This commit is contained in:
Desiree Beck
2019-11-08 10:08:18 -05:00
parent e3d9f9afac
commit bdbefee41f
2 changed files with 4 additions and 1 deletions
+1 -1
View File
@@ -8,7 +8,7 @@ Domain Name Generation
======================
Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/) is oriented toward an adversary perspective (although its examples include malware) is related to this MBC behavior.
The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.
Malware Examples
----------------
+3
View File
@@ -17,6 +17,9 @@ Methods
-------
* **Patch MmGetPhysicalMemoryRanges**: Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)
* **Hook memory mapping APIs**: Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)
* **Hook procedures**: Intercepts and executes designated code in response to events such as messages, keystrokes, and moust inputs.
* **Import Address Hooking (IAT) Hooking**: uses modifications to a process's IAT where pointers to imported API functions are stored.
* **Inline Hooking**: overwrites the first bytes in an API function to redirect code flow.
Malware Examples
----------------