From b934db350176acacfb6bb457d3704154e1eefe55 Mon Sep 17 00:00:00 2001 From: Dez Beck Date: Tue, 9 Aug 2022 11:29:30 -0400 Subject: [PATCH] mbc behavior related techniques --- anti-behavioral-analysis/detect-sandbox.md | 4 ++-- anti-behavioral-analysis/detect-vm.md | 2 +- anti-behavioral-analysis/evade-dynamic-analysis.md | 2 +- command-and-control/domain-name-generate.md | 4 ++-- execution/send-email.md | 2 +- impact/compromise-data.md | 4 ++-- impact/denial-of-service.md | 4 ++-- impact/hijack-sys-resources.md | 4 ++-- impact/manipulate-network-traffic.md | 4 ++-- 9 files changed, 15 insertions(+), 15 deletions(-) diff --git a/anti-behavioral-analysis/detect-sandbox.md b/anti-behavioral-analysis/detect-sandbox.md index fd82ac5..7d02cb7 100644 --- a/anti-behavioral-analysis/detect-sandbox.md +++ b/anti-behavioral-analysis/detect-sandbox.md @@ -9,7 +9,7 @@ Sandbox Detection ================= Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path. -The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior. +The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK techniques were defined subsequent to this MBC behavior. Methods ------- @@ -17,7 +17,7 @@ Methods |---|---|---| |**Check Clipboard Data**|B0007.001|Checks clipboard data which can be used to detect whether execution is inside a sandbox.| |**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.| -|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| +|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.| |**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.| |**Product Key/ID Testing**|B0007.005|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.| |**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.| diff --git a/anti-behavioral-analysis/detect-vm.md b/anti-behavioral-analysis/detect-vm.md index ef7fc94..a48daa4 100644 --- a/anti-behavioral-analysis/detect-vm.md +++ b/anti-behavioral-analysis/detect-vm.md @@ -9,7 +9,7 @@ Virtual Machine Detection ========================= Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1) -The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior. +The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK techniques were defined subsequent to this MBC behavior. Methods ------- diff --git a/anti-behavioral-analysis/evade-dynamic-analysis.md b/anti-behavioral-analysis/evade-dynamic-analysis.md index 4706da6..38ec3ab 100644 --- a/anti-behavioral-analysis/evade-dynamic-analysis.md +++ b/anti-behavioral-analysis/evade-dynamic-analysis.md @@ -11,7 +11,7 @@ Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an emulator-specific evasion behavior, and see [Conditional Execution](../anti-behavioral-analysis/conditional-execute.md) for a behavior that constrains dynamic execution based on environmental conditions. -The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior. +The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK techniques were defined subsequent to this MBC behavior. Methods ------- diff --git a/command-and-control/domain-name-generate.md b/command-and-control/domain-name-generate.md index 4e4acf0..3528ad1 100644 --- a/command-and-control/domain-name-generate.md +++ b/command-and-control/domain-name-generate.md @@ -2,14 +2,14 @@ |---|---| |**ID**|**B0031**| |**Objective(s)**|[Command and Control](../command-and-control)| -|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/)| +|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/)| Domain Name Generation ====================== Malware generates the domain name of the controller to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced implants; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1) -The related [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/) ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior. +The related [Dynamic Resolution: Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/) ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior. Malware Examples ---------------- diff --git a/execution/send-email.md b/execution/send-email.md index 85109a7..79b7b39 100644 --- a/execution/send-email.md +++ b/execution/send-email.md @@ -2,7 +2,7 @@ |---|---| |**ID**|**B0020**| |**Objective(s)**|[Execution](../execution), [Lateral Movement](../lateral-movement)| -|**Related ATT&CK Technique**|[Phishing](https://attack.mitre.org/techniques/T1566/)| +|**Related ATT&CK Technique**|[Phishing (T1566)](https://attack.mitre.org/techniques/T1566/)| Send Email diff --git a/impact/compromise-data.md b/impact/compromise-data.md index 1436999..d42631f 100644 --- a/impact/compromise-data.md +++ b/impact/compromise-data.md @@ -2,11 +2,11 @@ |---|---| |**ID**|**B0016**| |**Objective(s)**|[Impact](../impact)| -|**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/)| +|**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation (T1565.001)](https://attack.mitre.org/techniques/T1565/001/)| Compromise Data Integrity ========================= Data stored on the file system of a compromised system is manipulated to compromise its integrity. -The related [Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/) ATT&CK sub-technique was defined subsequent to this MBC behavior. +The related [Data Manipulation: Stored Data Manipulation (T1565.001)](https://attack.mitre.org/techniques/T1565/001/) ATT&CK sub-technique was defined subsequent to this MBC behavior. diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index 304c0a4..5a90ee3 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -2,7 +2,7 @@ |---|---| |**ID**|**B0033**| |**Objective(s)**|[Impact](../impact)| -|**Related ATT&CK Technique**|[Network Denial of Service](https://attack.mitre.org/techniques/T1498/)| +|**Related ATT&CK Technique**|[Network Denial of Service (T1498)](https://attack.mitre.org/techniques/T1498/)| Denial of Service @@ -11,7 +11,7 @@ Malware may make a network unavailable, for example, by launching a network-base Endpoint denial of service behaviors are captured by the [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499/) technique. -The related [Network Denial of Service](https://attack.mitre.org/techniques/T1498/) ATT&CK technique was defined subsequent to this MBC behavior. +The related [Network Denial of Service (T1498)](https://attack.mitre.org/techniques/T1498/) ATT&CK technique was defined subsequent to this MBC behavior. Malware Examples ---------------- diff --git a/impact/hijack-sys-resources.md b/impact/hijack-sys-resources.md index e632f0f..18366b1 100644 --- a/impact/hijack-sys-resources.md +++ b/impact/hijack-sys-resources.md @@ -2,14 +2,14 @@ |---|---| |**ID**|**B0018**| |**Objective(s)**|[Impact](../impact)| -|**Related ATT&CK Technique**|[Resource Hijacking](https://attack.mitre.org/techniques/T1496/)| +|**Related ATT&CK Technique**|[Resource Hijacking (T1496)](https://attack.mitre.org/techniques/T1496/)| Resource Hijacking ================== Uses system resources for other purposes; as a result, the system may not be available for intended uses. -The related [Resource Hijacking](https://attack.mitre.org/techniques/T1496/) ATT&CK technique was defined subsequent to this MBC behavior. +The related [Resource Hijacking (T1496)](https://attack.mitre.org/techniques/T1496/) ATT&CK technique was defined subsequent to this MBC behavior. Methods ------- diff --git a/impact/manipulate-network-traffic.md b/impact/manipulate-network-traffic.md index 665a5fe..9c5e60f 100644 --- a/impact/manipulate-network-traffic.md +++ b/impact/manipulate-network-traffic.md @@ -2,14 +2,14 @@ |---|---| |**ID**|**B0019**| |**Objective(s)**|[Impact](../impact)| -|**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/)| +|**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation (T1565.002)](https://attack.mitre.org/techniques/T1565/002/)| Manipulate Network Traffic ========================== Malware intercepts and manipulates network traffic, typically accessing or modifying data, going to or originating from the system on which the malware instance is executing. Also known as a Man-in-the-Middle attack. -The related [Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/) ATT&CK sub-technique was defined subsequent to this MBC behavior. +The related [Data Manipulation: Transmitted Data Manipulation (T1565.002)](https://attack.mitre.org/techniques/T1565/002/) ATT&CK sub-technique was defined subsequent to this MBC behavior. Malware Examples ----------------