: Import Address Table (IAT) Hooking F0003.002: Inline Patching F0003.006: Export Address Table (EAT) Hooking F0003.004: System Service Dispatch Table Hooking B0006.010: Hook memory mapping APIs B0006.001: Code Encryption in Memory B0006.003: Hide virtual memory B0006.005: Tampering B0006.002: Erase the PE header B0006.004: SizeOfImage B0006.011: Patch MmGetPhysicalMemoryRanges B0006.006: Guard Pages B0006.008: Feed Misinformation B0006.009: Flow Opcode Obstruction B0006.007: On-the-Fly APIs B0007.006: Screen Resolution Testing B0007.007: Self Check B0007.008: Timing/Date Check B0007.005: Product Key/ID Testing B0007.009: Timing/Uptime Check B0007.001: Check Clipboard Data B0007.003: Human User Check B0007.002: Check Files B0007.004: Injected DLL Testing F0001.009: Confuser F0001.005: Custom Compression F0001.007: Custom Compression of Data F0001.010: VMProtect F0001.011: Themida F0001.001: Nested Packing F0001.004: Standard Compression of Data F0001.003: Standard Compression of Code F0001.012: Armadillo F0001.013: ASPack F0001.002: Standard Compression F0001.006: Custom Compression of Code F0001.008: UPX B0009.009: Check Windows B0009.018: Modern Specs Check - Processor count B0009.005: Check Registry Keys B0009.006: Check Running Services B0009.034: Instruction Testing - CPUID B0009.020: Check Windows - Window size B0009.012: Human User Check B0009.019: Modern Specs Check - Keyboard layout B0009.011: HTML5 Performance Object Check B0009.021: Check Windows - Unique windows B0009.016: Modern Specs Check - USB drive B0009.038: Instruction Testing - VPCEXT B0009.029: Instruction Testing B0009.036: Instruction Testing - RDTSC B0009.003: Check Named System Objects B0009.037: Instruction Testing - VMCPUID B0009.017: Modern Specs Check - Printer B0009.013: Modern Specs Check B0009.030: Instruction Testing - SIDT (red pill) B0009.007: Check Software B0009.022: Check Windows - Title bars B0009.032: Instruction Testing - SMSW B0009.033: Instruction Testing - STR B0009.027: Unique Hardware/Firmware Check - CPU Location B0009.031: Instruction Testing - SGDT/SLDT (no pill) B0009.010: Guest Process Testing B0009.001: Check File and Directory Artifacts B0009.025: Unique Hardware/Firmware Check - I/O Communication Port B0009.004: Check Processes B0009.035: Instruction Testing - IN B0009.008: Check Virtual Devices B0009.026: Unique Hardware/Firmware Check - CPU Name B0009.024: Unique Hardware/Firmware Check - BIOS B0009.015: Modern Specs Check - Drive size B0009.002: Check Memory Artifacts B0009.028: Unique Hardware/Firmware Check - MAC Address B0009.014: Modern Specs Check - Total physical memory B0009.023: Unique Hardware/Firmware Check Anti-Behavioral Analysis B0010: Call Graph Generation Evasion B0045: Data Flow Analysis Evasion B0012: Disassembler Evasion B0032: Executable Code Obfuscation B0034: Executable Code Optimization B0008: Executable Code Virtualization E1027: Obfuscated Files or Information F0001: Software Packing B0010.001: Two-layer Function Return B0010.002: Invoke NTDLL System Calls via Encoded Table B0045.001: Control Dependence B0045.002: Implicit Flows B0045.003: Arbitrary Memory Corruption B0012.001: Argument Obfuscation B0012.002: Conditional Misdirection B0012.005: VBA Stomping B0012.004: Variable Recomposition B0012.003: Value Dependent Jumps B0032.001: API Hashing B0032.017: Stack Strings B0032.002: Code Insertion B0032.003: Dead Code Insertion B0032.008: Data Value Obfuscation B0032.014: Interleaving Code B0032.005: Jump Insertion B0032.004: Fake Code Insertion B0032.009: Entry Point Obfuscation B0032.007: Junk Code Insertion B0032.011: Import Address Table Obfuscation B0032.015: Merged Code Sections B0032.012: Import Compression B0032.018: Symbol Obfuscation B0032.016: Structured Exception Handling (SEH) B0032.013: Instruction Overlap B0032.006: Thunk Code Insertion B0032.010: Guard Pages B0034.002: Minification B0034.001: Jump/Call Absolute Address B0008.001: Multiple VMs E1027.m07: Encryption of Data E1027.m08: Encryption-Custom Algorithm E1027.m01: Encoding E1027.m06: Encryption of Code E1027.m05: Encryption-Standard Algorithm E1027.m04: Encryption E1027.m03: Encoding-Custom Algorithm E1027.m02: Encoding-Standard Algorithm F0001.009: Confuser F0001.005: Custom Compression F0001.007: Custom Compression of Data F0001.010: VMProtect F0001.011: Themida F0001.001: Nested Packing F0001.004: Standard Compression of Data F0001.003: Standard Compression of Code F0001.012: Armadillo F0001.013: ASPack F0001.002: Standard Compression F0001.006: Custom Compression of Code F0001.008: UPX Anti-Static Analysis B0028: Cryptocurrency F0003: Hooking E1056: Input Capture F0002: Keylogging E1113: Screen Capture B0028.001: Bitcoin B0028.002: Ethereum B0028.003: Zcash F0003.003: Procedure Hooking F0003.005: Shadow SDT Hooking F0003.001: Import Address Table (IAT) Hooking F0003.002: Inline Patching F0003.006: Export Address Table (EAT) Hooking F0003.004: System Service Dispatch Table Hooking E1056.m01: Mouse Events F0002.001: Application Hook F0002.002: Polling E1113.m01: WinAPI Collection B0030: C2 Communication B0031: Domain Name Generation E1105: Ingress Tool Transfer B0030.012: Directory Listing B0030.009: Request Email Template B0030.008: Request Command B0030.010: Request Email Address List B0030.001: Send Data B0030.007: Send Heartbeat B0030.014: Execute Shell Command B0030.002: Receive Data B0030.016: Start Interactive Shell B0030.004: Implant to Controller File Transfer B0030.003: Server to Client File Transfer B0030.013: Execute File B0030.006: Send System Information B0030.011: Authenticate B0030.005: Check for Payload B0030.015: File search Command and Control B0028: Cryptocurrency F0003: Hooking E1056: Input Capture F0002: Keylogging E1113: Screen Capture B0028.001: Bitcoin B0028.002: Ethereum B0028.003: Zcash F0003.003: Procedure Hooking F0003.005: Shadow SDT Hooking F0003.001: Import Address Table (IAT) Hooking F0003.002: Inline Patching F0003.006: Export Address Table (EAT) Hooking F0003.004: System Service Dispatch Table Hooking E1056.m01: Mouse Events F0002.001: Application Hook F0002.002: Polling E1113.m01: WinAPI Credential Access B0027: Alternative Installation Location F0013: Bootkit B0037: Bypass Data Execution Prevention F0009: Component Firmware B0025: Conditional Execution B0040: Covert Location F0004: Disable or Evade Security Tools E1564: Hidden Artifacts F0005: Hidden Files and Directories F0015: Hijack Execution Flow F0003: Hooking F0006: Indicator Blocking B0047: Install Insecure or Malicious Configuration E1112: Modify Registry E1027: Obfuscated Files or Information B0029: Polymorphic Code E1055: Process Injection E1014: Rootkit F0007: Self Deletion F0001: Software Packing B0027.002: Registry Install B0027.001: Fileless Malware B0037.001: ROP Chains F0009.001: Router Firmware B0025.007: Runs as Service B0025.002: Environmental Keys B0025.001: Suicide Exit B0025.003: GetVolumeInformation B0025.005: Secure Triggers B0025.008: Deposited Keys B0025.004: Host Fingerprint Check B0025.006: Token Check B0040.001: Hide Data in Registry B0040.002: Steganography F0004.008: Heavens Gate F0004.005: Modify Policy F0004.004: AMSI Bypass F0004.009: Disable Code Integrity F0004.001: Disable Kernel Patch Protection F0004.002: Disable System File Overwrite Protection F0004.007: Bypass Windows File Protection F0004.006: Force Lazy Writing F0004.003: Unhook APIs E1564.m01: Hidden Userspace Libraries E1564.m04: Hidden Services E1564.m05: Hidden Kernel Modules E1564.m03: Hidden Processes E1564.m02: Direct Kernel Object Manipulation F0005.002: Location F0005.004: Timestamp F0005.001: Extension F0005.003: Attribute F0015.003: Import Address Table (IAT) Hooking F0015.006: Abuse Windows Function Calls F0015.005: System Service Dispatch Table Hooking F0015.001: Export Address Table (EAT) Hooking F0015.002: Inline Patching F0015.004: Shadow System Service Dispatch Table Hooking F0003.003: Procedure Hooking F0003.005: Shadow SDT Hooking F0003.001: Import Address Table (IAT) Hooking F0003.002: Inline Patching F0003.006: Export Address Table (EAT) Hooking F0003.004: System Service Dispatch Table Hooking F0006.001: Remove SMS Warning Messages E1027.m07: Encryption of Data E1027.m08: Encryption-Custom Algorithm E1027.m01: Encoding E1027.m06: Encryption of Code E1027.m05: Encryption-Standard Algorithm E1027.m04: Encryption E1027.m03: Encoding-Custom Algorithm E1027.m02: Encoding-Standard Algorithm B0029.001: Packer Stub B0029.003: Code Reordering B0029.002: Call Indirections E1055.m04: Patch Process Command Line E1055.m01: Hook Injection via SetWindowsHooksEx E1055.m05: Injection via Windows Fibers E1055.m02: Injection and Persistence via Registry Modification E1055.m03: Injection using Shims E1014.m15: Hypervisor/Virtualized Rootkit E1014.m14: Hardware/Firmware Rootkit E1014.m12: Application Rootkit E1014.m17: Memory Rootkit E1014.m16: Kernel Mode Rootkit E1014.m13: Bootloader F0007.001: COMSPEC Environment Variable F0001.009: Confuser F0001.005: Custom Compression F0001.007: Custom Compression of Data F0001.010: VMProtect F0001.011: Themida F0001.001: Nested Packing F0001.004: Standard Compression of Data F0001.003: Standard Compression of Code F0001.012: Armadillo F0001.013: ASPack F0001.002: Standard Compression F0001.006: Custom Compression of Code F0001.008: UPX Defense Evasion B0013: Analysis Tool Discovery E1010: Application Window Discovery B0046: Code Discovery E1083: File and Directory Discovery B0038: Self Discovery B0014: SMTP Connection Discovery E1082: System Information Discovery B0043: Taskbar Discovery B0013.002: Process detection - Debuggers B0013.004: Process detection - PCAP Utilities B0013.005: Process detection - Process Utilities B0013.003: Process detection - SysInternals Suite Tools B0013.006: Process detection - PE Utilities B0013.001: Process detection B0013.008: Known File Location B0013.009: Known Window B0013.007: Process detection - Sandboxes E1010.m01: Window Text B0046.001: Enumerate PE Sections B0046.003: Parse PE Header B0046.002: Inspect Section Memory Permissions E1083.m01: Log File E1082.m01: Generate Windows Exception Discovery E1059: Command and Scripting Interpreter B0025: Conditional Execution B0044: Execution Dependency E1203: Exploitation for Client Execution B0023: Install Additional Program B0024: Prevent Concurrent Execution B0011: Remote Commands B0020: Send Email B0021: Send Poisoned Text Message E1569: System Services E1204: User Interaction B0025.007: Runs as Service B0025.002: Environmental Keys B0025.001: Suicide Exit B0025.003: GetVolumeInformation B0025.005: Secure Triggers B0025.008: Deposited Keys B0025.004: Host Fingerprint Check B0025.006: Token Check E1203.m01: Remote Desktop Protocols (RDP) E1203.m05: Sysinternals E1203.m03: File Transfer Protocol (FTP) Servers E1203.m02: Java-based Web Servers E1203.m06: Windows Utilities E1203.m04: Red Hat JBoss Enterprise Products B0011.001: Delete File B0011.003: Execute B0011.005: Sleep B0011.006: Uninstall B0011.007: Upload File B0011.004: Shutdown B0011.002: Download File E1569.m01: MSDTC Execution E1560: Archive Collected Data E1020: Automated Exfiltration E1560.m03: Encoding - Standard Encoding E1560.m05: Encryption - Standard Encryption E1560.m06: Encryption - Custom Encryption E1560.m01: Encoding E1560.m04: Encoding - Custom Encoding E1560.m02: Encryption E1020.m01: Exfiltrate via File Hosting Service Exfiltration E1510: Clipboard Modification F0009: Component Firmware B0016: Compromise Data Integrity E1485: Data Destruction E1486: Data Encrypted for Impact B0033: Denial of Service B0017: Destroy Hardware F0014: Disk Wipe E1190: Exploit Kit Behavior E1203: Exploitation for Client Execution E1472: Generate Fraudulent Advertising Revenue B0019: Manipulate Network Traffic B0042: Modify Hardware B0022: Remote Access B0018: Resource Hijacking B0039: Spamming F0009.001: Router Firmware E1485.m02: Empty Recycle Bin E1485.m03: Delete Application/Software E1485.m04: Delete Shadow Copies E1486.001: Ransom Note E1203.m01: Remote Desktop Protocols (RDP) E1203.m05: Sysinternals E1203.m03: File Transfer Protocol (FTP) Servers E1203.m02: Java-based Web Servers E1203.m06: Windows Utilities E1203.m04: Red Hat JBoss Enterprise Products E1472.m01: Click Hijacking E1472.m02: Advertisement Replacement Fraud B0042.002: Mouse B0042.001: CDROM B0042.003: Printer B0022.001: Reverse Shell B0018.002: Cryptojacking B0018.001: Password Cracking Impact B0026: Malicious Network Driver E1105: Ingress Tool Transfer B0020: Send Email B0021: Send Poisoned Text Message E1195: Supply Chain Compromise E1195.m02: Exploit Private APIs E1195.m01: Abuse Enterprise Certificates Lateral Movement C0011: DNS Communication C0004: FTP Communication C0002: HTTP Communication C0014: ICMP Communication C0003: Interprocess Communication C0012: SMTP Communication C0001: Socket Communication C0005: WinINet C0011.004: Resolve TLD::DNS Communication C0011.003: DDNS Domain Connect::DNS Communication C0011.005: Resolve Free Hosting Domain::DNS Communication C0011.001: Resolve::DNS Communication C0011.002: Server Connect::DNS Communication C0004.001: Send File::FTP Communication C0004.002: WinINet::FTP Communication C0002.002: Client::HTTP Communication C0002.009: Connect to Server::HTTP Communication C0002.017: Get Response::HTTP Communication C0002.003: Send Request::HTTP Communication C0002.004: Open URL::HTTP Communication C0002.007: WinINet::HTTP Communication C0002.015: Receive Request::HTTP Communication C0002.013: Set Header::HTTP Communication C0002.005: Send Data::HTTP Communication C0002.010: IWebBrowser::HTTP Communication C0002.016: Send Response::HTTP Communication C0002.012: Create Request::HTTP Communication C0002.001: Server::HTTP Communication C0002.011: Extract Body::HTTP Communication C0002.014: Read Header::HTTP Communication C0002.008: WinHTTP::HTTP Communication C0002.018: Start Server::HTTP Communication C0002.006: Download URL::HTTP Communication C0014.002: Echo Request::ICMP Communication C0014.001: Generate Traffic::ICMP Communication C0003.001: Create Pipe::Interprocess Communication C0003.003: Read Pipe::Interprocess Communication C0003.004: Write Pipe::Interprocess Communication C0003.002: Connect Pipe::Interprocess Communication C0012.002: Request::SMTP Communication C0012.001: Server Connect::SMTP Communication C0001.015: Send UDP Data::Socket Communication C0001.016: Receive TCP Data::Socket Communication C0001.005: Start TCP Server::Socket Communication C0001.006: Receive Data::Socket Communication C0001.013: UDP Client::Socket Communication C0001.012: Get Socket Status::Socket Communication C0001.017: Receive UDP Data::Socket Communication C0001.007: Send Data::Socket Communication C0001.014: Send TCP Data::Socket Communication C0001.009: Initialize Winsock Library::Socket Communication C0001.008: TCP Client::Socket Communication C0001.004: Connect Socket::Socket Communication C0001.011: Create TCP Socket::Socket Communication C0001.003: Create Socket::Socket Communication C0001.001: Set Socket Config::Socket Communication C0001.010: Create UDP Socket::Socket Communication C0001.002: TCP Server::Socket Communication C0005.002: InternetOpen::WinINet C0005.003: InternetOpenURL::WinINet C0005.005: InternetWriteFile::WinINet C0005.004: InternetReadFile::WinINet C0005.001: InternetConnect::WinINet Communication Micro-objective C0059: Crypto Library C0029: Cryptographic Hash C0031: Decrypt Data C0027: Encrypt Data C0028: Encryption Key C0021: Generate Pseudo-random Sequence C0061: Hashed Message Authentication Code C0029.002: SHA1::Cryptographic Hash C0029.003: SHA256::Cryptographic Hash C0029.004: SHA224::Cryptographic Hash C0029.001: MD5::Cryptographic Hash C0029.006: Snefru::Cryptographic Hash C0029.005: Tiger::Cryptographic Hash C0031.014: Twofish::Decrypt Data C0031.011: Skipjack::Decrypt Data C0031.003: Blowfish::Decrypt Data C0031.006: HC-128::Decrypt Data C0031.001: AES::Decrypt Data C0031.008: RC4::Decrypt Data C0031.013: Stream Cipher::Decrypt Data C0031.002: Block Cipher::Decrypt Data C0031.004: Camellia::Decrypt Data C0031.007: HC-256::Decrypt Data C0031.005: 3DES::Decrypt Data C0031.012: Sosemanuk::Decrypt Data C0031.009: RC6::Decrypt Data C0031.010: RSA::Decrypt Data C0027.011: RSA::Encrypt Data C0027.014: Block Cipher::Encrypt Data C0027.001: AES::Encrypt Data C0027.012: Stream Cipher::Encrypt Data C0027.010: RC6::Encrypt Data C0027.003: Camellia::Encrypt Data C0027.007: HC-256::Encrypt Data C0027.005: Twofish::Encrypt Data C0027.002: Blowfish::Encrypt Data C0027.006: HC-128::Encrypt Data C0027.013: Skipjack::Encrypt Data C0027.009: RC4::Encrypt Data C0027.004: 3DES::Encrypt Data C0027.008: Sosemanuk::Encrypt Data C0028.001: Import Public Key::Encryption Key C0028.002: RC4 KSA::Encryption Key C0021.001: GetTickCount::Generate Pseudo-random Sequence C0021.005: Mersenne Twister::Generate Pseudo-random Sequence C0021.003: Use API::Generate Pseudo-random Sequence C0021.002: rand::Generate Pseudo-random Sequence C0021.004: RC4 PRGA::Generate Pseudo-random Sequence Cryptography Micro-objective C0019: Check String C0032: Checksum C0024: Compress Data C0060: Compression Library C0053: Decode Data C0025: Decompress Data C0026: Encode Data C0058: Modulo C0030: Non-Cryptographic Hash C0020: Use Constant C0032.003: BSD::Checksum C0032.002: Luhn::Checksum C0032.001: CRC32::Checksum C0032.005: Adler::Checksum C0032.004: Verhoeff::Checksum C0024.001: QuickLZ::Compress Data C0024.002: IEncodingFilterFactory::Compress Data C0053.001: Base64::Decode Data C0053.002: XOR::Decode Data C0025.003: aPLib::Decompress Data C0025.002: IEncodingFilterFactory::Decompress Data C0025.001: QuickLZ::Decompress Data C0026.002: XOR::Encode Data C0026.001: Base64::Encode Data C0030.003: Fast-Hash::Non-Cryptographic Hash C0030.001: MurmurHash::Non-Cryptographic Hash C0030.004: dhash::Non-Cryptographic Hash C0030.002: pHash::Non-Cryptographic Hash C0030.005: FNV::Non-Cryptographic Hash Data Micro-objective C0015: Alter File Extension C0045: Copy File C0046: Create Directory C0016: Create File C0048: Delete Directory C0047: Delete File C0049: Get File Attributes C0063: Move File C0051: Read File C0056: Read Virtual Disk C0050: Set File Attributes C0052: Writes File C0015.001: Append Extension::Alter File Extension C0016.001: Create Office Document::Create File C0016.002: Create Ransomware File::Create File File System Micro-objective C0037: Install Driver C0023: Load Driver C0057: Simulate Hardware C0037.001: Minifilter::Install Driver C0023.001: Minifilter::Load Driver C0057.002: Mouse Click::Simulate Hardware C0057.001: Ctrl-Alt-Del::Simulate Hardware Hardware Micro-objective C0007: Allocate Memory C0008: Change Memory Protection C0044: Free Memory C0006: Heap Spray C0010: Overflow Buffer C0009: Stack Pivot C0008.001: Executable Stack::Change Memory Protection C0008.002: Executable Heap::Change Memory Protection Memory Micro-objective C0033: Console C0034: Environment Variable C0036: Registry C0035: Wallpaper C0034.002: Get Variable::Environment Variable C0034.001: Set Variable::Environment Variable C0036.004: Create Registry Key::Registry C0036.002: Delete Registry Key::Registry C0036.001: Set Registry Key::Registry C0036.005: Query Registry Key::Registry C0036.007: Delete Registry Value::Registry C0036.003: Open Registry Key::Registry C0036.006: Query Registry Value::Registry Operating System Micro-objective C0040: Allocate Thread Local Storage C0043: Check Mutex C0042: Create Mutex C0017: Create Process C0038: Create Thread C0064: Enumerate Threads C0065: Open Process C0066: Open Thread C0054: Resume Thread C0041: Set Thread Local Storage Value C0055: Suspend Thread C0022: Synchronization C0018: Terminate Process C0039: Terminate Thread C0017.001: Create Process via Shellcode::Create Process C0017.003: Create Suspended Process::Create Process C0017.002: Create Process via WMI::Create Process C0022.001: Create Mutex::Synchronization Process Micro-objective F0013: Bootkit F0009: Component Firmware E1564: Hidden Artifacts F0005: Hidden Files and Directories F0015: Hijack Execution Flow F0003: Hooking B0047: Install Insecure or Malicious Configuration F0010: Kernel Modules and Extensions B0026: Malicious Network Driver F0011: Modify Existing Service E1112: Modify Registry F0012: Registry Run Keys / Startup Folder B0022: Remote Access E1105: Ingress Tool Transfer B0035: Shutdown Event F0009.001: Router Firmware E1564.m01: Hidden Userspace Libraries E1564.m04: Hidden Services E1564.m05: Hidden Kernel Modules E1564.m03: Hidden Processes E1564.m02: Direct Kernel Object Manipulation F0005.002: Location F0005.004: Timestamp F0005.001: Extension F0005.003: Attribute F0015.003: Import Address Table (IAT) Hooking F0015.006: Abuse Windows Function Calls F0015.005: System Service Dispatch Table Hooking F0015.001: Export Address Table (EAT) Hooking F0015.002: Inline Patching F0015.004: Shadow System Service Dispatch Table Hooking F0003.003: Procedure Hooking F0003.005: Shadow SDT Hooking F0003.001: Import Address Table (IAT) Hooking F0003.002: Inline Patching F0003.006: Export Address Table (EAT) Hooking F0003.004: System Service Dispatch Table Hooking F0010.001: Device Driver B0022.001: Reverse Shell Persistence F0015: Hijack Execution Flow F0003: Hooking F0010: Kernel Modules and Extensions F0011: Modify Existing Service E1055: Process Injection F0015.003: Import Address Table (IAT) Hooking F0015.006: Abuse Windows Function Calls F0015.005: System Service Dispatch Table Hooking F0015.001: Export Address Table (EAT) Hooking F0015.002: Inline Patching F0015.004: Shadow System Service Dispatch Table Hooking F0003.003: Procedure Hooking F0003.005: Shadow SDT Hooking F0003.001: Import Address Table (IAT) Hooking F0003.002: Inline Patching F0003.006: Export Address Table (EAT) Hooking F0003.004: System Service Dispatch Table Hooking F0010.001: Device Driver E1055.m04: Patch Process Command Line E1055.m01: Hook Injection via SetWindowsHooksEx E1055.m05: Injection via Windows Fibers E1055.m02: Injection and Persistence via Registry Modification E1055.m03: Injection using Shims Privilege Escalation B0036: Capture Evasion B0025: Conditional Execution B0001: Debugger Detection B0002: Debugger Evasion B0003: Dynamic Analysis Evasion B0004: Emulator Detection B0005: Emulator Evasion B0008: Executable Code Virtualization F0015: Hijack Execution Flow B0006: Memory Dump Evasion B0007: Sandbox Detection F0001: Software Packing B0009: Virtual Machine Detection B0036.002: Encrypted Payloads B0036.001: Memory-only Payload B0036.003: Multiple Stages of Loaders B0025.008: Deposited Keys B0025.002: Environmental Keys B0025.003: GetVolumeInformation B0025.004: Host Fingerprint Check B0025.007: Runs as Service B0025.005: Secure Triggers B0025.001: Suicide Exit B0025.006: Token Check B0001.034: Anti-debugging Instructions B0001.001: API Hook Detection B0001.038: Check Processes B0001.002: CheckRemoteDebuggerPresent B0001.003: CloseHandle B0001.004: Debugger Artifacts B0001.005: Hardware Breakpoints B0001.006: Interruption B0001.008: IsDebuggerPresent B0001.009: Memory Breakpoints B0001.010: Memory Write Watching B0001.011: Monitoring Thread B0001.012: NtQueryInformationProcess B0001.013: NtQueryObject B0001.014: NtSetInformationThread B0001.015: NtYieldExecution/SwitchToThread B0001.016: OutputDebugString B0001.017: Page Exception Breakpoint Detection B0001.018: Parent Process B0001.019: Process Environment Block B0001.035: Process Environment Block BeingDebugged B0001.037: Process Environment Block IsDebugged B0001.036: Process Environment Block NtGlobalFlag B0001.020: Process Jobs B0001.021: ProcessHeap B0001.022: RtlAdjustPrivilege B0001.023: SeDebugPrivilege B0001.024: SetHandleInformation B0001.025: Software Breakpoints B0001.026: Stack Canary B0001.027: TIB Aware B0001.028: Timing/Delay Check B0001.032: Timing/Delay Check GetTickCount B0001.033: Timing/Delay Check QueryPerformanceCounter B0001.029: TLS Callbacks B0001.030: UnhandledExceptionFilter B0001.031: WudfIsAnyDebuggerPresent B0002.001: Block Interrupts B0002.002: Break Point Clearing B0002.003: Byte Stealing B0002.004: Change SizeOfImage B0002.005: Code Integrity Check B0002.006: Exception Misdirection B0002.007: Get Base Indirectly B0002.008: Guard Pages B0002.009: Hook Interrupt B0002.010: Import Obfuscation B0002.011: Inlining B0002.012: Loop Escapes B0002.013: Malloc Use B0002.014: Modify PE Header B0002.015: Nanomites B0002.016: Obfuscate Library Use B0002.017: Parallel Threads B0002.018: Pipeline Misdirection B0002.019: Pre-Debug B0002.020: Relocate API Code B0002.021: Return Obfuscation B0002.022: RtlAdjustPrivilege B0002.023: Section Misalignment B0002.024: Self-Debugging B0002.025: Self-Unmapping B0002.026: Static Linking B0002.027: Stolen API Code B0002.028: Tampering B0002.029: Thread Timeout B0002.030: Use Interrupts B0003.001: Alternative ntdll.dll B0003.012: API Hammering B0003.011: Code Integrity Check B0003.002: Data Flood B0003.003: Delayed Execution B0003.004: Demo Mode B0003.005: Drop Code B0003.006: Encode File B0003.007: Hook File System B0003.008: Hook Interrupt B0003.009: Illusion B0003.010: Restart B0004.003: Check Emulator-related Registry Keys B0004.001: Check for Emulator-related Files B0004.002: Check for WINE Version B0004.004: Failed Network Connections B0005.001: Different Opcode Sets B0005.004: Extra Loops/Time Locks B0005.002: Undocumented/Unimplemented Opcodes B0005.003: Unusual/Undocumented API Calls B0008.001: Multiple VMs F0015.006: Abuse Windows Function Calls F0015.001: Export Address Table Hooking F0015.003: Import Address Table Hooking F0015.002: Inline Patching F0015.007: Procedure Hooking F0015.004: Shadow System Service Dispatch Table Hooking F0015.005: System Service Dispatch Table Hooking B0006.001: Code Encryption in Memory B0006.002: Erase the PE header B0006.008: Feed Misinformation B0006.009: Flow Opcode Obstruction B0006.006: Guard Pages B0006.003: Hide virtual memory B0006.010: Hook memory mapping APIs B0006.007: On-the-Fly APIs B0006.011: Patch MmGetPhysicalMemoryRanges B0006.004: SizeOfImage B0006.005: Tampering B0007.001: Check Clipboard Data B0007.002: Check Files B0007.003: Human User Check B0007.004: Injected DLL Testing B0007.005: Product Key/ID Testing B0007.006: Screen Resolution Testing B0007.007: Self Check B0007.010: Test API Routines B0007.008: Timing/Date Check B0007.009: Timing/Uptime Check F0001.012: Armadillo F0001.013: ASPack F0001.009: Confuser F0001.005: Custom Compression F0001.006: Custom Compression of Code F0001.007: Custom Compression of Data F0001.001: Nested Packing F0001.002: Standard Compression F0001.003: Standard Compression of Code F0001.004: Standard Compression of Data F0001.011: Themida F0001.008: UPX F0001.010: VMProtect B0009.001: Check File and Directory Artifacts B0009.002: Check Memory Artifacts B0009.003: Check Named System Objects B0009.004: Check Processes B0009.005: Check Registry Keys B0009.006: Check Running Services B0009.007: Check Software B0009.008: Check Virtual Devices B0009.009: Check Windows B0009.022: Check Windows - Title bars B0009.021: Check Windows - Unique windows B0009.020: Check Windows - Window size B0009.010: Guest Process Testing B0009.011: HTML5 Performance Object Check B0009.012: Human User Check B0009.029: Instruction Testing B0009.034: Instruction Testing - CPUID B0009.035: Instruction Testing - IN B0009.036: Instruction Testing - RDTSC B0009.031: Instruction Testing - SGDT/SLDT (no pill) B0009.030: Instruction Testing - SIDT (red pill) B0009.032: Instruction Testing - SMSW B0009.033: Instruction Testing - STR B0009.037: Instruction Testing - VMCPUID B0009.038: Instruction Testing - VPCEXT B0009.013: Modern Specs Check B0009.015: Modern Specs Check - Drive size B0009.019: Modern Specs Check - Keyboard layout B0009.017: Modern Specs Check - Printer B0009.018: Modern Specs Check - Processor count B0009.014: Modern Specs Check - Total physical memory B0009.016: Modern Specs Check - USB drive B0009.023: Unique Hardware/Firmware Check B0009.024: Unique Hardware/Firmware Check - BIOS B0009.027: Unique Hardware/Firmware Check - CPU Location B0009.026: Unique Hardware/Firmware Check - CPU Name B0009.025: Unique Hardware/Firmware Check - I/O Communication Port B0009.028: Unique Hardware/Firmware Check - MAC Address Anti-Behavioral Analysis B0010: Call Graph Generation Evasion B0045: Data Flow Analysis Evasion B0012: Disassembler Evasion B0032: Executable Code Obfuscation B0034: Executable Code Optimization B0008: Executable Code Virtualization E1027: Obfuscated Files or Information F0001: Software Packing B0010.002: Invoke NTDLL System Calls via Encoded Table B0010.003: Shadow Process Communication B0010.001: Two-layer Function Return B0045.003: Arbitrary Memory Corruption B0045.001: Control Dependence B0045.002: Implicit Flows B0012.001: Argument Obfuscation B0012.002: Conditional Misdirection B0012.006: Desynchronizing Opaque Predicates B0012.007: Fake Function B0012.003: Value Dependent Jumps B0012.005: VBA Stomping B0032.001: API Hashing B0032.020: Argument Obfuscation B0032.002: Code Insertion B0032.008: Data Value Obfuscation B0032.003: Dead Code Insertion B0032.009: Entry Point Obfuscation B0032.004: Fake Code Insertion B0032.010: Guard Pages B0032.011: Import Address Table Obfuscation B0032.012: Import Compression B0032.013: Instruction Overlap B0032.014: Interleaving Code B0032.005: Jump Insertion B0032.007: Junk Code Insertion B0032.019: Opaque Predicate B0032.017: Stack Strings B0032.016: Structured Exception Handling (SEH) B0032.018: Symbol Obfuscation B0032.006: Thunk Code Insertion B0032.021: Variable Recomposition B0034.001: Jump/Call Absolute Address B0034.002: Minification B0008.001: Multiple VMs E1027.m01: Encoding E1027.m03: Encoding - Custom Algorithm E1027.m02: Encoding - Standard Algorithm E1027.m04: Encryption E1027.m08: Encryption - Custom Algorithm E1027.m05: Encryption - Standard Algorithm E1027.m06: Encryption of Code E1027.m07: Encryption of Data F0001.012: Armadillo F0001.013: ASPack F0001.009: Confuser F0001.005: Custom Compression F0001.006: Custom Compression of Code F0001.007: Custom Compression of Data F0001.001: Nested Packing F0001.002: Standard Compression F0001.003: Standard Compression of Code F0001.004: Standard Compression of Data F0001.011: Themida F0001.008: UPX F0001.010: VMProtect Anti-Static Analysis E1560: Archive Collected Data B0028: Cryptocurrency F0015: Hijack Execution Flow E1056: Input Capture F0002: Keylogging E1113: Screen Capture E1560.m01: Encoding E1560.m04: Encoding - Custom Algorithm E1560.m03: Encoding - Standard Algorithm E1560.m02: Encryption E1560.m06: Encryption - Custom Algorithm E1560.m05: Encryption - Standard Algorithm B0028.001: Bitcoin B0028.002: Ethereum B0028.003: Zcash F0015.006: Abuse Windows Function Calls F0015.001: Export Address Table Hooking F0015.003: Import Address Table Hooking F0015.002: Inline Patching F0015.007: Procedure Hooking F0015.004: Shadow System Service Dispatch Table Hooking F0015.005: System Service Dispatch Table Hooking E1056.m01: Mouse Events F0002.001: Application Hook F0002.002: Polling E1113.m01: WinAPI Collection B0030: C2 Communication B0031: Domain Name Generation E1105: Ingress Tool Transfer B0030.011: Authenticate B0030.005: Check for Payload B0030.012: Directory Listing B0030.013: Execute File B0030.014: Execute Shell Command B0030.015: File search B0030.004: Implant to Controller File Transfer B0030.002: Receive Data B0030.008: Request Command B0030.010: Request Email Address List B0030.009: Request Email Template B0030.001: Send Data B0030.007: Send Heartbeat B0030.006: Send System Information B0030.003: Server to Client File Transfer B0030.016: Start Interactive Shell Command and Control C0011: DNS Communication C0004: FTP Communication C0002: HTTP Communication C0014: ICMP Communication C0003: Interprocess Communication C0012: SMTP Communication C0001: Socket Communication C0005: WinINet C0011.003: DDNS Domain Connect C0011.001: Resolve C0011.005: Resolve Free Hosting Domain C0011.004: Resolve TLD C0011.002: Server Connect C0004.001: Send File C0004.002: WinINet C0002.002: Client C0002.009: Connect to Server C0002.012: Create Request C0002.006: Download URL C0002.011: Extract Body C0002.017: Get Response C0002.010: IWebBrowser C0002.004: Open URL C0002.014: Read Header C0002.015: Receive Request C0002.005: Send Data C0002.003: Send Request C0002.016: Send Response C0002.001: Server C0002.013: Set Header C0002.018: Start Server C0002.008: WinHTTP C0002.007: WinINet C0014.002: Echo Request C0014.001: Generate Traffic C0003.002: Connect Pipe C0003.001: Create Pipe C0003.003: Read Pipe C0003.004: Write Pipe C0012.002: Request C0012.001: Server Connect C0001.004: Connect Socket C0001.003: Create Socket C0001.011: Create TCP Socket C0001.010: Create UDP Socket C0001.012: Get Socket Status C0001.009: Initialize Winsock Library C0001.006: Receive Data C0001.016: Receive TCP Data C0001.017: Receive UDP Data C0001.007: Send Data C0001.014: Send TCP Data C0001.015: Send UDP Data C0001.001: Set Socket Config C0001.005: Start TCP Server C0001.008: TCP Client C0001.002: TCP Server C0001.013: UDP Client C0005.001: InternetConnect C0005.002: InternetOpen C0005.003: InternetOpenURL C0005.004: InternetReadFile C0005.005: InternetWriteFile Communication Micro-objective B0028: Cryptocurrency F0015: Hijack Execution Flow E1056: Input Capture F0002: Keylogging E1113: Screen Capture B0028.001: Bitcoin B0028.002: Ethereum B0028.003: Zcash F0015.006: Abuse Windows Function Calls F0015.001: Export Address Table Hooking F0015.003: Import Address Table Hooking F0015.002: Inline Patching F0015.007: Procedure Hooking F0015.004: Shadow System Service Dispatch Table Hooking F0015.005: System Service Dispatch Table Hooking E1056.m01: Mouse Events F0002.001: Application Hook F0002.002: Polling E1113.m01: WinAPI Credential Access C0068: Crypto Algorithm C0069: Crypto Constant C0059: Crypto Library C0029: Cryptographic Hash C0031: Decrypt Data C0027: Encrypt Data C0028: Encryption Key C0021: Generate Pseudo-random Sequence C0061: Hashed Message Authentication Code C0059.001: API Call C0059.002: Static Public Library C0029.001: MD5 C0029.002: SHA1 C0029.004: SHA224 C0029.003: SHA256 C0029.006: Snefru C0029.005: Tiger C0031.005: 3DES C0031.001: AES C0031.002: Block Cipher C0031.003: Blowfish C0031.004: Camellia C0031.006: HC-128 C0031.007: HC-256 C0031.008: RC4 C0031.009: RC6 C0031.010: RSA C0031.011: Skipjack C0031.012: Sosemanuk C0031.013: Stream Cipher C0031.014: Twofish C0027.004: 3DES C0027.001: AES C0027.014: Block Cipher C0027.002: Blowfish C0027.003: Camellia C0027.006: HC-128 C0027.007: HC-256 C0027.009: RC4 C0027.010: RC6 C0027.011: RSA C0027.013: Skipjack C0027.008: Sosemanuk C0027.012: Stream Cipher C0027.005: Twofish C0028.001: Import Public Key C0028.002: RC4 KSA C0021.001: GetTickCount C0021.002: rand C0021.004: RC4 PRGA C0021.003: Use API Cryptography Micro-objective C0019: Check String C0032: Checksum C0024: Compress Data C0060: Compression Library C0053: Decode Data C0025: Decompress Data C0026: Encode Data C0058: Modulo C0030: Non-Cryptographic Hash C0020: Use Constant C0032.005: Adler C0032.003: BSD C0032.001: CRC32 C0032.002: Luhn C0024.002: IEncodingFilterFactory C0024.001: QuickLZ C0053.001: Base64 C0053.002: XOR C0025.003: aPLib C0025.002: IEncodingFilterFactory C0025.001: QuickLZ C0026.001: Base64 C0026.002: XOR C0030.004: dhash C0030.006: djb2 C0030.003: Fast-Hash C0030.005: FNV C0030.001: MurmurHash C0030.002: pHash Data Micro-objective B0027: Alternative Installation Location F0013: Bootkit B0037: Bypass Data Execution Prevention F0009: Component Firmware B0025: Conditional Execution B0040: Covert Location F0004: Disable or Evade Security Tools F0005: Hidden Files and Directories E1564: Hide Artifacts F0015: Hijack Execution Flow F0006: Indicator Blocking B0047: Install Insecure or Malicious Configuration E1112: Modify Registry E1027: Obfuscated Files or Information B0029: Polymorphic Code E1055: Process Injection E1014: Rootkit F0007: Self Deletion F0001: Software Packing B0027.001: Fileless Malware B0027.002: Registry Install B0037.001: ROP Chains F0009.001: Router Firmware B0025.008: Deposited Keys B0025.002: Environmental Keys B0025.003: GetVolumeInformation B0025.004: Host Fingerprint Check B0025.007: Runs as Service B0025.005: Secure Triggers B0025.001: Suicide Exit B0025.006: Token Check B0040.001: Hide Data in Registry B0040.002: Steganography F0004.004: AMSI Bypass F0004.007: Bypass Windows File Protection F0004.009: Disable Code Integrity F0004.001: Disable Kernel Patch Protection F0004.002: Disable System File Overwrite Protection F0004.006: Force Lazy Writing F0004.008: Heavens Gate F0004.005: Modify Policy F0004.003: Unhook APIs F0005.003: Attribute F0005.001: Extension F0005.002: Location F0005.004: Timestamp E1564.m02: Direct Kernel Object Manipulation E1564.m05: Hidden Kernel Modules E1564.m03: Hidden Processes E1564.m04: Hidden Services E1564.m01: Hidden Userspace Libraries F0015.006: Abuse Windows Function Calls F0015.001: Export Address Table Hooking F0015.003: Import Address Table Hooking F0015.002: Inline Patching F0015.007: Procedure Hooking F0015.004: Shadow System Service Dispatch Table Hooking F0015.005: System Service Dispatch Table Hooking F0006.001: Remove SMS Warning Messages E1027.m01: Encoding E1027.m03: Encoding - Custom Algorithm E1027.m02: Encoding - Standard Algorithm E1027.m04: Encryption E1027.m08: Encryption - Custom Algorithm E1027.m05: Encryption - Standard Algorithm E1027.m06: Encryption of Code E1027.m07: Encryption of Data B0029.002: Call Indirections B0029.003: Code Reordering B0029.001: Packer Stub E1055.004: Asynchronous Procedure Call E1055.001: Dynamic-link Library Injection E1055.011: Extra Window Memory Injection E1055.m01: Hook Injection via SetWindowsHooksEx E1055.m02: Injection and Persistence via Registry Modification E1055.m03: Injection using Shims E1055.m05: Injection via Windows Fibers E1055.m04: Patch Process Command Line E1055.002: Portable Executable Injection E1055.012: Process Hollowing E1055.003: Thread Execution Hijacking E1014.m12: Application Rootkit E1014.m13: Bootloader E1014.m14: Hardware/Firmware Rootkit E1014.m15: Hypervisor/Virtualized Rootkit E1014.m16: Kernel Mode Rootkit E1014.m17: Memory Rootkit F0007.001: COMSPEC Environment Variable F0001.012: Armadillo F0001.013: ASPack F0001.009: Confuser F0001.005: Custom Compression F0001.006: Custom Compression of Code F0001.007: Custom Compression of Data F0001.001: Nested Packing F0001.002: Standard Compression F0001.003: Standard Compression of Code F0001.004: Standard Compression of Data F0001.011: Themida F0001.008: UPX F0001.010: VMProtect Defense Evasion B0013: Analysis Tool Discovery E1010: Application Window Discovery B0046: Code Discovery E1083: File and Directory Discovery B0043: References B0038: Self Discovery B0014: SMTP Connection Discovery E1082: System Information Discovery B0013.008: Known File Location B0013.009: Known Window B0013.010: Known Windows Class Name B0013.001: Process detection B0013.002: Process detection - Debuggers B0013.004: Process detection - PCAP Utilities B0013.006: Process detection - PE Utilities B0013.005: Process detection - Process Utilities B0013.007: Process detection - Sandboxes B0013.003: Process detection - SysInternals Suite Tools E1010.m01: Window Text B0046.001: Enumerate PE Sections B0046.002: Inspect Section Memory Permissions B0046.003: Parse PE Header E1083.m02: Filter by Extension E1083.m01: Log File B0038.002: Check Magic String B0038.003: Check Section Length B0038.001: Use Hashquine E1082.m02: Enumerate Environment Variables E1082.m01: Generate Windows Exception Discovery E1059: Command and Scripting Interpreter B0025: Conditional Execution B0044: Execution Dependency E1203: Exploitation for Client Execution B0023: Install Additional Program B0024: Prevent Concurrent Execution B0011: Remote Commands B0020: Send Email B0021: Send Poisoned Text Message E1569: System Services E1204: User Execution B0025.008: Deposited Keys B0025.002: Environmental Keys B0025.003: GetVolumeInformation B0025.004: Host Fingerprint Check B0025.007: Runs as Service B0025.005: Secure Triggers B0025.001: Suicide Exit B0025.006: Token Check E1203.m03: File Transfer Protocol (FTP) Servers E1203.m02: Java-based Web Servers E1203.m04: Red Hat JBoss Enterprise Products E1203.m01: Remote Desktop Protocols E1203.m05: Sysinternals E1203.m06: Windows Utilities B0011.001: Delete File B0011.002: Download File B0011.003: Execute B0011.004: Shutdown B0011.005: Sleep B0011.006: Uninstall B0011.007: Upload File E1569.m01: MSDTC Execution E1020: Automated Exfiltration E1020.m01: Exfiltrate via File Hosting Service Exfiltration C0015: Alter File Extension C0045: Copy File C0046: Create Directory C0016: Create File C0048: Delete Directory C0047: Delete File C0049: Get File Attributes C0063: Move File C0051: Read File C0056: Read Virtual Disk C0050: Set File Attributes C0052: Writes File C0015.001: Append Extension C0016.001: Create Office Document C0016.002: Create Ransomware File File System Micro-objective C0037: Install Driver C0023: Load Driver C0057: Simulate Hardware C0037.001: Minifilter C0023.001: Minifilter C0057.001: Ctrl-Alt-Del C0057.002: Mouse Click Hardware Micro-objective E1510: Clipboard Modification F0009: Component Firmware B0016: Compromise Data Integrity E1485: Data Destruction E1486: Data Encrypted for Impact B0033: Denial of Service B0017: Destroy Hardware F0014: Disk Wipe E1190: Exploit Kit E1203: Exploitation for Client Execution E1643: Generate Traffic from Victim B0019: Manipulate Network Traffic B0042: Modify Hardware B0022: Remote Access B0018: Resource Hijacking B0039: Spamming F0009.001: Router Firmware E1485.m03: Delete Application/Software E1485.m04: Delete Shadow Copies E1485.m02: Empty Recycle Bin E1486.001: Ransom Note E1203.m03: File Transfer Protocol (FTP) Servers E1203.m02: Java-based Web Servers E1203.m04: Red Hat JBoss Enterprise Products E1203.m01: Remote Desktop Protocols E1203.m05: Sysinternals E1203.m06: Windows Utilities E1643.m02: Advertisement Replacement Fraud E1643.m01: Click Hijacking B0042.001: CDROM B0042.002: Mouse B0042.003: Printer B0022.001: Reverse Shell B0018.002: Cryptojacking B0018.001: Password Cracking Impact E1105: Ingress Tool Transfer B0026: Malicious Network Driver B0020: Send Email B0021: Send Poisoned Text Message E1195: Supply Chain Compromise E1195.m01: Abuse Enterprise Certificates E1195.m02: Exploit Private APIs Lateral Movement C0007: Allocate Memory C0008: Change Memory Protection C0044: Free Memory C0006: Heap Spray C0010: Overflow Buffer C0009: Stack Pivot C0008.002: Executable Heap C0008.001: Executable Stack Memory Micro-objective C0033: Console C0034: Environment Variable C0036: Registry C0035: Wallpaper C0034.001: Set Variable C0036.004: Create Registry Key C0036.002: Delete Registry Key C0036.007: Delete Registry Value C0036.003: Open Registry Key C0036.005: Query Registry Key C0036.006: Query Registry Value C0036.001: Set Registry Value Operating System Micro-objective F0013: Bootkit F0009: Component Firmware F0005: Hidden Files and Directories E1564: Hide Artifacts F0015: Hijack Execution Flow E1105: Ingress Tool Transfer B0047: Install Insecure or Malicious Configuration F0010: Kernel Modules and Extensions B0026: Malicious Network Driver F0011: Modify Existing Service E1112: Modify Registry F0012: Registry Run Keys / Startup Folder B0022: Remote Access B0035: Shutdown Event F0009.001: Router Firmware F0005.003: Attribute F0005.001: Extension F0005.002: Location F0005.004: Timestamp E1564.m02: Direct Kernel Object Manipulation E1564.m05: Hidden Kernel Modules E1564.m03: Hidden Processes E1564.m04: Hidden Services E1564.m01: Hidden Userspace Libraries F0015.006: Abuse Windows Function Calls F0015.001: Export Address Table Hooking F0015.003: Import Address Table Hooking F0015.002: Inline Patching F0015.007: Procedure Hooking F0015.004: Shadow System Service Dispatch Table Hooking F0015.005: System Service Dispatch Table Hooking F0010.001: Device Driver B0022.001: Reverse Shell Persistence F0015: Hijack Execution Flow F0016: Install Certificate F0010: Kernel Modules and Extensions F0011: Modify Existing Service E1055: Process Injection F0015.006: Abuse Windows Function Calls F0015.001: Export Address Table Hooking F0015.003: Import Address Table Hooking F0015.002: Inline Patching F0015.007: Procedure Hooking F0015.004: Shadow System Service Dispatch Table Hooking F0015.005: System Service Dispatch Table Hooking F0010.001: Device Driver E1055.004: Asynchronous Procedure Call E1055.001: Dynamic-link Library Injection E1055.011: Extra Window Memory Injection E1055.m01: Hook Injection via SetWindowsHooksEx E1055.m02: Injection and Persistence via Registry Modification E1055.m03: Injection using Shims E1055.m05: Injection via Windows Fibers E1055.m04: Patch Process Command Line E1055.002: Portable Executable Injection E1055.012: Process Hollowing E1055.003: Thread Execution Hijacking Privilege Escalation C0040: Allocate Thread Local Storage C0043: Check Mutex C0042: Create Mutex C0017: Create Process C0038: Create Thread C0064: Enumerate Threads C0065: Open Process C0066: Open Thread C0054: Resume Thread C0072: Set Thread Context C0041: Set Thread Local Storage Value C0055: Suspend Thread C0018: Terminate Process C0039: Terminate Thread C0070: Unmap Section View C0071: Write Process Memory C0017.001: Create Process via Shellcode C0017.002: Create Process via WMI C0017.003: Create Suspended Process Process Micro-objective Capture Evasion Conditional Execution Debugger Detection Debugger Evasion Dynamic Analysis Evasion Emulator Detection Emulator Evasion Executable Code Virtualization Hooking Memory Dump Evasion Sandbox Detection Software Packing Virtual Machine Detection Multiple Stages of Loaders Memory-only Payload Encrypted Payloads Runs as Service Environmental Keys Suicide Exit GetVolumeInformation Secure Triggers Deposited Keys Host Fingerprint Check Token Check CloseHandle WudfIsAnyDebuggerPresent Software Breakpoints TIB Aware Timing/Delay Check SetHandleInformation Interrupt 1 TLS Callbacks Parent Process Memory Breakpoints Stack Canary Timing/Delay Check QueryPerformanceCounter Timing/Delay Check GetTickCount Interrupt 0x2d Page Exception Breakpoint Detection Anti-debugging Instructions NtYieldExecution/SwitchToThread ProcessHeap Process Environment Block IsDebugged API Hook Detection Debugger Artifacts NtQueryInformationProcess SeDebugPrivilege OutputDebugString IsDebuggerPresent RtlAdjustPrivilege Memory Write Watching Process Environment Block NtGlobalFlag CheckRemoteDebuggerPresent Hardware Breakpoints NtSetInformationThread NtQueryObject UnhandledExceptionFilter Monitoring Thread Process Jobs Process Environment Block BeingDebugged Process Environment Block Hook Interrupt Self-Unmapping Get Base Indirectly Code Integrity Check Self-Debugging Change SizeOfImage Malloc Use Static Linking Use Interrupts Return Obfuscation Byte Stealing Inlining Pre-Debug Thread Timeout Section Misalignment Tampering Pipeline Misdirection Break Point Clearing Guard Pages Relocate API Code Exception Misdirection RtlAdjustPrivilege Loop Escapes Modify PE Header Nanomites Parallel Threads Block Interrupts Obfuscate Library Use Stolen API Code Import Obfuscation Hook File System Alternative ntdll.dll Illusion Demo Mode Hook Interrupt Delayed Execution Data Flood Encode File Restart Drop Code Check Emulator-related Registry Keys Check for Emulator-related Files Failed Network Connections Check for WINE Version Extra Loops/Time Locks Different Opcode Sets Undocumented Opcodes Unusual/Undocumented API Calls Multiple VMs Procedure Hooking Shadow SDT Hooking Import Address Table (IAT) Hooking Inline Patching Export Address Table (EAT) Hooking System Service Dispatch Table Hooking Hook memory mapping APIs Code Encryption in Memory Hide virtual memory Tampering Erase the PE header SizeOfImage Patch MmGetPhysicalMemoryRanges Guard Pages Feed Misinformation Flow Opcode Obstruction On-the-Fly APIs Screen Resolution Testing Self Check Timing/Date Check Product Key/ID Testing Timing/Uptime Check Check Clipboard Data Human User Check Check Files Injected DLL Testing Confuser Custom Compression Custom Compression of Data VMProtect Themida Nested Packing Standard Compression of Data Standard Compression of Code Armadillo ASPack Standard Compression Custom Compression of Code UPX Check Windows Modern Specs Check - Processor count Check Registry Keys Check Running Services Instruction Testing - CPUID Check Windows - Window size Human User Check Modern Specs Check - Keyboard layout HTML5 Performance Object Check Check Windows - Unique windows Modern Specs Check - USB drive Instruction Testing - VPCEXT Instruction Testing Instruction Testing - RDTSC Check Named System Objects Instruction Testing - VMCPUID Modern Specs Check - Printer Modern Specs Check Instruction Testing - SIDT (red pill) Check Software Check Windows - Title bars Instruction Testing - SMSW Instruction Testing - STR Unique Hardware/Firmware Check - CPU Location Instruction Testing - SGDT/SLDT (no pill) Guest Process Testing Check File and Directory Artifacts Unique Hardware/Firmware Check - I/O Communication Port Check Processes Instruction Testing - IN Check Virtual Devices Unique Hardware/Firmware Check - CPU Name Unique Hardware/Firmware Check - BIOS Modern Specs Check - Drive size Check Memory Artifacts Unique Hardware/Firmware Check - MAC Address Modern Specs Check - Total physical memory Unique Hardware/Firmware Check Anti-Behavioral Analysis Call Graph Generation Evasion Data Flow Analysis Evasion Disassembler Evasion Executable Code Obfuscation Executable Code Optimization Executable Code Virtualization Obfuscated Files or Information Software Packing Two-layer Function Return Invoke NTDLL System Calls via Encoded Table Control Dependence Implicit Flows Arbitrary Memory Corruption Argument Obfuscation Conditional Misdirection VBA Stomping Variable Recomposition Value Dependent Jumps API Hashing Stack Strings Code Insertion Dead Code Insertion Data Value Obfuscation Interleaving Code Jump Insertion Fake Code Insertion Entry Point Obfuscation Junk Code Insertion Import Address Table Obfuscation Merged Code Sections Import Compression Symbol Obfuscation Structured Exception Handling (SEH) Instruction Overlap Thunk Code Insertion Guard Pages Minification Jump/Call Absolute Address Multiple VMs Encryption of Data Encryption-Custom Algorithm Encoding Encryption of Code Encryption-Standard Algorithm Encryption Encoding-Custom Algorithm Encoding-Standard Algorithm Confuser Custom Compression Custom Compression of Data VMProtect Themida Nested Packing Standard Compression of Data Standard Compression of Code Armadillo ASPack Standard Compression Custom Compression of Code UPX Anti-Static Analysis Cryptocurrency Hooking Input Capture Keylogging Screen Capture Bitcoin Ethereum Zcash Procedure Hooking Shadow SDT Hooking Import Address Table (IAT) Hooking Inline Patching Export Address Table (EAT) Hooking System Service Dispatch Table Hooking Mouse Events Application Hook Polling WinAPI Collection C2 Communication Domain Name Generation Ingress Tool Transfer Directory Listing Request Email Template Request Command Request Email Address List Send Data Send Heartbeat Execute Shell Command Receive Data Start Interactive Shell Implant to Controller File Transfer Server to Client File Transfer Execute File Send System Information Authenticate Check for Payload File search Command and Control Cryptocurrency Hooking Input Capture Keylogging Screen Capture Bitcoin Ethereum Zcash Procedure Hooking Shadow SDT Hooking Import Address Table (IAT) Hooking Inline Patching Export Address Table (EAT) Hooking System Service Dispatch Table Hooking Mouse Events Application Hook Polling WinAPI Credential Access Alternative Installation Location Bootkit Bypass Data Execution Prevention Component Firmware Conditional Execution Covert Location Disable or Evade Security Tools Hidden Artifacts Hidden Files and Directories Hijack Execution Flow Hooking Indicator Blocking Install Insecure or Malicious Configuration Modify Registry Obfuscated Files or Information Polymorphic Code Process Injection Rootkit Self Deletion Software Packing Registry Install Fileless Malware ROP Chains Router Firmware Runs as Service Environmental Keys Suicide Exit GetVolumeInformation Secure Triggers Deposited Keys Host Fingerprint Check Token Check Hide Data in Registry Steganography Heavens Gate Modify Policy AMSI Bypass Disable Code Integrity Disable Kernel Patch Protection Disable System File Overwrite Protection Bypass Windows File Protection Force Lazy Writing Unhook APIs Hidden Userspace Libraries Hidden Services Hidden Kernel Modules Hidden Processes Direct Kernel Object Manipulation Location Timestamp Extension Attribute Import Address Table (IAT) Hooking Abuse Windows Function Calls System Service Dispatch Table Hooking Export Address Table (EAT) Hooking Inline Patching Shadow System Service Dispatch Table Hooking Procedure Hooking Shadow SDT Hooking Import Address Table (IAT) Hooking Inline Patching Export Address Table (EAT) Hooking System Service Dispatch Table Hooking Remove SMS Warning Messages Encryption of Data Encryption-Custom Algorithm Encoding Encryption of Code Encryption-Standard Algorithm Encryption Encoding-Custom Algorithm Encoding-Standard Algorithm Packer Stub Code Reordering Call Indirections Patch Process Command Line Hook Injection via SetWindowsHooksEx Injection via Windows Fibers Injection and Persistence via Registry Modification Injection using Shims Hypervisor/Virtualized Rootkit Hardware/Firmware Rootkit Application Rootkit Memory Rootkit Kernel Mode Rootkit Bootloader COMSPEC Environment Variable Confuser Custom Compression Custom Compression of Data VMProtect Themida Nested Packing Standard Compression of Data Standard Compression of Code Armadillo ASPack Standard Compression Custom Compression of Code UPX Defense Evasion Analysis Tool Discovery Application Window Discovery Code Discovery File and Directory Discovery Self Discovery SMTP Connection Discovery System Information Discovery Taskbar Discovery Process detection - Debuggers Process detection - PCAP Utilities Process detection - Process Utilities Process detection - SysInternals Suite Tools Process detection - PE Utilities Process detection Known File Location Known Window Process detection - Sandboxes Window Text Enumerate PE Sections Parse PE Header Inspect Section Memory Permissions Log File Generate Windows Exception Discovery Command and Scripting Interpreter Conditional Execution Execution Dependency Exploitation for Client Execution Install Additional Program Prevent Concurrent Execution Remote Commands Send Email Send Poisoned Text Message System Services User Interaction Runs as Service Environmental Keys Suicide Exit GetVolumeInformation Secure Triggers Deposited Keys Host Fingerprint Check Token Check Remote Desktop Protocols (RDP) Sysinternals File Transfer Protocol (FTP) Servers Java-based Web Servers Windows Utilities Red Hat JBoss Enterprise Products Delete File Execute Sleep Uninstall Upload File Shutdown Download File MSDTC Execution Archive Collected Data Automated Exfiltration Encoding - Standard Encoding Encryption - Standard Encryption Encryption - Custom Encryption Encoding Encoding - Custom Encoding Encryption Exfiltrate via File Hosting Service Exfiltration Clipboard Modification Component Firmware Compromise Data Integrity Data Destruction Data Encrypted for Impact Denial of Service Destroy Hardware Disk Wipe Exploit Kit Behavior Exploitation for Client Execution Generate Fraudulent Advertising Revenue Manipulate Network Traffic Modify Hardware Remote Access Resource Hijacking Spamming Router Firmware Empty Recycle Bin Delete Application/Software Delete Shadow Copies Ransom Note Remote Desktop Protocols (RDP) Sysinternals File Transfer Protocol (FTP) Servers Java-based Web Servers Windows Utilities Red Hat JBoss Enterprise Products Click Hijacking Advertisement Replacement Fraud Mouse CDROM Printer Reverse Shell Cryptojacking Password Cracking Impact Malicious Network Driver Ingress Tool Transfer Send Email Send Poisoned Text Message Supply Chain Compromise Exploit Private APIs Abuse Enterprise Certificates Lateral Movement DNS Communication FTP Communication HTTP Communication ICMP Communication Interprocess Communication SMTP Communication Socket Communication WinINet Resolve TLD::DNS Communication DDNS Domain Connect::DNS Communication Resolve Free Hosting Domain::DNS Communication Resolve::DNS Communication Server Connect::DNS Communication Send File::FTP Communication WinINet::FTP Communication Client::HTTP Communication Connect to Server::HTTP Communication Get Response::HTTP Communication Send Request::HTTP Communication Open URL::HTTP Communication WinINet::HTTP Communication Receive Request::HTTP Communication Set Header::HTTP Communication Send Data::HTTP Communication IWebBrowser::HTTP Communication Send Response::HTTP Communication Create Request::HTTP Communication Server::HTTP Communication Extract Body::HTTP Communication Read Header::HTTP Communication WinHTTP::HTTP Communication Start Server::HTTP Communication Download URL::HTTP Communication Echo Request::ICMP Communication Generate Traffic::ICMP Communication Create Pipe::Interprocess Communication Read Pipe::Interprocess Communication Write Pipe::Interprocess Communication Connect Pipe::Interprocess Communication Request::SMTP Communication Server Connect::SMTP Communication Send UDP Data::Socket Communication Receive TCP Data::Socket Communication Start TCP Server::Socket Communication Receive Data::Socket Communication UDP Client::Socket Communication Get Socket Status::Socket Communication Receive UDP Data::Socket Communication Send Data::Socket Communication Send TCP Data::Socket Communication Initialize Winsock Library::Socket Communication TCP Client::Socket Communication Connect Socket::Socket Communication Create TCP Socket::Socket Communication Create Socket::Socket Communication Set Socket Config::Socket Communication Create UDP Socket::Socket Communication TCP Server::Socket Communication InternetOpen::WinINet InternetOpenURL::WinINet InternetWriteFile::WinINet InternetReadFile::WinINet InternetConnect::WinINet Communication Micro-objective Crypto Library Cryptographic Hash Decrypt Data Encrypt Data Encryption Key Generate Pseudo-random Sequence Hashed Message Authentication Code SHA1::Cryptographic Hash SHA256::Cryptographic Hash SHA224::Cryptographic Hash MD5::Cryptographic Hash Snefru::Cryptographic Hash Tiger::Cryptographic Hash Twofish::Decrypt Data Skipjack::Decrypt Data Blowfish::Decrypt Data HC-128::Decrypt Data AES::Decrypt Data RC4::Decrypt Data Stream Cipher::Decrypt Data Block Cipher::Decrypt Data Camellia::Decrypt Data HC-256::Decrypt Data 3DES::Decrypt Data Sosemanuk::Decrypt Data RC6::Decrypt Data RSA::Decrypt Data RSA::Encrypt Data Block Cipher::Encrypt Data AES::Encrypt Data Stream Cipher::Encrypt Data RC6::Encrypt Data Camellia::Encrypt Data HC-256::Encrypt Data Twofish::Encrypt Data Blowfish::Encrypt Data HC-128::Encrypt Data Skipjack::Encrypt Data RC4::Encrypt Data 3DES::Encrypt Data Sosemanuk::Encrypt Data Import Public Key::Encryption Key RC4 KSA::Encryption Key GetTickCount::Generate Pseudo-random Sequence Mersenne Twister::Generate Pseudo-random Sequence Use API::Generate Pseudo-random Sequence rand::Generate Pseudo-random Sequence RC4 PRGA::Generate Pseudo-random Sequence Cryptography Micro-objective Check String Checksum Compress Data Compression Library Decode Data Decompress Data Encode Data Modulo Non-Cryptographic Hash Use Constant BSD::Checksum Luhn::Checksum CRC32::Checksum Adler::Checksum Verhoeff::Checksum QuickLZ::Compress Data IEncodingFilterFactory::Compress Data Base64::Decode Data XOR::Decode Data aPLib::Decompress Data IEncodingFilterFactory::Decompress Data QuickLZ::Decompress Data XOR::Encode Data Base64::Encode Data Fast-Hash::Non-Cryptographic Hash MurmurHash::Non-Cryptographic Hash dhash::Non-Cryptographic Hash pHash::Non-Cryptographic Hash FNV::Non-Cryptographic Hash Data Micro-objective Alter File Extension Copy File Create Directory Create File Delete Directory Delete File Get File Attributes Move File Read File Read Virtual Disk Set File Attributes Writes File Append Extension::Alter File Extension Create Office Document::Create File Create Ransomware File::Create File File System Micro-objective Install Driver Load Driver Simulate Hardware Minifilter::Install Driver Minifilter::Load Driver Mouse Click::Simulate Hardware Ctrl-Alt-Del::Simulate Hardware Hardware Micro-objective Allocate Memory Change Memory Protection Free Memory Heap Spray Overflow Buffer Stack Pivot Executable Stack::Change Memory Protection Executable Heap::Change Memory Protection Memory Micro-objective Console Environment Variable Registry Wallpaper Get Variable::Environment Variable Set Variable::Environment Variable Create Registry Key::Registry Delete Registry Key::Registry Set Registry Key::Registry Query Registry Key::Registry Delete Registry Value::Registry Open Registry Key::Registry Query Registry Value::Registry Operating System Micro-objective Allocate Thread Local Storage Check Mutex Create Mutex Create Process Create Thread Enumerate Threads Open Process Open Thread Resume Thread Set Thread Local Storage Value Suspend Thread Synchronization Terminate Process Terminate Thread Create Process via Shellcode::Create Process Create Suspended Process::Create Process Create Process via WMI::Create Process Create Mutex::Synchronization Process Micro-objective Bootkit Component Firmware Hidden Artifacts Hidden Files and Directories Hijack Execution Flow Hooking Install Insecure or Malicious Configuration Kernel Modules and Extensions Malicious Network Driver Modify Existing Service Modify Registry Registry Run Keys / Startup Folder Remote Access Ingress Tool Transfer Shutdown Event Router Firmware Hidden Userspace Libraries Hidden Services Hidden Kernel Modules Hidden Processes Direct Kernel Object Manipulation Location Timestamp Extension Attribute Import Address Table (IAT) Hooking Abuse Windows Function Calls System Service Dispatch Table Hooking Export Address Table (EAT) Hooking Inline Patching Shadow System Service Dispatch Table Hooking Procedure Hooking Shadow SDT Hooking Import Address Table (IAT) Hooking Inline Patching Export Address Table (EAT) Hooking System Service Dispatch Table Hooking Device Driver Reverse Shell Persistence Hijack Execution Flow Hooking Kernel Modules and Extensions Modify Existing Service Process Injection Import Address Table (IAT) Hooking Abuse Windows Function Calls System Service Dispatch Table Hooking Export Address Table (EAT) Hooking Inline Patching Shadow System Service Dispatch Table Hooking Procedure Hooking Shadow SDT Hooking Import Address Table (IAT) Hooking Inline Patching Export Address Table (EAT) Hooking System Service Dispatch Table Hooking Device Driver Patch Process Command Line Hook Injection via SetWindowsHooksEx Injection via Windows Fibers Injection and Persistence via Registry Modification Injection using Shims Privilege Escalation Capture Evasion Conditional Execution Debugger Detection Debugger Evasion Dynamic Analysis Evasion Emulator Detection Emulator Evasion Executable Code Virtualization Hijack Execution Flow Memory Dump Evasion Sandbox Detection Software Packing Virtual Machine Detection Encrypted Payloads Memory-only Payload Multiple Stages of Loaders Deposited Keys Environmental Keys GetVolumeInformation Host Fingerprint Check Runs as Service Secure Triggers Suicide Exit Token Check Anti-debugging Instructions API Hook Detection Check Processes CheckRemoteDebuggerPresent CloseHandle Debugger Artifacts Hardware Breakpoints Interruption IsDebuggerPresent Memory Breakpoints Memory Write Watching Monitoring Thread NtQueryInformationProcess NtQueryObject NtSetInformationThread NtYieldExecution/SwitchToThread OutputDebugString Page Exception Breakpoint Detection Parent Process Process Environment Block Process Environment Block BeingDebugged Process Environment Block IsDebugged Process Environment Block NtGlobalFlag Process Jobs ProcessHeap RtlAdjustPrivilege SeDebugPrivilege SetHandleInformation Software Breakpoints Stack Canary TIB Aware Timing/Delay Check Timing/Delay Check GetTickCount Timing/Delay Check QueryPerformanceCounter TLS Callbacks UnhandledExceptionFilter WudfIsAnyDebuggerPresent Block Interrupts Break Point Clearing Byte Stealing Change SizeOfImage Code Integrity Check Exception Misdirection Get Base Indirectly Guard Pages Hook Interrupt Import Obfuscation Inlining Loop Escapes Malloc Use Modify PE Header Nanomites Obfuscate Library Use Parallel Threads Pipeline Misdirection Pre-Debug Relocate API Code Return Obfuscation RtlAdjustPrivilege Section Misalignment Self-Debugging Self-Unmapping Static Linking Stolen API Code Tampering Thread Timeout Use Interrupts Alternative ntdll.dll API Hammering Code Integrity Check Data Flood Delayed Execution Demo Mode Drop Code Encode File Hook File System Hook Interrupt Illusion Restart Check Emulator-related Registry Keys Check for Emulator-related Files Check for WINE Version Failed Network Connections Different Opcode Sets Extra Loops/Time Locks Undocumented/Unimplemented Opcodes Unusual/Undocumented API Calls Multiple VMs Abuse Windows Function Calls Export Address Table Hooking Import Address Table Hooking Inline Patching Procedure Hooking Shadow System Service Dispatch Table Hooking System Service Dispatch Table Hooking Code Encryption in Memory Erase the PE header Feed Misinformation Flow Opcode Obstruction Guard Pages Hide virtual memory Hook memory mapping APIs On-the-Fly APIs Patch MmGetPhysicalMemoryRanges SizeOfImage Tampering Check Clipboard Data Check Files Human User Check Injected DLL Testing Product Key/ID Testing Screen Resolution Testing Self Check Test API Routines Timing/Date Check Timing/Uptime Check Armadillo ASPack Confuser Custom Compression Custom Compression of Code Custom Compression of Data Nested Packing Standard Compression Standard Compression of Code Standard Compression of Data Themida UPX VMProtect Check File and Directory Artifacts Check Memory Artifacts Check Named System Objects Check Processes Check Registry Keys Check Running Services Check Software Check Virtual Devices Check Windows Check Windows - Title bars Check Windows - Unique windows Check Windows - Window size Guest Process Testing HTML5 Performance Object Check Human User Check Instruction Testing Instruction Testing - CPUID Instruction Testing - IN Instruction Testing - RDTSC Instruction Testing - SGDT/SLDT (no pill) Instruction Testing - SIDT (red pill) Instruction Testing - SMSW Instruction Testing - STR Instruction Testing - VMCPUID Instruction Testing - VPCEXT Modern Specs Check Modern Specs Check - Drive size Modern Specs Check - Keyboard layout Modern Specs Check - Printer Modern Specs Check - Processor count Modern Specs Check - Total physical memory Modern Specs Check - USB drive Unique Hardware/Firmware Check Unique Hardware/Firmware Check - BIOS Unique Hardware/Firmware Check - CPU Location Unique Hardware/Firmware Check - CPU Name Unique Hardware/Firmware Check - I/O Communication Port Unique Hardware/Firmware Check - MAC Address Anti-Behavioral Analysis Call Graph Generation Evasion Data Flow Analysis Evasion Disassembler Evasion Executable Code Obfuscation Executable Code Optimization Executable Code Virtualization Obfuscated Files or Information Software Packing Invoke NTDLL System Calls via Encoded Table Shadow Process Communication Two-layer Function Return Arbitrary Memory Corruption Control Dependence Implicit Flows Argument Obfuscation Conditional Misdirection Desynchronizing Opaque Predicates Fake Function Value Dependent Jumps VBA Stomping API Hashing Argument Obfuscation Code Insertion Data Value Obfuscation Dead Code Insertion Entry Point Obfuscation Fake Code Insertion Guard Pages Import Address Table Obfuscation Import Compression Instruction Overlap Interleaving Code Jump Insertion Junk Code Insertion Opaque Predicate Stack Strings Structured Exception Handling (SEH) Symbol Obfuscation Thunk Code Insertion Variable Recomposition Jump/Call Absolute Address Minification Multiple VMs Encoding Encoding - Custom Algorithm Encoding - Standard Algorithm Encryption Encryption - Custom Algorithm Encryption - Standard Algorithm Encryption of Code Encryption of Data Armadillo ASPack Confuser Custom Compression Custom Compression of Code Custom Compression of Data Nested Packing Standard Compression Standard Compression of Code Standard Compression of Data Themida UPX VMProtect Anti-Static Analysis Archive Collected Data Cryptocurrency Hijack Execution Flow Input Capture Keylogging Screen Capture Encoding Encoding - Custom Algorithm Encoding - Standard Algorithm Encryption Encryption - Custom Algorithm Encryption - Standard Algorithm Bitcoin Ethereum Zcash Abuse Windows Function Calls Export Address Table Hooking Import Address Table Hooking Inline Patching Procedure Hooking Shadow System Service Dispatch Table Hooking System Service Dispatch Table Hooking Mouse Events Application Hook Polling WinAPI Collection C2 Communication Domain Name Generation Ingress Tool Transfer Authenticate Check for Payload Directory Listing Execute File Execute Shell Command File search Implant to Controller File Transfer Receive Data Request Command Request Email Address List Request Email Template Send Data Send Heartbeat Send System Information Server to Client File Transfer Start Interactive Shell Command and Control DNS Communication FTP Communication HTTP Communication ICMP Communication Interprocess Communication SMTP Communication Socket Communication WinINet DDNS Domain Connect Resolve Resolve Free Hosting Domain Resolve TLD Server Connect Send File WinINet Client Connect to Server Create Request Download URL Extract Body Get Response IWebBrowser Open URL Read Header Receive Request Send Data Send Request Send Response Server Set Header Start Server WinHTTP WinINet Echo Request Generate Traffic Connect Pipe Create Pipe Read Pipe Write Pipe Request Server Connect Connect Socket Create Socket Create TCP Socket Create UDP Socket Get Socket Status Initialize Winsock Library Receive Data Receive TCP Data Receive UDP Data Send Data Send TCP Data Send UDP Data Set Socket Config Start TCP Server TCP Client TCP Server UDP Client InternetConnect InternetOpen InternetOpenURL InternetReadFile InternetWriteFile Communication Micro-objective Cryptocurrency Hijack Execution Flow Input Capture Keylogging Screen Capture Bitcoin Ethereum Zcash Abuse Windows Function Calls Export Address Table Hooking Import Address Table Hooking Inline Patching Procedure Hooking Shadow System Service Dispatch Table Hooking System Service Dispatch Table Hooking Mouse Events Application Hook Polling WinAPI Credential Access Crypto Algorithm Crypto Constant Crypto Library Cryptographic Hash Decrypt Data Encrypt Data Encryption Key Generate Pseudo-random Sequence Hashed Message Authentication Code API Call Static Public Library MD5 SHA1 SHA224 SHA256 Snefru Tiger 3DES AES Block Cipher Blowfish Camellia HC-128 HC-256 RC4 RC6 RSA Skipjack Sosemanuk Stream Cipher Twofish 3DES AES Block Cipher Blowfish Camellia HC-128 HC-256 RC4 RC6 RSA Skipjack Sosemanuk Stream Cipher Twofish Import Public Key RC4 KSA GetTickCount rand RC4 PRGA Use API Cryptography Micro-objective Check String Checksum Compress Data Compression Library Decode Data Decompress Data Encode Data Modulo Non-Cryptographic Hash Use Constant Adler BSD CRC32 Luhn IEncodingFilterFactory QuickLZ Base64 XOR aPLib IEncodingFilterFactory QuickLZ Base64 XOR dhash djb2 Fast-Hash FNV MurmurHash pHash Data Micro-objective Alternative Installation Location Bootkit Bypass Data Execution Prevention Component Firmware Conditional Execution Covert Location Disable or Evade Security Tools Hidden Files and Directories Hide Artifacts Hijack Execution Flow Indicator Blocking Install Insecure or Malicious Configuration Modify Registry Obfuscated Files or Information Polymorphic Code Process Injection Rootkit Self Deletion Software Packing Fileless Malware Registry Install ROP Chains Router Firmware Deposited Keys Environmental Keys GetVolumeInformation Host Fingerprint Check Runs as Service Secure Triggers Suicide Exit Token Check Hide Data in Registry Steganography AMSI Bypass Bypass Windows File Protection Disable Code Integrity Disable Kernel Patch Protection Disable System File Overwrite Protection Force Lazy Writing Heavens Gate Modify Policy Unhook APIs Attribute Extension Location Timestamp Direct Kernel Object Manipulation Hidden Kernel Modules Hidden Processes Hidden Services Hidden Userspace Libraries Abuse Windows Function Calls Export Address Table Hooking Import Address Table Hooking Inline Patching Procedure Hooking Shadow System Service Dispatch Table Hooking System Service Dispatch Table Hooking Remove SMS Warning Messages Encoding Encoding - Custom Algorithm Encoding - Standard Algorithm Encryption Encryption - Custom Algorithm Encryption - Standard Algorithm Encryption of Code Encryption of Data Call Indirections Code Reordering Packer Stub Asynchronous Procedure Call Dynamic-link Library Injection Extra Window Memory Injection Hook Injection via SetWindowsHooksEx Injection and Persistence via Registry Modification Injection using Shims Injection via Windows Fibers Patch Process Command Line Portable Executable Injection Process Hollowing Thread Execution Hijacking Application Rootkit Bootloader Hardware/Firmware Rootkit Hypervisor/Virtualized Rootkit Kernel Mode Rootkit Memory Rootkit COMSPEC Environment Variable Armadillo ASPack Confuser Custom Compression Custom Compression of Code Custom Compression of Data Nested Packing Standard Compression Standard Compression of Code Standard Compression of Data Themida UPX VMProtect Defense Evasion Analysis Tool Discovery Application Window Discovery Code Discovery File and Directory Discovery References Self Discovery SMTP Connection Discovery System Information Discovery Known File Location Known Window Known Windows Class Name Process detection Process detection - Debuggers Process detection - PCAP Utilities Process detection - PE Utilities Process detection - Process Utilities Process detection - Sandboxes Process detection - SysInternals Suite Tools Window Text Enumerate PE Sections Inspect Section Memory Permissions Parse PE Header Filter by Extension Log File Check Magic String Check Section Length Use Hashquine Enumerate Environment Variables Generate Windows Exception Discovery Command and Scripting Interpreter Conditional Execution Execution Dependency Exploitation for Client Execution Install Additional Program Prevent Concurrent Execution Remote Commands Send Email Send Poisoned Text Message System Services User Execution Deposited Keys Environmental Keys GetVolumeInformation Host Fingerprint Check Runs as Service Secure Triggers Suicide Exit Token Check File Transfer Protocol (FTP) Servers Java-based Web Servers Red Hat JBoss Enterprise Products Remote Desktop Protocols Sysinternals Windows Utilities Delete File Download File Execute Shutdown Sleep Uninstall Upload File MSDTC Execution Automated Exfiltration Exfiltrate via File Hosting Service Exfiltration Alter File Extension Copy File Create Directory Create File Delete Directory Delete File Get File Attributes Move File Read File Read Virtual Disk Set File Attributes Writes File Append Extension Create Office Document Create Ransomware File File System Micro-objective Install Driver Load Driver Simulate Hardware Minifilter Minifilter Ctrl-Alt-Del Mouse Click Hardware Micro-objective Clipboard Modification Component Firmware Compromise Data Integrity Data Destruction Data Encrypted for Impact Denial of Service Destroy Hardware Disk Wipe Exploit Kit Exploitation for Client Execution Generate Traffic from Victim Manipulate Network Traffic Modify Hardware Remote Access Resource Hijacking Spamming Router Firmware Delete Application/Software Delete Shadow Copies Empty Recycle Bin Ransom Note File Transfer Protocol (FTP) Servers Java-based Web Servers Red Hat JBoss Enterprise Products Remote Desktop Protocols Sysinternals Windows Utilities Advertisement Replacement Fraud Click Hijacking CDROM Mouse Printer Reverse Shell Cryptojacking Password Cracking Impact Ingress Tool Transfer Malicious Network Driver Send Email Send Poisoned Text Message Supply Chain Compromise Abuse Enterprise Certificates Exploit Private APIs Lateral Movement Allocate Memory Change Memory Protection Free Memory Heap Spray Overflow Buffer Stack Pivot Executable Heap Executable Stack Memory Micro-objective Console Environment Variable Registry Wallpaper Set Variable Create Registry Key Delete Registry Key Delete Registry Value Open Registry Key Query Registry Key Query Registry Value Set Registry Value Operating System Micro-objective Bootkit Component Firmware Hidden Files and Directories Hide Artifacts Hijack Execution Flow Ingress Tool Transfer Install Insecure or Malicious Configuration Kernel Modules and Extensions Malicious Network Driver Modify Existing Service Modify Registry Registry Run Keys / Startup Folder Remote Access Shutdown Event Router Firmware Attribute Extension Location Timestamp Direct Kernel Object Manipulation Hidden Kernel Modules Hidden Processes Hidden Services Hidden Userspace Libraries Abuse Windows Function Calls Export Address Table Hooking Import Address Table Hooking Inline Patching Procedure Hooking Shadow System Service Dispatch Table Hooking System Service Dispatch Table Hooking Device Driver Reverse Shell Persistence Hijack Execution Flow Install Certificate Kernel Modules and Extensions Modify Existing Service Process Injection Abuse Windows Function Calls Export Address Table Hooking Import Address Table Hooking Inline Patching Procedure Hooking Shadow System Service Dispatch Table Hooking System Service Dispatch Table Hooking Device Driver Asynchronous Procedure Call Dynamic-link Library Injection Extra Window Memory Injection Hook Injection via SetWindowsHooksEx Injection and Persistence via Registry Modification Injection using Shims Injection via Windows Fibers Patch Process Command Line Portable Executable Injection Process Hollowing Thread Execution Hijacking Privilege Escalation Allocate Thread Local Storage Check Mutex Create Mutex Create Process Create Thread Enumerate Threads Open Process Open Thread Resume Thread Set Thread Context Set Thread Local Storage Value Suspend Thread Terminate Process Terminate Thread Unmap Section View Write Process Memory Create Process via Shellcode Create Process via WMI Create Suspended Process Process Micro-objective