admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

add MBC table

Browse Source
This commit is contained in:
Dez Beck
2022-08-09 13:38:26 -04:00
parent 3e49062c21
commit c5b4a95793
1 changed files with 38 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+38 -3
View File
@@ -61,9 +61,7 @@ The MBC also contains a collection of [example malware](./xample-malware/README.
[Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.
## Malware Objective Descriptions ##
Malware objectives are defined in the table below. Follow the links to view associated behaviors. A visual representation of the MBC Matrix is also available (opens in a new window). There is another version under [FAQ](./yfaq/) with behavior ids.
<img src="https://raw.githubusercontent.com/MBCProject/mbc-markdown/v2.2/yfaq/mbc_matrix_without_ids.svg" alt="mbc matrix without ids">
Malware objectives are defined in the table below. Follow the links to view associated behaviors.
|**Objective**|**Description**|
|---|---|
@@ -81,6 +79,43 @@ Malware objectives are defined in the table below. Follow the links to view asso
|[**Persistence**](./persistence/README.md)|Malware aims to remain on a system.|
|[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain higher level permissions.|
## Navigator View ##
This visual representation of the MBC Matrix is based on the ATT&CK Navigator (opens in a new window). There is another version under [FAQ](./yfaq/) with behavior ids.
<img src="https://raw.githubusercontent.com/MBCProject/mbc-markdown/v2.2/yfaq/mbc_matrix_without_ids.svg" alt="mbc matrix without ids">
## MBC Behaviors vis-a-vis ATT&CK ##
The table below shows the behaviors defined in MBC and whether there is a corresponding ATT&CK technique or sub-technique. In most cases, related ATT&CK techniques were defined after the MBC behavior was defined.
|**ID**|**Behavior Name**|**Related ATT&CK Technique**|
|---|---|---|
|**B0001**|ANTI-BEHAVIORAL ANALYSIS::Debugger Detection|*none*|
|**B0002**|ANTI-BEHAVIORAL ANALYSIS::Debugger Evasion|Debugger Evasion ([T1622]())|
|**B0003**|ANTI-BEHAVIORAL ANALYSIS::Dynamic Analysis Evasion|Virtualization/Sandbox Evasion ([T1497](),[T1633]())|
|**B0004**|ANTI-BEHAVIORAL::Emulator Detection|*none*|
|**B0005**|ANTI-BEHAVIORAL::Emulator Evasion|*none*|
|**B0006**|ANTI-BEHAVIORAL::Memory Dump Evasion|*none*|
|**B0007**|ANTI-BEHAVIORAL::Sandbox Detection|Virtualization/Sandbox Evasion: System Checks ([T1497.001](),[T1633.001]()); Virtualization/Sandbox Evasion: User Activity Based Checks ([T1497.002]())|
|**B0008**|ANTI-BEHAVIORAL ANALYSIS/ANTI-STATIC ANALYSIS::Executable Code Virtualization|*none*|
|**B0009**|ANTI-BEHAVIORAL ANALYSIS::Virtual Machine Detection|Virtualization/Sandbox Evasion ([T1497](),[T1633]())|
|**B0010**|ANTI-STATIC ANALYSIS::Call Graph Generation Evasion|*none*|
|**B0011**|EXECUTION::Remote Commands|Virtualization/Sandbox Evasion ([T1497](),[T1633]())|
|**B0012**|ANTI-STATIC ANALYSIS::Disassembler Evasion|*none*|
|**B0013**|DISCOVERY::Analysis Tool Discovery|*none*|
|**B0014**|DISCOVERY::SMTP Connection Discovery|*none*|
|**B0015**|*not defined*||
|**B0016**|IMPACT::Compromise Data Integrity|Data Manipulation: Stored Data Manipulation ([T1565.001]())|
|**B0017**|IMPACT::Destroy Hardware|*none*|
|**B0018**|IMPACT::Resource Hijacking|Resource Hijacking ([T1496]())|
|**B0019**|IMPACT::Manipulate Network Traffic|Data Manipulation: Transmitted Data Manipulation ([T1565.002]())|
|**B0020**|EXECUTION/LATERAL MOVEMENT::Send Email|Phishing ([T1566]())|
|**B0021**|EXECUTION/LATERAL MOVEMENT::Send Poisoned Email|*none*|
|**B0022**|IMPACT/PERSISTENCE::Remote Access|*none*|
|**B0023**|EXECUTION::Install Additional Program|*none*|
|**B0024**|EXECUTION::Prevent Concurrent Execution|*none*|
|**B0025**|ANTI-BEHAVIORAL ANALYSIS//EXECUTION::Conditional Execution|Execution Guardrails ([T1480]())|
|**B0026**|LATERAL MOVEMENT//PERSISTENCE::Malicious Network Driver|*none*|
|**B0027**|DEFENSE EVASION::Alternative Installation Location|*none*|
**Copyright 2022 The MITRE Corporation. [Terms of Use.](./tou.md)**