From bdbefee41faef58d58f43f4a2c4fffce935dbb28 Mon Sep 17 00:00:00 2001 From: Desiree Beck Date: Fri, 8 Nov 2019 10:08:18 -0500 Subject: [PATCH] typos --- command-and-control/domain-name-generate.md | 2 +- credential-access/hooking.md | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/command-and-control/domain-name-generate.md b/command-and-control/domain-name-generate.md index 93a6251..a64d7fd 100644 --- a/command-and-control/domain-name-generate.md +++ b/command-and-control/domain-name-generate.md @@ -8,7 +8,7 @@ Domain Name Generation ====================== Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1) -The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/) is oriented toward an adversary perspective (although its examples include malware) is related to this MBC behavior. +The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior. Malware Examples ---------------- diff --git a/credential-access/hooking.md b/credential-access/hooking.md index cb63807..fbaf561 100644 --- a/credential-access/hooking.md +++ b/credential-access/hooking.md @@ -17,6 +17,9 @@ Methods ------- * **Patch MmGetPhysicalMemoryRanges**: Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1) * **Hook memory mapping APIs**: Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1) +* **Hook procedures**: Intercepts and executes designated code in response to events such as messages, keystrokes, and moust inputs. +* **Import Address Hooking (IAT) Hooking**: uses modifications to a process's IAT where pointers to imported API functions are stored. +* **Inline Hooking**: overwrites the first bytes in an API function to redirect code flow. Malware Examples ----------------