diff --git a/README.md b/README.md
index e3ed268..15454a8 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# Malware Behavior Catalog v3.0 #
+# Malware Behavior Catalog v3.1 #
The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions, and read the [newsletters](./ynewsletters/README.md) for information on the most recent MBC updates and activity.
Open-source malware analysis tools map their output to MBC and ATT&CK:
@@ -62,7 +62,7 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**.
Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.
### STIX 2.1 Representation ###
-A STIX 2.1 representation for MBC v3.0 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9) that includes new STIX domain objects for MBC objectives, behaviors, and methods.
+A STIX 2.1 representation for MBC v3.1 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9) that includes new STIX domain objects for MBC objectives, behaviors, and methods.
### Navigator View ###
This visual representation of the MBC Matrix is based on the ATT&CK Navigator. Two views are available:
diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md
index 11aadff..6fd0642 100644
--- a/anti-behavioral-analysis/debugger-detection.md
+++ b/anti-behavioral-analysis/debugger-detection.md
@@ -17,7 +17,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-6 February 2024 |
+27 April 2024 |
@@ -129,21 +129,31 @@ Details on detecting debuggers can be found in the references.
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antidebug_checkremotedebuggerpresent](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_checkremotedebuggerpresent.py)|Debugger Detection (B0001)|CheckRemoteDebuggerPresent, NtQueryInformationProcess|
-|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection (B0001)|LdrGetDllHandle, LdrLoadDll|
-|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection::API Hook Detection (B0001.001)|LdrGetDllHandle, LdrLoadDll|
-|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection (B0001)|SetUnhandledExceptionFilter|
-|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection::UnhandledExceptionFilter (B0001.030)|SetUnhandledExceptionFilter|
-|[antidebug_addvectoredexceptionhandler](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_addvectoredexceptionhandler.py)|Debugger Detection (B0001)|AddVectoredExceptionHandler|
-|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection (B0001)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
-|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection::OutputDebugString (B0001.016)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
-|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection (B0001)|GetTickCount|
-|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|GetTickCount|
-|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection (B0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
-|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection::Memory Breakpoints (B0001.009)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
-|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection (B0001)|NtSetInformationThread|
-|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection::NtSetInformationThread (B0001.014)|NtSetInformationThread|
-|[antidebug_debugactiveprocess](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_debugactiveprocess.py)|Debugger Detection (B0001)|DebugActiveProcess|
+|[antidebug_checkremotedebuggerpresent](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_checkremotedebuggerpresent.py)|Debugger Detection (B0001)|CheckRemoteDebuggerPresent, NtQueryInformationProcess|
+|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_nthookengine_libs.py)|Debugger Detection (B0001)|LdrGetDllHandle, LdrLoadDll|
+|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_nthookengine_libs.py)|Debugger Detection::API Hook Detection (B0001.001)|LdrGetDllHandle, LdrLoadDll|
+|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_setunhandledexceptionfilter.py)|Debugger Detection (B0001)|SetUnhandledExceptionFilter|
+|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_setunhandledexceptionfilter.py)|Debugger Detection::UnhandledExceptionFilter (B0001.030)|SetUnhandledExceptionFilter|
+|[antidebug_addvectoredexceptionhandler](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_addvectoredexceptionhandler.py)|Debugger Detection (B0001)|AddVectoredExceptionHandler|
+|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_outputdebugstring.py)|Debugger Detection (B0001)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
+|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_outputdebugstring.py)|Debugger Detection::OutputDebugString (B0001.016)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
+|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_gettickcount.py)|Debugger Detection (B0001)|GetTickCount|
+|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_gettickcount.py)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|GetTickCount|
+|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Detection (B0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Detection::Memory Breakpoints (B0001.009)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntsetinformationthread.py)|Debugger Detection (B0001)|NtSetInformationThread|
+|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntsetinformationthread.py)|Debugger Detection::NtSetInformationThread (B0001.014)|NtSetInformationThread|
+|[antidebug_debugactiveprocess](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_debugactiveprocess.py)|Debugger Detection (B0001)|DebugActiveProcess|
+
+### B0001.019 Snippet
+
+ Anti-Behavioral Analysis::Debugger Detection::Process Environment Block
+SHA256: e33a713b96b45e2b2e0da350c0fdaaf865139607066aadff3b67b0ced82ca8bc
+Location: 0x1800270A2
+
+mov rax, qword ptr GS:[0x60] ; GS:[0x60] contains a pointer to the Windows Process Environment Block on 64-bit versions of Windows. This command is copying that pointer into the rax register.
+
+
## References
diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md
index ae98b9a..97659c9 100644
--- a/anti-behavioral-analysis/debugger-evasion.md
+++ b/anti-behavioral-analysis/debugger-evasion.md
@@ -17,7 +17,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-6 February 2024 |
+27 April 2024 |
@@ -91,11 +91,11 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion (B0002)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
-|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion::Guard Pages (B0002.008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
-|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Debugger Evasion (B0002)|NtCreateThreadEx|
-|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion (B0002)|CreateProcessInternalW|
-|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion::Self-Debugging (B0002.024)|CreateProcessInternalW|
+|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Evasion (B0002)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_guardpages.py)|Debugger Evasion::Guard Pages (B0002.008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_ntcreatethreadex.py)|Debugger Evasion (B0002)|NtCreateThreadEx|
+|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/debugs_self.py)|Debugger Evasion (B0002)|CreateProcessInternalW|
+|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/debugs_self.py)|Debugger Evasion::Self-Debugging (B0002.024)|CreateProcessInternalW|
## References
diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md
index 9974e6e..d80f5f8 100644
--- a/anti-behavioral-analysis/dynamic-analysis-evasion.md
+++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+27 April 2024 |
@@ -75,15 +75,26 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion (B0003)|--|
-|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Data Flood (B0003.002)|--|
-|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|--|
-|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Dynamic Analysis Evasion (B0003)|NtSuspendThread|
-|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion (B0003)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
-|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion::Restart (B0003.010)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
-|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion (B0003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
-|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
-|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Dynamic Analysis Evasion (B0003)|--|
+|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/api_spamming.py)|Dynamic Analysis Evasion (B0003)|--|
+|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/api_spamming.py)|Dynamic Analysis Evasion::Data Flood (B0003.002)|--|
+|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/api_spamming.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|--|
+|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_suspend.py)|Dynamic Analysis Evasion (B0003)|NtSuspendThread|
+|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_restart.py)|Dynamic Analysis Evasion (B0003)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
+|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_restart.py)|Dynamic Analysis Evasion::Restart (B0003.010)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
+|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_timelimit.py)|Dynamic Analysis Evasion (B0003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
+|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_timelimit.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
+|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_unhook.py)|Dynamic Analysis Evasion (B0003)|--|
+
+### B0003.003 Snippet
+
+ Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution
+SHA256: 21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561
+Location: 0x40103B
+
+push 0x36ee80 ; sleep duration: 3600000 milliseconds (1 hour)
+call dword ptr [->KERNEL32.DLL::Sleep] ; Windows API call instructing thread to sleep for the time period specified above
+
+
## References
diff --git a/anti-behavioral-analysis/emulator-detection.md b/anti-behavioral-analysis/emulator-detection.md
index 8e7afcf..a4bedb6 100644
--- a/anti-behavioral-analysis/emulator-detection.md
+++ b/anti-behavioral-analysis/emulator-detection.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+27 April 2024 |
@@ -57,12 +57,12 @@ Detects whether the malware instance is being executed inside an emulator. If so
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antiemu_windefend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_windefend.py)|Emulator Detection (B0004)|--|
-|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection (B0004)|--|
-|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
-|[antiemu_wine_func](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_func.py)|Emulator Detection (B0004)|LdrGetProcedureAddress|
-|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection (B0004)|--|
-|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
+|[antiemu_windefend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_windefend.py)|Emulator Detection (B0004)|--|
+|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Emulator Detection (B0004)|--|
+|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
+|[antiemu_wine_func](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine_func.py)|Emulator Detection (B0004)|LdrGetProcedureAddress|
+|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|Emulator Detection (B0004)|--|
+|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
## References
diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md
index 53d9681..d7a86e4 100644
--- a/anti-behavioral-analysis/memory-dump-evasion.md
+++ b/anti-behavioral-analysis/memory-dump-evasion.md
@@ -17,7 +17,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-8 May 2023 |
+29 April 2024 |
@@ -39,7 +39,7 @@ Memory dump evasion is an anti-forensic technique in which malware hinders retri
|---|---|---|
|**Code Encryption in Memory**|B0006.001|Encrypt the executing malware instance code in memory.|
|**Erase the PE header**|B0006.002|Erase PE header from memory.|
-|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](../credential-access/hooking.md).|
+|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md).|
|**Flow Opcode Obstruction**|B0006.009|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[6]](#6).|
|**Guard Pages**|B0006.006|Encrypt blocks of code individually and decrypt temporarily only upon execution. This method is related to Unprotect technique U0102.|
|**Hide virtual memory**|B0006.003|Hide arbitrary segments of virtual memory.|
diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md
index b59087d..73dab40 100644
--- a/anti-behavioral-analysis/sandbox-detection.md
+++ b/anti-behavioral-analysis/sandbox-detection.md
@@ -17,7 +17,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-6 February 2024 |
+27 April 2024 |
@@ -71,30 +71,30 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
-|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
-|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
-|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
-|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection (B0007)|NtDelayExecution|
-|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection::Timing/Date Check (B0007.008)|NtDelayExecution|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection (B0007)|SetWindowsHookExA, SetWindowsHookExW|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection::Human User Check (B0007.003)|SetWindowsHookExA, SetWindowsHookExW|
-|[antisandbox_foregroundwindows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_foregroundwindows.py)|Sandbox Detection (B0007)|GetForegroundWindow, NtDelayExecution|
-|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_mutex.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_script_timer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_script_timer.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_sboxie_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
-|[antisandbox_cuckoocrash](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoocrash.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
-|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
-|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection (B0007)|--|
-|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
-|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Sandbox Detection (B0007)|NtOpenDirectoryObject|
-|[antisandbox_sunbelt_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
-|[antisandbox_cuckoo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_threattrack_files.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_threattrack_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sleep.py)|Sandbox Detection (B0007)|NtDelayExecution|
+|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sleep.py)|Sandbox Detection::Timing/Date Check (B0007.008)|NtDelayExecution|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Sandbox Detection (B0007)|SetWindowsHookExA, SetWindowsHookExW|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Sandbox Detection::Human User Check (B0007.003)|SetWindowsHookExA, SetWindowsHookExW|
+|[antisandbox_foregroundwindows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_forehwnd.py)|Sandbox Detection (B0007)|GetForegroundWindow, NtDelayExecution|
+|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_mutex.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_script_timer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_scripttimer.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_sboxie_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
+|[antisandbox_cuckoocrash](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoocrash.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_fortinet_files.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_fortinet_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_files.py)|Sandbox Detection (B0007)|--|
+|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_objects.py)|Sandbox Detection (B0007)|NtOpenDirectoryObject|
+|[antisandbox_sunbelt_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
+|[antisandbox_cuckoo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo.py)|Sandbox Detection (B0007)|--|
## Code Snippets
diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md
index 46a73bb..8113d94 100644
--- a/anti-behavioral-analysis/virtual-machine-detection.md
+++ b/anti-behavioral-analysis/virtual-machine-detection.md
@@ -17,7 +17,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-6 February 2024 |
+27 April 2024 |
@@ -127,64 +127,64 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection (B0009)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
-|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection::Modern Specs Check - Drive size (B0009.015)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
-|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_mutex.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection (B0009)|NtQueryDirectoryObject, NtOpenDirectoryObject|
-|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|NtQueryDirectoryObject, NtOpenDirectoryObject|
-|[antivm_network_adapters](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_network_adapters.py)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
-|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection (B0009)|WNetGetProviderNameW|
-|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|WNetGetProviderNameW|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|Virtual Machine Detection (B0009)|NtOpenEvent, NtCreateEvent|
-|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
-|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection (B0009)|SetWindowsHookExA, SetWindowsHookExW|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection::Human User Check (B0009.012)|SetWindowsHookExA, SetWindowsHookExW|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection (B0009)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
-|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
-|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
-|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
-|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Running Services (B0009.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|Virtual Machine Detection (B0009)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
-|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Virtual Machine Detection (B0009)|NtOpenDirectoryObject|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
-|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection (B0009)|--|
-|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection::Check Windows (B0009.009)|--|
+|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk.py)|Virtual Machine Detection (B0009)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
+|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk.py)|Virtual Machine Detection::Modern Specs Check - Drive size (B0009.015)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
+|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_mutex.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_dirobjects.py)|Virtual Machine Detection (B0009)|NtQueryDirectoryObject, NtOpenDirectoryObject|
+|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_dirobjects.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|NtQueryDirectoryObject, NtOpenDirectoryObject|
+|[antivm_network_adapters](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_network_adapter.py)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
+|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_provname.py)|Virtual Machine Detection (B0009)|WNetGetProviderNameW|
+|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_provname.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|WNetGetProviderNameW|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_events.py)|Virtual Machine Detection (B0009)|NtOpenEvent, NtCreateEvent|
+|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_devices.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
+|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_devices.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_files.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_files.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Virtual Machine Detection (B0009)|SetWindowsHookExA, SetWindowsHookExW|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Virtual Machine Detection::Human User Check (B0009.012)|SetWindowsHookExA, SetWindowsHookExW|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|Virtual Machine Detection (B0009)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
+|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
+|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_files.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
+|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_mutexes.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
+|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_files.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|Virtual Machine Detection::Check Running Services (B0009.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk_setupapi.py)|Virtual Machine Detection (B0009)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
+|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sboxie_objects.py)|Virtual Machine Detection (B0009)|NtOpenDirectoryObject|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
+|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_window.py)|Virtual Machine Detection (B0009)|--|
+|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_window.py)|Virtual Machine Detection::Check Windows (B0009.009)|--|
## Code Snippets
diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md
index 7d53787..aff9bb8 100644
--- a/anti-static-analysis/software-packing.md
+++ b/anti-static-analysis/software-packing.md
@@ -17,7 +17,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-6 February 2024 |
+27 April 2024 |
@@ -91,31 +91,30 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[packer_nspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nspack.py)|Software Packing (F0001)|--|
-|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing (F0001)|--|
-|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing::VMProtect (F0001.010)|--|
-|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing (F0001)|--|
-|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing::Confuser (F0001.009)|--|
-|[packer_smartassembly](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_smartassembly.py)|Software Packing (F0001)|--|
-|[packer_mpress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_mpress.py)|Software Packing (F0001)|--|
-|[packer_enigma](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_enigma.py)|Software Packing (F0001)|--|
-|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Software Packing (F0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
-|[packer_aspirecrypt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspirecrypt.py)|Software Packing (F0001)|--|
-|[packer_nate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nate.py)|Software Packing (F0001)|--|
-|[packer_entropy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_entropy.py)|Software Packing (F0001)|--|
-|[packer_unknown_pe_section_name](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_unknown_pe_section_name.py)|Software Packing (F0001)|--|
-|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing (F0001)|--|
-|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing::UPX (F0001.008)|--|
-|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing (F0001)|--|
-|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing::ASPack (F0001.013)|--|
-|[packer_bedsprotector](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_bedsprotector.py)|Software Packing (F0001)|--|
-|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|FindWindowA|
-|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|FindWindowA|
-|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|--|
-|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|--|
-|[packer_spices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_spices.py)|Software Packing (F0001)|--|
-|[packer_yoda](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_yoda.py)|Software Packing (F0001)|--|
-|[packer_titan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_titan.py)|Software Packing (F0001)|--|
+|[packer_nspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_nspack.py)|Software Packing (F0001)|--|
+|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_vmprotect.py)|Software Packing (F0001)|--|
+|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_vmprotect.py)|Software Packing::VMProtect (F0001.010)|--|
+|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_confuser.py)|Software Packing (F0001)|--|
+|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_confuser.py)|Software Packing::Confuser (F0001.009)|--|
+|[packer_smartassembly](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_smartassembly.py)|Software Packing (F0001)|--|
+|[packer_mpress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_mpress.py)|Software Packing (F0001)|--|
+|[packer_enigma](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_enigma.py)|Software Packing (F0001)|--|
+|[packer_aspirecrypt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_aspirecrypt.py)|Software Packing (F0001)|--|
+|[packer_nate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_nate.py)|Software Packing (F0001)|--|
+|[packer_entropy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_entropy.py)|Software Packing (F0001)|--|
+|[packer_unknown_pe_section_name](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_anomaly.py)|Software Packing (F0001)|--|
+|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_upx.py)|Software Packing (F0001)|--|
+|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_upx.py)|Software Packing::UPX (F0001.008)|--|
+|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_aspack.py)|Software Packing (F0001)|--|
+|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_aspack.py)|Software Packing::ASPack (F0001.013)|--|
+|[packer_bedsprotector](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_bedsprotector.py)|Software Packing (F0001)|--|
+|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing (F0001)|FindWindowA|
+|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing::Themida (F0001.011)|FindWindowA|
+|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing (F0001)|--|
+|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_themida.py)|Software Packing::Themida (F0001.011)|--|
+|[packer_spices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_spices.py)|Software Packing (F0001)|--|
+|[packer_yoda](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_yoda.py)|Software Packing (F0001)|--|
+|[packer_titan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/packer_titan.py)|Software Packing (F0001)|--|
## References
diff --git a/collection/archive-collected-data.md b/collection/archive-collected-data.md
index 1373225..8a99239 100644
--- a/collection/archive-collected-data.md
+++ b/collection/archive-collected-data.md
@@ -13,7 +13,7 @@
| Version |
-4.0 |
+4.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-18 December 2023 |
+27 April 2024 |
@@ -55,12 +55,12 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data (E1560)|CryptEncrypt|
-|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt|
-|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
-|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
-|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
-|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
+|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data (E1560)|CryptEncrypt|
+|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt|
+|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
+|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
+|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
+|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malware_data_encryption.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
## References
diff --git a/collection/cryptocurrency.md b/collection/cryptocurrency.md
index 4ce7b49..00a0777 100644
--- a/collection/cryptocurrency.md
+++ b/collection/cryptocurrency.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+27 April 2024 |
@@ -47,8 +47,8 @@ Malware accesses files that contain sensitive data or credentials related to Bit
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency (B0028)|--|
-|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency::Bitcoin (B0028.001)|--|
+|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_bitcoin.py)|Cryptocurrency (B0028)|--|
+|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_bitcoin.py)|Cryptocurrency::Bitcoin (B0028.001)|--|
## References
diff --git a/collection/input-capture.md b/collection/input-capture.md
index 7918ea5..b7c8202 100644
--- a/collection/input-capture.md
+++ b/collection/input-capture.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+27 April 2024 |
@@ -56,9 +56,9 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture (E1056)|SetWindowsHookExA, SetWindowsHookExW|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture::Mouse Events (E1056.m01)|SetWindowsHookExA, SetWindowsHookExW|
-|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Input Capture (E1056)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Input Capture (E1056)|SetWindowsHookExA, SetWindowsHookExW|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Input Capture::Mouse Events (E1056.m01)|SetWindowsHookExA, SetWindowsHookExW|
+|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_scanbox.py)|Input Capture (E1056)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
## References
diff --git a/collection/keylogging.md b/collection/keylogging.md
index 15a99fd..85e5dad 100644
--- a/collection/keylogging.md
+++ b/collection/keylogging.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+27 April 2024 |
@@ -66,9 +66,23 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging (F0002)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
-|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging::Application Hook (F0002.001)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
-|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Keylogging (F0002)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Keylogging (F0002)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
+|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Keylogging::Application Hook (F0002.001)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
+|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_scanbox.py)|Keylogging (F0002)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+
+### F0002.002 Snippet
+
+ Collection::Keylogging::Polling
+SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
+
+Location: 0x438af1
+
+push 0x11 ; provide argument for function call. In this case, 0x11 is the Windows keyboard code for indicating the 'CTRL' key
+call USER32.DLL::GetKeyState ; call function to get the state of the control key
+test ax, 0x8000 ; test to see what the previous function returned. In this case, we are seeing if the return value's high-order bit is a 1, which would mean the ctrl key is pressed
+setnz al ; if the previous condition is not met (the zero flag is 1), a 1 is stored in byte al
+
+
## References
diff --git a/collection/screen-capture.md b/collection/screen-capture.md
index 12e05bd..5e256da 100644
--- a/collection/screen-capture.md
+++ b/collection/screen-capture.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+27 April 2024 |
@@ -59,8 +59,30 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Screen Capture (E1113)|--|
-|[captures_screenshot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/captures_screenshot.py)|Screen Capture (E1113)|LdrGetProcedureAddress, NtCreateFile|
+|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_poullight.py)|Screen Capture (E1113)|--|
+|[captures_screenshot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_screenshot.py)|Screen Capture (E1113)|LdrGetProcedureAddress, NtCreateFile|
+
+### E1113.m01 Snippet
+
+ Collection::Screen Capture::WinAPI
+SHA256: c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec
+Location: 0x4036de
+
+push 0xcc0020 ; Raster operation code to copy the source rectangle directly onto the destination rectangle
+push 0x0 ; y-coordinate of upper left corner of source rectangle
+push 0x0 ; x-coordinate of upper left corner of source rectangle
+push dword ptr [esi] ; handle to source device
+push eax ; height of source/destination rectangles
+mov eax, dword ptr [esi + 0xc]
+sub eax, param_2
+sub param_2, ebx
+push eax ; width of source/destination rectangles
+push param_1 ; y-coordinate of upper left corner of destination rectangle
+push param_2 ; x-coordinate of upper left corner of destination rectangle
+push dword ptr [ebp + local_28] ; handle to destingation device
+call dword ptr [->GDI32.DLL::BitBlt] ; Windows API function to transfer a rectangle of pixels from one device to another
+
+
## References
diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md
index 1bafee9..118849f 100644
--- a/command-and-control/c2-communication.md
+++ b/command-and-control/c2-communication.md
@@ -13,7 +13,7 @@
| Version |
-2.3 |
+2.4 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+28 April 2024 |
@@ -101,25 +101,25 @@ As "server" and "client" are confusing terminology, we use the terms "controller
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|C2 Communication (B0030)|ConnectEx, URLDownloadToFileW|
-|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication (B0030)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
-|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication::Check for Payload (B0030.005)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
-|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|C2 Communication (B0030)|--|
-|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|C2 Communication (B0030)|--|
-|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|C2 Communication (B0030)|HttpOpenRequestA, HttpSendRequestA|
-|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|C2 Communication (B0030)|InternetOpenA, InternetOpenUrlA|
-|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|C2 Communication (B0030)|--|
-|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|C2 Communication (B0030)|--|
-|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|C2 Communication (B0030)|--|
-|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|C2 Communication (B0030)|DnsQuery_A, DnsQuery_W|
-|[network_questionable_host](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_questionable_host.py)|C2 Communication (B0030)|--|
-|[injection_network_traffic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_network_traffic.py)|C2 Communication (B0030)|HttpOpenRequestA, URLDownloadToFileW, HttpOpenRequestW, InternetConnectW, InternetConnectA, connect, InternetCrackUrlW, InternetCrackUrlA, WSASend|
-|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|C2 Communication (B0030)|listen, bind|
-|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
-|[network_country_distribution](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_country_distribution.py)|C2 Communication (B0030)|--|
-|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|C2 Communication (B0030)|--|
-|[network_dyndns](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dyndns.py)|C2 Communication (B0030)|--|
-|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
+|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|C2 Communication (B0030)|ConnectEx, URLDownloadToFileW|
+|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/internet_dropper.py)|C2 Communication (B0030)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
+|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/internet_dropper.py)|C2 Communication::Check for Payload (B0030.005)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
+|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_madness.py)|C2 Communication (B0030)|--|
+|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive.py)|C2 Communication (B0030)|--|
+|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_beacon.py)|C2 Communication (B0030)|HttpOpenRequestA, HttpSendRequestA|
+|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|C2 Communication (B0030)|InternetOpenA, InternetOpenUrlA|
+|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_drive2.py)|C2 Communication (B0030)|--|
+|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_dirtjumper.py)|C2 Communication (B0030)|--|
+|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/bot_athenahttp.py)|C2 Communication (B0030)|--|
+|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_dns_suspicious.py)|C2 Communication (B0030)|DnsQuery_A, DnsQuery_W|
+|[network_questionable_host](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_questionable_host.py)|C2 Communication (B0030)|--|
+|[injection_network_traffic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_network.py)|C2 Communication (B0030)|HttpOpenRequestA, URLDownloadToFileW, HttpOpenRequestW, InternetConnectW, InternetConnectA, connect, InternetCrackUrlW, InternetCrackUrlA, WSASend|
+|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_bind.py)|C2 Communication (B0030)|listen, bind|
+|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_docfile_http.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
+|[network_country_distribution](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_cnc_generic.py)|C2 Communication (B0030)|--|
+|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/banker_zeus_url.py)|C2 Communication (B0030)|--|
+|[network_dyndns](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dyndns.py)|C2 Communication (B0030)|--|
+|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
## Code Snippets
diff --git a/command-and-control/domain-name-generation.md b/command-and-control/domain-name-generation.md
index fa31999..42df4d8 100644
--- a/command-and-control/domain-name-generation.md
+++ b/command-and-control/domain-name-generation.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -47,9 +47,9 @@ This behavior is related to Unprotect technique U0906.
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[whois_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/whois_create.py)|Domain Name Generation (B0031)|--|
-|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|Domain Name Generation (B0031)|--|
-|[network_dga_fraunhofer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga_fraunhofer.py)|Domain Name Generation (B0031)|--|
+|[whois_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/whois_create.py)|Domain Name Generation (B0031)|--|
+|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dga.py)|Domain Name Generation (B0031)|--|
+|[network_dga_fraunhofer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_dga_fraunhofer.py)|Domain Name Generation (B0031)|--|
## References
diff --git a/command-and-control/ingress-tool-transfer.md b/command-and-control/ingress-tool-transfer.md
index 8be87b7..8685c38 100644
--- a/command-and-control/ingress-tool-transfer.md
+++ b/command-and-control/ingress-tool-transfer.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -53,8 +53,8 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[suspicious_mpcmdrun_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_mpcmdrun_use.py)|Ingress Tool Transfer (E1105)|--|
-|[network_document_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_file.py)|Ingress Tool Transfer (E1105)|URLDownloadToFileW, HttpOpenRequestW, send, InternetCrackUrlW, InternetCrackUrlA, WSASend, URLDownloadToCacheFileW|
+|[suspicious_mpcmdrun_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|Ingress Tool Transfer (E1105)|--|
+|[network_document_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_payload_download.py)|Ingress Tool Transfer (E1105)|URLDownloadToFileW, HttpOpenRequestW, send, InternetCrackUrlW, InternetCrackUrlA, WSASend, URLDownloadToCacheFileW|
## References
diff --git a/defense-evasion/bootkit.md b/defense-evasion/bootkit.md
index 5ffa055..1ce43b1 100644
--- a/defense-evasion/bootkit.md
+++ b/defense-evasion/bootkit.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -43,12 +43,12 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Bootkit (F0013)|--|
-|[bootkit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bootkit.py)|Bootkit (F0013)|NtSetInformationFile, NtClose, DeviceIoControl, NtCreateFile, NtDuplicateObject, NtOpenFile, NtWriteFile, NtDeviceIoControlFile|
-|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Bootkit (F0013)|--|
-|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Bootkit (F0013)|--|
-|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Bootkit (F0013)|--|
-|[suspicious_ioctl_scsipassthough](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ioctl_scsipassthough.py)|Bootkit (F0013)|DeviceIoControl, NtDeviceIoControlFile|
+|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
+|[bootkit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|NtSetInformationFile, NtClose, DeviceIoControl, NtCreateFile, NtDuplicateObject, NtOpenFile, NtWriteFile, NtDeviceIoControlFile|
+|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
+|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
+|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|--|
+|[suspicious_ioctl_scsipassthough](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Bootkit (F0013)|DeviceIoControl, NtDeviceIoControlFile|
## References
diff --git a/defense-evasion/bypass-data-execution-prevention.md b/defense-evasion/bypass-data-execution-prevention.md
index e3883e9..4c9140c 100644
--- a/defense-evasion/bypass-data-execution-prevention.md
+++ b/defense-evasion/bypass-data-execution-prevention.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -40,7 +40,7 @@ Malware may bypass Data Execution Prevention (DEP).
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[dep_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dep_bypass.py)|Bypass Data Execution Prevention (B0037)|VirtualProtectEx, NtProtectVirtualMemory|
+|[dep_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dep_bypass.py)|Bypass Data Execution Prevention (B0037)|VirtualProtectEx, NtProtectVirtualMemory|
## References
diff --git a/defense-evasion/disable-or-evade-security-tools.md b/defense-evasion/disable-or-evade-security-tools.md
index 08d61bf..06080b7 100644
--- a/defense-evasion/disable-or-evade-security-tools.md
+++ b/defense-evasion/disable-or-evade-security-tools.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -70,41 +70,41 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Disable or Evade Security Tools (F0004)|--|
-|[clickfraud_volume](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_volume.py)|Disable or Evade Security Tools (F0004)|CoInternetSetFeatureEnabled|
-|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_1.py)|Disable or Evade Security Tools (F0004)|--|
-|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_2.py)|Disable or Evade Security Tools (F0004)|--|
-|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Disable or Evade Security Tools (F0004)|NtSuspendThread|
-|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_servicestop.py)|Disable or Evade Security Tools (F0004)|OpenServiceA, ControlService, OpenServiceW|
-|[disables_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_security.py)|Disable or Evade Security Tools (F0004)|--|
-|[antiav_whitespace](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_whitespace.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_windows_file_protection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_file_protection.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_crashdumps](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_crashdumps.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
-|[clickfraud_cookies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_cookies.py)|Disable or Evade Security Tools (F0004)|InternetSetOptionA|
-|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools (F0004)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
-|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
-|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools (F0004)|--|
-|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
-|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Disable or Evade Security Tools (F0004)|--|
-|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools (F0004)|--|
-|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools::Unhook APIs (F0004.003)|--|
-|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_windows_defender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Disable or Evade Security Tools (F0004)|--|
-|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Disable or Evade Security Tools (F0004)|--|
-|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Disable or Evade Security Tools (F0004)|--|
-|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Disable or Evade Security Tools (F0004)|--|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools (F0004)|--|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Disable or Evade Security Tools (F0004)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|Disable or Evade Security Tools (F0004)|--|
+|[clickfraud_volume](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clickfraud_volume.py)|Disable or Evade Security Tools (F0004)|CoInternetSetFeatureEnabled|
+|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Disable or Evade Security Tools (F0004)|--|
+|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Disable or Evade Security Tools (F0004)|--|
+|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_suspend.py)|Disable or Evade Security Tools (F0004)|NtSuspendThread|
+|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_servicestop.py)|Disable or Evade Security Tools (F0004)|OpenServiceA, ControlService, OpenServiceW|
+|[disables_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_security.py)|Disable or Evade Security Tools (F0004)|--|
+|[antiav_whitespace](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_whitespace.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_windows_file_protection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windows_file_protection.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_winfirewall.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_crashdumps](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_crashdumps.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
+|[clickfraud_cookies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clickfraud_cookies.py)|Disable or Evade Security Tools (F0004)|InternetSetOptionA|
+|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wfp.py)|Disable or Evade Security Tools (F0004)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
+|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wfp.py)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
+|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|Disable or Evade Security Tools (F0004)|--|
+|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
+|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|Disable or Evade Security Tools (F0004)|--|
+|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_unhook.py)|Disable or Evade Security Tools (F0004)|--|
+|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_unhook.py)|Disable or Evade Security Tools::Unhook APIs (F0004.003)|--|
+|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_seccenter.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_windows_defender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
+|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
+|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Disable or Evade Security Tools (F0004)|--|
+|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_browserwarn.py)|Disable or Evade Security Tools (F0004)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|Disable or Evade Security Tools (F0004)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|Disable or Evade Security Tools (F0004)|--|
## References
diff --git a/defense-evasion/hidden-files-and-directories.md b/defense-evasion/hidden-files-and-directories.md
index 8a43824..88513c6 100644
--- a/defense-evasion/hidden-files-and-directories.md
+++ b/defense-evasion/hidden-files-and-directories.md
@@ -13,7 +13,7 @@
| Version |
-2.3 |
+2.4 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+28 April 2024 |
@@ -59,13 +59,13 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories (F0005)|--|
-|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories::Location (F0005.002)|--|
-|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories (F0005)|--|
-|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories::Timestamp (F0005.004)|--|
-|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Hidden Files and Directories (F0005)|--|
-|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Hidden Files and Directories (F0005)|--|
-|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Hidden Files and Directories (F0005)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
+|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/spoofs_procname.py)|Hidden Files and Directories (F0005)|--|
+|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/spoofs_procname.py)|Hidden Files and Directories::Location (F0005.002)|--|
+|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/static_pe_anomaly.py)|Hidden Files and Directories (F0005)|--|
+|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/static_pe_anomaly.py)|Hidden Files and Directories::Timestamp (F0005.004)|--|
+|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Hidden Files and Directories (F0005)|--|
+|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Hidden Files and Directories (F0005)|--|
+|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_file.py)|Hidden Files and Directories (F0005)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
## References
diff --git a/defense-evasion/hide-artifacts.md b/defense-evasion/hide-artifacts.md
index b6689d7..34393ab 100644
--- a/defense-evasion/hide-artifacts.md
+++ b/defense-evasion/hide-artifacts.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -55,7 +55,7 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[stealth_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_window.py)|Hide Artifacts (E1564)|ShellExecuteExW, CreateProcessInternalW|
+|[stealth_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_window.py)|Hide Artifacts (E1564)|ShellExecuteExW, CreateProcessInternalW|
## References
diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md
index c4258ec..1ef954b 100644
--- a/defense-evasion/hijack-execution-flow.md
+++ b/defense-evasion/hijack-execution-flow.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -76,12 +76,12 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
-|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, SetWindowsHookExW|
-|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, SetWindowsHookExW|
-|[dll_load_uncommon_file_types](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dll_load_uncommon_file_types.py)|Hijack Execution Flow (F0015)|LdrLoadDll|
-|[malicious_dynamic_function_loading](https://github.com/CAPESandbox/community/tree/master/modules/signatures/malicious_dynamic_function_loading.py)|Hijack Execution Flow (F0015)|LdrGetProcedureAddress, LdrLoadDll|
+|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
+|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/infostealer_keylog.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, SetWindowsHookExW|
+|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_mouse_hook.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, SetWindowsHookExW|
+|[dll_load_uncommon_file_types](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dll_load_uncommon.py)|Hijack Execution Flow (F0015)|LdrLoadDll|
+|[malicious_dynamic_function_loading](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/malicious_dynamic_function_loading.py)|Hijack Execution Flow (F0015)|LdrGetProcedureAddress, LdrLoadDll|
## References
diff --git a/defense-evasion/indicator-blocking.md b/defense-evasion/indicator-blocking.md
index c347828..59cb0c4 100644
--- a/defense-evasion/indicator-blocking.md
+++ b/defense-evasion/indicator-blocking.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -51,13 +51,13 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Indicator Blocking (F0006)|--|
-|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Indicator Blocking (F0006)|--|
-|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Indicator Blocking (F0006)|--|
-|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Indicator Blocking (F0006)|--|
-|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Indicator Blocking (F0006)|NtCreateKey, NtSetValueKey|
-|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Indicator Blocking (F0006)|--|
-|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Indicator Blocking (F0006)|--|
+|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|Indicator Blocking (F0006)|--|
+|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Indicator Blocking (F0006)|--|
+|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Indicator Blocking (F0006)|--|
+|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Indicator Blocking (F0006)|--|
+|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Indicator Blocking (F0006)|NtCreateKey, NtSetValueKey|
+|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|Indicator Blocking (F0006)|--|
+|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|Indicator Blocking (F0006)|--|
## References
diff --git a/defense-evasion/install-insecure-or-malicious-configuration.md b/defense-evasion/install-insecure-or-malicious-configuration.md
index 4282631..27bc218 100644
--- a/defense-evasion/install-insecure-or-malicious-configuration.md
+++ b/defense-evasion/install-insecure-or-malicious-configuration.md
@@ -13,7 +13,7 @@
| Version |
-3.1 |
+3.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -41,14 +41,14 @@ Malware may install malicious configuration settings or may modify existing conf
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Install Insecure or Malicious Configuration (B0047)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
-|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Install Insecure or Malicious Configuration (B0047)|--|
-|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Install Insecure or Malicious Configuration (B0047)|--|
-|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Install Insecure or Malicious Configuration (B0047)|--|
-|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Install Insecure or Malicious Configuration (B0047)|--|
-|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Install Insecure or Malicious Configuration (B0047)|--|
-|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Install Insecure or Malicious Configuration (B0047)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Install Insecure or Malicious Configuration (B0047)|--|
+|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bcdedit_command.py)|Install Insecure or Malicious Configuration (B0047)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Install Insecure or Malicious Configuration (B0047)|--|
+|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Install Insecure or Malicious Configuration (B0047)|--|
+|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Install Insecure or Malicious Configuration (B0047)|--|
+|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Install Insecure or Malicious Configuration (B0047)|--|
+|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_hostsfile.py)|Install Insecure or Malicious Configuration (B0047)|--|
+|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_srp.py)|Install Insecure or Malicious Configuration (B0047)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|Install Insecure or Malicious Configuration (B0047)|--|
## References
diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md
index ba11b9e..819e5da 100644
--- a/defense-evasion/modify-registry.md
+++ b/defense-evasion/modify-registry.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+28 April 2024 |
@@ -49,73 +49,73 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Modify Registry (E1112)|--|
-|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Modify Registry (E1112)|--|
-|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Modify Registry (E1112)|--|
-|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Modify Registry (E1112)|--|
-|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_networking_icon.py)|Modify Registry (E1112)|--|
-|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Modify Registry (E1112)|--|
-|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_power_options.py)|Modify Registry (E1112)|--|
-|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_cpl_disable.py)|Modify Registry (E1112)|--|
-|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Modify Registry (E1112)|--|
-|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
-|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/hides_recycle_bin_icon.py)|Modify Registry (E1112)|--|
-|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_restore_default_state.py)|Modify Registry (E1112)|--|
-|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_auto_app_termination.py)|Modify Registry (E1112)|--|
-|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_regkeys.py)|Modify Registry (E1112)|--|
-|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Modify Registry (E1112)|--|
-|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/prevents_safeboot.py)|Modify Registry (E1112)|--|
-|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Modify Registry (E1112)|--|
-|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_context_menus.py)|Modify Registry (E1112)|--|
+|[persistence_remotedesktop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|Modify Registry (E1112)|--|
+|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_bho.py)|Modify Registry (E1112)|--|
+|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_security.py)|Modify Registry (E1112)|--|
+|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_notificationcenter.py)|Modify Registry (E1112)|--|
+|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_networking_icon.py)|Modify Registry (E1112)|--|
+|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_powershell_logging.py)|Modify Registry (E1112)|--|
+|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_power_options.py)|Modify Registry (E1112)|--|
+|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_cpl_display.py)|Modify Registry (E1112)|--|
+|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_startpage.py)|Modify Registry (E1112)|--|
+|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_fileless.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
+|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/hides_recyclebin_icon.py)|Modify Registry (E1112)|--|
+|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_restore_default_state.py)|Modify Registry (E1112)|--|
+|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app_autotermination.py)|Modify Registry (E1112)|--|
+|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_nemty.py)|Modify Registry (E1112)|--|
+|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|Modify Registry (E1112)|--|
+|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/prevents_safeboot.py)|Modify Registry (E1112)|--|
+|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_smartscreen.py)|Modify Registry (E1112)|--|
+|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_context_menus.py)|Modify Registry (E1112)|--|
|[reg_binary](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Modify Registry (E1112)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
-|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Modify Registry (E1112)|--|
-|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_run_command.py)|Modify Registry (E1112)|--|
-|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Modify Registry (E1112)|--|
-|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Modify Registry (E1112)|--|
-|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_backups.py)|Modify Registry (E1112)|--|
-|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_largekey.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
-|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_username_startmenu.py)|Modify Registry (E1112)|--|
-|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Modify Registry (E1112)|--|
-|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_startmenu_search.py)|Modify Registry (E1112)|--|
-|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Modify Registry (E1112)|--|
-|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Modify Registry (E1112)|--|
-|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
-|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Modify Registry (E1112)|--|
-|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
-|[persistence_autorun_tasks](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun_tasks.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
-|[persistence_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_safeboot.py)|Modify Registry (E1112)|--|
-|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Modify Registry (E1112)|--|
-|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_certs.py)|Modify Registry (E1112)|--|
-|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Modify Registry (E1112)|--|
-|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_appv_virtualization.py)|Modify Registry (E1112)|--|
-|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Modify Registry (E1112)|--|
-|[modify_uac_prompt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_uac_prompt.py)|Modify Registry (E1112)|--|
-|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Modify Registry (E1112)|RegQueryValueExW, RegSetValueExW|
-|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rdptcp_key.py)|Modify Registry (E1112)|--|
-|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_system_restore.py)|Modify Registry (E1112)|--|
-|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_folder_options.py)|Modify Registry (E1112)|--|
-|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Modify Registry (E1112)|--|
-|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_security_maintenance_icon.py)|Modify Registry (E1112)|--|
-|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Modify Registry (E1112)|--|
-|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Modify Registry (E1112)|--|
-|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Modify Registry (E1112)|--|
-|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_startmenu_defaults.py)|Modify Registry (E1112)|--|
-|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_uac.py)|Modify Registry (E1112)|--|
-|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Modify Registry (E1112)|--|
-|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Modify Registry (E1112)|--|
-|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_perfkey.py)|Modify Registry (E1112)|--|
-|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_oem_information.py)|Modify Registry (E1112)|--|
-|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Modify Registry (E1112)|--|
-|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Modify Registry (E1112)|--|
-|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Modify Registry (E1112)|--|
-|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Modify Registry (E1112)|--|
-|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Modify Registry (E1112)|--|
-|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windowsupdate.py)|Modify Registry (E1112)|--|
-|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_pinned_programs.py)|Modify Registry (E1112)|--|
-|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_regkeys.py)|Modify Registry (E1112)|--|
-|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Modify Registry (E1112)|--|
-|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Modify Registry (E1112)|--|
+|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenextension.py)|Modify Registry (E1112)|--|
+|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_run_command.py)|Modify Registry (E1112)|--|
+|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Modify Registry (E1112)|--|
+|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Modify Registry (E1112)|--|
+|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_backups.py)|Modify Registry (E1112)|--|
+|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_largekey.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
+|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_username_startmenu.py)|Modify Registry (E1112)|--|
+|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hiddenreg.py)|Modify Registry (E1112)|--|
+|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|Modify Registry (E1112)|--|
+|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Modify Registry (E1112)|--|
+|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Modify Registry (E1112)|--|
+|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
+|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
+|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Modify Registry (E1112)|--|
+|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
+|[persistence_autorun_tasks](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
+|[persistence_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|--|
+|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_bypass.py)|Modify Registry (E1112)|--|
+|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_certs.py)|Modify Registry (E1112)|--|
+|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_proxy.py)|Modify Registry (E1112)|--|
+|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_appv_virtualization.py)|Modify Registry (E1112)|--|
+|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_neshta.py)|Modify Registry (E1112)|--|
+|[modify_uac_prompt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_uac_notify.py)|Modify Registry (E1112)|--|
+|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Modify Registry (E1112)|RegQueryValueExW, RegSetValueExW|
+|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Modify Registry (E1112)|--|
+|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_sysrestore.py)|Modify Registry (E1112)|--|
+|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_folder_options.py)|Modify Registry (E1112)|--|
+|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_security.py)|Modify Registry (E1112)|--|
+|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_sec_maintain_icon.py)|Modify Registry (E1112)|--|
+|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/tampers_etw.py)|Modify Registry (E1112)|--|
+|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_event_logging.py)|Modify Registry (E1112)|--|
+|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_addon.py)|Modify Registry (E1112)|--|
+|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_startmenu_defaults.py)|Modify Registry (E1112)|--|
+|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_uac.py)|Modify Registry (E1112)|--|
+|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_seccenter.py)|Modify Registry (E1112)|--|
+|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_wer.py)|Modify Registry (E1112)|--|
+|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Modify Registry (E1112)|--|
+|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_oem.py)|Modify Registry (E1112)|--|
+|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|Modify Registry (E1112)|--|
+|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Modify Registry (E1112)|--|
+|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Modify Registry (E1112)|--|
+|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Modify Registry (E1112)|--|
+|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_browserwarn.py)|Modify Registry (E1112)|--|
+|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windowsupdate.py)|Modify Registry (E1112)|--|
+|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/removes_pinned_programs.py)|Modify Registry (E1112)|--|
+|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_medusalocker.py)|Modify Registry (E1112)|--|
+|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_firewall.py)|Modify Registry (E1112)|--|
+|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Modify Registry (E1112)|--|
## References
diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md
index b14f3bd..456dbfc 100644
--- a/defense-evasion/obfuscated-files-or-information.md
+++ b/defense-evasion/obfuscated-files-or-information.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -79,7 +79,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|[**Kraken**](../xample-malware/kraken.md)|2008|E1027.m02|Kraken encodes data using XOR. [[9]](#9)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|E1027.m02|Locky Bart encodes data using XOR. [[9]](#9)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|E1027.m02|Mebromi encodes data using XOR. [[9]](#9)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|E1027.m02|Redhip encodes data using XOR. [[9]](#9)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|E1027.m02|Redhip encodes data using XOR. [[9]](#9)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1027.m02|Rombertik encodes data using XOR. [[9]](#9)|
|[**SamSam**](../xample-malware/samsam.md)|2015|E1027.m07|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[10]](#10)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Shamoon encodes data using XOR. [[9]](#9)|
@@ -120,9 +120,38 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|---|---|---|
|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|RtlDecompressBuffer|
|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|CryptDecrypt|
-|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Obfuscated Files or Information (E1027)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
-|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Obfuscated Files or Information (E1027)|--|
-|[dotnet_code_compile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dotnet_code_compile.py)|Obfuscated Files or Information (E1027)|NtWriteFile, CreateProcessInternalA, NtCreateUserProcess, CreateProcessInternalW|
+|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Obfuscated Files or Information (E1027)|--|
+|[dotnet_code_compile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/compile_dotnet_code.py)|Obfuscated Files or Information (E1027)|NtWriteFile, CreateProcessInternalA, NtCreateUserProcess, CreateProcessInternalW|
+
+### E1027.m02 Snippet
+
+ Obfuscated Files or Information::Encoding-Standard Algorithm
+SHA256: 5fb7f3fac0a9b9ab243ee642a0775500c524166ef075035c9510ccbab76ad633
+Location: 0x10001060
+
+mov eax, dword ptr [esi + 0x38]
+xor dword ptr [esi + 0xd0], eax
+mov eax, dword ptr [esi + 0xf0]
+add eax, 0xfff5b6c8
+add eax, ecx
+mov ecx, dword ptr [esi + 0x8c]
+add dword ptr [esi + 0xc0], eax
+mov eax, dword ptr [esi + 0x54]
+xor dword ptr [ecx + edx*0x1], eax ; perform encryption operation
+add edx, 0x4 ; adjust edx to next location to encrypt
+mov eax, dword ptr [esi + 0x90]
+add dword ptr [esi + 0x54], eax
+mov ecx, dword ptr [esi + 0xe8]
+mov eax, ecx
+xor eax, 0xa4937
+add dword ptr [esi + 0x68], eax
+mov eax, dword ptr [esi + 0xa4]
+xor eax, 0x4
+sub dword ptr [esi + 0x60], eax
+cmp edx, 0x36c8 ; perform comparison to check if all data encrypted
+jl lab_10001060 ; jump to first line of sample
+
+
## References
diff --git a/defense-evasion/polymorphic-code.md b/defense-evasion/polymorphic-code.md
index 8607e00..e3ed9b3 100644
--- a/defense-evasion/polymorphic-code.md
+++ b/defense-evasion/polymorphic-code.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+29 April 2024 |
@@ -48,7 +48,7 @@ Polymorphic code, a file with the same functionality but different execution, is
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[polymorphic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/polymorphic.py)|Polymorphic Code (B0029)|--|
+|[polymorphic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/polymorphic.py)|Polymorphic Code (B0029)|--|
## References
diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md
index 547f16b..d7f8c03 100644
--- a/defense-evasion/process-injection.md
+++ b/defense-evasion/process-injection.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -67,7 +67,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.m02|Stuxnet uses Mrxcls.sys driver for persistence. It is registered as a boot start service by creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys". [[9]](#9)|
|[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory. [[10]](#10)|
|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|The malware can attach user process memory. [[13]](#13)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)|
|[**Conti**](../xample-malware/conti.md)|2019|E1055.012|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space.|
## Detection
@@ -83,28 +83,27 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[volatility_handles_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_handles_1.py)|Process Injection (E1055)|--|
-|[volatility_ldrmodules_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_1.py)|Process Injection (E1055)|--|
-|[volatility_ldrmodules_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_2.py)|Process Injection (E1055)|--|
-|[volatility_malfind_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_1.py)|Process Injection (E1055)|--|
-|[volatility_malfind_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_2.py)|Process Injection (E1055)|--|
-|[volatility_modscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_modscan_1.py)|Process Injection (E1055)|--|
-|[injection_explorer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_explorer.py)|Process Injection (E1055)|NtReadVirtualMemory, NtWow64ReadVirtualMemory64, NtOpenProcess, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, SetWindowLongW, FindWindowA, FindWindowW, FindWindowExW, ReadProcessMemory, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
-|[injection_themeinitapihook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_themeinitapihook.py)|Process Injection (E1055)|ThemeInitApiHook|
-|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|Process Injection (E1055)|WinHttpConnect, WinHttpOpenRequest|
-|[injection_createremotethread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_createremotethread.py)|Process Injection (E1055)|--|
+|[volatility_handles_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
+|[volatility_ldrmodules_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
+|[volatility_ldrmodules_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
+|[volatility_malfind_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
+|[volatility_malfind_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
+|[volatility_modscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Process Injection (E1055)|--|
+|[injection_explorer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_explorer.py)|Process Injection (E1055)|NtReadVirtualMemory, NtWow64ReadVirtualMemory64, NtOpenProcess, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, SetWindowLongW, FindWindowA, FindWindowW, FindWindowExW, ReadProcessMemory, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
+|[injection_themeinitapihook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_themeinitapihook.py)|Process Injection (E1055)|ThemeInitApiHook|
+|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/network_explorer.py)|Process Injection (E1055)|WinHttpConnect, WinHttpOpenRequest|
+|[injection_createremotethread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_createremotethread.py)|Process Injection (E1055)|--|
|[doppelganging](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|[injection_inter_process](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|[injection_process_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
-|[injection_set_window_long](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_set_window_long.py)|Process Injection (E1055)|NtMapViewOfSection, SetWindowLongW, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, FindWindowA, PostMessageA, FindWindowW, FindWindowExW, PostMessageW, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
|[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction|
-|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection (E1055)|--|
-|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
-|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Process Injection (E1055)|--|
-|[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
-|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_shim_database.py)|Process Injection::Injection using Shims (E1055.m03)|--|
-|[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_runpe.py)|Process Injection (E1055)|--|
+|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
+|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
+|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_silent_process_exit.py)|Process Injection (E1055)|--|
+|[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|Process Injection::Injection using Shims (E1055.m03)|--|
+|[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_runpe.py)|Process Injection (E1055)|--|
## References
[1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
diff --git a/defense-evasion/rootkit.md b/defense-evasion/rootkit.md
index 7e367e9..feb7365 100644
--- a/defense-evasion/rootkit.md
+++ b/defense-evasion/rootkit.md
@@ -13,7 +13,7 @@
| Version |
-3.1 |
+3.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -61,11 +61,11 @@ Rootkits can also be detected via memory dump analysis or virtual machine intros
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[spicyhotpot_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spicyhotpot_behavior.py)|Rootkit (E1014)|--|
-|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Rootkit (E1014)|--|
-|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Rootkit (E1014)|--|
-|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Rootkit (E1014)|--|
-|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Rootkit (E1014)|--|
+|[spicyhotpot_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rootkit_spicyhotpot.py)|Rootkit (E1014)|--|
+|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
+|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
+|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
+|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bootkit.py)|Rootkit (E1014)|--|
## References
diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md
index b6d9701..829b71e 100644
--- a/defense-evasion/self-deletion.md
+++ b/defense-evasion/self-deletion.md
@@ -12,7 +12,7 @@
Indicator Removal on Host: Uninstall Malicious Application (T1630.001), Indicator Removal on Host: File Deletion (T1070.004) |
| Version |
-2.2 |
+2.3 |
| Created |
@@ -20,7 +20,7 @@
| Last Modified |
-5 December 2023 |
+28 April 2024 |
@@ -57,9 +57,9 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Self Deletion (F0007)|DeleteFileW|
-|[deletes_executed_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_executed_files.py)|Self Deletion (F0007)|--|
-|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Self Deletion (F0007)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
+|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/trickbot_files.py)|Self Deletion (F0007)|DeleteFileW|
+|[deletes_executed_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_executed.py)|Self Deletion (F0007)|--|
+|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_self.py)|Self Deletion (F0007)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
## References
diff --git a/discovery/analysis-tool-discovery.md b/discovery/analysis-tool-discovery.md
index 4ab62ac..a4455b8 100644
--- a/discovery/analysis-tool-discovery.md
+++ b/discovery/analysis-tool-discovery.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -66,14 +66,14 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Analysis Tool Discovery (B0013)|--|
-|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Analysis Tool Discovery (B0013)|--|
-|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery (B0013)|--|
-|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Process detection (B0013.001)|--|
-|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Known Window (B0013.009)|--|
-|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Analysis Tool Discovery (B0013)|--|
-|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery (B0013)|--|
-|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery::Known File Location (B0013.008)|--|
+|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectreg.py)|Analysis Tool Discovery (B0013)|--|
+|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_devices.py)|Analysis Tool Discovery (B0013)|--|
+|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_windows.py)|Analysis Tool Discovery (B0013)|--|
+|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_windows.py)|Analysis Tool Discovery::Process detection (B0013.001)|--|
+|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antidebug_windows.py)|Analysis Tool Discovery::Known Window (B0013.009)|--|
+|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_bochs_keys.py)|Analysis Tool Discovery (B0013)|--|
+|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|Analysis Tool Discovery (B0013)|--|
+|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|Analysis Tool Discovery::Known File Location (B0013.008)|--|
## References
diff --git a/discovery/application-window-discovery.md b/discovery/application-window-discovery.md
index f91038a..2b4d233 100644
--- a/discovery/application-window-discovery.md
+++ b/discovery/application-window-discovery.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -55,7 +55,22 @@ Malware may attempt to gain information about the operating system and applicati
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[browser_needed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_needed.py)|Application Window Discovery (E1010)|FindWindowW, FindWindowExA, FindWindowExW, FindWindowA|
+|[browser_needed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_needed.py)|Application Window Discovery (E1010)|FindWindowW, FindWindowExA, FindWindowExW, FindWindowA|
+
+### E1010 Snippet
+
+ Discovery::Application Window Discovery
+SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
+Location: 0x455A5D
+
+push 0x100 ; Maximum number of characters to get from window title, including trailing string terminator (in this case, 256).
+lea param_1, [esp + 0x4]
+push param_1 ; Buffer for receiving text from window
+mov param_1, dword ptr [ebx + 0x30]
+push param_1 ; Handle to window containing text
+call USER32.DLL::GetWindowTextA ; Function call to fetch specified window title
+
+
## References
diff --git a/discovery/code-discovery.md b/discovery/code-discovery.md
index 7f80a02..404f9ed 100644
--- a/discovery/code-discovery.md
+++ b/discovery/code-discovery.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+29 April 2024 |
@@ -49,7 +49,7 @@ Malware may inspect code or enumerate aspects.
|[**Gamut**](../xample-malware/gamut.md)|2014|B0046.001|Gamut enumerates PE sections. [[1]](#1)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0046.001|Hupigon enumerates PE sections. [[1]](#1)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|B0046.001|Locky Bart enumerates PE sections. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|B0046.002|Redhip inspects section memory permissions. [[1]](#1)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|B0046.002|Redhip inspects section memory permissions. [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0046.001|Stuxnet enumerates PE sections. [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|TrickBot inspects section memory permissions. [[1]](#1)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Ursnif enumerates PE sections. [[1]](#1)|
diff --git a/discovery/file-and-directory-discovery.md b/discovery/file-and-directory-discovery.md
index bc147dd..0f0b8a6 100644
--- a/discovery/file-and-directory-discovery.md
+++ b/discovery/file-and-directory-discovery.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -58,7 +58,7 @@ Malware may enumerate files and directories or may search for specific files or
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR checks if a file exists. [[6]](#6)|
|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|The malware gets a file size. [[6]](#6)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi gets a file size. [[6]](#6)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets a file size. [[6]](#6)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip gets a file size. [[6]](#6)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware gets the file version info. [[6]](#6)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[7]](#7)|
@@ -79,24 +79,39 @@ Malware may enumerate files and directories or may search for specific files or
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|File and Directory Discovery (E1083)|--|
-|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|File and Directory Discovery (E1083)|--|
-|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|File and Directory Discovery (E1083)|NtQueryDirectoryObject, NtOpenDirectoryObject|
-|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery (E1083)|NtOpenEvent, NtCreateEvent|
-|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery::Log File (E1083.m01)|NtOpenEvent, NtCreateEvent|
-|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|File and Directory Discovery (E1083)|--|
-|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|File and Directory Discovery (E1083)|--|
-|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|File and Directory Discovery (E1083)|--|
-|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
-|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|File and Directory Discovery (E1083)|--|
-|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|File and Directory Discovery (E1083)|--|
-|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
-|[driver_filtermanager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_filtermanager.py)|File and Directory Discovery (E1083)|--|
-|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|File and Directory Discovery (E1083)|--|
-|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|File and Directory Discovery (E1083)|--|
-|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|File and Directory Discovery (E1083)|--|
-|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|File and Directory Discovery (E1083)|--|
-|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|File and Directory Discovery (E1083)|--|
+|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_cuckoo_files.py)|File and Directory Discovery (E1083)|--|
+|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_threattrack_files.py)|File and Directory Discovery (E1083)|--|
+|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_dirobjects.py)|File and Directory Discovery (E1083)|NtQueryDirectoryObject, NtOpenDirectoryObject|
+|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_events.py)|File and Directory Discovery (E1083)|NtOpenEvent, NtCreateEvent|
+|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_events.py)|File and Directory Discovery::Log File (E1083.m01)|NtOpenEvent, NtCreateEvent|
+|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_devices.py)|File and Directory Discovery (E1083)|--|
+|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_devices.py)|File and Directory Discovery (E1083)|--|
+|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_files.py)|File and Directory Discovery (E1083)|--|
+|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
+|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectfile.py)|File and Directory Discovery (E1083)|--|
+|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vpc_files.py)|File and Directory Discovery (E1083)|--|
+|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vbox_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
+|[driver_filtermanager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/driver_filtermanager.py)|File and Directory Discovery (E1083)|--|
+|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_joe_anubis_files.py)|File and Directory Discovery (E1083)|--|
+|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_vmware_files.py)|File and Directory Discovery (E1083)|--|
+|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_fortinet_files.py)|File and Directory Discovery (E1083)|--|
+|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_sunbelt_files.py)|File and Directory Discovery (E1083)|--|
+|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antianalysis_detectfile.py)|File and Directory Discovery (E1083)|--|
+
+### E1083 Snippet
+
+ Discovery::File and Directory Discovery
+SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
+Location: 0x409A62
+
+push eax ; argument to function containing file path to search
+call KERNEL32.DLL::GetFileAttributesA ; Function to retrieve file attributes for file path indicated by eax
+cmp eax, -0x1 ; Test if function returned an error
+jz lab_00409a71 ; If the function failed (the file's attributes were not retrieved and the return value is -1), jump to the specified address to continue execution
+test al, 0x10 ; Test the lower 8 bits of the return value to check if the file is a directory
+jnz lab_00409a75 ; If the returned result is not a directory, jump to the specified address to continue execution
+
+
## References
@@ -112,4 +127,4 @@ Malware may enumerate files and directories or may search for specific files or
[6] capa v4.0, analyzed at MITRE on 10/12/2022
-[7] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
\ No newline at end of file
+[7] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md
index cda14b5..5deb774 100644
--- a/discovery/system-information-discovery.md
+++ b/discovery/system-information-discovery.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -37,6 +37,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|Name|ID|Description|
|---|---|---|
|**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.|
+|**Enumerate Environment Variables**|E1082.m02|Malware may query environmental variables as a way of gathering system details.|
## Use in Malware
@@ -46,7 +47,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Malware learns about the system so it can drop compatible miner software. [[8]](#8)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Malware uses Window's command prompt commands to gather system info, task list, installed drivers, and installed programs. [[1]](#1)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Malware uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor. [[2]](#2)|
-|[**DarkComet**](../xample-malware/darkcomet.md)|2008|--|Malware can collect information about the computer, resources, and operating system version. [[3]](#3)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|Malware can collect information about the computer, resources, and operating system version. [[3]](#3)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet collects information related to OS, processes, and sometimes mail client information and sends it to C2. [[4]](#4)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Malware gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the network to spread itself. [[5]](#5)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks OS version. [[5]](#5)|
@@ -57,7 +58,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon queries environment variables. [[9]](#9)|
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter gets disk information. [[9]](#9)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi checks OS version. [[9]](#9)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip checks the OS version. [[9]](#9)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip checks the OS version. [[9]](#9)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)|
|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
|[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|
@@ -74,32 +75,44 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|System Information Discovery (E1082)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
-|[recon_systeminfo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_systeminfo.py)|System Information Discovery (E1082)|--|
-|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|System Information Discovery (E1082)|HttpOpenRequestA, HttpSendRequestA|
-|[uses_adfind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_adfind.py)|System Information Discovery (E1082)|--|
-|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|System Information Discovery (E1082)|--|
-|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|System Information Discovery (E1082)|--|
-|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|System Information Discovery (E1082)|--|
-|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|System Information Discovery (E1082)|--|
-|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|System Information Discovery (E1082)|--|
-|[uses_windows_utilities_nltest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_nltest.py)|System Information Discovery (E1082)|--|
-|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
-|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|System Information Discovery (E1082)|--|
-|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|System Information Discovery (E1082)|--|
-|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|System Information Discovery (E1082)|--|
-|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|System Information Discovery (E1082)|--|
-|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|System Information Discovery (E1082)|--|
-|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|System Information Discovery (E1082)|--|
-|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|System Information Discovery (E1082)|--|
-|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|System Information Discovery (E1082)|--|
-|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|System Information Discovery (E1082)|--|
-|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|System Information Discovery (E1082)|--|
-|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
-|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|System Information Discovery (E1082)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
-|[antisandbox_check_userdomain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_check_userdomain.py)|System Information Discovery (E1082)|rtcEnvironBstr|
-|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|System Information Discovery (E1082)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_fingerprint.py)|System Information Discovery (E1082)|--|
+|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk.py)|System Information Discovery (E1082)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
+|[recon_systeminfo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_systeminfo.py)|System Information Discovery (E1082)|--|
+|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_beacon.py)|System Information Discovery (E1082)|HttpOpenRequestA, HttpSendRequestA|
+|[uses_adfind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_adfind.py)|System Information Discovery (E1082)|--|
+|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_cpu.py)|System Information Discovery (E1082)|--|
+|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|System Information Discovery (E1082)|--|
+|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/accesses_netlogon.py)|System Information Discovery (E1082)|--|
+|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|System Information Discovery (E1082)|--|
+|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_hyperv_keys.py)|System Information Discovery (E1082)|--|
+|[uses_windows_utilities_nltest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|System Information Discovery (E1082)|--|
+|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_scsi.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
+|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_parallels_keys.py)|System Information Discovery (E1082)|--|
+|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_diskreg.py)|System Information Discovery (E1082)|--|
+|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|System Information Discovery (E1082)|--|
+|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
+|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
+|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
+|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
+|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
+|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
+|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|System Information Discovery (E1082)|--|
+|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_services.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
+|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_disk_setupapi.py)|System Information Discovery (E1082)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
+|[antisandbox_check_userdomain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antisandbox_check_userdomain.py)|System Information Discovery (E1082)|rtcEnvironBstr|
+|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/browser_scanbox.py)|System Information Discovery (E1082)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/recon_fingerprint.py)|System Information Discovery (E1082)|--|
+
+### E1082.m02 Snippet
+
+ System Information Discovery
+SHA256: e4b36a1d4e70d988efa2ec27e5a639be5eb0880474f746851c13e56f007a8377
+Location: 0x004017e9
+
+push eax ; push register to store return value onto the stack
+push u_ALLUSERSPROFILE_0041a9a4 ; push argument to function (name of the sought environment variable - in this case, ALLUSERSPROFILE)
+call dword ptr [->KERNEL32.DLL::GetEnvironmentVariableW] ; call function to get environment variable value
+
+
## References
diff --git a/discovery/taskbar-discovery.md b/discovery/taskbar-discovery.md
index 00d2b5d..8a62d7f 100644
--- a/discovery/taskbar-discovery.md
+++ b/discovery/taskbar-discovery.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+29 April 2024 |
@@ -32,7 +32,7 @@
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)|
## Detection
diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md
index 75a3625..f9f8588 100644
--- a/execution/command-and-scripting-interpreter.md
+++ b/execution/command-and-scripting-interpreter.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -50,7 +50,7 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut accepts command line arguments. [[9]](#9)|
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon accepts command line arguments. [[9]](#9)|
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi accepts command line arguments. [[9]](#9)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip accepts command line arguments. [[9]](#9)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip accepts command line arguments. [[9]](#9)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware accepts command line arguments. [[9]](#9)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs a script to inject a JavaScript script and modify web traffic. [[10]](#10)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot accepts command line arguments. [[9]](#9)|
@@ -65,53 +65,63 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
-|[js_suspicious_redirect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_suspicious_redirect.py)|Command and Scripting Interpreter (E1059)|CDocument_write, JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[odbcconf_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/odbcconf_bypass.py)|Command and Scripting Interpreter (E1059)|--|
-|[regsvr32_squiblydoo_dll_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/regsvr32_squiblydoo_dll_load.py)|Command and Scripting Interpreter (E1059)|LdrLoadDll|
-|[squiblydoo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblydoo_bypass.py)|Command and Scripting Interpreter (E1059)|--|
-|[squiblytwo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblytwo_bypass.py)|Command and Scripting Interpreter (E1059)|--|
-|[exe_dropper_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exe_dropper_js.py)|Command and Scripting Interpreter (E1059)|JsEval|
-|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Command and Scripting Interpreter (E1059)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
-|[ie_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ie_martian_children.py)|Command and Scripting Interpreter (E1059)|--|
-|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
-|[office_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_martian_children.py)|Command and Scripting Interpreter (E1059)|--|
-|[js_phish](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_phish.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Command and Scripting Interpreter (E1059)|--|
-|[script_tool_executed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_tool_executed.py)|Command and Scripting Interpreter (E1059)|--|
-|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Command and Scripting Interpreter (E1059)|--|
-|[cmdline_switches](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_switches.py)|Command and Scripting Interpreter (E1059)|--|
-|[cmdline_terminate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_terminate.py)|Command and Scripting Interpreter (E1059)|--|
-|[cmdline_forfiles_wildcard](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_forfiles_wildcard.py)|Command and Scripting Interpreter (E1059)|--|
-|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|Command and Scripting Interpreter (E1059)|--|
-|[cmdline_long_string](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_long_string.py)|Command and Scripting Interpreter (E1059)|--|
-|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|Command and Scripting Interpreter (E1059)|--|
-|[long_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/long_commandline.py)|Command and Scripting Interpreter (E1059)|--|
-|[powershell_renamed_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed_commandline.py)|Command and Scripting Interpreter (E1059)|--|
-|[wmi_script_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_script_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
-|[disables_mappeddrives_autodisconnect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_mappeddrives_autodisconnect.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
-|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
-|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|Command and Scripting Interpreter (E1059)|--|
-|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
-|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--|
-|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
-|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--|
-|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
-|[powershell_network_connection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_network_connection.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, InternetReadFile|
-|[powershell_scriptblock_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_scriptblock_logging.py)|Command and Scripting Interpreter (E1059)|--|
-|[powershell_command_suspicious](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_command_suspicious.py)|Command and Scripting Interpreter (E1059)|--|
-|[powershell_renamed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed.py)|Command and Scripting Interpreter (E1059)|--|
-|[powershell_reversed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_reversed.py)|Command and Scripting Interpreter (E1059)|--|
-|[powershell_variable_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_variable_obfuscation.py)|Command and Scripting Interpreter (E1059)|--|
-|[office_com_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_com_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
-|[office_vb_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_vb_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
-|[office_wmi_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_wmi_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
-|[document_script_exe_drop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/document_script_exe_drop.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
-|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Command and Scripting Interpreter (E1059)|--|
-|[office_suspicious_processes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_suspicious_processes.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
-|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
-|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
-|[suspicious_js_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_js_script.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText|
+|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
+|[js_suspicious_redirect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/js_suspicious_redirect.py)|Command and Scripting Interpreter (E1059)|CDocument_write, JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[odbcconf_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|--|
+|[regsvr32_squiblydoo_dll_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|LdrLoadDll|
+|[squiblydoo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|--|
+|[squiblytwo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bypass_applocker.py)|Command and Scripting Interpreter (E1059)|--|
+|[exe_dropper_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dropper_js.py)|Command and Scripting Interpreter (E1059)|JsEval|
+|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_fileless.py)|Command and Scripting Interpreter (E1059)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
+|[ie_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/martians_ie.py)|Command and Scripting Interpreter (E1059)|--|
+|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bcdedit_command.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+|[office_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/martians_office.py)|Command and Scripting Interpreter (E1059)|--|
+|[js_phish](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/js_phish.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_winfirewall.py)|Command and Scripting Interpreter (E1059)|--|
+|[script_tool_executed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|Command and Scripting Interpreter (E1059)|--|
+|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[cmdline_switches](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[cmdline_terminate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[cmdline_forfiles_wildcard](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[cmdline_long_string](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[long_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[powershell_renamed_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cmdline_anomaly.py)|Command and Scripting Interpreter (E1059)|--|
+|[wmi_script_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wmi.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
+|[disables_mappeddrives_autodisconnect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_drives_autodisconnect.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
+|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
+|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
+|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
+|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
+|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
+|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/collects_systeminfo_cmd.py)|Command and Scripting Interpreter (E1059)|--|
+|[powershell_network_connection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, InternetReadFile|
+|[powershell_scriptblock_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
+|[powershell_command_suspicious](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
+|[powershell_renamed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
+|[powershell_reversed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
+|[powershell_variable_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/powershell_command.py)|Command and Scripting Interpreter (E1059)|--|
+|[office_com_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
+|[office_vb_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
+|[office_wmi_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_dll_loading.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
+|[document_script_exe_drop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/document_exedrop.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
+|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_windefender.py)|Command and Scripting Interpreter (E1059)|--|
+|[office_suspicious_processes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_suspicious_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
+|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
+|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
+|[suspicious_js_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/script_downloader.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText|
+
+### E1059 Snippet
+
+ Execution::Command and Scripting Interpreter
+SHA256: 905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8
+Location: 0x41B7A6
+
+call dword ptr [->KERNEL32.DLL::GetCommandLineW]
+
+
## References
diff --git a/execution/conditional-execution.md b/execution/conditional-execution.md
index 70be472..98e80a4 100644
--- a/execution/conditional-execution.md
+++ b/execution/conditional-execution.md
@@ -17,7 +17,7 @@
| Version |
-3.0 |
+3.1 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-19 September 2023 |
+30 April 2024 |
@@ -70,6 +70,31 @@ Some aspects of this Conditional Execution behavior are related to the [Executio
|---|---|---|
|[run as service](https://github.com/mandiant/capa-rules/blob/master/host-interaction/service/run-as-service.yml)|Conditional Execution::Runs as Service (B0025.007)|RegisterServiceCtrlHandler, RegisterServiceCtrlHandlerEx, StartServiceCtrlDispatcher, System.ServiceProcess.ServiceBase::Run|
+### B0025.007 Snippet
+
+ Execution::Conditional Execution::Runs as Service
+SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
+Location: 0x4596BC
+
+push 0x0 ; Optional password to account running the service. Not needed for services running as LocalService
+push 0x0 ; Name of account under which to run the service. If null, use the LocalService account
+push 0x0 ; Optional list of dependencies required for the service to run
+push 0x0 ; Optional variable for tag depending on value of next parameter. If null, accept the value provided by that parameter.
+push 0x0 ; Optional load order group for the service. This service does not belong to a group
+mov param_1, dword ptr [ebp + local_8]
+call FUN_00404dfc ; Get path of binary for service to run and any arguments
+push param_1 ; Push to stack
+push 0x0 ; What to do if there is an error -- in this case, ignore it
+push 0x2 ; How to start service -- in this case, during system startup
+push 0x110 ; Service type -- in this case, service is its own process and is capable of interacting with desktop
+push 0xf01ff ; Desired access rights for service -- in this case, all rights
+push edi ; Display name for service
+push esi ; Name of service to install
+push ebx ; Handle to service control manager database
+call ADVAPI32.DLL::CreateServiceA ; Create service
+
+
+
## References
[1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
diff --git a/execution/execution-dependency.md b/execution/execution-dependency.md
index 34521c1..629832e 100644
--- a/execution/execution-dependency.md
+++ b/execution/execution-dependency.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-12 June 2023 |
+29 April 2024 |
@@ -34,8 +34,8 @@ Software may require certain run-time or library dependencies consistent with no
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Adwind jRAT**](../xample-malware/adwindjrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
+|[**Adwind jRAT**](../xample-malware/adwind-jrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
## References
-[1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
\ No newline at end of file
+[1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md
index 2ed5f15..e355e29 100644
--- a/execution/exploitation-for-client-execution.md
+++ b/execution/exploitation-for-client-execution.md
@@ -17,7 +17,7 @@
| Version |
-3.1 |
+3.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -57,31 +57,31 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[office_cve2017_11882](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882.py)|Exploitation for Client Execution (E1203)|CreateProcessInternalW|
-|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|Exploitation for Client Execution (E1203)|ConnectEx, URLDownloadToFileW|
-|[office_flash_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_flash_load.py)|Exploitation for Client Execution (E1203)|CoGetClassObject, CoCreateInstance|
-|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Exploitation for Client Execution (E1203)|NtWriteFile|
-|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
-|[exploit_getbasekerneladdress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_getbasekerneladdress.py)|Exploitation for Client Execution (E1203)|EnumDeviceDrivers, LdrGetProcedureAddress, LdrLoadDll, K32EnumDeviceDrivers|
-|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
-|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
-|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_process_create.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
-|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
-|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_curl.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
-|[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
-|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution (E1203)|--|
-|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
-|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution (E1203)|--|
-|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
-|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
-|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
-|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|Exploitation for Client Execution (E1203)|NtAllocateVirtualMemory|
-|[rtf_aslr_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_aslr_bypass.py)|Exploitation for Client Execution (E1203)|--|
-|[rtf_exploit_static](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_exploit_static.py)|Exploitation for Client Execution (E1203)|--|
+|[office_cve2017_11882](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|CreateProcessInternalW|
+|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|ConnectEx, URLDownloadToFileW|
+|[office_flash_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|CoGetClassObject, CoCreateInstance|
+|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_exploit.py)|Exploitation for Client Execution (E1203)|NtWriteFile|
+|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
+|[exploit_getbasekerneladdress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_getbasekerneladdress.py)|Exploitation for Client Execution (E1203)|EnumDeviceDrivers, LdrGetProcedureAddress, LdrLoadDll, K32EnumDeviceDrivers|
+|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016_7200.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
+|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
+|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
+|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
+|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution (E1203)|--|
+|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
+|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution (E1203)|--|
+|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sysinternals.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
+|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
+|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
+|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016-0189.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_heapspray.py)|Exploitation for Client Execution (E1203)|NtAllocateVirtualMemory|
+|[rtf_aslr_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_rtf.py)|Exploitation for Client Execution (E1203)|--|
+|[rtf_exploit_static](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/office_rtf.py)|Exploitation for Client Execution (E1203)|--|
## References
diff --git a/execution/install-additional-program.md b/execution/install-additional-program.md
index b02681d..f31e155 100644
--- a/execution/install-additional-program.md
+++ b/execution/install-additional-program.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -58,7 +58,7 @@ Droppers may be described as “single stage” or “two stage.” While the fo
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs an open-source program called mitmproxy. [[16]](#16)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware contains an embedded PE file. [[19]](#19)|
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut contains an embedded PE file. [[19]](#19)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[20]](#20)|
## Detection
@@ -70,9 +70,9 @@ Droppers may be described as “single stage” or “two stage.” While the fo
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[bitcoin_opencl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bitcoin_opencl.py)|Install Additional Program (B0023)|--|
-|[dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dropper.py)|Install Additional Program (B0023)|--|
-|[sniffer_winpcap](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sniffer_winpcap.py)|Install Additional Program (B0023)|--|
+|[bitcoin_opencl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bitcoin_opencl.py)|Install Additional Program (B0023)|--|
+|[dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/dropper.py)|Install Additional Program (B0023)|--|
+|[sniffer_winpcap](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/sniffer_winpcap.py)|Install Additional Program (B0023)|--|
## References
"Cyclops Blink: Malware Analysis Report, Version 1.0," National Cyber Security Centre/GCHQ, 23 Feb. 2022. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf.
diff --git a/impact/clipboard-modification.md b/impact/clipboard-modification.md
index 7e54498..5659fda 100644
--- a/impact/clipboard-modification.md
+++ b/impact/clipboard-modification.md
@@ -17,7 +17,7 @@
| Version |
-3.1 |
+3.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-12 February 2024 |
+30 April 2024 |
@@ -54,7 +54,45 @@ After E1510 was defined, T1510 was replaced by T1641.001, and Clipboard Data (
+ Impact::Clipboard Modification
+SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
+Location: 0x402C0F
+
+push 0x0 ; associate clipboard with current task
+call dword ptr [->USER32.DLL::OpenClipboard] ; call function to open clipboard
+test eax, eax ; test if the clipboard open returned 0
+jz LAB_00402c70 ; if the clipboard open operation returned 0 (failed), jump to another instruction and execute from that point
+call dword ptr [->USER32.DLL::EmptyClipboard] ; call function to empty the clipboard
+lea eax, [esi * 0x2 + 0x2]
+push eax ; Number of bytes of heap memory to allocate
+push 0x2042 ; Memory allocation attributes. Notably, 0x2000 is deprecated and only intended for use with 16-bit Windows and will be ignored, so the actual argument is 0x0042, which allocates moveable memory and initializes the contents to zero
+call dword ptr [->KERNEL32.DLL::GlobalAlloc] ; Allocates heap memory
+mov esi, eax ; store pointer to allocated memory in esi
+test esi, esi ; test to see if NULL (0) returned, indicating an error with allocation
+jz LAB_00402c6a ; if error occurred, jump to memory address and begin execution there
+push esi ; pass newly-allocated memory to lock function
+call dword ptr [->KERNEL32.DLL::GlobalLock] ; lock the allocated heap memory
+test eax, eax ; test to see if lock returned NULL (0), indicating an error occurred
+jz LAB_00402c6a ; if an error occurred, jump to memory address and begin execution there
+push dword ptr [esp + local_26c] ; number of characters that can be stored in the provided buffer
+push eax ; buffer that will hold converted string
+push -0x1 ; size of the string to process. -1 indicates that the input ends with a null-terminating character, so to process up through that point
+push edi ; pointer to string to convert
+push 0x0 ; conversion type flags (must be 0 for UTF-8)
+push 0xfde9 ; code to use for conversion. In this case, 65001 indicates UTF-8
+call dword ptr [->KERNEL32.DLL::MultiByteToWideChar] ; call function to map string from UTF-8 to UTF-16
+push esi ; pointer to heap memory to unlock
+call dword ptr [->KERNEL32.DLL::GlobalUnlock] ; call function to unlock heap memory
+push esi ; handle to heap memory that will be written to clipboard
+push 0xd ; type of data to write (0xd indicates unicode)
+call dword ptr [->USER32.DLL::SetClipboardData] ; call function to write data to clipboard
+call dword ptr [->USER32.DLL::CloseClipboard] ; close the clipboard
+
+
## References
diff --git a/impact/compromise-data-integrity.md b/impact/compromise-data-integrity.md
index 6348efb..e2cc0dc 100644
--- a/impact/compromise-data-integrity.md
+++ b/impact/compromise-data-integrity.md
@@ -17,7 +17,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+29 April 2024 |
@@ -46,4 +46,4 @@ The related **Data Manipulation: Stored Data Manipulation ([T1565.001](https://a
[1] "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf.
-[2] https://content.fireeye.com/apt/rpt-apt38
\ No newline at end of file
+[2] https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf
diff --git a/impact/data-destruction.md b/impact/data-destruction.md
index ee9fb43..5820045 100644
--- a/impact/data-destruction.md
+++ b/impact/data-destruction.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -62,10 +62,10 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Data Destruction (E1485)|--|
-|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Data Destruction (E1485)|--|
-|[uses_windows_utilities_cipher](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_cipher.py)|Data Destruction (E1485)|--|
-|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Data Destruction (E1485)|NtDeleteFile, DeleteFileW, DeleteFileA|
+|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/clears_logs.py)|Data Destruction (E1485)|--|
+|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_recyclebin.py)|Data Destruction (E1485)|--|
+|[uses_windows_utilities_cipher](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/windows_utilities.py)|Data Destruction (E1485)|--|
+|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/anomalous_deletefile.py)|Data Destruction (E1485)|NtDeleteFile, DeleteFileW, DeleteFileA|
## References
diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md
index 04a3858..c5a7f73 100644
--- a/impact/data-encrypted-for-impact.md
+++ b/impact/data-encrypted-for-impact.md
@@ -17,7 +17,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -57,15 +57,15 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Data Encrypted for Impact (E1486)|CryptEncrypt|
-|[ransomware_dmalocker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_dmalocker.py)|Data Encrypted for Impact (E1486)|RegSetValueExA|
-|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_revil_regkey.py)|Data Encrypted for Impact (E1486)|--|
-|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_radamant.py)|Data Encrypted for Impact (E1486)|--|
-|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Data Encrypted for Impact (E1486)|--|
-|[sodinokibi_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sodinokibi_behavior.py)|Data Encrypted for Impact (E1486)|bind, RegSetValueExW, WinHttpOpen, NtCreateUserProcess, CreateProcessInternalW|
-|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Data Encrypted for Impact (E1486)|NtWriteFile|
-|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Data Encrypted for Impact (E1486)|--|
-|[ransomware_file_modifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_file_modifications.py)|Data Encrypted for Impact (E1486)|NtWriteFile, MoveFileWithProgressW, NtCreateFile, MoveFileWithProgressTransactedW|
+|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_crypto.py)|Data Encrypted for Impact (E1486)|CryptEncrypt|
+|[ransomware_dmalocker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_dmalocker.py)|Data Encrypted for Impact (E1486)|RegSetValueExA|
+|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_revil_regkey.py)|Data Encrypted for Impact (E1486)|--|
+|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|Data Encrypted for Impact (E1486)|--|
+|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_fileextensions.py)|Data Encrypted for Impact (E1486)|--|
+|[sodinokibi_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_sodinokibi.py)|Data Encrypted for Impact (E1486)|bind, RegSetValueExW, WinHttpOpen, NtCreateUserProcess, CreateProcessInternalW|
+|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_message.py)|Data Encrypted for Impact (E1486)|NtWriteFile|
+|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_files.py)|Data Encrypted for Impact (E1486)|--|
+|[ransomware_file_modifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_filemodifications.py)|Data Encrypted for Impact (E1486)|NtWriteFile, MoveFileWithProgressW, NtCreateFile, MoveFileWithProgressTransactedW|
## References
diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md
index 425da46..f6aafa9 100644
--- a/impact/denial-of-service.md
+++ b/impact/denial-of-service.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -49,10 +49,10 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|Denial of Service (B0033)|--|
-|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
-|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016_7200.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/network_cnc_http.py)|Denial of Service (B0033)|--|
+|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
+|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2016-0189.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
## References
diff --git a/impact/disk-wipe.md b/impact/disk-wipe.md
index e3f76f3..577913a 100644
--- a/impact/disk-wipe.md
+++ b/impact/disk-wipe.md
@@ -17,7 +17,7 @@
| Version |
-3.1 |
+3.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -49,9 +49,9 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001](
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[deletes_shadow_copies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_shadow_copies.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
-|[deletes_system_state_backup](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_system_state_backup.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
-|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Disk Wipe (F0014)|NtWriteFile|
+|[deletes_shadow_copies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_shadowcopies.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+|[deletes_system_state_backup](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deletes_system_backup.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/wiper.py)|Disk Wipe (F0014)|NtWriteFile|
## References
diff --git a/impact/remote-access.md b/impact/remote-access.md
index 1d717de..d4e85ff 100644
--- a/impact/remote-access.md
+++ b/impact/remote-access.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -61,48 +61,48 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Remote Access (B0022)|--|
-|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_spynet.py)|Remote Access (B0022)|--|
-|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/parallax_mutexes.py)|Remote Access (B0022)|--|
-|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_pcclient.py)|Remote Access (B0022)|--|
-|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_fynloski_mutexes.py)|Remote Access (B0022)|--|
-|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_beebus_mutexes.py)|Remote Access (B0022)|--|
-|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Remote Access (B0022)|--|
-|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_mutexes.py)|Remote Access (B0022)|--|
-|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Remote Access (B0022)|--|
-|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Remote Access (B0022)|--|
+|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_remotedesktop.py)|Remote Access (B0022)|--|
+|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_spynet.py)|Remote Access (B0022)|--|
+|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_parallax_mutex.py)|Remote Access (B0022)|--|
+|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_pcclient.py)|Remote Access (B0022)|--|
+|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_fynloski_mutex.py)|Remote Access (B0022)|--|
+|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_beebus_mutex.py)|Remote Access (B0022)|--|
+|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xpert.py)|Remote Access (B0022)|--|
+|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xpert.py)|Remote Access (B0022)|--|
+|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|Remote Access (B0022)|--|
+|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_warzone.py)|Remote Access (B0022)|--|
|[evil_grab](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
|[PlugX](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|memcpy, RtlDecompressBuffer|
-|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ratsnif_mutexes.py)|Remote Access (B0022)|--|
-|[netwire_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/netwire_behavior.py)|Remote Access (B0022)|RegSetValueExA|
-|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Remote Access (B0022)|--|
-|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_xtreme_mutexes.py)|Remote Access (B0022)|--|
-|[blackrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_apis.py)|Remote Access (B0022)|CryptHashData, RtlDecompressBuffer, CreateProcessInternalW|
-|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_mutexes.py)|Remote Access (B0022)|--|
-|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Remote Access (B0022)|send|
-|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Remote Access (B0022)|RegQueryValueExW, RegSetValueExW|
-|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Remote Access (B0022)|--|
-|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Remote Access (B0022)|--|
-|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_plugx_mutexes.py)|Remote Access (B0022)|--|
-|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Remote Access (B0022)|--|
-|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_mutexes.py)|Remote Access (B0022)|--|
-|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Remote Access (B0022)|send|
-|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/venomrat_mutexes.py)|Remote Access (B0022)|--|
-|[trochilusrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trochilusrat_apis.py)|Remote Access (B0022)|OutputDebugStringW, NtCreateUserProcess, RegSetValueExW, CreateProcessInternalW|
-|[dcrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_behavior.py)|Remote Access (B0022)|GetAddrInfo, GetAddrInfoW, CryptHashData|
-|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Remote Access (B0022)|--|
-|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_mutexes.py)|Remote Access (B0022)|--|
-|[karagany_system_event_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_system_event_objects.py)|Remote Access (B0022)|NtCreateEventEx, NtCreateEvent|
-|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Remote Access (B0022)|--|
-|[orcusrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/orcusrat_behavior.py)|Remote Access (B0022)|RegOpenKeyExW|
-|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_mutexes.py)|Remote Access (B0022)|--|
-|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Remote Access (B0022)|--|
-|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_luminosity.py)|Remote Access (B0022)|CryptHashData, NtCreateMutant, NtCreateFile|
-|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_nanocore.py)|Remote Access (B0022)|CryptHashData|
-|[static_rat_config](https://github.com/CAPESandbox/community/tree/master/modules/signatures/static_rat_config.py)|Remote Access (B0022)|--|
-|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Remote Access (B0022)|--|
-|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Remote Access (B0022)|--|
-|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Remote Access (B0022)|--|
+|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_ratsnif_mutex.py)|Remote Access (B0022)|--|
+|[netwire_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_netwire.py)|Remote Access (B0022)|RegSetValueExA|
+|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_njrat_regkeys.py)|Remote Access (B0022)|--|
+|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_xtreme_mutex.py)|Remote Access (B0022)|--|
+|[blackrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|CryptHashData, RtlDecompressBuffer, CreateProcessInternalW|
+|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|--|
+|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|send|
+|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_blackremote.py)|Remote Access (B0022)|RegQueryValueExW, RegSetValueExW|
+|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Remote Access (B0022)|--|
+|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remote_desktop.py)|Remote Access (B0022)|--|
+|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_plugx_mutex.py)|Remote Access (B0022)|--|
+|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|Remote Access (B0022)|--|
+|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|Remote Access (B0022)|--|
+|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_oblique.py)|Remote Access (B0022)|send|
+|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_venom.py)|Remote Access (B0022)|--|
+|[trochilusrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_trochilus.py)|Remote Access (B0022)|OutputDebugStringW, NtCreateUserProcess, RegSetValueExW, CreateProcessInternalW|
+|[dcrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|Remote Access (B0022)|GetAddrInfo, GetAddrInfoW, CryptHashData|
+|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|Remote Access (B0022)|--|
+|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_dcrat.py)|Remote Access (B0022)|--|
+|[karagany_system_event_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_karagany.py)|Remote Access (B0022)|NtCreateEventEx, NtCreateEvent|
+|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_karagany.py)|Remote Access (B0022)|--|
+|[orcusrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_orcus.py)|Remote Access (B0022)|RegOpenKeyExW|
+|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|Remote Access (B0022)|--|
+|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_limerat.py)|Remote Access (B0022)|--|
+|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_luminosity.py)|Remote Access (B0022)|CryptHashData, NtCreateMutant, NtCreateFile|
+|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_nanocore.py)|Remote Access (B0022)|CryptHashData|
+|[static_rat_config](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/static_rat_config.py)|Remote Access (B0022)|--|
+|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Remote Access (B0022)|--|
+|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Remote Access (B0022)|--|
+|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/remcos.py)|Remote Access (B0022)|--|
## References
diff --git a/impact/resource-hijacking.md b/impact/resource-hijacking.md
index 4cea9a3..ab3dfab 100644
--- a/impact/resource-hijacking.md
+++ b/impact/resource-hijacking.md
@@ -17,7 +17,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -25,7 +25,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -56,9 +56,9 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[cryptopool_domains](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptopool_domains.py)|Resource Hijacking (B0018)|GetAddrInfoW|
-|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking (B0018)|--|
-|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking::Cryptojacking (B0018.002)|--|
+|[cryptopool_domains](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cryptopools.py)|Resource Hijacking (B0018)|GetAddrInfoW|
+|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cryptomining.py)|Resource Hijacking (B0018)|--|
+|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cryptomining.py)|Resource Hijacking::Cryptojacking (B0018.002)|--|
## References
[1] B. G. a. M. Ahuje,"CrowdStrike Discovers First-Ever Dero Cryptojacking Campaign Targeting Kubernetes," CrowdStrike, blog, 15 Mar. 2023. [Online]. Available: https://www.crowdstrike.com/blog/crowdstrike-discovers-first-ever-dero-cryptojacking-campaign-targeting-kubernetes/.
diff --git a/micro-behaviors/communication/dns-communication.md b/micro-behaviors/communication/dns-communication.md
index 4669c35..a30e256 100644
--- a/micro-behaviors/communication/dns-communication.md
+++ b/micro-behaviors/communication/dns-communication.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+29 April 2024 |
@@ -44,8 +44,8 @@ The DNS Communication micro-behavior focuses on DNS communication.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0011.001|Hupigon resolves DNS. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0011.001|Shamoon resolves DNS. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0011.001|Hupigon resolves DNS. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0011.001|Shamoon resolves DNS. [[1]](#1)|
## Detection
@@ -65,6 +65,17 @@ The DNS Communication micro-behavior focuses on DNS communication.
|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_doh_tls.py)|DNS Communication (C0011)|--|
|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|DNS Communication (C0011)|--|
+### C0011.001 Snippet
+
+ Communication::DNS Communication::Resolve
+SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
+Location: 0x472CD3
+
+push ebx ; hostname to perform DNS lookup for
+call WSOCK32.DLL::gethostbyname ; Windows function which will retrieve an object representing the specified host
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/communication/http-communication.md b/micro-behaviors/communication/http-communication.md
index 62bef98..f846ade 100644
--- a/micro-behaviors/communication/http-communication.md
+++ b/micro-behaviors/communication/http-communication.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -59,11 +59,11 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|Name|Date|Method|Description|
|---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.010|The malware initializes IWebBrowser2. [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.011|The malware extracts the HTTP body. [[1]](#1)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|C0002.012|The malware creates a HTTP request. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.009|Kovter connects to a HTTP server. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.012|Kovter creates a HTTP request. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0002.010|The malware initializes IWebBrowser2. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0002.011|The malware extracts the HTTP body. [[1]](#1)|
+|[**Emotet**](../../xample-malware/emotet.md)|2018|C0002.012|The malware creates a HTTP request. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|C0002.009|Kovter connects to a HTTP server. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|C0002.012|Kovter creates a HTTP request. [[1]](#1)|
## Detection
@@ -120,6 +120,21 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|[downloads_from_filehosting](https://github.com/CAPESandbox/community/tree/master/modules/signatures/downloads_from_filehosting.py)|HTTP Communication (C0002)|WinHttpOpenRequest, InternetOpenUrlA|
|[purplewave_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_network_activity.py)|HTTP Communication (C0002)|InternetOpenW, HttpOpenRequestW, HttpSendRequestW, HttpAddRequestHeadersA|
+### C0002.017 Snippet
+
+ Communication::HTTP Communication::Get Response
+SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
+Location: 0x180001380
+
+mov param_2, ebx
+lea r9, [rsp + 0x44] ; where to store the number of bytes read
+add param_2, r14 ; pointer to buffer to receive HTTP data
+mov param_3, 0x400 ; number of bytes to read (1024)
+mov param_1, rsi ; handle to previously opened HTTP request
+call qword ptr [->WININET::InternetReadFile] ; Windows API for reading data from HTTP or FTP connections
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/communication/interprocess-communication.md b/micro-behaviors/communication/interprocess-communication.md
index 735d31e..8efc48c 100644
--- a/micro-behaviors/communication/interprocess-communication.md
+++ b/micro-behaviors/communication/interprocess-communication.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -43,9 +43,9 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.001|Hupigon creates two anonymous pipes. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.004|Hupigon writes pipes. [[1]](#1)|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0003.004|Poison Ivy writes pipes. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0003.001|Hupigon creates two anonymous pipes. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0003.004|Hupigon writes pipes. [[1]](#1)|
+|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|C0003.004|Poison Ivy writes pipes. [[1]](#1)|
## Detection
@@ -64,6 +64,24 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
+### C0003.002 Snippet
+
+ Communication::Interprocess Communication::Connect Pipe
+SHA256: e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732
+Location: 0x40167C
+
+call qword ptr [->KERNEL32.DLL::CreateNamedPipeA] ; stores return value in rax
+mov r12, rax ; r12 now contains a handle to the named pipe
+lea rax, [rax + -0x1]
+cmp rax, -0x3
+ja LAB_004016dc
+xor param_2, param_2 ; set value to zeroes. param_2 is edx, which is sometimes used to hold the second argument to a function
+mov param_1, r12 ; param_1 is rcx, which is sometimes used to hold the first argument to a function. r12 contains the return value from KERNEL32.DLL::CreateNamedPipeA (see earlier mov instruction)
+lea rdi, [rsp + 0x4c]
+call qword ptr [->KERNEL32.DLL::ConnectNamedPipe] ; takes param_1 and param_2 as arguments. Return value stored in rax.
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/communication/socket-communication.md b/micro-behaviors/communication/socket-communication.md
index 94e775b..b56db8c 100644
--- a/micro-behaviors/communication/socket-communication.md
+++ b/micro-behaviors/communication/socket-communication.md
@@ -13,7 +13,7 @@
| Version |
-3.1 |
+3.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -59,9 +59,9 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|Name|Date|Method|Description|
|---|---|---|---|
|[**SYNful Knock**](../../xample-malware/synful-knock.md)|2015|C0001.014|SYNful Knock initiates communication with the C2 server via a uniquely crafted TCP SYN packet sent to port 80 of the "implanted" router. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0001.010|Hupigon creates a UDP socket. [[2]](#2)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0001.011|Rombertik creates a TCP socket. [[2]](#2)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0001.009|Shamoon initializes a Winsock library. [[2]](#2)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0001.010|Hupigon creates a UDP socket. [[2]](#2)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0001.011|Rombertik creates a TCP socket. [[2]](#2)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0001.009|Shamoon initializes a Winsock library. [[2]](#2)|
## Detection
@@ -90,6 +90,18 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Socket Communication (C0001)|send|
|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|Socket Communication (C0001)|listen, bind|
+### C0001.009 Snippet
+
+ Communication::Socket Communication::Initialize Winsock Library
+SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
+Location: 0x472C92
+
+push eax ; pointer to WSADATA structure that the call to start Winsock will populate with the Windows socket data
+push 0x101 ; highest version of Winsock permitted for use in this application -- in this case, version 1.1 (major version in lowest-order byte, minor version in highest-order byte)
+call WSOCK.DLL::WSAStartup ; Initiate the Winsock DLL
+
+
+
## References
[1] https://www.mandiant.com/resources/synful-knock-acis
diff --git a/micro-behaviors/communication/wininet.md b/micro-behaviors/communication/wininet.md
index d1f6181..8653321 100644
--- a/micro-behaviors/communication/wininet.md
+++ b/micro-behaviors/communication/wininet.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -48,6 +48,45 @@ The methods below are those of most interest in malware analysis. Details can be
|---|---|---|
|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|WinINet (C0005)|InternetOpenA, InternetOpenUrlA|
+### C0005.001 Snippet
+
+ Communication::WinINet::InternetConnect
+SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
+Location: 0x1800010b2
+
+call qword ptr [->WININET.DLL::InternetOpenA] ; Open a connection to the Internet and return the handle into rax
+mov rbp, rax ; store the handle in rbp
+test rax, rax
+jz LAB_1800013de
+mov param_1, 0x17
+call thunk_FUN_180004114
+mov r10, rax
+mov rdi, rax
+xor eax, eax
+mov param_1, 0x17
+stosb.rep rdi
+mov rdi, r10
+mov param_2, rbx
+nop dword ptr [rax]
+nop word ptr [rax + rax*0x1]
+movzx param_1, byte ptr [param_2 + rsi*offset DAT_18001ea00] ; first instruction in loop
+add param_2, 0x3 ; increase loop variable
+mov byte ptr [rdi], param_1
+lea rdi, [rdi + 0x1]
+cmp param_2, 0x42 ; test for loop end
+jl LAB_1800010f0 ; jump to beginning of loop
+movzx param_3, word ptr [DAT_18001ea44] ; TCP/IP port to connect to. DAT_18001ea44 contains 443, so this connection will occur on the default HTTPS port
+xor r9d, r9d ; name of user (if FTP connection), or NULL
+mov qword ptr [rsp + local_390], rbx ; pointer to application context for the returned handle to the internet connection
+mov param_2, r10 ; pointer to host name for internet server
+mov dword ptr [rsp + local_398], ebx ; pointer to flags specific for service used
+mov param_1, rbp ; handle to the internet connection established earlier
+mov dword ptr [rsp + local_3a0], 0x3 ; service type to access (0x3 indicates use of HTTP)
+mov qword ptr [rsp + local_3a8], rbx ; password for FTP (if needed)
+call qword ptr [->WININET.DLL::InternetConnectA] ; Windows API function to initiate an HTTP connection
+
+
+
## References
[1] https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions
diff --git a/micro-behaviors/cryptography/README.md b/micro-behaviors/cryptography/README.md
index 519f04d..7e5c5ed 100644
--- a/micro-behaviors/cryptography/README.md
+++ b/micro-behaviors/cryptography/README.md
@@ -18,7 +18,7 @@ Micro-behaviors that enable malware to use crypto.
* **Crypto Algorithm** [C0068](../cryptography/crypto-algorithm.md)
* **Crypto Constant** [C0069](../cryptography/crypto-constant.md)
-* **Crypto Library** [C0059](../cryptography/crypto-lib.md)
+* **Crypto Library** [C0059](../cryptography/crypto-library.md)
* **Encrypt Data** [C0027](../cryptography/encrypt-data.md)
* **Decrypt Data** [C0031](../cryptography/decrypt-data.md)
* **Generate Pseudo-random Sequence** [C0021](../cryptography/generate-pseudorandom-sequence.md)
diff --git a/micro-behaviors/cryptography/crypto-algorithm.md b/micro-behaviors/cryptography/crypto-algorithm.md
index c299aed..a4d940a 100644
--- a/micro-behaviors/cryptography/crypto-algorithm.md
+++ b/micro-behaviors/cryptography/crypto-algorithm.md
@@ -30,4 +30,4 @@
A known crypto algorithm is implemented in the code and it is unknown whether it is from a public crypto library.
-When the library is known, **Crypto Library ([C0059](../cryptography/crypto-lib.md))** micro-behavior should be used.
+When the library is known, **Crypto Library ([C0059](../cryptography/crypto-library.md))** micro-behavior should be used.
diff --git a/micro-behaviors/cryptography/cryptographic-hash.md b/micro-behaviors/cryptography/cryptographic-hash.md
index 88cf515..18066f6 100644
--- a/micro-behaviors/cryptography/cryptographic-hash.md
+++ b/micro-behaviors/cryptography/cryptographic-hash.md
@@ -45,13 +45,13 @@ Malware may use a cryptographic hash.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy hashes data via WinCrypt. [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029.001|BlackEnergy hashes data with MD5. [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029.002|BlackEnergy hashes data using SHA1. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter hashes data via WinCrypt. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip hashes data via WinCrypt. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0029.002|Redhip hashes data using SHA1. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|C0029.002|UP007 hashes data using SHA1. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy hashes data via WinCrypt. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0029.001|BlackEnergy hashes data with MD5. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0029.002|BlackEnergy hashes data using SHA1. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter hashes data via WinCrypt. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip hashes data via WinCrypt. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|C0029.002|Redhip hashes data using SHA1. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|C0029.002|UP007 hashes data using SHA1. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md
index 65acb6c..96a9b8b 100644
--- a/micro-behaviors/cryptography/decrypt-data.md
+++ b/micro-behaviors/cryptography/decrypt-data.md
@@ -53,8 +53,8 @@ Malware may decrypt data.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
## Detection
diff --git a/micro-behaviors/cryptography/encrypt-data.md b/micro-behaviors/cryptography/encrypt-data.md
index 0fe34d1..d8c0f5a 100644
--- a/micro-behaviors/cryptography/encrypt-data.md
+++ b/micro-behaviors/cryptography/encrypt-data.md
@@ -54,20 +54,20 @@ Malware may encrypt data.
|Name|Date|Method|Description|
|---|---|---|---|
|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0027.001|The malware uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files. [[1]](#1)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|C0027.009|Emotet encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Emotet**](../../xample-malware/emotet.md)|2018|C0027.009|Emotet encrypts data using RC4 PRGA. [[8]](#8)|
|[**Emotet**](../../xample-malware/emotet.md)|2018|C0027.011|Emotet uses RSA to encrypt network traffic to its C2. [[2]](#2)|
|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|C0027.001|GravityRat v3 supports file AES file encryption. [[3]](#3)|
|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|C0027.003|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key. [[4]](#4)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|C0027.009|CHOPSTICK encrypts the configuration block using RC4 encryption. [[5]](#5)|
-|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|C0027.009|The malware decrypts inner configurations stored in the binary. The malware also encrypts the value of each JSON key with RC4 and encodes the value with Base64. [[6]](#6) [[7]](#7)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0027.009|BlackEnergy encrypts data using RC4 via WinAPI. [[8]](#8)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0027.009|Dark Comet encrypts data using RC4 PRGA. [[8]](#8)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0027.009|DNSChanger encrypts data using RC4 PRGA. [[8]](#8)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0027.004|Hupigon encrypts data using DES. [[8]](#8)|
-|[**Kraken**](../xample-malware/kraken.md)|2008|C0027.009|Kraken encrypts data using RC4 PRGA. [[8]](#8)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0027.009|Locky Bart encrypts data using RC4 PRGA. [[8]](#8)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip encrypts data using DPAPI. [[8]](#8)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0027.009|Rombertik encrypts data using RC4 PRGA. [[8]](#8)|
+|[**CHOPSTICK**](../../xample-malware/chopstick.md)|2015|C0027.009|CHOPSTICK encrypts the configuration block using RC4 encryption. [[5]](#5)|
+|[**Matanbuchus**](../../xample-malware/matanbuchus.md)|2021|C0027.009|The malware decrypts inner configurations stored in the binary. The malware also encrypts the value of each JSON key with RC4 and encodes the value with Base64. [[6]](#6) [[7]](#7)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0027.009|BlackEnergy encrypts data using RC4 via WinAPI. [[8]](#8)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0027.009|Dark Comet encrypts data using RC4 PRGA. [[8]](#8)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0027.009|DNSChanger encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0027.004|Hupigon encrypts data using DES. [[8]](#8)|
+|[**Kraken**](../../xample-malware/kraken.md)|2008|C0027.009|Kraken encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0027.009|Locky Bart encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip encrypts data using DPAPI. [[8]](#8)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0027.009|Rombertik encrypts data using RC4 PRGA. [[8]](#8)|
## Detection
diff --git a/micro-behaviors/cryptography/encryption-key.md b/micro-behaviors/cryptography/encryption-key.md
index 2e11632..23a01df 100644
--- a/micro-behaviors/cryptography/encryption-key.md
+++ b/micro-behaviors/cryptography/encryption-key.md
@@ -41,10 +41,10 @@ Malware may import, generate, or otherwise use an encryption key.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates new key via CryptAcquireContext. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a new key via CryptAcquireContext. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a new key via CryptAcquireContext. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0028.002|Rombertik encrypts data using RC4 KSA. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates new key via CryptAcquireContext. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates a new key via CryptAcquireContext. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a new key via CryptAcquireContext. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0028.002|Rombertik encrypts data using RC4 KSA. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md
index c22ecb4..b24d675 100644
--- a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md
+++ b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md
@@ -13,7 +13,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -43,8 +43,8 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
|Name|Date|Method|Description|
|---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
## Detection
@@ -55,6 +55,43 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
|[generate random numbers via RtlGenRandom](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|SystemFunction036|
|[generate random numbers using a Mersenne Twister](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml)|Generate Pseudo-random Sequence (C0021)|--|
+### C0021 Snippet
+
+ Cryptography::Generate Pseudo-random Sequence
+SHA256: 192cdcbdec8bdebb7cae89037d6004b4aff2b8264c35a3875fa2d6db104437ca
+Location: 0x40B120
+
+mov eax, [DAT_00423174] ; set up the array of values used for the twister
+mov ecx, dword ptr [eax*0x4 + DAT_004227b0]
+mov dword ptr [EBP + local_8], ecx
+mov edx, dword ptr [DAT_00423174]
+add edx, 0x1
+mov dword ptr [DAT_OO423174], edx
+mov eax, dword ptr [ebp + local_8] ; set up by taking x (value in series to start the transform, stored at the memory address [ebp + local_8] in this case
+shr eax, 0xb ; shift x right by 11
+xor eax, dword ptr [ebp + local_8] ; xor the result of the previous operation with the old value of x. The eax register now contains intermediate value y
+mov dword ptr [ebp + local_8], eax ; store the value of y
+mov ecx, dword ptr [ebp + local_8] ; ecx now contains y
+shl ecx, 0x7 ; shift y left by 7
+and ecx, 0x9d2c5680 ; perform a bitwise and against a known constant bitmask (this value is specified in the transform equation)
+xor ecx, dword ptr [ebp + local_8] ; xor the output of the previous two instructions with the old value of y to produce y1 (still an intermediate value)
+mov dword ptr [ebp + local_8], ecx ; store y1
+mov edx, dword ptr [ebp + local_8] ; load y1 into edx to start the third part of the transform
+shl edx, 0xf ; shift y1 left by 15
+and edx, 0xefc60000 ; take y1 and perform a bitwise and operation with another constant
+xor edx, dword ptr [ebp + local_8] ; xor the output from the previous two instructions with the value of y1 stored earlier
+mov dword ptr [ebp + local_8], edx ; save this new intermediate y-value (y2)
+mov eax, dword ptr [ebp + local_8] ; load y2 into eax to start the final portion of the transform and produce the output
+shr eax, 0x12 ; shift y2 right by 18
+xor eax, dword ptr [ebp + local_8] ; xor the output from the previous instruction with the value of y2 stored earlier
+mov dword ptr [ebp + local_8], eax ; store the z-value (final output)
+mov eax, dword ptr [ebp + local_8] ; load the z-value into eax to return it
+mov esp, ebp ; move the stack pointer to the frame pointer
+pop ebp ; pop the current frame off the stack
+ret ; return from the function
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/data/check-string.md b/micro-behaviors/data/check-string.md
index 8cd89d4..49cb34a 100644
--- a/micro-behaviors/data/check-string.md
+++ b/micro-behaviors/data/check-string.md
@@ -34,7 +34,7 @@ Malware may check a string for some characteristics, such as being ASCII content
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart references Base64 strings. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart references Base64 strings. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/data/checksum.md b/micro-behaviors/data/checksum.md
index 6b84947..6546e4a 100644
--- a/micro-behaviors/data/checksum.md
+++ b/micro-behaviors/data/checksum.md
@@ -43,10 +43,10 @@ Malware may derive a checksum from some block of data. The checksum is often use
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0032.001|Dark Comet hashes data with CRC32. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0032.001|Gamut hashes data with CRC32. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0032.001|Locky Bart hashes data with CRC32. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|C0032.001|UP007 hashes data with CRC32. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0032.001|Dark Comet hashes data with CRC32. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|C0032.001|Gamut hashes data with CRC32. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0032.001|Locky Bart hashes data with CRC32. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|C0032.001|UP007 hashes data with CRC32. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/data/compression-library.md b/micro-behaviors/data/compression-library.md
index 4fc487d..d5c557e 100644
--- a/micro-behaviors/data/compression-library.md
+++ b/micro-behaviors/data/compression-library.md
@@ -34,8 +34,8 @@ Malware may utilize a compression library.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
## Detection
diff --git a/micro-behaviors/data/decompress-data.md b/micro-behaviors/data/decompress-data.md
index e9a936a..8c72867 100644
--- a/micro-behaviors/data/decompress-data.md
+++ b/micro-behaviors/data/decompress-data.md
@@ -42,7 +42,7 @@ Malware may decompress data.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Bagle**](../xample-malware/bagle.md)|2004|C0025.003|Bagle decompresses data using aPLib. [[1]](#1)|
+|[**Bagle**](../../xample-malware/bagle.md)|2004|C0025.003|Bagle decompresses data using aPLib. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/data/encode-data.md b/micro-behaviors/data/encode-data.md
index a40be74..0a380ef 100644
--- a/micro-behaviors/data/encode-data.md
+++ b/micro-behaviors/data/encode-data.md
@@ -41,20 +41,20 @@ Malware may encode data.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|C0026.002|CryptoLocker encodes data using XOR. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0026.002|Dark Comet encodes data using XOR. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0026.002|DNSChanger encodes data using XOR. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0026.002|Gamut encodes data using XOR. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0026.002|Hupigon encodes data using XOR. [[1]](#1)|
-|[**Kraken**](../xample-malware/kraken.md)|2008|C0026.002|Kraken encodes data using XOR. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0026.002|Locky Bart encodes data using XOR. [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|C0026.002|Mebromi encodes data using XOR. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0026.002|Redhip encodes data using XOR. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0026.002|Rombertik encodes data using XOR. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0026.002|Shamoon encodes data using XOR. [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0026.002|Stuxnet encodes data using XOR. [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0026.002|TrickBot encodes data using XOR. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|C0026.002|The malware encodes data using XOR. [[1]](#1)|
+|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|C0026.002|CryptoLocker encodes data using XOR. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0026.002|Dark Comet encodes data using XOR. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0026.002|DNSChanger encodes data using XOR. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|C0026.002|Gamut encodes data using XOR. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0026.002|Hupigon encodes data using XOR. [[1]](#1)|
+|[**Kraken**](../../xample-malware/kraken.md)|2008|C0026.002|Kraken encodes data using XOR. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0026.002|Locky Bart encodes data using XOR. [[1]](#1)|
+|[**Mebromi**](../../xample-malware/mebromi.md)|2011|C0026.002|Mebromi encodes data using XOR. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|C0026.002|Redhip encodes data using XOR. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0026.002|Rombertik encodes data using XOR. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0026.002|Shamoon encodes data using XOR. [[1]](#1)|
+|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|C0026.002|Stuxnet encodes data using XOR. [[1]](#1)|
+|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0026.002|TrickBot encodes data using XOR. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|C0026.002|The malware encodes data using XOR. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/data/modulo.md b/micro-behaviors/data/modulo.md
index cd2e937..904a5e6 100644
--- a/micro-behaviors/data/modulo.md
+++ b/micro-behaviors/data/modulo.md
@@ -13,7 +13,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -35,3 +35,13 @@ Malware calculates a modulo value.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[calculate modulo 256 via x86 assembly](https://github.com/mandiant/capa-rules/blob/master/lib/calculate-modulo-256-via-x86-assembly.yml)|Modulo (C0058)|--|
+
+### C0058 Snippet
+
+ Data::Modulo
+SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
+Location: 0x403135
+
+and param_3, 0xff ; Taking the bitwise AND of any number x with a number equivalent to (2^n - 1) where n is a whole number is congruent to taking x % 2^n. In this case, x = param_3 and 0xff = 255 which satisfies (2^n - 1) for n = 8.
+
+
diff --git a/micro-behaviors/data/noncryptographic-hash.md b/micro-behaviors/data/noncryptographic-hash.md
index a891588..380d8d7 100644
--- a/micro-behaviors/data/noncryptographic-hash.md
+++ b/micro-behaviors/data/noncryptographic-hash.md
@@ -13,7 +13,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -48,3 +48,27 @@ Malware may use a non-cryptographic hash.
|[hash data using murmur3](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml)|Non-Cryptographic Hash::MurmurHash (C0030.001)|--|
|[hash data using fnv](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/fnv/hash-data-using-fnv.yml)|Non-Cryptographic Hash::FNV (C0030.005)|_allmul|
|[hash data using djb2](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/djb2/hash-data-using-djb2.yml)|Non-Cryptographic Hash::djb2 (C0030.006)|--|
+
+
+### C0030.005 Snippet
+
+ Data::Non-Cryptographic Hash::FNV
+SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
+Location: 0x403454
+
+mov esi, dword ptr [ebp + param_2] ; set number of bytes to hash
+mov edx, 0x811c9dc5 ; store FNV offset constant. The constants used in this snippet are the constants used for a 32-bit/4 byte message.
+push edi ; save the value of edi on the stack
+mov edi, dword ptr [ebp + param_1] ; first byte to hash
+mov ecx, 0x0 ; initialize counter
+sub esi, edi ; obtain the offset between first and last bytes to hash
+jz LAB_00403481 ; if the first and last bytes of the hash are the same, execute elsewhere and don't perform the hashing operation.
+nop dword ptr [eax]
+movzx eax, byte ptr [ecx + edi*0x1] ; move the byte to hash into the accumulator
+inc ecx ; increment the counter
+xor eax, edx ; xor the new value in the accumulator with the rest of the hash (for first xor, this will be the offset constant set earlier) and store the result in the accumulator. The xor occurring before the multiplication indicates that this is the FNV-1a variant of the algorithm
+imul edx, eax, 0x1000193 ; multiply the accumulator by the prime constant and store in edx for xor operation in next iteration
+cmp ecx, esi ; check if counter has reached offset (hashed last byte)
+jc LAB_00403470 ; if the counter has not yet reached the offset, jump back to the movzx instruction above
+
+
diff --git a/micro-behaviors/file-system/copy-file.md b/micro-behaviors/file-system/copy-file.md
index 7871eed..e8a1816 100644
--- a/micro-behaviors/file-system/copy-file.md
+++ b/micro-behaviors/file-system/copy-file.md
@@ -34,12 +34,12 @@ Malware copies a file.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR copies files. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon copies files. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter copies files. [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip copies files. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR copies files. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon copies files. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter copies files. [[1]](#1)|
+|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip copies files. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/file-system/create-directory.md b/micro-behaviors/file-system/create-directory.md
index cf60127..4e1dbc1 100644
--- a/micro-behaviors/file-system/create-directory.md
+++ b/micro-behaviors/file-system/create-directory.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,13 +34,13 @@ Malware creates a directory.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut creates directories. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates directories. [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT creates directories. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates directories. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates directories. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates directories. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 creates directories. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut creates directories. [[1]](#1)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR creates directories. [[1]](#1)|
+|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT creates directories. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates directories. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates directories. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip creates directories. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 creates directories. [[1]](#1)|
## Detection
@@ -52,6 +52,18 @@ Malware creates a directory.
|---|---|---|
|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create Directory (C0046)|--|
+### C0046 Snippet
+
+ File System::Create Directory
+SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
+Location: 0x1400036d4
+
+xor param_2, param_2 ; use default security attributes (param_2 is NULL)
+mov param_1, rbp ; use contents of rbp as directory name
+call qword ptr [->KERNEL32.DLL::CreateDirectoryA] ; call Windows API to create directory
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/file-system/delete-directory.md b/micro-behaviors/file-system/delete-directory.md
index a282217..64d9a3b 100644
--- a/micro-behaviors/file-system/delete-directory.md
+++ b/micro-behaviors/file-system/delete-directory.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,9 +34,9 @@ Malware deletes a directory.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|
## Detection
@@ -44,6 +44,17 @@ Malware deletes a directory.
|---|---|---|
|[delete directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-directory.yml)|Delete Directory (C0048)|RemoveDirectory, RemoveDirectoryTransacted, _rmdir, _wrmdir, System.IO.DirectoryInfo::Delete, System.IO.Directory::Delete|
+### C0048 Snippet
+
+ File System::Delete Directory
+SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
+Location: 0x140002204
+
+mov param_1, rdi ; store name of directory to remove
+call qword ptr [->KERNEL32.DLL::RemoveDirectoryA] ; call Windows API function to remove directory
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/file-system/delete-file.md b/micro-behaviors/file-system/delete-file.md
index 21c00d6..01a5f67 100644
--- a/micro-behaviors/file-system/delete-file.md
+++ b/micro-behaviors/file-system/delete-file.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,19 +34,19 @@ Malware deletes a file.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet deletes files. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut deletes files. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR deletes files. [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT deletes files. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon deletes files. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter deletes files. [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi deletes files. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip deletes files. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik deletes files. [[1]](#1)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam deletes files. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet deletes files. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut deletes files. [[1]](#1)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR deletes files. [[1]](#1)|
+|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT deletes files. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon deletes files. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter deletes files. [[1]](#1)|
+|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi deletes files. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip deletes files. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik deletes files. [[1]](#1)|
+|[**SamSam**](../../xample-malware/samsam.md)|2015|--|SamSam deletes files. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
+|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|
## Detection
@@ -63,6 +63,20 @@ Malware deletes a file.
|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA|
|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
+### C0047 Snippet
+
+ File System::Delete File
+SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
+Location: 0x409BB1
+
+call FUN_00404E80 ; generate file name to delete and store in eax
+push eax ; use the name generated by the previous function as an argument to the next function call
+call KERNEL32.DLL::DeleteFileA ; delete the file
+cmp eax, 0x1 ; if the file was successfully deleted, the previous function call will return a 1 into eax
+sbb eax, eax ; isolate the carry flag from the previous comparison. This will only be 1 if the previous command failed, otherwise it will be 0.
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/file-system/get-file-attributes.md b/micro-behaviors/file-system/get-file-attributes.md
index 2ceed04..269775b 100644
--- a/micro-behaviors/file-system/get-file-attributes.md
+++ b/micro-behaviors/file-system/get-file-attributes.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,12 +34,12 @@ Malware gets file attributes.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet gets file attributes. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger gets file attributes. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut gets file attributes. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon gets file attributes. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets file attributes. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 gets file attributes. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet gets file attributes. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger gets file attributes. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut gets file attributes. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon gets file attributes. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip gets file attributes. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 gets file attributes. [[1]](#1)|
## Detection
@@ -47,6 +47,25 @@ Malware gets file attributes.
|---|---|---|
|[get file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-attributes.yml)|Get File Attributes (C0049)|kernel32.GetFileAttributes, ZwQueryDirectoryFile, ZwQueryInformationFile, NtQueryDirectoryFile, NtQueryInformationFile, System.IO.File::GetAttributes, System.IO.File::GetCreationTime, System.IO.File::GetCreationTimeUtc, System.IO.File::GetLastAccessTime, System.IO.File::GetLastAccessTimeUtc, System.IO.File::GetLastWriteTime, System.IO.File::GetLastWriteTimeUtc|
+### C0049 Snippet
+
+ File System::Get File Attributes
+SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
+Location: 0x4094B0
+
+push ebx ; Name of file to get attributes for
+mov ebx, param_1
+mov param_1, ebx
+call FUN_00404DFC
+push param_1 ; Return value for function call
+call KERNEL32.DLL::GetFileAttributesA ; Call Windows API for file deletion
+cmp param_1, -0x1 ; Test if the return value indicates an error
+jz LAB_004094C9 ; If the function returned an error, go to this address to continue execution
+test param_1, 0x10 ; Test to see if the file queried is a directory
+jnz LAB_004094CD ; If the file is not a directory, continue execution from this address
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/file-system/move-file.md b/micro-behaviors/file-system/move-file.md
index 7e1fdc1..7235f75 100644
--- a/micro-behaviors/file-system/move-file.md
+++ b/micro-behaviors/file-system/move-file.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,12 +34,12 @@ Malware moves a file.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut moves files. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon moves files. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter moves files. [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi moves files. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon moves files. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 moves files. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut moves files. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon moves files. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter moves files. [[1]](#1)|
+|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi moves files. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon moves files. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 moves files. [[1]](#1)|
## Detection
@@ -51,6 +51,20 @@ Malware moves a file.
|---|---|---|
|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
+### C0063 Snippet
+
+ File System::Move File
+SHA256: bb8c0e477512adab1db26eb77fe10dadbc5dcbf8e94569061c7199ca4626a420
+Location: 0x41a61d
+
+push 0x4 ; option to delay move until the next reboot
+push edi ; new name for the moved file
+lea eax, [ebp + 0xffffefc4]
+push eax ; name of the file to be moved
+call dword ptr [->KERNEL32.DLL::MoveFileExW] ; Windows API function to move the file from one name to another
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/file-system/read-file.md b/micro-behaviors/file-system/read-file.md
index e3afb55..86db5cf 100644
--- a/micro-behaviors/file-system/read-file.md
+++ b/micro-behaviors/file-system/read-file.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,20 +34,20 @@ Malware reads a file.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet reads files on Windows. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger reads files on Windows. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut reads files on Windows. [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT reads files on Windows. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon reads files on Windows. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter reads files on Windows. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart reads files on Windows. [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi reads files on Windows. [[1]](#1)|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy reads files on Windows. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip reads files on Windows. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik reads files on Windows. [[1]](#1)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam reads files on Windows. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon reads files on Windows. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 reads files on Windows. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet reads files on Windows. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger reads files on Windows. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut reads files on Windows. [[1]](#1)|
+|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT reads files on Windows. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon reads files on Windows. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter reads files on Windows. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart reads files on Windows. [[1]](#1)|
+|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi reads files on Windows. [[1]](#1)|
+|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy reads files on Windows. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip reads files on Windows. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik reads files on Windows. [[1]](#1)|
+|[**SamSam**](../../xample-malware/samsam.md)|2015|--|SamSam reads files on Windows. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon reads files on Windows. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 reads files on Windows. [[1]](#1)|
## Detection
@@ -67,6 +67,21 @@ Malware reads a file.
|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_browser.py)|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW|
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Read File (C0051)|--|
+### C0051 Snippet
+
+ File System::Read File
+SHA256: e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732
+Location: 0x401762
+
+mov r9, rdi ; variable that will hold number of bytes actually read from file
+mov r8d, ebx ; number of bytes to read
+mov param_2, rsi ; pointer to buffer that will hold content read from file
+mov param_1, r12 ; handle to the device/file to read from
+mov qword ptr [rsp + local_58], 0x0 ; optional pointer to OVERLAPPED structure (in this case, it is NULL)
+call qword ptr [->KERNEL32.DLL::ReadFile] ; API call to read file specified in param_1
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/file-system/set-file-attributes.md b/micro-behaviors/file-system/set-file-attributes.md
index e85c9f1..cce2780 100644
--- a/micro-behaviors/file-system/set-file-attributes.md
+++ b/micro-behaviors/file-system/set-file-attributes.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,12 +34,12 @@ Malware sets file attributes.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger sets file attributes. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut sets file attributes. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon sets file attributes. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter sets file attributes. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets file attributes. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 sets file attributes. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger sets file attributes. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut sets file attributes. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon sets file attributes. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter sets file attributes. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip sets file attributes. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 sets file attributes. [[1]](#1)|
## Detection
@@ -48,6 +48,18 @@ Malware sets file attributes.
|[change file permission on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/change-file-permission-on-linux.yml)|Set File Attributes (C0050)|chown, fchown, lchown, fchownat|
|[set file attributes](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/set-file-attributes.yml)|Set File Attributes (C0050)|kernel32.SetFileAttributes, ZwSetInformationFile, NtSetInformationFile, System.IO.File::SetAttributes, System.IO.File::SetCreationTime, System.IO.File::SetCreationTimeUtc, System.IO.File::SetLastAccessTime, System.IO.File::SetLastAccessTimeUtc, System.IO.File::SetLastWriteTime, System.IO.File::SetLastWriteTimeUtc|
+### C0050 Snippet
+
+ File System::Set File Attributes
+SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
+Location: 0x140006a6d
+
+mov edx, 0x2 ; pass the value indicating for the 'hidden' attribute to be set on the file
+lea rcx, [rsp + 0x40] ; name of the file for which attributes should be changed
+call qword ptr [->KERNEL32.DLL::SetFileAttributesA] ; call Windows API for changing file attributes
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/file-system/writes-file.md b/micro-behaviors/file-system/writes-file.md
index 44e5734..bd2c17c 100644
--- a/micro-behaviors/file-system/writes-file.md
+++ b/micro-behaviors/file-system/writes-file.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,18 +34,18 @@ Malware writes to a file.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker writes Fileon Windows. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet writes Fileon Windows. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger writes Fileon Windows. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut writes files on Windows. [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT writes files on Windows. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon writes files on Windows. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart writes files on Windows. [[1]](#1)|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy writes files on Windows. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip writes files on Windows. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik writes files on Windows. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon writes files on Windows. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 writes files on Windows. [[1]](#1)|
+|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|--|CryptoLocker writes Fileon Windows. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet writes Fileon Windows. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger writes Fileon Windows. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut writes files on Windows. [[1]](#1)|
+|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT writes files on Windows. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon writes files on Windows. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart writes files on Windows. [[1]](#1)|
+|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy writes files on Windows. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip writes files on Windows. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik writes files on Windows. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon writes files on Windows. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 writes files on Windows. [[1]](#1)|
## Detection
@@ -67,6 +67,21 @@ Malware writes to a file.
|[echelon_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/echelon_files.py)|Writes File (C0052)|--|
|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/upatre_files.py)|Writes File (C0052)|--|
+### C0052 Snippet
+
+ File System::Writes File
+SHA256: e5897829835f3e9fbab71674ca06f48ff127ec014d1629817f0566203c93b732
+Location: 0x4016A7
+
+mov r9, rdi ; variable that will hold number of bytes actually written
+mov r8d, ebx ; number of bytes to write
+mov param_2, rsi ; pointer to buffer containing data that will be written to the file
+mov param_1, r12 ; handle to the device/file to write to
+mov qword ptr [rsp + local_58], 0x0 ; optional pointer to OVERLAPPED structure (in this case, it is NULL)
+call qword ptr [->KERNEL32.DLL::WriteFile] ; API call to write to file specified in param_1
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/memory/allocate-memory.md b/micro-behaviors/memory/allocate-memory.md
index 492bae2..357d8b8 100644
--- a/micro-behaviors/memory/allocate-memory.md
+++ b/micro-behaviors/memory/allocate-memory.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2023 |
@@ -34,15 +34,15 @@ Malware allocates memory, often to unpack itself.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker allocates RWX memory. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet allocates RWX memory. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger allocates RWX memory. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon allocates RWX memory. [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi allocates RWX memory. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip spawns threads to RWX shellcode. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik allocates RWX memory. [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet allocates RWX memory. [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot allocates RWX memory. [[1]](#1)|
+|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|--|CryptoLocker allocates RWX memory. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet allocates RWX memory. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|--|DNSChanger allocates RWX memory. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon allocates RWX memory. [[1]](#1)|
+|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi allocates RWX memory. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip spawns threads to RWX shellcode. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik allocates RWX memory. [[1]](#1)|
+|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet allocates RWX memory. [[1]](#1)|
+|[**TrickBot**](../../xample-malware/trickbot.md)|2016|--|TrickBot allocates RWX memory. [[1]](#1)|
## Detection
@@ -57,6 +57,20 @@ Malware allocates memory, often to unpack itself.
|---|---|---|
|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+### C0007 Snippet
+
+ Memory::Allocate Memory
+SHA256: 000b535ab2a4fec86e2d8254f8ed65c6ebd37309ed68692c929f8f93a99233f6
+Location: 0x422BDC
+
+push 0x40 ; Memory protections to apply to pages in allocated memory region (in this case, PAGE_EXECUTE_READWRITE, which allows execute, read-only, or read/write access to the allocated memory)
+push 0x1000 ; The type of allocation to perform (in this case, MEM_COMMIT which allocates empty virtual memory to begin with and only allocates physical pages when needed).
+push 0x1000 ; Size of region to allocate in bytes
+push 0x0 ; Starting address for region where memory should be allocated (not provided in this example)
+call KERNEL32.DLL::VirtualAlloc ; call function to allocate virtual memory
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/memory/change-memory-protection.md b/micro-behaviors/memory/change-memory-protection.md
index 4c8a8f1..eccb417 100644
--- a/micro-behaviors/memory/change-memory-protection.md
+++ b/micro-behaviors/memory/change-memory-protection.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -50,6 +50,23 @@ Malware may change memory protection. For example, read-write memory may be chan
|---|---|---|
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+### C0008 Snippet
+
+ Memory::Change Memory Protection
+SHA256: 905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8
+Location: 0x41AB74
+
+push ecx ; pointer to return value
+push 0x40 ; new memory protection option to apply -- in this case, read, write, and execute permissions will be applied to the pages
+mov [DAT_01f56ff0], eax
+mov eax, [DAT_00492fc4]
+push edx ; size of region to change access protection attributes (in bytes)
+push eax ; Address of first page in region where access protection attributes are to be changed
+; instructions from 0x41ab83 to 0x41abb4 omitted
+call dword ptr [->KERNEL32.DLL::VirtualProtect] ; call function to change memory protection attributes
+
+
+
## References
[1] https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
diff --git a/micro-behaviors/memory/stack-pivot.md b/micro-behaviors/memory/stack-pivot.md
index 53a9081..b5a95c8 100644
--- a/micro-behaviors/memory/stack-pivot.md
+++ b/micro-behaviors/memory/stack-pivot.md
@@ -28,4 +28,4 @@
# Stack Pivot
-Stack pivoting involves pointing the stack pointer to an attacker-owned buffer, such as the heap, and facilitates exploits such as ROP-based exploits (see [Bypass DEP](../defense-evasion/bypass-data-execution-prevention.md) behavior).
+Stack pivoting involves pointing the stack pointer to an attacker-owned buffer, such as the heap, and facilitates exploits such as ROP-based exploits (see [Bypass DEP](../../defense-evasion/bypass-data-execution-prevention.md) behavior).
diff --git a/micro-behaviors/operating-system/console.md b/micro-behaviors/operating-system/console.md
index 1967b73..f9ff531 100644
--- a/micro-behaviors/operating-system/console.md
+++ b/micro-behaviors/operating-system/console.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -40,3 +40,21 @@ Malware modifies the console.
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Console (C0033)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
+
+### C0033 Snippet
+
+ Operating System::Console
+SHA256: 905b9db8cf5a3001318b28ee5dc674f8f65ca1e4306aab9e331b3bba24e7b8a8
+Location: 0x41B4CD
+
+lea eax, [esp + 0x50] ; load an address into eax
+push eax ; where to store number of characters read
+push ecx ; coordinates of console cell on screen where reading text should begin
+push ecx ; number of screen buffer character cells to read
+lea edx, [esp + 0x2cc] ; load address into edx
+push edx ; address of buffer into which characters should be read
+push ecx ; handle to the console read buffer
+mov dword ptr [esp + 0x68], ecx
+call KERNEL32.DLL::ReadConsoleOutputCharacterA ; call function to read characters from the console
+
+
diff --git a/micro-behaviors/operating-system/environment-variable.md b/micro-behaviors/operating-system/environment-variable.md
index 6df471e..df1a881 100644
--- a/micro-behaviors/operating-system/environment-variable.md
+++ b/micro-behaviors/operating-system/environment-variable.md
@@ -40,8 +40,8 @@ Malware modifies environment variables.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0034.001|Kovter sets environment variables. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|C0034.001|UP007 sets environment variables. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|C0034.001|Kovter sets environment variables. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|C0034.001|UP007 sets environment variables. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md
index 56a51b7..03c248a 100644
--- a/micro-behaviors/operating-system/registry.md
+++ b/micro-behaviors/operating-system/registry.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -46,40 +46,40 @@ Malware modifies the registry.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.005|BlackEnergy queries or enumerates a registry key. [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.006|BlackEnergy queries or enumerates a registry value. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.001|Dark Comet sets registry values. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.002|Dark Comet deletes registry keys. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.005|Dark Comet queries or enumerates registry keys. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.006|Dark Comet queries or enumerates registry values. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.007|Dark Comet deletes registry values. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.001|DNSChanger sets registry keys. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.006|DNSChanger queries or enumerates registry values. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.001|Gamut sets registry values. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.002|Gamut deletes registry keys. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.005|Gamut queries or enumerates registry keys. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.006|Gamut queries or enumerates registry values. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.007|Gamut deletes registry values. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|C0036.006|GoBotKR queries or enumerates registry values. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.001|Hupigon sets registry values. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.002|Hupigon deletes registry keys. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.005|Hupigon queries or enumerates registry keys. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.006|Hupigon queries or enumerates registry values. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.007|Hupigon deletes registry values. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.004|Kovter creates or opens registry keys. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.006|Kovter queries or enumerates registry values. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0036.001|Locky Bart sets registry values. [[1]](#1)|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0036.006|Poison Ivy queries or enumerates registry values. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.001|Redhip set registry values. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.002|Redhip deletes registry keys. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.006|Redhip queries or enumerates registry values. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.001|Rombertik sets registry values. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.002|Rombertik deletes registry keys. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.006|Rombertik queries or enumerates registry values. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.006|Shamoon queries or enumerates registry values. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.007|Shamoon deletes registry values. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|C0036.001|UP007 sets registry values. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|C0036.006|UP007 queries or enumerates registry values. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0036.005|BlackEnergy queries or enumerates a registry key. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|C0036.006|BlackEnergy queries or enumerates a registry value. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.001|Dark Comet sets registry values. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.002|Dark Comet deletes registry keys. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.005|Dark Comet queries or enumerates registry keys. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.006|Dark Comet queries or enumerates registry values. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|C0036.007|Dark Comet deletes registry values. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0036.001|DNSChanger sets registry keys. [[1]](#1)|
+|[**DNSChanger**](../../xample-malware/dnschanger.md)|2011|C0036.006|DNSChanger queries or enumerates registry values. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.001|Gamut sets registry values. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.002|Gamut deletes registry keys. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.005|Gamut queries or enumerates registry keys. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.006|Gamut queries or enumerates registry values. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|C0036.007|Gamut deletes registry values. [[1]](#1)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|C0036.006|GoBotKR queries or enumerates registry values. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.001|Hupigon sets registry values. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.002|Hupigon deletes registry keys. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.005|Hupigon queries or enumerates registry keys. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.006|Hupigon queries or enumerates registry values. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|C0036.007|Hupigon deletes registry values. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|C0036.004|Kovter creates or opens registry keys. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|C0036.006|Kovter queries or enumerates registry values. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|C0036.001|Locky Bart sets registry values. [[1]](#1)|
+|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|C0036.006|Poison Ivy queries or enumerates registry values. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|C0036.001|Redhip set registry values. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|C0036.002|Redhip deletes registry keys. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|C0036.006|Redhip queries or enumerates registry values. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0036.001|Rombertik sets registry values. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0036.002|Rombertik deletes registry keys. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|C0036.006|Rombertik queries or enumerates registry values. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0036.006|Shamoon queries or enumerates registry values. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|C0036.007|Shamoon deletes registry values. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|C0036.001|UP007 sets registry values. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|C0036.006|UP007 queries or enumerates registry values. [[1]](#1)|
## Detection
@@ -220,6 +220,21 @@ Malware modifies the registry.
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry::Set Registry Value (C0036.001)|--|
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Registry (C0036)|--|
+### C0036.005 Snippet
+
+ Registry::Query Registry Key
+SHA256: 1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53
+Location: 0x408723
+
+push eax ; phkResult: stores pointer to handle containing open registry key
+push 0x1 ; samDesired: Desired access rights for opened key. 0x1 is KEY_QUERY_VALUE, which is required to query the value of the sought registry key
+push 0x0 ; ulOptions: Optional key set to 0, so no options passed to registry key
+push ecx ; lpSubKey: Optional parameter indicating a subkey to read from
+push edx ; handle to open registry key or name of registry key to open
+call dword ptr [->ADVAPI32.DLL::RegOpenKeyExA] ; Windows API call which opens registry key for the query
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/process/allocate-thread-local-storage.md b/micro-behaviors/process/allocate-thread-local-storage.md
index 75b9791..365b0a2 100644
--- a/micro-behaviors/process/allocate-thread-local-storage.md
+++ b/micro-behaviors/process/allocate-thread-local-storage.md
@@ -13,7 +13,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-13 September 2023 |
+30 April 2024 |
@@ -34,8 +34,8 @@ Malware allocates thread local storage.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter allocates thread local storage. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon allocates thread local storage. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter allocates thread local storage. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon allocates thread local storage. [[1]](#1)|
## Detection
@@ -43,6 +43,16 @@ Malware allocates thread local storage.
|---|---|---|
|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
+### C0040 Snippet
+
+ Process::Allocate Thread Local Storage
+SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
+Location: 0x4142CB
+
+call dword ptr [->KERNEL32.DLL::TlsAlloc] ; call Windows API function to allocate thread local storage
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/process/check-mutex.md b/micro-behaviors/process/check-mutex.md
index 966275e..102d5e8 100644
--- a/micro-behaviors/process/check-mutex.md
+++ b/micro-behaviors/process/check-mutex.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -34,8 +34,8 @@ Malware checks a mutex.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[1]](#1)|
-|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[2]](#2) [[3]](#3)|
+|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[1]](#1)|
+|[**Matanbuchus**](../../xample-malware/matanbuchus.md)|2021|--|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[2]](#2) [[3]](#3)|
## Detection
@@ -51,6 +51,21 @@ Malware checks a mutex.
|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Check Mutex (C0043)|--|
|[purplewave_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_mutexes.py)|Check Mutex (C0043)|--|
+### C0043 Snippet
+
+ Process::Check Mutex
+SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
+Location: 0x40294C
+
+ push eax ; name of mutex to be opened
+push 0x0 ; whether to allow processes created by the process which owns the mutex to inherit it (false)
+push 0x1f0001 ; mutex access rights (MUTEX_ALL_ACCESS)
+call dword ptr [->KERNEL32.DLL::OpenMutexW] ; call function to open mutex
+test eax, eax ; test to see if previous function call returned 0
+jz LAB_00402976 ; if it returned zero (error), jump to new memory location and execute from that point
+
+
+
## References
[1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
diff --git a/micro-behaviors/process/create-mutex.md b/micro-behaviors/process/create-mutex.md
index c94dce0..cbdbf8d 100644
--- a/micro-behaviors/process/create-mutex.md
+++ b/micro-behaviors/process/create-mutex.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -34,12 +34,12 @@ Malware creates a mutex.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy has a default process mutex, but can be altered at build time. [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[2]](#2)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a mutex. [[3]](#3)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a mutex. [[3]](#3)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates a mutex. [[3]](#3)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a mutex. [[3]](#3)|
+|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|--|Poison Ivy has a default process mutex, but can be altered at build time. [[1]](#1)|
+|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[2]](#2)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates a mutex. [[3]](#3)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates a mutex. [[3]](#3)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip creates a mutex. [[3]](#3)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik creates a mutex. [[3]](#3)|
## Detection
@@ -102,6 +102,19 @@ Malware creates a mutex.
|[medusalocker_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_mutexes.py)|Create Mutex (C0042)|--|
|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Create Mutex (C0042)|--|
+### C0042 Snippet
+
+ Process::Create Mutex
+SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
+Location: 0x402A1E
+
+push eax ; name of mutex
+push 0x0 ; if the thread that creates the mutex owns it (false, in this case)
+push 0x0 ; optional security descriptor set to NULL, so default security descriptor will be used
+call dword ptr [->KERNEL32.DLL::CreateMutexW] ; call function to create mutex
+
+
+
## References
[1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
diff --git a/micro-behaviors/process/create-process.md b/micro-behaviors/process/create-process.md
index 6732640..433669d 100644
--- a/micro-behaviors/process/create-process.md
+++ b/micro-behaviors/process/create-process.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -42,20 +42,20 @@ Malware creates a process.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0017.002|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates a process on Windows. [[2]](#2)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a process on Windows. [[2]](#2)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut creates a process on Windows. [[2]](#2)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a process on Windows. [[2]](#2)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a process on Windows. [[2]](#2)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a process on Windows. [[2]](#2)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi creates a process on Windows. [[2]](#2)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates a process on Windows. [[2]](#2)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0017.003|Redhip creates a suspended process. [[2]](#2)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a process on Windows. [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot creates a process on Windows. [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0017.003|TrickBot creates a suspended process. [[2]](#2)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|The malware creates a process on Windows. [[2]](#2)|
+|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|C0017.002|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates a process on Windows. [[2]](#2)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a process on Windows. [[2]](#2)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut creates a process on Windows. [[2]](#2)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a process on Windows. [[2]](#2)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates a process on Windows. [[2]](#2)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter creates a process on Windows. [[2]](#2)|
+|[**Mebromi**](../../xample-malware/mebromi.md)|2011|--|Mebromi creates a process on Windows. [[2]](#2)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip creates a process on Windows. [[2]](#2)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|C0017.003|Redhip creates a suspended process. [[2]](#2)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon creates a process on Windows. [[2]](#2)|
+|[**TrickBot**](../../xample-malware/trickbot.md)|2016|--|TrickBot creates a process on Windows. [[2]](#2)|
+|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0017.003|TrickBot creates a suspended process. [[2]](#2)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|The malware creates a process on Windows. [[2]](#2)|
## Detection
@@ -75,6 +75,30 @@ Malware creates a process.
|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process::Create Process via WMI (C0017.002)|NtCreateUserProcess, CreateProcessInternalW|
|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW|
+### C0049 Snippet
+
+ Process::Create Process
+SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
+Location: 0x458C26
+
+lea param_1, [ebp + 0xfffffeb0]
+push param_1 ; pointer to PROCESS_INFORMATION struct to hold information about the new process
+lea param_1, [ebp + 0xfffffec0]
+push param_1 ; pointer to STARTUPINFO struct
+push 0x0 ; path to directory for new process -- if null, use same directory as calling process
+push 0x0 ; environment block for new process -- if null, use the calling process's environment block
+push 0x4 ; process creation flags (CREATE_SUSPENDED in this case)
+push 0x0 ; if heritable handles in the calling process should be inherited by the new process. If false, inheritance will not occur.
+push 0x0 ; security attributes for new process. If null, child processes cannot inherit thread running new process
+push 0x0 ; security attributes for new process. If null, child processes cannot inherit handle for new process
+mov param_1, dword ptr [ebp + local_8]
+call FUN_00404dfc
+push param_1 ; command line for new process to execute
+push 0x0 ; application name to be executed. If null, use command line provided in another argument
+call KERNEL32.DLL::CreateProcessA ; Call Windows API function to create new process
+
+
+
## References
[1] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
diff --git a/micro-behaviors/process/create-thread.md b/micro-behaviors/process/create-thread.md
index ac45153..0e3cfa7 100644
--- a/micro-behaviors/process/create-thread.md
+++ b/micro-behaviors/process/create-thread.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,12 +34,12 @@ Malware creates a thread.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a thread. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a thread. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a thread. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a thread. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a thread. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a thread. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a thread. [[1]](#1)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a thread. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon creates a thread. [[1]](#1)|
+|[**Locky Bart**](../../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a thread. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik creates a thread. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon creates a thread. [[1]](#1)|
## Detection
@@ -54,6 +54,26 @@ Malware creates a thread.
|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Create Thread (C0038)|NtCreateThreadEx|
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Create Thread (C0038)|NtSetInformationThread|
+### C0038 Snippet
+
+ Process::Create Thread
+SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
+Location: 0x404915
+
+mov param_2, dword ptr [ebp + param_4]
+push param_2 ; Pointer to location where thread handler will be returned
+mov param_2, dword ptr [ebp + param_5]
+push param_2 ; Flags controlling thread creation
+push param_1 ; Pointer to variable to be passed to thread
+mov param_1, FUN_004048b8
+push param_1 ; Pointer to function where thread will begin execution
+push esi ; Size of stack for new thread
+push ebx ; Pointer to security attributes for thread. If null, the handle to the thread cannot be inherited
+call KERNEL32.DLL::CreateThread ; Call to thread creation API
+
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/process/enumerate-threads.md b/micro-behaviors/process/enumerate-threads.md
index 33e0ffc..1a0a36c 100644
--- a/micro-behaviors/process/enumerate-threads.md
+++ b/micro-behaviors/process/enumerate-threads.md
@@ -13,7 +13,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-13 September 2023 |
+30 April 2024 |
@@ -35,3 +35,18 @@ Malware enumerates threads.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[enumerate threads](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/list/enumerate-threads.yml)|Enumerate Threads (C0064)|kernel32.Thread32First, kernel32.Thread32Next, kernel32.CreateToolhelp32Snapshot|
+
+### C0064 Snippet
+
+ Process::Enumerate Threads
+SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
+Location: 0x180003675
+
+lea rdx, [rsp + 0x48] ; pointer to THREAD32ENTRY struct
+mov rcx, r15 ; handle to snapshot of system processes
+call qword ptr [->KERNEL32.DLL::Thread32First] ; Windows API call to retrieve information about the first thread in a snapshot
+lea rdx, [rsp + 0x48]
+mov rcx, r15
+call qword ptr [->KERNEL32.DLL::Thread32Next] ; takes the same arguments as Thread32First and gets the next thread from the snapshot
+
+
diff --git a/micro-behaviors/process/resume-thread.md b/micro-behaviors/process/resume-thread.md
index 85c6961..441b2aa 100644
--- a/micro-behaviors/process/resume-thread.md
+++ b/micro-behaviors/process/resume-thread.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-6 February 2024 |
+30 April 2024 |
@@ -34,8 +34,8 @@ Malware resumes a thread.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker resumes thread. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet resumes a thread. [[1]](#1)|
+|[**CryptoLocker**](../../xample-malware/cryptolocker.md)|2013|--|CryptoLocker resumes thread. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet resumes a thread. [[1]](#1)|
## Detection
@@ -43,6 +43,21 @@ Malware resumes a thread.
|---|---|---|
|[resume thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/resume/resume-thread.yml)|Resume Thread (C0054)|kernel32.ResumeThread, ntdll.NtResumeThread, ntdll.ZwResumeThread, System.Threading.Thread::Resume|
+### C0054 Snippet
+
+ Process::Resume Thread
+SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
+Location: 0x41B345
+
+push esi ; Where to store return value
+mov ebx, param_1
+mov param_1, dword ptr [ebx + 0x4]
+push param_1 ; Handle to thread to resume
+call KERNEL32.DLL::ResumeThread ; API call to resume thread
+
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/process/set-thread-local-storage-value.md b/micro-behaviors/process/set-thread-local-storage-value.md
index acc7ca8..da8e420 100644
--- a/micro-behaviors/process/set-thread-local-storage-value.md
+++ b/micro-behaviors/process/set-thread-local-storage-value.md
@@ -13,7 +13,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-13 September 2023 |
+30 April 2024 |
@@ -34,12 +34,12 @@ Malware allocates thread local storage.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet sets thread local storage values. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut sets thread local storage values. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon sets thread local storage values. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter sets thread local storage values. [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets thread local storage values. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik sets thread local storage values. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet sets thread local storage values. [[1]](#1)|
+|[**Gamut**](../../xample-malware/gamut.md)|2014|--|Gamut sets thread local storage values. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon sets thread local storage values. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter sets thread local storage values. [[1]](#1)|
+|[**Redhip**](../../xample-malware/redhip.md)|2011|--|Redhip sets thread local storage values. [[1]](#1)|
+|[**Rombertik**](../../xample-malware/rombertik.md)|2015|--|Rombertik sets thread local storage values. [[1]](#1)|
## Detection
@@ -47,6 +47,18 @@ Malware allocates thread local storage.
|---|---|---|
|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
+### C0041 Snippet
+
+ Process::Set Thread Local Storage Value
+SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
+Location: 0x180005B08
+
+mov param_2, rbx ; Value to be stored in TLS index
+mov param_1, edi ; TLS index
+call qword ptr [->KERNEL32.DLL::TlsSetValue] ; Call Windows API function to store value in thread's thread local storage (TLS) at the specified index
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/process/suspend-thread.md b/micro-behaviors/process/suspend-thread.md
index 61df206..b877bf9 100644
--- a/micro-behaviors/process/suspend-thread.md
+++ b/micro-behaviors/process/suspend-thread.md
@@ -34,10 +34,10 @@ This behavior is related to Unprotect technique U0101.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet suspends threads. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR suspends threads. [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT suspends threads. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon suspends threads. [[1]](#1)|
+|[**Dark Comet**](../../xample-malware/dark-comet.md)|2008|--|Dark Comet suspends threads. [[1]](#1)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR suspends threads. [[1]](#1)|
+|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT suspends threads. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon suspends threads. [[1]](#1)|
## Detection
diff --git a/micro-behaviors/process/terminate-process.md b/micro-behaviors/process/terminate-process.md
index 24eac22..b658727 100644
--- a/micro-behaviors/process/terminate-process.md
+++ b/micro-behaviors/process/terminate-process.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -34,15 +34,15 @@ Malware terminates a process.
|Name|Date|Method|Description|
|---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy terminates a process via fastfail. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR terminates processes. [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT terminates processes. [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon terminates processes. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter terminates processes. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon terminates processes. [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet terminates processes. [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot terminates processes. [[1]](#1)|
-|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 terminates processes. [[1]](#1)|
+|[**BlackEnergy**](../../xample-malware/blackenergy.md)|2007|--|BlackEnergy terminates a process via fastfail. [[1]](#1)|
+|[**GoBotKR**](../../xample-malware/gobotkr.md)|2019|--|GoBotKR terminates processes. [[1]](#1)|
+|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|--|GravityRAT terminates processes. [[1]](#1)|
+|[**Hupigon**](../../xample-malware/hupigon.md)|2013|--|Hupigon terminates processes. [[1]](#1)|
+|[**Kovter**](../../xample-malware/kovter.md)|2016|--|Kovter terminates processes. [[1]](#1)|
+|[**Shamoon**](../../xample-malware/shamoon.md)|2012|--|Shamoon terminates processes. [[1]](#1)|
+|[**Stuxnet**](../../xample-malware/stuxnet.md)|2010|--|Stuxnet terminates processes. [[1]](#1)|
+|[**TrickBot**](../../xample-malware/trickbot.md)|2016|--|TrickBot terminates processes. [[1]](#1)|
+|[**UP007**](../../xample-malware/up007.md)|2016|--|UP007 terminates processes. [[1]](#1)|
## Detection
@@ -56,6 +56,17 @@ Malware terminates a process.
|---|---|---|
|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess|
+### C0018 Snippet
+
+ Process::Terminate Process
+SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
+Location: 0x1400083c7
+
+mov ecx, eax ; use the value stored in eax as the exit status for the exited process
+call qword ptr [->MSVCRT.DLL::exit] ; call the Windows API function to terminate the process
+
+
+
## References
[1] capa v4.0, analyzed at MITRE on 10/12/2022
diff --git a/micro-behaviors/process/terminate-thread.md b/micro-behaviors/process/terminate-thread.md
index 692cd6e..82f83e8 100644
--- a/micro-behaviors/process/terminate-thread.md
+++ b/micro-behaviors/process/terminate-thread.md
@@ -13,7 +13,7 @@
| Version |
-2.0 |
+2.1 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-13 September 2023 |
+30 April 2024 |
@@ -35,3 +35,15 @@ Malware terminates a thread.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[terminate thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/terminate/terminate-thread.yml)|Terminate Thread (C0039)|kernel32.TerminateThread, PsTerminateSystemThread, System.Threading.Thread.Abort|
+
+### C0039 Snippet
+
+ Process::Terminate Thread
+SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f
+Location: 0x14000395B
+
+mov param_1, qword ptr [DAT_14000ca58] ; thread to terminate
+xor param_2, param_2 ; set the thread's exit status to 0
+call qword ptr [->KERNEL32.DLL::TerminateThread] ; call the Windows API function to terminate the thread
+
+
diff --git a/persistence/kernel-modules-and-extensions.md b/persistence/kernel-modules-and-extensions.md
index e26474d..f1fe12f 100644
--- a/persistence/kernel-modules-and-extensions.md
+++ b/persistence/kernel-modules-and-extensions.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -49,9 +49,9 @@ See ATT&CK: **Boot or Logon Autostart Execution: Kernel Modules and Extensions (
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_devicetree_1.py)|Kernel Modules and Extensions (F0010)|--|
-|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_devicetree_1.py)|Kernel Modules and Extensions::Device Driver (F0010.001)|--|
-|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_load.py)|Kernel Modules and Extensions (F0010)|NtLoadDriver|
+|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Kernel Modules and Extensions (F0010)|--|
+|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Kernel Modules and Extensions::Device Driver (F0010.001)|--|
+|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/driver_load.py)|Kernel Modules and Extensions (F0010)|NtLoadDriver|
## References
diff --git a/persistence/modify-existing-service.md b/persistence/modify-existing-service.md
index 3280847..2382519 100644
--- a/persistence/modify-existing-service.md
+++ b/persistence/modify-existing-service.md
@@ -13,7 +13,7 @@
| Version |
-2.1 |
+2.2 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -46,12 +46,12 @@ See ATT&CK: **Create or Modify System Process::Windows Service ([T1543.003](http
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_1.py)|Modify Existing Service (F0011)|--|
-|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_2.py)|Modify Existing Service (F0011)|--|
-|[volatility_svcscan_3](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_3.py)|Modify Existing Service (F0011)|--|
-|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_servicestop.py)|Modify Existing Service (F0011)|OpenServiceA, ControlService, OpenServiceW|
-|[persistence_service](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_service.py)|Modify Existing Service (F0011)|--|
-|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Modify Existing Service (F0011)|--|
+|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Modify Existing Service (F0011)|--|
+|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Modify Existing Service (F0011)|--|
+|[volatility_svcscan_3](https://github.com/CAPESandbox/community/tree/master/modules/signatures/all/volatility_sig.py)|Modify Existing Service (F0011)|--|
+|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_servicestop.py)|Modify Existing Service (F0011)|OpenServiceA, ControlService, OpenServiceW|
+|[persistence_service](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_service.py)|Modify Existing Service (F0011)|--|
+|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/modifies_seccenter.py)|Modify Existing Service (F0011)|--|
## References
diff --git a/persistence/registry-run-keys-startup-folder.md b/persistence/registry-run-keys-startup-folder.md
index 05ed7d6..0466721 100644
--- a/persistence/registry-run-keys-startup-folder.md
+++ b/persistence/registry-run-keys-startup-folder.md
@@ -13,7 +13,7 @@
| Version |
-2.2 |
+2.3 |
| Created |
@@ -21,7 +21,7 @@
| Last Modified |
-5 December 2023 |
+30 April 2024 |
@@ -48,11 +48,11 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware adds registry entries to ensure automatic execution at system startup. [[9]](#9)|
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder, allowing it to persist via a Run registry key. [[10]](#10) [[17]](#17)|
|[**Conficker**](../xample-malware/conficker.md)|2008|--|To start itself at system boot, the virus saves a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service. [[11]](#11)|
-|[**DarkComet**](../xample-malware/darkcomet.md)|2008|--|DarkComet adds several registry entries to enable automatic execution at startup. [[12]](#12)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet adds several registry entries to enable automatic execution at startup. [[12]](#12)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|To start itself at system boot, Emotet adds the downloaded payload to the registry to maintain persistence. [[13]](#13)|
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle adds registry keys to enable its automatic execution at every system startup. [[14]](#14)|
|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Malware adds registry keys to enable startup after reboot. [[15]](#15)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry creates two registry run keys to ensure persistence. [[18]](#18)|
|[**CryptoWall**](../xample-malware/cryptowall.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[19]](#19)|
@@ -64,9 +64,40 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol
|Tool: CAPE|Mapping|APIs|
|---|---|---|
-|[persistence_bootexecute](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_bootexecute.py)|Registry Run Keys / Startup Folder (F0012)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
-|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry Run Keys / Startup Folder (F0012)|--|
-|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun.py)|Registry Run Keys / Startup Folder (F0012)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
+|[persistence_bootexecute](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_bootexecute.py)|Registry Run Keys / Startup Folder (F0012)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
+|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Registry Run Keys / Startup Folder (F0012)|--|
+|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Registry Run Keys / Startup Folder (F0012)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
+
+### F0012 Snippet
+
+ Persistence::Registry Run Keys/Startup Folder
+SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c
+Location: 0x402994
+
+push eax ; where to store handle to created/opened registry key
+push u_SOFTWARE\Microsoft\Windows\Curre_00429bb8 ; subkey to create -- in this case SOFTWARE\Microsoft\Windows\Current\Version\Run
+push 0x80000001 ; predefined registry key HKEY_CURRENT_USER
+call dword ptr [->ADVAPI32.DLL::RegCreateKeyW] ; call to Windows API function to create the registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current\Version\Run
+lea ecx, [esp + 0x70]
+lea edx, [ecx + 0x2]
+nop dword ptr [eax]
+mov ax, word ptr [ecx]
+add ecx, 0x2
+test ax, ax
+jnz lab_004029b0
+sub ecx, edx
+sar ecx, 1
+lea eax, [ecx * 0x2 + 0x2]
+push eax ; size of data to write to registry key
+lea eax, [esp + 0x74]
+push eax ; data to write to registry key
+push 0x1 ; indicates that the type of value to be written to registry key is a string
+push 0x0 ; reserved parameter, must be NULL
+push u_WinHoster_00429c14 ; name of the value to add to the key -- in this case, WinHoster
+push dword ptr [esp + local_264] ; handle to open registry key
+call dword ptr [->ADVAPI32.DLL::RegSetValueExW] ; API call to set registry value
+
+
## References
diff --git a/xample-malware/dyepack.md b/xample-malware/dyepack.md
index 688a5db..c9685e6 100644
--- a/xample-malware/dyepack.md
+++ b/xample-malware/dyepack.md
@@ -37,4 +37,4 @@ DYEPACK is a malware suite that manipulates local information regarding SWIFT tr
## References
-[1] https://content.fireeye.com/apt/rpt-apt38
+[1] https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf
diff --git a/yfaq/README.md b/yfaq/README.md
index 0058565..dc7ffc4 100644
--- a/yfaq/README.md
+++ b/yfaq/README.md
@@ -10,7 +10,7 @@
## What's New? ##
-* **MBC v3.0** - The latest MBC release includes behavior detection information, expanded descriptions, and new properties, such as version and created and modified dates.
+* **MBC v3.1** - The MBC 3.1 release includes additional code snippets, expanded descriptions, and updated links.
* **STIX 2.1 Representation** - MBC content is available in an updated STIX format based on the new [STIX 2.1 Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9).
@@ -18,7 +18,7 @@
* **CACAO Playbook Example** - An example [CACAO](https://github.com/oasis-tcs/cacao/tree/master/Examples/CACAO-2.0) playbook for [Locky Bart](../xample-malware/locky-bart.md) references MBC behaviors.
-* **MBC Website** - We're developing a website to replace the current markdown content.
+
* **MBC Mailing List** - To join the MBC mailing list, please send a request to mbc@mitre.org.
@@ -32,7 +32,7 @@
* **Malware analysis support**: MBC's set of identified, organized behaviors helps an analyst know what to look for, informing the malware analysis process.
### What are objectives? ###
-**Objectives** correspond to the intentions behind malware behaviors. For example, malware may use [Hooking](../credential-access/hooking.md) (behavior) to load and execute code within the context of another process either to hide its execution (defense evasion objective), to gain elevated privileges (privilege escalation objective), or to access the process's memory (credential access objective).
+**Objectives** correspond to the intentions behind malware behaviors. For example, malware may use [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md) (behavior) to load and execute code within the context of another process either to hide its execution (defense evasion objective), to gain elevated privileges (privilege escalation objective), or to access the process's memory (credential access objective).
### How were behaviors identified? ###
As discussed [below](#maec), many MBC behaviors stemmed from MAEC and EMA. Mapping [capa rules](https://github.com/fireeye/capa-rules) to MBC was another avenue for defining behaviors (especially MBC's micro-behaviors). We also identified MBC behaviors by studying publicly available analysis reports and output of automated analysis engines (some of which map behavior indicators to ATT&CK). Such resources enabled identification of MBC-enhanced ATT&CK techniques, as well as the definition of new behaviors for results that could not be mapped to ATT&CK.
@@ -68,6 +68,7 @@ There was no version control when MBC v1.0 was released at the end of January 20
* MBC v2.2 was released in February 2022 and includes additional micro-behaviors and behavior methods. Added code snippets to certain methods.
* MBC v2.3 was released in September 2022 and aligns with ATT&CK v11 and includes an updated malware corpus.
* MBC v3.0 was released in September 2023 and includes behavior detection information, expanded descriptions, and new properties.
+* MBC v3.1 was released in May 2024 and includes expanded descriptions and additional code snippets.
## Using MBC ##
@@ -120,7 +121,7 @@ Although one-to-one mappings are best practice, there may be some instances when
Behaviors identified by automated tools are often intentionally broad to give an overview of the malware sample's behavior. Broad behaviors will often map to multiple MBC behaviors. For example, if a tool reports that Armadillo was used on a malware sample, both [Executable Code Obfuscation](../anti-static-analysis/executable-code-obfuscation.md) and [Software Packing](../anti-static-analysis/software-packing.md) behaviors apply.
### How are MBC behaviors, possibly at different levels of abstraction, associated? ###
-MBC does not define relationships between behaviors, so association of behaviors must be done at the reporting level. The [GoBotKR](../xample-malware/gobotkr.md) example [above](./gobotkr) illustrates how two behaviors can be associated by the human-readable text: "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2).
+MBC does not define relationships between behaviors, so association of behaviors must be done at the reporting level. The [GoBotKR](../xample-malware/gobotkr.md) example above illustrates how two behaviors can be associated by the human-readable text: "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2).
### Can variant names captured by an anti-virus tool be captured in MBC? ###
No. MBC captures behaviors and characteristics directly associated with malware code. Variant names are outside MBC's scope. A variant name may lead to published reports, in which case, one could use the report to map the sample to its associated behaviors.
@@ -180,7 +181,7 @@ Cuckoo Sandbox 2.0.7 includes mappings between its signatures and ATT&CK. The MB
## MBC and Other Community Efforts ##
### What is the relationship between MAEC, EMA, and MBC? ###
-In short, the [Malware Attribute Enumeration and Characterization (MAEC)](http://maecproject.github.io/) led to the [Encyclopedia of Malware Attributes (EMA)](https://collaborate.mitre.org/ema/index.php/ema:Main_Page), and EMA led to the Malware Behavior Catalog.
+In short, the [Malware Attribute Enumeration and Characterization (MAEC)](http://maecproject.github.io/) led to the Encyclopedia of Malware Attributes (EMA), and EMA led to the Malware Behavior Catalog.
MAEC is a community-developed structured language for encoding and sharing high-fidelity information about malware based upon attributes such as behaviors, artifacts, and relationships between malware samples. The vocabularies associated with MAEC define malware capabilities and behaviors, which are further defined and specified in EMA, along with "behavior instances" that capture specific malware instances/families exhibiting behaviors.
@@ -231,7 +232,7 @@ We can't predict what will happen in the long run, but currently there are no pl
### Why aren't ATT&CK [Initial Access](https://attack.mitre.org/tactics/TA0001/) techniques included in MBC? ###
Initial Access - the way malware gains an initial foothold within a system - is not typically determined by analyzing the malware's code. For example, in ATT&CK's [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/) sub-technique, the attachment may be a malicious executable file, but the *code* of the attached file's isn't related to its email delivery. This is not to say an analyst can't surmise initial access by studying a malware instance, but determining initial access requires evidence beyond the malware's code.
-Some malware self-replicates or distributes other malware, but in keeping with MBC's *malware, code-oriented perspective*, such behaviors would be associated with the [LATERAL MOVEMENT](../lateral-movement), [EXECUTION](../execution), and/or [IMPACT](../impact) objectives in MBC. For example, if malware sends spearphishing email, its behavior would be captured by the [Send Email](../executionsend-email.md) behavior, which is associated with execution and lateral movement.
+Some malware self-replicates or distributes other malware, but in keeping with MBC's *malware, code-oriented perspective*, such behaviors would be associated with the [LATERAL MOVEMENT](../lateral-movement), [EXECUTION](../execution), and/or [IMPACT](../impact) objectives in MBC. For example, if malware sends spearphishing email, its behavior would be captured by the [Send Email](../execution/send-email.md) behavior, which is associated with execution and lateral movement.
### Why aren't [PRE-ATT&CK](https://attack.mitre.org/techniques/pre/) techniques used by malware authors included in MBC? ###
**For example, why doesn't the [Obfuscate or Encrypt Code](https://attack.mitre.org/techniques/T1319/) technique under the [Adversary OPSEC](https://attack.mitre.org/tactics/TA0021/) tactic apply to malware showing signs of anti-analysis techniques?**
diff --git a/yfaq/pafish.md b/yfaq/pafish.md
index ccec5c5..db0bf9d 100644
--- a/yfaq/pafish.md
+++ b/yfaq/pafish.md
@@ -16,8 +16,8 @@
| [Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Total physical memory (B0009.014)](../anti-behavioral-analysis/virtual-machine-detection.md)| Pafish checks whether the hardware has modern characteristics. Physical memory less than 4 GB indicates a virtual environment. [[1]](#1)|
|[Anti-Behavioral Analysis::Sandbox Detection::Timing/Uptime Check (B0007.009)](../anti-behavioral-analysis/sandbox-detection.md) | Pafish uses the GetTickCount function to to check how long the system has been running (a short uptime indicates a sandbox). [[1]](#1)|
|[Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks IsNativeVhdBoot() to determine whether the OS was booted from a virtual hard drive. [[1]](#1)|
-|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox_detection.md) | Pafish checks whether the ShellExecuteExW or CreateProcessA functions have been hooked, indicating a sandbox. [[1]](#1)|
-|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox_detection.md) | Pafish checks whether the module sbiedll.dll (which is associated with Sandboxie) has been mapped into the address space of the process [[1]](#1)|
+|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md) | Pafish checks whether the ShellExecuteExW or CreateProcessA functions have been hooked, indicating a sandbox. [[1]](#1)|
+|[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md) | Pafish checks whether the module sbiedll.dll (which is associated with Sandboxie) has been mapped into the address space of the process [[1]](#1)|
| [Anti-Behavioral Analysis::Emulator Detection (B0004)](../anti-behavioral-analysis/emulator-detection.md) | Pafish detects Wine using GetProcAddress(wine_get_unix_file_name) from kernel32.dll [[1]](#1)|
|[Anti-Behavioral Analysis::Virtual Machine Detection::Check Registry Keys (B0009.005)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks the value of several registry keys to determine whether VWware, VitualBox, Bocks, or QEMU is running [[1]](#1)|
| [Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish identifies VirtualBox by checking whether the MAC address starts with 08:00:27, and it identifies VMware by checking whether the MAC address starts with 00:05:69, 00:0C:29, 00:1C:14 or 00:50:56. [[1]](#1)|
diff --git a/ynewsletters/05012024.md b/ynewsletters/05012024.md
new file mode 100644
index 0000000..f9ec4c2
--- /dev/null
+++ b/ynewsletters/05012024.md
@@ -0,0 +1,15 @@
+# Malware Behavior Catalog Newsletter #
+**May 1, 2024**
+
+Hello everyone!
+
+Here are recent MBC developments:
+
+* Released [MBC 3.1](https://github.com/MBCProject/mbc-markdown/releases/tag/v3.1).
+* Released the [STIX 2.1 representation](https://github.com/MBCProject/mbc-stix2.1) for MBC 3.1, which is based on the new [malware behavior extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9).
+* Developed over 40 new code snippets.
+* Updated MBC for ATT&CK v15.
+* Updated CAPE signature links.
+* Reviewed capa to identify mapping suggestions (none found).
+
+Please post questions or comments in [Discussions](https://github.com/MBCProject/mbc-markdown/discussions) on GitHub, or email us at mbc@mitre.org. Feedback is always appreciated!
diff --git a/ynewsletters/README.md b/ynewsletters/README.md
index 4b38f13..dea05a8 100644
--- a/ynewsletters/README.md
+++ b/ynewsletters/README.md
@@ -1,5 +1,7 @@
## Malware Behavior Catalog Newsletters ##
+May 2024
+
December 2023
September 2023