diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index 6a494be..b8c9927 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -22,7 +22,7 @@ Methods |**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)| |**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).| |**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.| -|**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.| +|**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware. Examples include Interrupt 0x2d and Interrupt 1 [7].| |**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.| |**Memory Breakpoints**|B0001.009|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.| |**Memory Write Watching**|B0001.010|[[7]](#7)| diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index 5d4dd46..a9a95f9 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -47,7 +47,7 @@ Malware Examples References ---------- -[1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injectionion-techniques-technical-survey-common-and-trending-process +[1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process [2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy @@ -55,7 +55,7 @@ References [4] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/ -[5] https://www.ired.team/offensive-security/code-injection-process-injectionion/executing-shellcode-with-createfiber +[5] https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber [6] https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/ diff --git a/micro-behaviors/cryptography/hashed-message-authentication-code.md b/micro-behaviors/cryptography/hashed-message-authentication-code.md index f920764..fa5670a 100644 --- a/micro-behaviors/cryptography/hashed-message-authentication-code.md +++ b/micro-behaviors/cryptography/hashed-message-authentication-code.md @@ -7,4 +7,4 @@ Hashed Message Authentication Code ================================== -Malware uses an hashed-message-authentication-code schema. \ No newline at end of file +Malware uses a hashed message authentication code (HMAC) schema. \ No newline at end of file diff --git a/persistence/README.md b/persistence/README.md index 5d9f331..38cd5de 100644 --- a/persistence/README.md +++ b/persistence/README.md @@ -11,7 +11,7 @@ Behaviors that enable malware to remain on a system regardless of system events, * **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md) * **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md) * **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md) -* **Install Insecure or Malicious Configuration** [E1478](../defense-evasion/install-insecure-or-malicious-configuration.md) +* **Install Insecure or Malicious Configuration** [B0047](../defense-evasion/install-insecure-or-malicious-configuration.md) * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-and-extensions.md) * **Malicious Network Driver** [B0026](../persistence/malicious-network-driver.md) * **Modify Existing Service** [F0011](../persistence/modify-existing-service.md) diff --git a/xample-malware/bagle.md b/xample-malware/bagle.md index 223fea8..52527c1 100644 --- a/xample-malware/bagle.md +++ b/xample-malware/bagle.md @@ -11,7 +11,7 @@ Bagle ===== A mass-mailing computer worm affecting Microsoft Windows. [[1]](#1) -Behaviors +MBC MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/blackenergy.md b/xample-malware/blackenergy.md index e99676d..5f7307a 100644 --- a/xample-malware/blackenergy.md +++ b/xample-malware/blackenergy.md @@ -11,7 +11,7 @@ BlackEnergy =========== An HTTP-based botnet used mostly for DDoS attacks. [[1]](#1) -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/conficker.md b/xample-malware/conficker.md index 9db1926..62f5f4a 100644 --- a/xample-malware/conficker.md +++ b/xample-malware/conficker.md @@ -11,7 +11,7 @@ Conficker ========= A worm targeting Microsoft Windows operations systems. -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/cryptolocker.md b/xample-malware/cryptolocker.md index f24dfe8..bec8ab8 100644 --- a/xample-malware/cryptolocker.md +++ b/xample-malware/cryptolocker.md @@ -20,7 +20,7 @@ ATT&CK Techniques |[Command and Control::Encrypted Channel::Asymmetric Cryptography (T1573.002)](https://attack.mitre.org/techniques/T1573/002/)|The malware encrypts messages with a public RSA key [[1]](#1)| |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses http to communicate with C2 [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/cryptowall.md b/xample-malware/cryptowall.md index f2cb956..2081a96 100644 --- a/xample-malware/cryptowall.md +++ b/xample-malware/cryptowall.md @@ -21,7 +21,7 @@ ATT&CK Techniques |[Command and Control:Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware tries to connect to I2P proxies [[1]](#1)| |[Impact::Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)|The malware encrypts files [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/dark-comet.md b/xample-malware/dark-comet.md index 53bfb89..28a1a26 100644 --- a/xample-malware/dark-comet.md +++ b/xample-malware/dark-comet.md @@ -11,7 +11,7 @@ Dark Comet ========== A Remote Access Trojan (RAT) that allows a user to control the system via a GUI. It has many features which allows a user to use it as administrative remote help tool; however, DarkComet has many features which can be used maliciously. DarkComet is commonly used to spy on the victims by taking screen captures, key-logging, or password stealing. [[1]](#1) -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index e63f8b7..8ed5be1 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -11,7 +11,7 @@ DNSChanger ========== Used to change DNS settings to generate fraudulent advertising revenue. -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index dea9af5..239346e 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -11,7 +11,7 @@ Emotet ===== Emotet is a banking trojan. [[1]](#1) -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md index 4939603..e0caa96 100644 --- a/xample-malware/gamut.md +++ b/xample-malware/gamut.md @@ -19,7 +19,7 @@ ATT&CK Techniques |[Command and Control::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)|The malware receives files from C2 [[1]](#1)| |[Command and Control::Application Layer Protocol:Web Protocol (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP for command and control [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/geneio.md b/xample-malware/geneio.md index 89431a6..2443433 100644 --- a/xample-malware/geneio.md +++ b/xample-malware/geneio.md @@ -34,7 +34,7 @@ ATT&CK Techniques |---|---| |[Persistence::Browser Extensions (T1176)](https://attack.mitre.org/techniques/T1176/)|Geneio installs Safari Extensions that are adware [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/gotbotkr.md b/xample-malware/gotbotkr.md index d4f667e..31814e6 100644 --- a/xample-malware/gotbotkr.md +++ b/xample-malware/gotbotkr.md @@ -37,11 +37,11 @@ ATT&CK Techniques |[Command and Control::Standard Application Layer Protocol (T1071)](https://attack.mitre.org/techniques/T1071/)|GoBotKR uses HTTP or HTTPS for C&C. [[1]](#1)| |[Command and Control::Uncommonly Used Port (T1571)](https://attack.mitre.org/techniques/T1571/)|GoBotKR uses non-standard ports, such as 6446, 6556 and 7777, for C&C. [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| -|[Execution::Install Additional Program](../execution/install-additional-program.md)|GotBotKR reinstalls its running instance if it is removed. [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GotBotKR reinstalls its running instance if it is removed. [[1]](#1)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|GoBotKR uses cmd.exe to execute commands. [[1]](#1)| |[Persistence::Registry Run Keys/Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)| GoBotKR installs itself under registry run keys to establish persistence. [[1]](#1)| |[Defense Evasion::Hidden Files and Directories (F0005)](../defense-evasion/hidden-files-and-directories.md)| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)| diff --git a/xample-malware/gravity-rat.md b/xample-malware/gravity-rat.md index c3a23b5..c71134d 100644 --- a/xample-malware/gravity-rat.md +++ b/xample-malware/gravity-rat.md @@ -17,7 +17,7 @@ ATT&CK Techniques |Name|Use| |---|---| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/heriplor.md b/xample-malware/heriplor.md index f5eba87..3969f89 100644 --- a/xample-malware/heriplor.md +++ b/xample-malware/heriplor.md @@ -11,7 +11,7 @@ Heriplor ======== This Trojan is associated with the Energetic Bear group [[1]](#1). -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/hupigon.md b/xample-malware/hupigon.md index eb9da4f..f26b2bc 100644 --- a/xample-malware/hupigon.md +++ b/xample-malware/hupigon.md @@ -18,11 +18,11 @@ ATT&CK Techniques |---|---| |[Defense Evasion::Obfuscated Files or Information:Software Packing (T1027.002)](https://attack.mitre.org/techniques/T1027/002/)|The malware may be packed with UPX [[2]](#2)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| -|[Registry Run Keys / Startup Folder](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1)| |[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds many entries to the registry [[1]](#1)| |[Impact::Remote Access (B0022)](../impact/remote-access.md)|The malware acts as a backdoor [[1]](#1)| |[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into processes such as cmd.exe, notepad.exe [[2]](#2)| diff --git a/xample-malware/kovter.md b/xample-malware/kovter.md index e460818..3c98da3 100644 --- a/xample-malware/kovter.md +++ b/xample-malware/kovter.md @@ -20,7 +20,7 @@ ATT&CK Techniques |[Execution::User Execution::Malicious File (T1204.002)](https://attack.mitre.org/techniques/T1204/002/)|The malware relies on a victim to execute itself [[2]](#2)| |[Defense Evasion::System Binary Proxy Execution:Mshta (T1218.005)](https://attack.mitre.org/techniques/T1218/005/)| The malware uses mshta.exe to run Javascript [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/kraken.md b/xample-malware/kraken.md index 5de7dff..7b23e2b 100644 --- a/xample-malware/kraken.md +++ b/xample-malware/kraken.md @@ -18,11 +18,11 @@ ATT&CK Techniques |[Command and Control::Dynamic Resolution:Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/)|Uses a domain name generator.  [[1]](#1)| |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP to communicate with C2 [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| -|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| [[1]](#1)| +|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Uses a domain name generator. [[1]](#1)| |[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is wiped out. [[1]](#1)| References diff --git a/xample-malware/locky-bart.md b/xample-malware/locky-bart.md index 5f5e497..26f355e 100644 --- a/xample-malware/locky-bart.md +++ b/xample-malware/locky-bart.md @@ -11,7 +11,7 @@ Locky Bart ========== Locky Bart is ransomware. [[1]](#1) -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/mazarbot.md b/xample-malware/mazarbot.md index 3c86111..f264f33 100644 --- a/xample-malware/mazarbot.md +++ b/xample-malware/mazarbot.md @@ -11,7 +11,7 @@ MazarBot ========== Targets Android phones via a poisoned text message. -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/mebromi.md b/xample-malware/mebromi.md index e42a369..b47dbec 100644 --- a/xample-malware/mebromi.md +++ b/xample-malware/mebromi.md @@ -18,7 +18,7 @@ ATT&CK Techniques |---|---| |[Defense Evasion::Pre-OS Boot::System Firmware (T1542.001)](https://attack.mitre.org/techniques/T1542/001/)|Malware performs BIOS modification and can download and execute a file as well as protect itself from removal [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/poison-ivy.md b/xample-malware/poison-ivy.md index 18adfb1..4ffeaa5 100644 --- a/xample-malware/poison-ivy.md +++ b/xample-malware/poison-ivy.md @@ -15,7 +15,7 @@ ATT&CK Techniques ----------------- See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S0012/). -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/redhip.md b/xample-malware/redhip.md index 8042006..210298d 100644 --- a/xample-malware/redhip.md +++ b/xample-malware/redhip.md @@ -11,7 +11,7 @@ Redhip ====== An information stealer. -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/rombertik.md b/xample-malware/rombertik.md index 53c0a07..381e6ef 100644 --- a/xample-malware/rombertik.md +++ b/xample-malware/rombertik.md @@ -23,7 +23,7 @@ ATT&CK Techniques |[Command and Control::Data Encoding::Standard Encoding (T1132.001)](https://attack.mitre.org/techniques/T1132/001/)|The malware transmits Base64 encoded data to C2 [[1]](#1)| |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware transmits data over HTTP [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/samsam.md b/xample-malware/samsam.md index 9a99c18..c1987fb 100644 --- a/xample-malware/samsam.md +++ b/xample-malware/samsam.md @@ -16,7 +16,7 @@ ATT&CK Techniques ----------------- See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/). -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index eea9477..1f3ed3f 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -22,7 +22,7 @@ ATT&CK Techniques |[Execution:Command and Scripting Interpreter (T1059.007)](https://attack.mitre.org/techniques/T1059/007/)|The malware installs a script to inject JavaScript script and modify web traffic. [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/shamoon.md b/xample-malware/shamoon.md index cd92620..18d5884 100644 --- a/xample-malware/shamoon.md +++ b/xample-malware/shamoon.md @@ -16,7 +16,7 @@ ATT&CK Techniques ----------------- See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/). -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/stuxnet.md b/xample-malware/stuxnet.md index 97d7367..893e248 100644 --- a/xample-malware/stuxnet.md +++ b/xample-malware/stuxnet.md @@ -17,7 +17,7 @@ ATT&CK Techniques See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/). -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/synful-knock.md b/xample-malware/synful-knock.md index fc2c8a7..8b672a1 100644 --- a/xample-malware/synful-knock.md +++ b/xample-malware/synful-knock.md @@ -11,7 +11,7 @@ SYNful Knock ============ A modification of the router's firmware images used to maintain persistence. [[1]](#1) -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/terminator.md b/xample-malware/terminator.md index de79753..b0e54e4 100644 --- a/xample-malware/terminator.md +++ b/xample-malware/terminator.md @@ -18,7 +18,7 @@ ATT&CK Techniques |---|---| |[Defense Evasion::Virtualization/Sandbox Evasion: User Activity Based Checks (T1497)](https://attack.mitre.org/techniques/T1497/)|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[2]](#2)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md index f0c8a02..900d26c 100644 --- a/xample-malware/trickbot.md +++ b/xample-malware/trickbot.md @@ -14,40 +14,9 @@ Trojan spyware program that has mainly been used for targeting banking sites. Tr ATT&CK Techniques ----------------- -|Name|Use| -|---|---| -|[Account Discovery](https://attack.mitre.org/techniques/T1087/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Non-Standard Port](https://attack.mitre.org/techniques/T1571/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Credentials from Password Stores::Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Unsecured Credentials::Credentials In Files](https://attack.mitre.org/techniques/T1552/001/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Unsecured Credentials::Credentials in Registry](https://attack.mitre.org/techniques/T1552/002/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Encrypted Channel](https://attack.mitre.org/techniques/T1573/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Data from Local System](https://attack.mitre.org/techniques/T1005/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Disable or Evade Security Tools](../defense-evasion/disable-or-evade-security-tools.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Domain Trust Discovery](https://attack.mitre.org/techniques/T1482/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Email Collection](https://attack.mitre.org/techniques/T1114/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Native API](https://attack.mitre.org/techniques/T1106/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Hooking](../credential-access/hooking.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Man in the Browser](https://attack.mitre.org/techniques/T1185/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Modify Registry](../defense-evasion/modify-registry.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Obfuscated Files or Information](../defense-evasion/obfuscated-files-or-information.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Process Injection](../defense-evasion/process-injection.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Registry Run Keys / Startup Folder](../persistence/registry-run-keys-startup-folder.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Remote File Copy](../command-and-control/ingress-tool-transfer.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Scheduled Task/Job](https://attack.mitre.org/techniques/T1053/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Executable Code Obfuscation](../anti-static-analysis/executable-code-obfuscation.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Send Email](../execution/send-email.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Application Layer Protocol](https://attack.mitre.org/techniques/T1071/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[System Information Discovery](../discovery/system-information-discovery.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[System Service Discovery](https://attack.mitre.org/techniques/T1016/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[Non-Standard Port](https://attack.mitre.org/techniques/T1571/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| -|[User Interaction](../execution/user-execution.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)| +See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/). -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/up007.md b/xample-malware/up007.md index b8d82da..96d138f 100644 --- a/xample-malware/up007.md +++ b/xample-malware/up007.md @@ -23,7 +23,7 @@ ATT&CK Techniques |[Command and Control::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)|The malware downloads files from C2 [[1]](#1)| |[Command and Control::Application Layer Protocol: Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware communicates to the C2 server using HTTP [[1]](#1)| -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/ursnif.md b/xample-malware/ursnif.md index 1859a8d..82b5bd1 100644 --- a/xample-malware/ursnif.md +++ b/xample-malware/ursnif.md @@ -11,7 +11,7 @@ Ursnif ====== A banking trojan that uses malware macros to evade sandbox detection. Variant of Gozi. -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| diff --git a/xample-malware/webcobra.md b/xample-malware/webcobra.md index 5760500..a09b17c 100644 --- a/xample-malware/webcobra.md +++ b/xample-malware/webcobra.md @@ -11,28 +11,33 @@ WebCobra ======== Cryptojacking malware. [[1]](#1) -Behaviors +ATT&CK Techniques +----------------- +|Name|Use| +|---|---| +|[Discovery::File and Directory Discovery (T1083)](https://attack.mitre.org/techniques/T1083/)|[[1]](#1)| +|[Discovery::Query Registry (T1012)](https://attack.mitre.org/techniques/T1012/)|[[1]](#1)| +|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057/)|[[1]](#1)| +|[Discovery::System Time Discovery (T1124)](https://attack.mitre.org/techniques/T1124/)|[[1]](#1)| +|[Discovery::Software Discovery::Security Software Discovery (T1518.001)](https://attack.mitre.org/techniques/T1518/001/)|Learns about security software. [[1]](#1)| +|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|[[1]](#1)| +|[Defense Evasion::Indicator Removal on Host::File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/)|[[1]](#1)| + +MBC Behaviors --------- |Name|Use| |---|---| -|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)|[[1]](#1)| -|[Query Registry](https://attack.mitre.org/techniques/T1012/)|[[1]](#1)| -|[System Information Discovery](../discovery/system-information-discovery.md)|Learns about the system so it can drop compatible miner software. [[1]](#1)| -|[Process Discovery](https://attack.mitre.org/techniques/T1057/)|[[1]](#1)| -|[System Time Discovery](https://attack.mitre.org/techniques/T1124/)|[[1]](#1)| -|[Software Discovery::Security Software Discovery](https://attack.mitre.org/techniques/T1518/001/)|Learns about security software. [[1]](#1)| -|[Command and Scripting Interpreter](../execution/command-and-scripting-interpreter.md)|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)| -|[Install Additional Program](../execution/install-additional-program.md)|Downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)| -|[Conditional Execution](../execution/conditional-execution.md)|Executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)| -|[Resource Hijacking](../impact/resource-hijacking.md)|Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)| -|[Dynamic Analysis Evasion](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|[[1]](#1)| -|[Emulator Evasion](../anti-behavioral-analysis/emulator-evasion.md)|[[1]](#1)| -|[Virtual Machine Detection](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment. [[1]](#1)| -|[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140/)|[[1]](#1)| -|[Obfuscated Files or Information](../defense-evasion/obfuscated-files-or-information.md)|[[1]](#1)| -|[Indicator Removal on Host::File Deletion](https://attack.mitre.org/techniques/T1070/004/)|[[1]](#1)| -|[Process Injection](../defense-evasion/process-injection.md)|Injects miner code into a running process.| -|[Disable or Evade Security Tools](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)| +|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Learns about the system so it can drop compatible miner software. [[1]](#1)| +|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)| +|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)| +|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)| +|[Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|[[1]](#1)| +|[Anti-Behavioral Analysis::Emulator Evasion (B0005)](../anti-behavioral-analysis/emulator-evasion.md)|[[1]](#1)| +|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment. [[1]](#1)| +|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|[[1]](#1)| +|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Injects miner code into a running process.| +|[Defense Evasion::Disable or Evade Security Tools (E1089)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)| References ---------- diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index ffc55de..382ebf2 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -11,14 +11,14 @@ YiSpecter ========= YiSpecter is Apple iOS malware that can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to a C2 server. It uses tricks to hide its icons from iOS’s SpringBoard, which prevents the user from finding and deleting it. The components also use the same name and logos of system apps to trick iOS power users. [[1]](#1) -Behaviors +MBC Behaviors --------- |Name|Use| |---|---| |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Can download and install arbitrary iOS apps [[1]](#1)| |[Defense Evasion::Hidden Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)| |[Command and Control::Command and Control Communication::Send System Information (B0030.006)](../command-and-control/c2-communication.md)|Connects to the command and control server using HTTP to send device information [[1]](#1)| -|[Defense Evasion::Install Insecure or Malicious Configuration (E1478)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Changes iOS Safari's default configuration [[1]](#1)| +|[Defense Evasion::Install Insecure or Malicious Configuration (B0047)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Changes iOS Safari's default configuration [[1]](#1)| |[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements [[1]](#1)| |[Lateral Movement::Supply Chain Compromise:Exploit Private APIs (E1195.m02)](../lateral-movement/supply-chain-compromise.md)|Use of the private api allowed both Installation of malicious apps and uninstallation of legitimate apps without user notification [[1]](#1)| |[Lateral Movement::Supply Chain Compromise:Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution [[1]](#1)| diff --git a/yfaq/mbc_matrix_with_ids.svg b/yfaq/mbc_matrix_with_ids.svg index 4c4d9c6..9b38ba5 100644 --- a/yfaq/mbc_matrix_with_ids.svg +++ b/yfaq/mbc_matrix_with_ids.svg @@ -1 +1 @@ -B0036: Capture EvasionB0025:Conditional ExecutionB0001: Debugger DetectionB0002: Debugger EvasionB0003:Dynamic Analysis EvasionB0004: Emulator DetectionB0005: Emulator EvasionB0008: ExecutableCode VirtualizationF0003: HookingB0006: Memory Dump EvasionB0007: Sandbox DetectionF0001: Software PackingB0009:Virtual Machine DetectionB0036.003: MultipleStages of LoadersB0036.001:Memory-only PayloadB0036.002:Encrypted PayloadsB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0001.003: CloseHandleB0001.031:WudfIsAnyDebuggerPresentB0001.025:Software BreakpointsB0001.027: TIB AwareB0001.028:Timing/Delay CheckB0001.024:SetHandleInformationB0001.007: Interrupt 1B0001.029: TLS CallbacksB0001.018: Parent ProcessB0001.009:Memory BreakpointsB0001.026: Stack CanaryB0001.033: Timing/DelayCheck QueryPerformanceCounterB0001.032: Timing/DelayCheck GetTickCountB0001.006: Interrupt 0x2dB0001.017: Page ExceptionBreakpoint DetectionB0001.034: Anti-debuggingInstructionsB0001.015:NtYieldExecution/SwitchToThreadB0001.021: ProcessHeapB0001.037: ProcessEnvironment Block IsDebuggedB0001.001:API Hook DetectionB0001.004:Debugger ArtifactsB0001.012:NtQueryInformationProcessB0001.023:SeDebugPrivilegeB0001.016:OutputDebugStringB0001.008:IsDebuggerPresentB0001.022:RtlAdjustPrivilegeB0001.010:Memory Write WatchingB0001.036: ProcessEnvironment Block NtGlobalFlagB0001.002:CheckRemoteDebuggerPresentB0001.005:Hardware BreakpointsB0001.014:NtSetInformationThreadB0001.013: NtQueryObjectB0001.030:UnhandledExceptionFilterB0001.011:Monitoring ThreadB0001.020: Process JobsB0001.035: Process EnvironmentBlock BeingDebuggedB0001.019:Process Environment BlockB0002.009: Hook InterruptB0002.025: Self-UnmappingB0002.007:Get Base IndirectlyB0002.005:Code Integrity CheckB0002.024: Self-DebuggingB0002.004:Change SizeOfImageB0002.013: Malloc UseB0002.026: Static LinkingB0002.030: Use InterruptsB0002.021:Return ObfuscationB0002.003: Byte StealingB0002.011: InliningB0002.019: Pre-DebugB0002.029: Thread TimeoutB0002.023:Section MisalignmentB0002.028: TamperingB0002.018:Pipeline MisdirectionB0002.002:Break Point ClearingB0002.008: Guard PagesB0002.020:Relocate API CodeB0002.006:Exception MisdirectionB0002.022:RtlAdjustPrivilegeB0002.012: Loop EscapesB0002.014:Modify PE HeaderB0002.015: NanomitesB0002.017:Parallel ThreadsB0002.001:Block InterruptsB0002.016:Obfuscate Library UseB0002.027:Stolen API CodeB0002.010:Import ObfuscationB0003.007:Hook File SystemB0003.001:Alternative ntdll.dllB0003.009: IllusionB0003.004: Demo ModeB0003.008: Hook InterruptB0003.003:Delayed ExecutionB0003.002: Data FloodB0003.006: Encode FileB0003.010: RestartB0003.005: Drop CodeB0004.003: CheckEmulator-related Registry KeysB0004.001: Check forEmulator-related FilesB0004.004: FailedNetwork ConnectionsB0004.002:Check for WINE VersionB0005.004:Extra Loops/Time LocksB0005.001:Different Opcode SetsB0005.002:Undocumented OpcodesB0005.003:Unusual/Undocumented API CallsB0008.001: Multiple VMsF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingB0006.010:Hook memory mapping APIsB0006.001:Code Encryption in MemoryB0006.003:Hide virtual memoryB0006.005: TamperingB0006.002:Erase the PE headerB0006.004: SizeOfImageB0006.011: PatchMmGetPhysicalMemoryRangesB0006.006: Guard PagesB0006.008:Feed MisinformationB0006.009:Flow Opcode ObstructionB0006.007:On-the-Fly APIsB0007.006:Screen Resolution TestingB0007.007: Self CheckB0007.008:Timing/Date CheckB0007.005:Product Key/ID TestingB0007.009:Timing/Uptime CheckB0007.001:Check Clipboard DataB0007.003:Human User CheckB0007.002: Check FilesB0007.004:Injected DLL TestingF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXB0009.009: Check WindowsB0009.018: Modern SpecsCheck - Processor countB0009.005:Check Registry KeysB0009.006:Check Running ServicesB0009.034: InstructionTesting - CPUIDB0009.020: CheckWindows - Window sizeB0009.012:Human User CheckB0009.019: Modern SpecsCheck - Keyboard layoutB0009.011: HTML5Performance Object CheckB0009.021: CheckWindows - Unique windowsB0009.016: ModernSpecs Check - USB driveB0009.038: InstructionTesting - VPCEXTB0009.029:Instruction TestingB0009.036: InstructionTesting - RDTSCB0009.003: CheckNamed System ObjectsB0009.037: InstructionTesting - VMCPUIDB0009.017: ModernSpecs Check - PrinterB0009.013:Modern Specs CheckB0009.030: InstructionTesting - SIDT (red pill)B0009.007: Check SoftwareB0009.022: CheckWindows - Title barsB0009.032: InstructionTesting - SMSWB0009.033:Instruction Testing - STRB0009.027: Unique Hardware/FirmwareCheck - CPU LocationB0009.031: InstructionTesting - SGDT/SLDT (no pill)B0009.010:Guest Process TestingB0009.001: Check Fileand Directory ArtifactsB0009.025: Unique Hardware/FirmwareCheck - I/O Communication PortB0009.004:Check ProcessesB0009.035:Instruction Testing - INB0009.008:Check Virtual DevicesB0009.026: UniqueHardware/Firmware Check - CPU NameB0009.024: UniqueHardware/Firmware Check - BIOSB0009.015: ModernSpecs Check - Drive sizeB0009.002:Check Memory ArtifactsB0009.028: Unique Hardware/FirmwareCheck - MAC AddressB0009.014: Modern SpecsCheck - Total physical memoryB0009.023: UniqueHardware/Firmware CheckAnti-Behavioral AnalysisB0010: CallGraph Generation EvasionB0045:Data Flow Analysis EvasionB0012: Disassembler EvasionB0032:Executable Code ObfuscationB0034: ExecutableCode OptimizationB0008: ExecutableCode VirtualizationE1027: ObfuscatedFiles or InformationF0001: Software PackingB0010.001:Two-layer Function ReturnB0010.002: Invoke NTDLLSystem Calls via Encoded TableB0045.001:Control DependenceB0045.002: Implicit FlowsB0045.003: ArbitraryMemory CorruptionB0012.001:Argument ObfuscationB0012.002:Conditional MisdirectionB0012.005: VBA StompingB0012.004:Variable RecompositionB0012.003:Value Dependent JumpsB0032.001: API HashingB0032.017: Stack StringsB0032.002: Code InsertionB0032.003:Dead Code InsertionB0032.008:Data Value ObfuscationB0032.014:Interleaving CodeB0032.005: Jump InsertionB0032.004:Fake Code InsertionB0032.009:Entry Point ObfuscationB0032.007:Junk Code InsertionB0032.011: ImportAddress Table ObfuscationB0032.015:Merged Code SectionsB0032.012:Import CompressionB0032.018:Symbol ObfuscationB0032.016: StructuredException Handling (SEH)B0032.013:Instruction OverlapB0032.006:Thunk Code InsertionB0032.010: Guard PagesB0034.002: MinificationB0034.001: Jump/CallAbsolute AddressB0008.001: Multiple VMsE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXAnti-Static AnalysisB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICollectionB0030: C2 CommunicationB0031:Domain Name GenerationE1105: Remote File CopyB0030.012:Directory ListingB0030.009:Request Email TemplateB0030.008:Request CommandB0030.010: RequestEmail Address ListB0030.001: Send DataB0030.007: Send HeartbeatB0030.014:Execute Shell CommandB0030.002: Receive DataB0030.016:Start Interactive ShellB0030.004: Implant toController File TransferB0030.003: Serverto Client File TransferB0030.013: Execute FileB0030.006:Send System InformationB0030.011: AuthenticateB0030.005:Check for PayloadB0030.015: File searchCommand and ControlB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICredential AccessB0027: AlternativeInstallation LocationF0013: BootkitB0037: BypassData Execution PreventionF0009: Component FirmwareB0025:Conditional ExecutionB0040: Covert LocationF0004: Disableor Evade Security ToolsE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingF0006: Indicator BlockingE1478: Install Insecureor Malicious ConfigurationE1112: Modify RegistryE1027: ObfuscatedFiles or InformationB0029: Polymorphic CodeE1055: Process InjectionE1014: RootkitF0007: Self DeletionF0001: Software PackingB0027.002:Registry InstallB0027.001:Fileless MalwareB0037.001: ROP ChainsF0009.001:Router FirmwareB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0040.001:Hide Data in RegistryB0040.002: SteganographyF0004.008: Heavens GateF0004.005: Modify PolicyF0004.004: AMSI BypassF0004.009:Disable Code IntegrityF0004.001: DisableKernel Patch ProtectionF0004.002: Disable SystemFile Overwrite ProtectionF0004.007: BypassWindows File ProtectionF0004.006:Force Lazy WritingF0004.003: Unhook APIsE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0006.001: RemoveSMS Warning MessagesE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmB0029.001: Packer StubB0029.003:Code ReorderingB0029.002:Call IndirectionsE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsE1014.m15:Hypervisor/Virtualized RootkitE1014.m14:Hardware/Firmware RootkitE1014.m12:Application RootkitE1014.m17: Memory RootkitE1014.m16:Kernel Mode RootkitE1014.m13: BootloaderF0007.001: COMSPECEnvironment VariableF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXDefense EvasionB0013:Analysis Tool DiscoveryE1010: ApplicationWindow DiscoveryB0046: Code DiscoveryE1083: Fileand Directory DiscoveryB0038: Self DiscoveryB0014:SMTP Connection DiscoveryE1082: SystemInformation DiscoveryB0043: Taskbar DiscoveryB0013.002: Processdetection - DebuggersB0013.004: Processdetection - PCAP UtilitiesB0013.005: Process detection- Process UtilitiesB0013.003: Process detection- SysInternals Suite ToolsB0013.006: Processdetection - PE UtilitiesB0013.001:Process detectionB0013.008:Known File LocationB0013.009: Known WindowB0013.007: Processdetection - SandboxesE1010.m01: Window TextB0046.001:Enumerate PE SectionsB0046.003:Parse PE HeaderB0046.002: InspectSection Memory PermissionsE1083.m01: Log FileE1082.m01: GenerateWindows ExceptionDiscoveryE1059: Commandand Scripting InterpreterB0025:Conditional ExecutionB0044: Execution DependencyE1203: Exploitationfor Client ExecutionB0023:Install Additional ProgramB0024: PreventConcurrent ExecutionB0011: Remote CommandsB0020: Send EmailB0021:Send Poisoned Text MessageE1569: System ServicesE1204: User InteractionB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsB0011.001: Delete FileB0011.003: ExecuteB0011.005: SleepB0011.006: UninstallB0011.007: Upload FileB0011.004: ShutdownB0011.002: Download FileE1569.m01: MSDTCExecutionE1560:Archive Collected DataE1020:Automated ExfiltrationE1560.m03: Encoding- Standard EncodingE1560.m05: Encryption- Standard EncryptionE1560.m06: Encryption- Custom EncryptionE1560.m01: EncodingE1560.m04: Encoding- Custom EncodingE1560.m02: EncryptionE1020.m01: Exfiltratevia File Hosting ServiceExfiltrationE1510:Clipboard ModificationF0009: Component FirmwareB0016:Compromise Data IntegrityE1485: Data DestructionE1486:Data Encrypted for ImpactB0033: Denial of ServiceB0017: Destroy HardwareF0014: Disk WipeE1190: Exploit Kit BehaviorE1203: Exploitationfor Client ExecutionE1472: Generate FraudulentAdvertising RevenueB0019:Manipulate Network TrafficB0042: Modify HardwareB0022: Remote AccessB0018: Resource HijackingB0039: SpammingF0009.001:Router FirmwareE1485.m02:Empty Recycle BinE1485.m03: DeleteApplication/SoftwareE1485.m04:Delete Shadow CopiesE1486.001: Ransom NoteE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsE1472.m01:Click HijackingE1472.m02: AdvertisementReplacement FraudB0042.002: MouseB0042.001: CDROMB0042.003: PrinterB0022.001: Reverse ShellB0018.002: CryptojackingB0018.001:Password CrackingImpactB0026:Malicious Network DriverE1105: Remote File CopyB0020: Send EmailB0021:Send Poisoned Text MessageE1195:Supply Chain CompromiseE1195.m02:Exploit Private APIsE1195.m01: AbuseEnterprise CertificatesLateral MovementC0011: DNS CommunicationC0004: FTP CommunicationC0002: HTTP CommunicationC0014: ICMP CommunicationC0003:Interprocess CommunicationC0012: SMTP CommunicationC0001: Socket CommunicationC0005: WinINetC0011.004: ResolveTLD::DNS CommunicationC0011.003: DDNS DomainConnect::DNS CommunicationC0011.005: Resolve Free HostingDomain::DNS CommunicationC0011.001: Resolve::DNSCommunicationC0011.002: ServerConnect::DNS CommunicationC0004.001: SendFile::FTP CommunicationC0004.002: WinINet::FTPCommunicationC0002.002: Client::HTTPCommunicationC0002.009: Connect toServer::HTTP CommunicationC0002.017: GetResponse::HTTP CommunicationC0002.003: SendRequest::HTTP CommunicationC0002.004: OpenURL::HTTP CommunicationC0002.007: WinINet::HTTPCommunicationC0002.015: ReceiveRequest::HTTP CommunicationC0002.013: SetHeader::HTTP CommunicationC0002.005: SendData::HTTP CommunicationC0002.010: IWebBrowser::HTTPCommunicationC0002.016: SendResponse::HTTP CommunicationC0002.012: CreateRequest::HTTP CommunicationC0002.001: Server::HTTPCommunicationC0002.011: ExtractBody::HTTP CommunicationC0002.014: ReadHeader::HTTP CommunicationC0002.008: WinHTTP::HTTPCommunicationC0002.018: StartServer::HTTP CommunicationC0002.006: DownloadURL::HTTP CommunicationC0014.002: EchoRequest::ICMP CommunicationC0014.001: GenerateTraffic::ICMP CommunicationC0003.001: CreatePipe::Interprocess CommunicationC0003.003: ReadPipe::Interprocess CommunicationC0003.004: WritePipe::Interprocess CommunicationC0003.002: ConnectPipe::Interprocess CommunicationC0012.002: Request::SMTPCommunicationC0012.001: ServerConnect::SMTP CommunicationC0001.015: Send UDPData::Socket CommunicationC0001.016: Receive TCPData::Socket CommunicationC0001.005: Start TCPServer::Socket CommunicationC0001.006: ReceiveData::Socket CommunicationC0001.013: UDPClient::Socket CommunicationC0001.012: Get SocketStatus::Socket CommunicationC0001.017: Receive UDPData::Socket CommunicationC0001.007: SendData::Socket CommunicationC0001.014: Send TCPData::Socket CommunicationC0001.009: Initialize WinsockLibrary::Socket CommunicationC0001.008: TCPClient::Socket CommunicationC0001.004: ConnectSocket::Socket CommunicationC0001.011: Create TCPSocket::Socket CommunicationC0001.003: CreateSocket::Socket CommunicationC0001.001: Set SocketConfig::Socket CommunicationC0001.010: Create UDPSocket::Socket CommunicationC0001.002: TCPServer::Socket CommunicationC0005.002:InternetOpen::WinINetC0005.003:InternetOpenURL::WinINetC0005.005:InternetWriteFile::WinINetC0005.004:InternetReadFile::WinINetC0005.001:InternetConnect::WinINetCommunicationMicro-objectiveC0059: Crypto LibraryC0029: Cryptographic HashC0031: Decrypt DataC0027: Encrypt DataC0028: Encryption KeyC0021: GeneratePseudo-random SequenceC0061: HashedMessage Authentication CodeC0029.002:SHA1::Cryptographic HashC0029.003:SHA256::Cryptographic HashC0029.004:SHA224::Cryptographic HashC0029.001:MD5::Cryptographic HashC0029.006:Snefru::Cryptographic HashC0029.005:Tiger::Cryptographic HashC0031.014:Twofish::Decrypt DataC0031.011:Skipjack::Decrypt DataC0031.003:Blowfish::Decrypt DataC0031.006:HC-128::Decrypt DataC0031.001:AES::Decrypt DataC0031.008:RC4::Decrypt DataC0031.013: StreamCipher::Decrypt DataC0031.002: BlockCipher::Decrypt DataC0031.004:Camellia::Decrypt DataC0031.007:HC-256::Decrypt DataC0031.005:3DES::Decrypt DataC0031.012:Sosemanuk::Decrypt DataC0031.009:RC6::Decrypt DataC0031.010:RSA::Decrypt DataC0027.011:RSA::Encrypt DataC0027.014: BlockCipher::Encrypt DataC0027.001:AES::Encrypt DataC0027.012: StreamCipher::Encrypt DataC0027.010:RC6::Encrypt DataC0027.003:Camellia::Encrypt DataC0027.007:HC-256::Encrypt DataC0027.005:Twofish::Encrypt DataC0027.002:Blowfish::Encrypt DataC0027.006:HC-128::Encrypt DataC0027.013:Skipjack::Encrypt DataC0027.009:RC4::Encrypt DataC0027.004:3DES::Encrypt DataC0027.008:Sosemanuk::Encrypt DataC0028.001: Import PublicKey::Encryption KeyC0028.002:RC4 KSA::Encryption KeyC0021.001: GetTickCount::GeneratePseudo-random SequenceC0021.005: Mersenne Twister::GeneratePseudo-random SequenceC0021.003: Use API::GeneratePseudo-random SequenceC0021.002: rand::GeneratePseudo-random SequenceC0021.004: RC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveC0019: Check StringC0032: ChecksumC0024: Compress DataC0060: Compression LibraryC0053: Decode DataC0025: Decompress DataC0026: Encode DataC0058: ModuloC0030:Non-Cryptographic HashC0020: Use ConstantC0032.003: BSD::ChecksumC0032.002: Luhn::ChecksumC0032.001:CRC32::ChecksumC0032.005:Adler::ChecksumC0032.004:Verhoeff::ChecksumC0024.001:QuickLZ::Compress DataC0024.002:IEncodingFilterFactory::Compress DataC0053.001:Base64::Decode DataC0053.002:XOR::Decode DataC0025.003:aPLib::Decompress DataC0025.002:IEncodingFilterFactory::DecompressDataC0025.001:QuickLZ::Decompress DataC0026.002:XOR::Encode DataC0026.001:Base64::Encode DataC0030.003:Fast-Hash::Non-Cryptographic HashC0030.001:MurmurHash::Non-Cryptographic HashC0030.004:dhash::Non-Cryptographic HashC0030.002:pHash::Non-Cryptographic HashC0030.005:FNV::Non-Cryptographic HashData Micro-objectiveC0015: Alter File ExtensionC0045: Copy FileC0046: Create DirectoryC0016: Create FileC0048: Delete DirectoryC0047: Delete FileC0049: Get File AttributesC0063: Move FileC0051: Read FileC0056: Read Virtual DiskC0050: Set File AttributesC0052: Writes FileC0015.001: AppendExtension::Alter File ExtensionC0016.001: Create OfficeDocument::Create FileC0016.002: CreateRansomware File::Create FileFile System Micro-objectiveC0037: Install DriverC0023: Load DriverC0057: Simulate HardwareC0037.001:Minifilter::Install DriverC0023.001:Minifilter::Load DriverC0057.002: MouseClick::Simulate HardwareC0057.001:Ctrl-Alt-Del::Simulate HardwareHardware Micro-objectiveC0007: Allocate MemoryC0008:Change Memory ProtectionC0044: Free MemoryC0006: Heap SprayC0010: Overflow BufferC0009: Stack PivotC0008.001: ExecutableStack::Change Memory ProtectionC0008.002: ExecutableHeap::Change Memory ProtectionMemory Micro-objectiveC0033: ConsoleC0034: Environment VariableC0036: RegistryC0035: WallpaperC0034.002: GetVariable::Environment VariableC0034.001: SetVariable::Environment VariableC0036.004: CreateRegistry Key::RegistryC0036.002: DeleteRegistry Key::RegistryC0036.001: SetRegistry Key::RegistryC0036.005: QueryRegistry Key::RegistryC0036.007: DeleteRegistry Value::RegistryC0036.003: OpenRegistry Key::RegistryC0036.006: QueryRegistry Value::RegistryOperatingSystem Micro-objectiveC0040: AllocateThread Local StorageC0043: Check MutexC0042: Create MutexC0017: Create ProcessC0038: Create ThreadC0064: Enumerate ThreadsC0065: Open ProcessC0066: Open ThreadC0054: Resume ThreadC0041: SetThread Local Storage ValueC0055: Suspend ThreadC0022: SynchronizationC0018: Terminate ProcessC0039: Terminate ThreadC0017.001: Create Processvia Shellcode::Create ProcessC0017.003: Create SuspendedProcess::Create ProcessC0017.002: Create Processvia WMI::Create ProcessC0022.001: CreateMutex::SynchronizationProcess Micro-objectiveF0013: BootkitF0009: Component FirmwareE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingE1478: Install Insecureor Malicious ConfigurationF0010: KernelModules and ExtensionsB0026:Malicious Network DriverF0011:Modify Existing ServiceE1112: Modify RegistryF0012: RegistryRun Keys / Startup FolderB0022: Remote AccessE1105: Remote File CopyB0035: Shutdown EventF0009.001:Router FirmwareE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverB0022.001: Reverse ShellPersistenceF0015:Hijack Execution FlowF0003: HookingF0010: KernelModules and ExtensionsF0011:Modify Existing ServiceE1055: Process InjectionF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsPrivilege Escalation \ No newline at end of file +B0036: Capture EvasionB0025:Conditional ExecutionB0001: Debugger DetectionB0002: Debugger EvasionB0003:Dynamic Analysis EvasionB0004: Emulator DetectionB0005: Emulator EvasionB0008: ExecutableCode VirtualizationF0003: HookingB0006: Memory Dump EvasionB0007: Sandbox DetectionF0001: Software PackingB0009:Virtual Machine DetectionB0036.003: MultipleStages of LoadersB0036.001:Memory-only PayloadB0036.002:Encrypted PayloadsB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0001.003: CloseHandleB0001.031:WudfIsAnyDebuggerPresentB0001.025:Software BreakpointsB0001.027: TIB AwareB0001.028:Timing/Delay CheckB0001.024:SetHandleInformationB0001.007: Interrupt 1B0001.029: TLS CallbacksB0001.018: Parent ProcessB0001.009:Memory BreakpointsB0001.026: Stack CanaryB0001.033: Timing/DelayCheck QueryPerformanceCounterB0001.032: Timing/DelayCheck GetTickCountB0001.006: Interrupt 0x2dB0001.017: Page ExceptionBreakpoint DetectionB0001.034: Anti-debuggingInstructionsB0001.015:NtYieldExecution/SwitchToThreadB0001.021: ProcessHeapB0001.037: ProcessEnvironment Block IsDebuggedB0001.001:API Hook DetectionB0001.004:Debugger ArtifactsB0001.012:NtQueryInformationProcessB0001.023:SeDebugPrivilegeB0001.016:OutputDebugStringB0001.008:IsDebuggerPresentB0001.022:RtlAdjustPrivilegeB0001.010:Memory Write WatchingB0001.036: ProcessEnvironment Block NtGlobalFlagB0001.002:CheckRemoteDebuggerPresentB0001.005:Hardware BreakpointsB0001.014:NtSetInformationThreadB0001.013: NtQueryObjectB0001.030:UnhandledExceptionFilterB0001.011:Monitoring ThreadB0001.020: Process JobsB0001.035: Process EnvironmentBlock BeingDebuggedB0001.019:Process Environment BlockB0002.009: Hook InterruptB0002.025: Self-UnmappingB0002.007:Get Base IndirectlyB0002.005:Code Integrity CheckB0002.024: Self-DebuggingB0002.004:Change SizeOfImageB0002.013: Malloc UseB0002.026: Static LinkingB0002.030: Use InterruptsB0002.021:Return ObfuscationB0002.003: Byte StealingB0002.011: InliningB0002.019: Pre-DebugB0002.029: Thread TimeoutB0002.023:Section MisalignmentB0002.028: TamperingB0002.018:Pipeline MisdirectionB0002.002:Break Point ClearingB0002.008: Guard PagesB0002.020:Relocate API CodeB0002.006:Exception MisdirectionB0002.022:RtlAdjustPrivilegeB0002.012: Loop EscapesB0002.014:Modify PE HeaderB0002.015: NanomitesB0002.017:Parallel ThreadsB0002.001:Block InterruptsB0002.016:Obfuscate Library UseB0002.027:Stolen API CodeB0002.010:Import ObfuscationB0003.007:Hook File SystemB0003.001:Alternative ntdll.dllB0003.009: IllusionB0003.004: Demo ModeB0003.008: Hook InterruptB0003.003:Delayed ExecutionB0003.002: Data FloodB0003.006: Encode FileB0003.010: RestartB0003.005: Drop CodeB0004.003: CheckEmulator-related Registry KeysB0004.001: Check forEmulator-related FilesB0004.004: FailedNetwork ConnectionsB0004.002:Check for WINE VersionB0005.004:Extra Loops/Time LocksB0005.001:Different Opcode SetsB0005.002:Undocumented OpcodesB0005.003:Unusual/Undocumented API CallsB0008.001: Multiple VMsF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingB0006.010:Hook memory mapping APIsB0006.001:Code Encryption in MemoryB0006.003:Hide virtual memoryB0006.005: TamperingB0006.002:Erase the PE headerB0006.004: SizeOfImageB0006.011: PatchMmGetPhysicalMemoryRangesB0006.006: Guard PagesB0006.008:Feed MisinformationB0006.009:Flow Opcode ObstructionB0006.007:On-the-Fly APIsB0007.006:Screen Resolution TestingB0007.007: Self CheckB0007.008:Timing/Date CheckB0007.005:Product Key/ID TestingB0007.009:Timing/Uptime CheckB0007.001:Check Clipboard DataB0007.003:Human User CheckB0007.002: Check FilesB0007.004:Injected DLL TestingF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXB0009.009: Check WindowsB0009.018: Modern SpecsCheck - Processor countB0009.005:Check Registry KeysB0009.006:Check Running ServicesB0009.034: InstructionTesting - CPUIDB0009.020: CheckWindows - Window sizeB0009.012:Human User CheckB0009.019: Modern SpecsCheck - Keyboard layoutB0009.011: HTML5Performance Object CheckB0009.021: CheckWindows - Unique windowsB0009.016: ModernSpecs Check - USB driveB0009.038: InstructionTesting - VPCEXTB0009.029:Instruction TestingB0009.036: InstructionTesting - RDTSCB0009.003: CheckNamed System ObjectsB0009.037: InstructionTesting - VMCPUIDB0009.017: ModernSpecs Check - PrinterB0009.013:Modern Specs CheckB0009.030: InstructionTesting - SIDT (red pill)B0009.007: Check SoftwareB0009.022: CheckWindows - Title barsB0009.032: InstructionTesting - SMSWB0009.033:Instruction Testing - STRB0009.027: Unique Hardware/FirmwareCheck - CPU LocationB0009.031: InstructionTesting - SGDT/SLDT (no pill)B0009.010:Guest Process TestingB0009.001: Check Fileand Directory ArtifactsB0009.025: Unique Hardware/FirmwareCheck - I/O Communication PortB0009.004:Check ProcessesB0009.035:Instruction Testing - INB0009.008:Check Virtual DevicesB0009.026: UniqueHardware/Firmware Check - CPU NameB0009.024: UniqueHardware/Firmware Check - BIOSB0009.015: ModernSpecs Check - Drive sizeB0009.002:Check Memory ArtifactsB0009.028: Unique Hardware/FirmwareCheck - MAC AddressB0009.014: Modern SpecsCheck - Total physical memoryB0009.023: UniqueHardware/Firmware CheckAnti-Behavioral AnalysisB0010: CallGraph Generation EvasionB0045:Data Flow Analysis EvasionB0012: Disassembler EvasionB0032:Executable Code ObfuscationB0034: ExecutableCode OptimizationB0008: ExecutableCode VirtualizationE1027: ObfuscatedFiles or InformationF0001: Software PackingB0010.001:Two-layer Function ReturnB0010.002: Invoke NTDLLSystem Calls via Encoded TableB0045.001:Control DependenceB0045.002: Implicit FlowsB0045.003: ArbitraryMemory CorruptionB0012.001:Argument ObfuscationB0012.002:Conditional MisdirectionB0012.005: VBA StompingB0012.004:Variable RecompositionB0012.003:Value Dependent JumpsB0032.001: API HashingB0032.017: Stack StringsB0032.002: Code InsertionB0032.003:Dead Code InsertionB0032.008:Data Value ObfuscationB0032.014:Interleaving CodeB0032.005: Jump InsertionB0032.004:Fake Code InsertionB0032.009:Entry Point ObfuscationB0032.007:Junk Code InsertionB0032.011: ImportAddress Table ObfuscationB0032.015:Merged Code SectionsB0032.012:Import CompressionB0032.018:Symbol ObfuscationB0032.016: StructuredException Handling (SEH)B0032.013:Instruction OverlapB0032.006:Thunk Code InsertionB0032.010: Guard PagesB0034.002: MinificationB0034.001: Jump/CallAbsolute AddressB0008.001: Multiple VMsE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXAnti-Static AnalysisB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICollectionB0030: C2 CommunicationB0031:Domain Name GenerationE1105: Remote File CopyB0030.012:Directory ListingB0030.009:Request Email TemplateB0030.008:Request CommandB0030.010: RequestEmail Address ListB0030.001: Send DataB0030.007: Send HeartbeatB0030.014:Execute Shell CommandB0030.002: Receive DataB0030.016:Start Interactive ShellB0030.004: Implant toController File TransferB0030.003: Serverto Client File TransferB0030.013: Execute FileB0030.006:Send System InformationB0030.011: AuthenticateB0030.005:Check for PayloadB0030.015: File searchCommand and ControlB0028: CryptocurrencyF0003: HookingE1056: Input CaptureF0002: KeyloggingE1113: Screen CaptureB0028.001: BitcoinB0028.002: EthereumB0028.003: ZcashF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingE1056.m01: Mouse EventsF0002.001:Application HookF0002.002: PollingE1113.m01: WinAPICredential AccessB0027: AlternativeInstallation LocationF0013: BootkitB0037: BypassData Execution PreventionF0009: Component FirmwareB0025:Conditional ExecutionB0040: Covert LocationF0004: Disableor Evade Security ToolsE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingF0006: Indicator BlockingB0047: Install Insecureor Malicious ConfigurationE1112: Modify RegistryE1027: ObfuscatedFiles or InformationB0029: Polymorphic CodeE1055: Process InjectionE1014: RootkitF0007: Self DeletionF0001: Software PackingB0027.002:Registry InstallB0027.001:Fileless MalwareB0037.001: ROP ChainsF0009.001:Router FirmwareB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckB0040.001:Hide Data in RegistryB0040.002: SteganographyF0004.008: Heavens GateF0004.005: Modify PolicyF0004.004: AMSI BypassF0004.009:Disable Code IntegrityF0004.001: DisableKernel Patch ProtectionF0004.002: Disable SystemFile Overwrite ProtectionF0004.007: BypassWindows File ProtectionF0004.006:Force Lazy WritingF0004.003: Unhook APIsE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0006.001: RemoveSMS Warning MessagesE1027.m07:Encryption of DataE1027.m08:Encryption-Custom AlgorithmE1027.m01: EncodingE1027.m06:Encryption of CodeE1027.m05:Encryption-Standard AlgorithmE1027.m04: EncryptionE1027.m03:Encoding-Custom AlgorithmE1027.m02:Encoding-Standard AlgorithmB0029.001: Packer StubB0029.003:Code ReorderingB0029.002:Call IndirectionsE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsE1014.m15:Hypervisor/Virtualized RootkitE1014.m14:Hardware/Firmware RootkitE1014.m12:Application RootkitE1014.m17: Memory RootkitE1014.m16:Kernel Mode RootkitE1014.m13: BootloaderF0007.001: COMSPECEnvironment VariableF0001.009: ConfuserF0001.005:Custom CompressionF0001.007: CustomCompression of DataF0001.010: VMProtectF0001.011: ThemidaF0001.001: Nested PackingF0001.004: StandardCompression of DataF0001.003: StandardCompression of CodeF0001.012: ArmadilloF0001.013: ASPackF0001.002:Standard CompressionF0001.006: CustomCompression of CodeF0001.008: UPXDefense EvasionB0013:Analysis Tool DiscoveryE1010: ApplicationWindow DiscoveryB0046: Code DiscoveryE1083: Fileand Directory DiscoveryB0038: Self DiscoveryB0014:SMTP Connection DiscoveryE1082: SystemInformation DiscoveryB0043: Taskbar DiscoveryB0013.002: Processdetection - DebuggersB0013.004: Processdetection - PCAP UtilitiesB0013.005: Process detection- Process UtilitiesB0013.003: Process detection- SysInternals Suite ToolsB0013.006: Processdetection - PE UtilitiesB0013.001:Process detectionB0013.008:Known File LocationB0013.009: Known WindowB0013.007: Processdetection - SandboxesE1010.m01: Window TextB0046.001:Enumerate PE SectionsB0046.003:Parse PE HeaderB0046.002: InspectSection Memory PermissionsE1083.m01: Log FileE1082.m01: GenerateWindows ExceptionDiscoveryE1059: Commandand Scripting InterpreterB0025:Conditional ExecutionB0044: Execution DependencyE1203: Exploitationfor Client ExecutionB0023:Install Additional ProgramB0024: PreventConcurrent ExecutionB0011: Remote CommandsB0020: Send EmailB0021:Send Poisoned Text MessageE1569: System ServicesE1204: User InteractionB0025.007:Runs as ServiceB0025.002:Environmental KeysB0025.001: Suicide ExitB0025.003:GetVolumeInformationB0025.005:Secure TriggersB0025.008: Deposited KeysB0025.004:Host Fingerprint CheckB0025.006: Token CheckE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsB0011.001: Delete FileB0011.003: ExecuteB0011.005: SleepB0011.006: UninstallB0011.007: Upload FileB0011.004: ShutdownB0011.002: Download FileE1569.m01: MSDTCExecutionE1560:Archive Collected DataE1020:Automated ExfiltrationE1560.m03: Encoding- Standard EncodingE1560.m05: Encryption- Standard EncryptionE1560.m06: Encryption- Custom EncryptionE1560.m01: EncodingE1560.m04: Encoding- Custom EncodingE1560.m02: EncryptionE1020.m01: Exfiltratevia File Hosting ServiceExfiltrationE1510:Clipboard ModificationF0009: Component FirmwareB0016:Compromise Data IntegrityE1485: Data DestructionE1486:Data Encrypted for ImpactB0033: Denial of ServiceB0017: Destroy HardwareF0014: Disk WipeE1190: Exploit Kit BehaviorE1203: Exploitationfor Client ExecutionE1472: Generate FraudulentAdvertising RevenueB0019:Manipulate Network TrafficB0042: Modify HardwareB0022: Remote AccessB0018: Resource HijackingB0039: SpammingF0009.001:Router FirmwareE1485.m02:Empty Recycle BinE1485.m03: DeleteApplication/SoftwareE1485.m04:Delete Shadow CopiesE1486.001: Ransom NoteE1203.m01: RemoteDesktop Protocols (RDP)E1203.m05: SysinternalsE1203.m03: File TransferProtocol (FTP) ServersE1203.m02:Java-based Web ServersE1203.m06:Windows UtilitiesE1203.m04: Red HatJBoss Enterprise ProductsE1472.m01:Click HijackingE1472.m02: AdvertisementReplacement FraudB0042.002: MouseB0042.001: CDROMB0042.003: PrinterB0022.001: Reverse ShellB0018.002: CryptojackingB0018.001:Password CrackingImpactB0026:Malicious Network DriverE1105: Remote File CopyB0020: Send EmailB0021:Send Poisoned Text MessageE1195:Supply Chain CompromiseE1195.m02:Exploit Private APIsE1195.m01: AbuseEnterprise CertificatesLateral MovementC0011: DNS CommunicationC0004: FTP CommunicationC0002: HTTP CommunicationC0014: ICMP CommunicationC0003:Interprocess CommunicationC0012: SMTP CommunicationC0001: Socket CommunicationC0005: WinINetC0011.004: ResolveTLD::DNS CommunicationC0011.003: DDNS DomainConnect::DNS CommunicationC0011.005: Resolve Free HostingDomain::DNS CommunicationC0011.001: Resolve::DNSCommunicationC0011.002: ServerConnect::DNS CommunicationC0004.001: SendFile::FTP CommunicationC0004.002: WinINet::FTPCommunicationC0002.002: Client::HTTPCommunicationC0002.009: Connect toServer::HTTP CommunicationC0002.017: GetResponse::HTTP CommunicationC0002.003: SendRequest::HTTP CommunicationC0002.004: OpenURL::HTTP CommunicationC0002.007: WinINet::HTTPCommunicationC0002.015: ReceiveRequest::HTTP CommunicationC0002.013: SetHeader::HTTP CommunicationC0002.005: SendData::HTTP CommunicationC0002.010: IWebBrowser::HTTPCommunicationC0002.016: SendResponse::HTTP CommunicationC0002.012: CreateRequest::HTTP CommunicationC0002.001: Server::HTTPCommunicationC0002.011: ExtractBody::HTTP CommunicationC0002.014: ReadHeader::HTTP CommunicationC0002.008: WinHTTP::HTTPCommunicationC0002.018: StartServer::HTTP CommunicationC0002.006: DownloadURL::HTTP CommunicationC0014.002: EchoRequest::ICMP CommunicationC0014.001: GenerateTraffic::ICMP CommunicationC0003.001: CreatePipe::Interprocess CommunicationC0003.003: ReadPipe::Interprocess CommunicationC0003.004: WritePipe::Interprocess CommunicationC0003.002: ConnectPipe::Interprocess CommunicationC0012.002: Request::SMTPCommunicationC0012.001: ServerConnect::SMTP CommunicationC0001.015: Send UDPData::Socket CommunicationC0001.016: Receive TCPData::Socket CommunicationC0001.005: Start TCPServer::Socket CommunicationC0001.006: ReceiveData::Socket CommunicationC0001.013: UDPClient::Socket CommunicationC0001.012: Get SocketStatus::Socket CommunicationC0001.017: Receive UDPData::Socket CommunicationC0001.007: SendData::Socket CommunicationC0001.014: Send TCPData::Socket CommunicationC0001.009: Initialize WinsockLibrary::Socket CommunicationC0001.008: TCPClient::Socket CommunicationC0001.004: ConnectSocket::Socket CommunicationC0001.011: Create TCPSocket::Socket CommunicationC0001.003: CreateSocket::Socket CommunicationC0001.001: Set SocketConfig::Socket CommunicationC0001.010: Create UDPSocket::Socket CommunicationC0001.002: TCPServer::Socket CommunicationC0005.002:InternetOpen::WinINetC0005.003:InternetOpenURL::WinINetC0005.005:InternetWriteFile::WinINetC0005.004:InternetReadFile::WinINetC0005.001:InternetConnect::WinINetCommunicationMicro-objectiveC0059: Crypto LibraryC0029: Cryptographic HashC0031: Decrypt DataC0027: Encrypt DataC0028: Encryption KeyC0021: GeneratePseudo-random SequenceC0061: HashedMessage Authentication CodeC0029.002:SHA1::Cryptographic HashC0029.003:SHA256::Cryptographic HashC0029.004:SHA224::Cryptographic HashC0029.001:MD5::Cryptographic HashC0029.006:Snefru::Cryptographic HashC0029.005:Tiger::Cryptographic HashC0031.014:Twofish::Decrypt DataC0031.011:Skipjack::Decrypt DataC0031.003:Blowfish::Decrypt DataC0031.006:HC-128::Decrypt DataC0031.001:AES::Decrypt DataC0031.008:RC4::Decrypt DataC0031.013: StreamCipher::Decrypt DataC0031.002: BlockCipher::Decrypt DataC0031.004:Camellia::Decrypt DataC0031.007:HC-256::Decrypt DataC0031.005:3DES::Decrypt DataC0031.012:Sosemanuk::Decrypt DataC0031.009:RC6::Decrypt DataC0031.010:RSA::Decrypt DataC0027.011:RSA::Encrypt DataC0027.014: BlockCipher::Encrypt DataC0027.001:AES::Encrypt DataC0027.012: StreamCipher::Encrypt DataC0027.010:RC6::Encrypt DataC0027.003:Camellia::Encrypt DataC0027.007:HC-256::Encrypt DataC0027.005:Twofish::Encrypt DataC0027.002:Blowfish::Encrypt DataC0027.006:HC-128::Encrypt DataC0027.013:Skipjack::Encrypt DataC0027.009:RC4::Encrypt DataC0027.004:3DES::Encrypt DataC0027.008:Sosemanuk::Encrypt DataC0028.001: Import PublicKey::Encryption KeyC0028.002:RC4 KSA::Encryption KeyC0021.001: GetTickCount::GeneratePseudo-random SequenceC0021.005: Mersenne Twister::GeneratePseudo-random SequenceC0021.003: Use API::GeneratePseudo-random SequenceC0021.002: rand::GeneratePseudo-random SequenceC0021.004: RC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveC0019: Check StringC0032: ChecksumC0024: Compress DataC0060: Compression LibraryC0053: Decode DataC0025: Decompress DataC0026: Encode DataC0058: ModuloC0030:Non-Cryptographic HashC0020: Use ConstantC0032.003: BSD::ChecksumC0032.002: Luhn::ChecksumC0032.001:CRC32::ChecksumC0032.005:Adler::ChecksumC0032.004:Verhoeff::ChecksumC0024.001:QuickLZ::Compress DataC0024.002:IEncodingFilterFactory::Compress DataC0053.001:Base64::Decode DataC0053.002:XOR::Decode DataC0025.003:aPLib::Decompress DataC0025.002:IEncodingFilterFactory::DecompressDataC0025.001:QuickLZ::Decompress DataC0026.002:XOR::Encode DataC0026.001:Base64::Encode DataC0030.003:Fast-Hash::Non-Cryptographic HashC0030.001:MurmurHash::Non-Cryptographic HashC0030.004:dhash::Non-Cryptographic HashC0030.002:pHash::Non-Cryptographic HashC0030.005:FNV::Non-Cryptographic HashData Micro-objectiveC0015: Alter File ExtensionC0045: Copy FileC0046: Create DirectoryC0016: Create FileC0048: Delete DirectoryC0047: Delete FileC0049: Get File AttributesC0063: Move FileC0051: Read FileC0056: Read Virtual DiskC0050: Set File AttributesC0052: Writes FileC0015.001: AppendExtension::Alter File ExtensionC0016.001: Create OfficeDocument::Create FileC0016.002: CreateRansomware File::Create FileFile System Micro-objectiveC0037: Install DriverC0023: Load DriverC0057: Simulate HardwareC0037.001:Minifilter::Install DriverC0023.001:Minifilter::Load DriverC0057.002: MouseClick::Simulate HardwareC0057.001:Ctrl-Alt-Del::Simulate HardwareHardware Micro-objectiveC0007: Allocate MemoryC0008:Change Memory ProtectionC0044: Free MemoryC0006: Heap SprayC0010: Overflow BufferC0009: Stack PivotC0008.001: ExecutableStack::Change Memory ProtectionC0008.002: ExecutableHeap::Change Memory ProtectionMemory Micro-objectiveC0033: ConsoleC0034: Environment VariableC0036: RegistryC0035: WallpaperC0034.002: GetVariable::Environment VariableC0034.001: SetVariable::Environment VariableC0036.004: CreateRegistry Key::RegistryC0036.002: DeleteRegistry Key::RegistryC0036.001: SetRegistry Key::RegistryC0036.005: QueryRegistry Key::RegistryC0036.007: DeleteRegistry Value::RegistryC0036.003: OpenRegistry Key::RegistryC0036.006: QueryRegistry Value::RegistryOperatingSystem Micro-objectiveC0040: AllocateThread Local StorageC0043: Check MutexC0042: Create MutexC0017: Create ProcessC0038: Create ThreadC0064: Enumerate ThreadsC0065: Open ProcessC0066: Open ThreadC0054: Resume ThreadC0041: SetThread Local Storage ValueC0055: Suspend ThreadC0022: SynchronizationC0018: Terminate ProcessC0039: Terminate ThreadC0017.001: Create Processvia Shellcode::Create ProcessC0017.003: Create SuspendedProcess::Create ProcessC0017.002: Create Processvia WMI::Create ProcessC0022.001: CreateMutex::SynchronizationProcess Micro-objectiveF0013: BootkitF0009: Component FirmwareE1564: Hidden ArtifactsF0005: HiddenFiles and DirectoriesF0015:Hijack Execution FlowF0003: HookingB0047: Install Insecureor Malicious ConfigurationF0010: KernelModules and ExtensionsB0026:Malicious Network DriverF0011:Modify Existing ServiceE1112: Modify RegistryF0012: RegistryRun Keys / Startup FolderB0022: Remote AccessE1105: Remote File CopyB0035: Shutdown EventF0009.001:Router FirmwareE1564.m01: HiddenUserspace LibrariesE1564.m04:Hidden ServicesE1564.m05:Hidden Kernel ModulesE1564.m03:Hidden ProcessesE1564.m02: Direct KernelObject ManipulationF0005.002: LocationF0005.004: TimestampF0005.001: ExtensionF0005.003: AttributeF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverB0022.001: Reverse ShellPersistenceF0015:Hijack Execution FlowF0003: HookingF0010: KernelModules and ExtensionsF0011:Modify Existing ServiceE1055: Process InjectionF0015.003: Import AddressTable (IAT) HookingF0015.006: AbuseWindows Function CallsF0015.005: System ServiceDispatch Table HookingF0015.001: Export AddressTable (EAT) HookingF0015.002:Inline PatchingF0015.004: Shadow SystemService Dispatch Table HookingF0003.003:Procedure HookingF0003.005:Shadow SDT HookingF0003.001: Import AddressTable (IAT) HookingF0003.002:Inline PatchingF0003.006: Export AddressTable (EAT) HookingF0003.004: System ServiceDispatch Table HookingF0010.001: Device DriverE1055.m04: PatchProcess Command LineE1055.m01: Hook Injectionvia SetWindowsHooksExE1055.m05: Injectionvia Windows FibersE1055.m02: Injection and Persistencevia Registry ModificationE1055.m03:Injection using ShimsPrivilege Escalation \ No newline at end of file diff --git a/yfaq/mbc_matrix_without_ids.svg b/yfaq/mbc_matrix_without_ids.svg index 0cdd98d..d6970c0 100644 --- a/yfaq/mbc_matrix_without_ids.svg +++ b/yfaq/mbc_matrix_without_ids.svg @@ -1 +1 @@ -Capture EvasionConditional ExecutionDebugger DetectionDebugger EvasionDynamic Analysis EvasionEmulator DetectionEmulator EvasionExecutableCode VirtualizationHookingMemory Dump EvasionSandbox DetectionSoftware PackingVirtual Machine DetectionMultipleStages of LoadersMemory-only PayloadEncrypted PayloadsRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckCloseHandleWudfIsAnyDebuggerPresentSoftware BreakpointsTIB AwareTiming/Delay CheckSetHandleInformationInterrupt 1TLS CallbacksParent ProcessMemory BreakpointsStack CanaryTiming/Delay CheckQueryPerformanceCounterTiming/DelayCheck GetTickCountInterrupt 0x2dPage ExceptionBreakpoint DetectionAnti-debuggingInstructionsNtYieldExecution/SwitchToThreadProcessHeapProcess EnvironmentBlock IsDebuggedAPI Hook DetectionDebugger ArtifactsNtQueryInformationProcessSeDebugPrivilegeOutputDebugStringIsDebuggerPresentRtlAdjustPrivilegeMemory Write WatchingProcess EnvironmentBlock NtGlobalFlagCheckRemoteDebuggerPresentHardware BreakpointsNtSetInformationThreadNtQueryObjectUnhandledExceptionFilterMonitoring ThreadProcess JobsProcess EnvironmentBlock BeingDebuggedProcess Environment BlockHook InterruptSelf-UnmappingGet Base IndirectlyCode Integrity CheckSelf-DebuggingChange SizeOfImageMalloc UseStatic LinkingUse InterruptsReturn ObfuscationByte StealingInliningPre-DebugThread TimeoutSection MisalignmentTamperingPipeline MisdirectionBreak Point ClearingGuard PagesRelocate API CodeException MisdirectionRtlAdjustPrivilegeLoop EscapesModify PE HeaderNanomitesParallel ThreadsBlock InterruptsObfuscate Library UseStolen API CodeImport ObfuscationHook File SystemAlternative ntdll.dllIllusionDemo ModeHook InterruptDelayed ExecutionData FloodEncode FileRestartDrop CodeCheck Emulator-relatedRegistry KeysCheck forEmulator-related FilesFailedNetwork ConnectionsCheck for WINE VersionExtra Loops/Time LocksDifferent Opcode SetsUndocumented OpcodesUnusual/UndocumentedAPI CallsMultiple VMsProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingHook memory mapping APIsCode Encryption in MemoryHide virtual memoryTamperingErase the PE headerSizeOfImagePatchMmGetPhysicalMemoryRangesGuard PagesFeed MisinformationFlow Opcode ObstructionOn-the-Fly APIsScreen Resolution TestingSelf CheckTiming/Date CheckProduct Key/ID TestingTiming/Uptime CheckCheck Clipboard DataHuman User CheckCheck FilesInjected DLL TestingConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXCheck WindowsModern SpecsCheck - Processor countCheck Registry KeysCheck Running ServicesInstructionTesting - CPUIDCheckWindows - Window sizeHuman User CheckModern SpecsCheck - Keyboard layoutHTML5Performance Object CheckCheckWindows - Unique windowsModernSpecs Check - USB driveInstructionTesting - VPCEXTInstruction TestingInstructionTesting - RDTSCCheckNamed System ObjectsInstructionTesting - VMCPUIDModernSpecs Check - PrinterModern Specs CheckInstructionTesting - SIDT (red pill)Check SoftwareCheckWindows - Title barsInstructionTesting - SMSWInstruction Testing - STRUnique Hardware/FirmwareCheck - CPU LocationInstruction Testing- SGDT/SLDT (no pill)Guest Process TestingCheck Fileand Directory ArtifactsUnique Hardware/FirmwareCheck - I/O Communication PortCheck ProcessesInstruction Testing - INCheck Virtual DevicesUnique Hardware/FirmwareCheck - CPU NameUnique Hardware/FirmwareCheck - BIOSModernSpecs Check - Drive sizeCheck Memory ArtifactsUnique Hardware/FirmwareCheck - MAC AddressModern Specs Check- Total physical memoryUniqueHardware/Firmware CheckAnti-Behavioral AnalysisCallGraph Generation EvasionData Flow Analysis EvasionDisassembler EvasionExecutable Code ObfuscationExecutableCode OptimizationExecutableCode VirtualizationObfuscatedFiles or InformationSoftware PackingTwo-layer Function ReturnInvoke NTDLL SystemCalls via Encoded TableControl DependenceImplicit FlowsArbitraryMemory CorruptionArgument ObfuscationConditional MisdirectionVBA StompingVariable RecompositionValue Dependent JumpsAPI HashingStack StringsCode InsertionDead Code InsertionData Value ObfuscationInterleaving CodeJump InsertionFake Code InsertionEntry Point ObfuscationJunk Code InsertionImportAddress Table ObfuscationMerged Code SectionsImport CompressionSymbol ObfuscationStructuredException Handling (SEH)Instruction OverlapThunk Code InsertionGuard PagesMinificationJump/CallAbsolute AddressMultiple VMsEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXAnti-Static AnalysisCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICollectionC2 CommunicationDomain Name GenerationRemote File CopyDirectory ListingRequest Email TemplateRequest CommandRequestEmail Address ListSend DataSend HeartbeatExecute Shell CommandReceive DataStart Interactive ShellImplant toController File TransferServerto Client File TransferExecute FileSend System InformationAuthenticateCheck for PayloadFile searchCommand and ControlCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICredential AccessAlternativeInstallation LocationBootkitBypassData Execution PreventionComponent FirmwareConditional ExecutionCovert LocationDisableor Evade Security ToolsHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingIndicator BlockingInstall Insecureor Malicious ConfigurationModify RegistryObfuscatedFiles or InformationPolymorphic CodeProcess InjectionRootkitSelf DeletionSoftware PackingRegistry InstallFileless MalwareROP ChainsRouter FirmwareRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckHide Data in RegistrySteganographyHeavens GateModify PolicyAMSI BypassDisable Code IntegrityDisableKernel Patch ProtectionDisable SystemFile Overwrite ProtectionBypassWindows File ProtectionForce Lazy WritingUnhook APIsHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingRemoveSMS Warning MessagesEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmPacker StubCode ReorderingCall IndirectionsPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsHypervisor/VirtualizedRootkitHardware/Firmware RootkitApplication RootkitMemory RootkitKernel Mode RootkitBootloaderCOMSPECEnvironment VariableConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXDefense EvasionAnalysis Tool DiscoveryApplicationWindow DiscoveryCode DiscoveryFileand Directory DiscoverySelf DiscoverySMTP Connection DiscoverySystemInformation DiscoveryTaskbar DiscoveryProcessdetection - DebuggersProcess detection- PCAP UtilitiesProcess detection- Process UtilitiesProcess detection -SysInternals Suite ToolsProcessdetection - PE UtilitiesProcess detectionKnown File LocationKnown WindowProcessdetection - SandboxesWindow TextEnumerate PE SectionsParse PE HeaderInspect SectionMemory PermissionsLog FileGenerateWindows ExceptionDiscoveryCommandand Scripting InterpreterConditional ExecutionExecution DependencyExploitationfor Client ExecutionInstall Additional ProgramPreventConcurrent ExecutionRemote CommandsSend EmailSend Poisoned Text MessageSystem ServicesUser InteractionRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsDelete FileExecuteSleepUninstallUpload FileShutdownDownload FileMSDTCExecutionArchive Collected DataAutomated ExfiltrationEncoding- Standard EncodingEncryption- Standard EncryptionEncryption- Custom EncryptionEncodingEncoding- Custom EncodingEncryptionExfiltratevia File Hosting ServiceExfiltrationClipboard ModificationComponent FirmwareCompromise Data IntegrityData DestructionData Encrypted for ImpactDenial of ServiceDestroy HardwareDisk WipeExploit Kit BehaviorExploitationfor Client ExecutionGenerate FraudulentAdvertising RevenueManipulate Network TrafficModify HardwareRemote AccessResource HijackingSpammingRouter FirmwareEmpty Recycle BinDeleteApplication/SoftwareDelete Shadow CopiesRansom NoteRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsClick HijackingAdvertisementReplacement FraudMouseCDROMPrinterReverse ShellCryptojackingPassword CrackingImpactMalicious Network DriverRemote File CopySend EmailSend Poisoned Text MessageSupply Chain CompromiseExploit Private APIsAbuseEnterprise CertificatesLateral MovementDNS CommunicationFTP CommunicationHTTP CommunicationICMP CommunicationInterprocess CommunicationSMTP CommunicationSocket CommunicationWinINetResolveTLD::DNS CommunicationDDNS Domain Connect::DNSCommunicationResolve Free HostingDomain::DNS CommunicationResolve::DNSCommunicationServer Connect::DNSCommunicationSendFile::FTP CommunicationWinINet::FTPCommunicationClient::HTTPCommunicationConnect to Server::HTTPCommunicationGet Response::HTTPCommunicationSend Request::HTTPCommunicationOpenURL::HTTP CommunicationWinINet::HTTPCommunicationReceive Request::HTTPCommunicationSet Header::HTTPCommunicationSendData::HTTP CommunicationIWebBrowser::HTTPCommunicationSend Response::HTTPCommunicationCreate Request::HTTPCommunicationServer::HTTPCommunicationExtractBody::HTTP CommunicationRead Header::HTTPCommunicationWinHTTP::HTTPCommunicationStart Server::HTTPCommunicationDownloadURL::HTTP CommunicationEcho Request::ICMPCommunicationGenerate Traffic::ICMPCommunicationCreate Pipe::InterprocessCommunicationRead Pipe::InterprocessCommunicationWrite Pipe::InterprocessCommunicationConnect Pipe::InterprocessCommunicationRequest::SMTPCommunicationServer Connect::SMTPCommunicationSend UDP Data::SocketCommunicationReceive TCP Data::SocketCommunicationStart TCP Server::SocketCommunicationReceive Data::SocketCommunicationUDP Client::SocketCommunicationGet Socket Status::SocketCommunicationReceive UDP Data::SocketCommunicationSend Data::SocketCommunicationSend TCP Data::SocketCommunicationInitialize WinsockLibrary::Socket CommunicationTCP Client::SocketCommunicationConnect Socket::SocketCommunicationCreate TCP Socket::SocketCommunicationCreate Socket::SocketCommunicationSet Socket Config::SocketCommunicationCreate UDP Socket::SocketCommunicationTCP Server::SocketCommunicationInternetOpen::WinINetInternetOpenURL::WinINetInternetWriteFile::WinINetInternetReadFile::WinINetInternetConnect::WinINetCommunicationMicro-objectiveCrypto LibraryCryptographic HashDecrypt DataEncrypt DataEncryption KeyGeneratePseudo-random SequenceHashedMessage Authentication CodeSHA1::Cryptographic HashSHA256::CryptographicHashSHA224::CryptographicHashMD5::Cryptographic HashSnefru::CryptographicHashTiger::Cryptographic HashTwofish::Decrypt DataSkipjack::Decrypt DataBlowfish::Decrypt DataHC-128::Decrypt DataAES::Decrypt DataRC4::Decrypt DataStreamCipher::Decrypt DataBlockCipher::Decrypt DataCamellia::Decrypt DataHC-256::Decrypt Data3DES::Decrypt DataSosemanuk::Decrypt DataRC6::Decrypt DataRSA::Decrypt DataRSA::Encrypt DataBlockCipher::Encrypt DataAES::Encrypt DataStreamCipher::Encrypt DataRC6::Encrypt DataCamellia::Encrypt DataHC-256::Encrypt DataTwofish::Encrypt DataBlowfish::Encrypt DataHC-128::Encrypt DataSkipjack::Encrypt DataRC4::Encrypt Data3DES::Encrypt DataSosemanuk::Encrypt DataImport PublicKey::Encryption KeyRC4 KSA::Encryption KeyGetTickCount::GeneratePseudo-random SequenceMersenne Twister::GeneratePseudo-random SequenceUse API::GeneratePseudo-random Sequencerand::GeneratePseudo-random SequenceRC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveCheck StringChecksumCompress DataCompression LibraryDecode DataDecompress DataEncode DataModuloNon-Cryptographic HashUse ConstantBSD::ChecksumLuhn::ChecksumCRC32::ChecksumAdler::ChecksumVerhoeff::ChecksumQuickLZ::Compress DataIEncodingFilterFactory::CompressDataBase64::Decode DataXOR::Decode DataaPLib::Decompress DataIEncodingFilterFactory::DecompressDataQuickLZ::Decompress DataXOR::Encode DataBase64::Encode DataFast-Hash::Non-CryptographicHashMurmurHash::Non-CryptographicHashdhash::Non-CryptographicHashpHash::Non-CryptographicHashFNV::Non-CryptographicHashData Micro-objectiveAlter File ExtensionCopy FileCreate DirectoryCreate FileDelete DirectoryDelete FileGet File AttributesMove FileRead FileRead Virtual DiskSet File AttributesWrites FileAppend Extension::AlterFile ExtensionCreate OfficeDocument::Create FileCreate RansomwareFile::Create FileFile System Micro-objectiveInstall DriverLoad DriverSimulate HardwareMinifilter::InstallDriverMinifilter::Load DriverMouseClick::Simulate HardwareCtrl-Alt-Del::SimulateHardwareHardware Micro-objectiveAllocate MemoryChange Memory ProtectionFree MemoryHeap SprayOverflow BufferStack PivotExecutable Stack::ChangeMemory ProtectionExecutable Heap::ChangeMemory ProtectionMemory Micro-objectiveConsoleEnvironment VariableRegistryWallpaperGet Variable::EnvironmentVariableSet Variable::EnvironmentVariableCreateRegistry Key::RegistryDeleteRegistry Key::RegistrySetRegistry Key::RegistryQueryRegistry Key::RegistryDeleteRegistry Value::RegistryOpenRegistry Key::RegistryQueryRegistry Value::RegistryOperatingSystem Micro-objectiveAllocateThread Local StorageCheck MutexCreate MutexCreate ProcessCreate ThreadEnumerate ThreadsOpen ProcessOpen ThreadResume ThreadSetThread Local Storage ValueSuspend ThreadSynchronizationTerminate ProcessTerminate ThreadCreate Process viaShellcode::Create ProcessCreate SuspendedProcess::Create ProcessCreate Processvia WMI::Create ProcessCreateMutex::SynchronizationProcess Micro-objectiveBootkitComponent FirmwareHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingInstall Insecureor Malicious ConfigurationKernelModules and ExtensionsMalicious Network DriverModify Existing ServiceModify RegistryRegistryRun Keys / Startup FolderRemote AccessRemote File CopyShutdown EventRouter FirmwareHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverReverse ShellPersistenceHijack Execution FlowHookingKernelModules and ExtensionsModify Existing ServiceProcess InjectionImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsPrivilege Escalation \ No newline at end of file +Capture EvasionConditional ExecutionDebugger DetectionDebugger EvasionDynamic Analysis EvasionEmulator DetectionEmulator EvasionExecutableCode VirtualizationHookingMemory Dump EvasionSandbox DetectionSoftware PackingVirtual Machine DetectionMultipleStages of LoadersMemory-only PayloadEncrypted PayloadsRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckCloseHandleWudfIsAnyDebuggerPresentSoftware BreakpointsTIB AwareTiming/Delay CheckSetHandleInformationInterrupt 1TLS CallbacksParent ProcessMemory BreakpointsStack CanaryTiming/Delay CheckQueryPerformanceCounterTiming/DelayCheck GetTickCountInterrupt 0x2dPage ExceptionBreakpoint DetectionAnti-debuggingInstructionsNtYieldExecution/SwitchToThreadProcessHeapProcess EnvironmentBlock IsDebuggedAPI Hook DetectionDebugger ArtifactsNtQueryInformationProcessSeDebugPrivilegeOutputDebugStringIsDebuggerPresentRtlAdjustPrivilegeMemory Write WatchingProcess EnvironmentBlock NtGlobalFlagCheckRemoteDebuggerPresentHardware BreakpointsNtSetInformationThreadNtQueryObjectUnhandledExceptionFilterMonitoring ThreadProcess JobsProcess EnvironmentBlock BeingDebuggedProcess Environment BlockHook InterruptSelf-UnmappingGet Base IndirectlyCode Integrity CheckSelf-DebuggingChange SizeOfImageMalloc UseStatic LinkingUse InterruptsReturn ObfuscationByte StealingInliningPre-DebugThread TimeoutSection MisalignmentTamperingPipeline MisdirectionBreak Point ClearingGuard PagesRelocate API CodeException MisdirectionRtlAdjustPrivilegeLoop EscapesModify PE HeaderNanomitesParallel ThreadsBlock InterruptsObfuscate Library UseStolen API CodeImport ObfuscationHook File SystemAlternative ntdll.dllIllusionDemo ModeHook InterruptDelayed ExecutionData FloodEncode FileRestartDrop CodeCheck Emulator-relatedRegistry KeysCheck forEmulator-related FilesFailedNetwork ConnectionsCheck for WINE VersionExtra Loops/Time LocksDifferent Opcode SetsUndocumented OpcodesUnusual/UndocumentedAPI CallsMultiple VMsProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingHook memory mapping APIsCode Encryption in MemoryHide virtual memoryTamperingErase the PE headerSizeOfImagePatchMmGetPhysicalMemoryRangesGuard PagesFeed MisinformationFlow Opcode ObstructionOn-the-Fly APIsScreen Resolution TestingSelf CheckTiming/Date CheckProduct Key/ID TestingTiming/Uptime CheckCheck Clipboard DataHuman User CheckCheck FilesInjected DLL TestingConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXCheck WindowsModern SpecsCheck - Processor countCheck Registry KeysCheck Running ServicesInstructionTesting - CPUIDCheckWindows - Window sizeHuman User CheckModern SpecsCheck - Keyboard layoutHTML5Performance Object CheckCheckWindows - Unique windowsModernSpecs Check - USB driveInstructionTesting - VPCEXTInstruction TestingInstructionTesting - RDTSCCheckNamed System ObjectsInstructionTesting - VMCPUIDModernSpecs Check - PrinterModern Specs CheckInstructionTesting - SIDT (red pill)Check SoftwareCheckWindows - Title barsInstructionTesting - SMSWInstruction Testing - STRUnique Hardware/FirmwareCheck - CPU LocationInstruction Testing- SGDT/SLDT (no pill)Guest Process TestingCheck Fileand Directory ArtifactsUnique Hardware/FirmwareCheck - I/O Communication PortCheck ProcessesInstruction Testing - INCheck Virtual DevicesUnique Hardware/FirmwareCheck - CPU NameUnique Hardware/FirmwareCheck - BIOSModernSpecs Check - Drive sizeCheck Memory ArtifactsUnique Hardware/FirmwareCheck - MAC AddressModern Specs Check- Total physical memoryUniqueHardware/Firmware CheckAnti-Behavioral AnalysisCallGraph Generation EvasionData Flow Analysis EvasionDisassembler EvasionExecutable Code ObfuscationExecutableCode OptimizationExecutableCode VirtualizationObfuscatedFiles or InformationSoftware PackingTwo-layer Function ReturnInvoke NTDLL SystemCalls via Encoded TableControl DependenceImplicit FlowsArbitraryMemory CorruptionArgument ObfuscationConditional MisdirectionVBA StompingVariable RecompositionValue Dependent JumpsAPI HashingStack StringsCode InsertionDead Code InsertionData Value ObfuscationInterleaving CodeJump InsertionFake Code InsertionEntry Point ObfuscationJunk Code InsertionImportAddress Table ObfuscationMerged Code SectionsImport CompressionSymbol ObfuscationStructuredException Handling (SEH)Instruction OverlapThunk Code InsertionGuard PagesMinificationJump/CallAbsolute AddressMultiple VMsEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXAnti-Static AnalysisCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICollectionC2 CommunicationDomain Name GenerationRemote File CopyDirectory ListingRequest Email TemplateRequest CommandRequestEmail Address ListSend DataSend HeartbeatExecute Shell CommandReceive DataStart Interactive ShellImplant toController File TransferServerto Client File TransferExecute FileSend System InformationAuthenticateCheck for PayloadFile searchCommand and ControlCryptocurrencyHookingInput CaptureKeyloggingScreen CaptureBitcoinEthereumZcashProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingMouse EventsApplication HookPollingWinAPICredential AccessAlternativeInstallation LocationBootkitBypassData Execution PreventionComponent FirmwareConditional ExecutionCovert LocationDisableor Evade Security ToolsHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingIndicator BlockingInstall Insecureor Malicious ConfigurationModify RegistryObfuscatedFiles or InformationPolymorphic CodeProcess InjectionRootkitSelf DeletionSoftware PackingRegistry InstallFileless MalwareROP ChainsRouter FirmwareRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckHide Data in RegistrySteganographyHeavens GateModify PolicyAMSI BypassDisable Code IntegrityDisableKernel Patch ProtectionDisable SystemFile Overwrite ProtectionBypassWindows File ProtectionForce Lazy WritingUnhook APIsHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingRemoveSMS Warning MessagesEncryption of DataEncryption-CustomAlgorithmEncodingEncryption of CodeEncryption-StandardAlgorithmEncryptionEncoding-Custom AlgorithmEncoding-StandardAlgorithmPacker StubCode ReorderingCall IndirectionsPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsHypervisor/VirtualizedRootkitHardware/Firmware RootkitApplication RootkitMemory RootkitKernel Mode RootkitBootloaderCOMSPECEnvironment VariableConfuserCustom CompressionCustomCompression of DataVMProtectThemidaNested PackingStandardCompression of DataStandardCompression of CodeArmadilloASPackStandard CompressionCustomCompression of CodeUPXDefense EvasionAnalysis Tool DiscoveryApplicationWindow DiscoveryCode DiscoveryFileand Directory DiscoverySelf DiscoverySMTP Connection DiscoverySystemInformation DiscoveryTaskbar DiscoveryProcessdetection - DebuggersProcess detection- PCAP UtilitiesProcess detection- Process UtilitiesProcess detection -SysInternals Suite ToolsProcessdetection - PE UtilitiesProcess detectionKnown File LocationKnown WindowProcessdetection - SandboxesWindow TextEnumerate PE SectionsParse PE HeaderInspect SectionMemory PermissionsLog FileGenerateWindows ExceptionDiscoveryCommandand Scripting InterpreterConditional ExecutionExecution DependencyExploitationfor Client ExecutionInstall Additional ProgramPreventConcurrent ExecutionRemote CommandsSend EmailSend Poisoned Text MessageSystem ServicesUser InteractionRuns as ServiceEnvironmental KeysSuicide ExitGetVolumeInformationSecure TriggersDeposited KeysHost Fingerprint CheckToken CheckRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsDelete FileExecuteSleepUninstallUpload FileShutdownDownload FileMSDTCExecutionArchive Collected DataAutomated ExfiltrationEncoding- Standard EncodingEncryption- Standard EncryptionEncryption- Custom EncryptionEncodingEncoding- Custom EncodingEncryptionExfiltratevia File Hosting ServiceExfiltrationClipboard ModificationComponent FirmwareCompromise Data IntegrityData DestructionData Encrypted for ImpactDenial of ServiceDestroy HardwareDisk WipeExploit Kit BehaviorExploitationfor Client ExecutionGenerate FraudulentAdvertising RevenueManipulate Network TrafficModify HardwareRemote AccessResource HijackingSpammingRouter FirmwareEmpty Recycle BinDeleteApplication/SoftwareDelete Shadow CopiesRansom NoteRemoteDesktop Protocols (RDP)SysinternalsFile TransferProtocol (FTP) ServersJava-based Web ServersWindows UtilitiesRed HatJBoss Enterprise ProductsClick HijackingAdvertisementReplacement FraudMouseCDROMPrinterReverse ShellCryptojackingPassword CrackingImpactMalicious Network DriverRemote File CopySend EmailSend Poisoned Text MessageSupply Chain CompromiseExploit Private APIsAbuseEnterprise CertificatesLateral MovementDNS CommunicationFTP CommunicationHTTP CommunicationICMP CommunicationInterprocess CommunicationSMTP CommunicationSocket CommunicationWinINetResolveTLD::DNS CommunicationDDNS Domain Connect::DNSCommunicationResolve Free HostingDomain::DNS CommunicationResolve::DNSCommunicationServer Connect::DNSCommunicationSendFile::FTP CommunicationWinINet::FTPCommunicationClient::HTTPCommunicationConnect to Server::HTTPCommunicationGet Response::HTTPCommunicationSend Request::HTTPCommunicationOpenURL::HTTP CommunicationWinINet::HTTPCommunicationReceive Request::HTTPCommunicationSet Header::HTTPCommunicationSendData::HTTP CommunicationIWebBrowser::HTTPCommunicationSend Response::HTTPCommunicationCreate Request::HTTPCommunicationServer::HTTPCommunicationExtractBody::HTTP CommunicationRead Header::HTTPCommunicationWinHTTP::HTTPCommunicationStart Server::HTTPCommunicationDownloadURL::HTTP CommunicationEcho Request::ICMPCommunicationGenerate Traffic::ICMPCommunicationCreate Pipe::InterprocessCommunicationRead Pipe::InterprocessCommunicationWrite Pipe::InterprocessCommunicationConnect Pipe::InterprocessCommunicationRequest::SMTPCommunicationServer Connect::SMTPCommunicationSend UDP Data::SocketCommunicationReceive TCP Data::SocketCommunicationStart TCP Server::SocketCommunicationReceive Data::SocketCommunicationUDP Client::SocketCommunicationGet Socket Status::SocketCommunicationReceive UDP Data::SocketCommunicationSend Data::SocketCommunicationSend TCP Data::SocketCommunicationInitialize WinsockLibrary::Socket CommunicationTCP Client::SocketCommunicationConnect Socket::SocketCommunicationCreate TCP Socket::SocketCommunicationCreate Socket::SocketCommunicationSet Socket Config::SocketCommunicationCreate UDP Socket::SocketCommunicationTCP Server::SocketCommunicationInternetOpen::WinINetInternetOpenURL::WinINetInternetWriteFile::WinINetInternetReadFile::WinINetInternetConnect::WinINetCommunicationMicro-objectiveCrypto LibraryCryptographic HashDecrypt DataEncrypt DataEncryption KeyGeneratePseudo-random SequenceHashedMessage Authentication CodeSHA1::Cryptographic HashSHA256::CryptographicHashSHA224::CryptographicHashMD5::Cryptographic HashSnefru::CryptographicHashTiger::Cryptographic HashTwofish::Decrypt DataSkipjack::Decrypt DataBlowfish::Decrypt DataHC-128::Decrypt DataAES::Decrypt DataRC4::Decrypt DataStreamCipher::Decrypt DataBlockCipher::Decrypt DataCamellia::Decrypt DataHC-256::Decrypt Data3DES::Decrypt DataSosemanuk::Decrypt DataRC6::Decrypt DataRSA::Decrypt DataRSA::Encrypt DataBlockCipher::Encrypt DataAES::Encrypt DataStreamCipher::Encrypt DataRC6::Encrypt DataCamellia::Encrypt DataHC-256::Encrypt DataTwofish::Encrypt DataBlowfish::Encrypt DataHC-128::Encrypt DataSkipjack::Encrypt DataRC4::Encrypt Data3DES::Encrypt DataSosemanuk::Encrypt DataImport PublicKey::Encryption KeyRC4 KSA::Encryption KeyGetTickCount::GeneratePseudo-random SequenceMersenne Twister::GeneratePseudo-random SequenceUse API::GeneratePseudo-random Sequencerand::GeneratePseudo-random SequenceRC4 PRGA::GeneratePseudo-random SequenceCryptographyMicro-objectiveCheck StringChecksumCompress DataCompression LibraryDecode DataDecompress DataEncode DataModuloNon-Cryptographic HashUse ConstantBSD::ChecksumLuhn::ChecksumCRC32::ChecksumAdler::ChecksumVerhoeff::ChecksumQuickLZ::Compress DataIEncodingFilterFactory::CompressDataBase64::Decode DataXOR::Decode DataaPLib::Decompress DataIEncodingFilterFactory::DecompressDataQuickLZ::Decompress DataXOR::Encode DataBase64::Encode DataFast-Hash::Non-CryptographicHashMurmurHash::Non-CryptographicHashdhash::Non-CryptographicHashpHash::Non-CryptographicHashFNV::Non-CryptographicHashData Micro-objectiveAlter File ExtensionCopy FileCreate DirectoryCreate FileDelete DirectoryDelete FileGet File AttributesMove FileRead FileRead Virtual DiskSet File AttributesWrites FileAppend Extension::AlterFile ExtensionCreate OfficeDocument::Create FileCreate RansomwareFile::Create FileFile System Micro-objectiveInstall DriverLoad DriverSimulate HardwareMinifilter::InstallDriverMinifilter::Load DriverMouseClick::Simulate HardwareCtrl-Alt-Del::SimulateHardwareHardware Micro-objectiveAllocate MemoryChange Memory ProtectionFree MemoryHeap SprayOverflow BufferStack PivotExecutable Stack::ChangeMemory ProtectionExecutable Heap::ChangeMemory ProtectionMemory Micro-objectiveConsoleEnvironment VariableRegistryWallpaperGet Variable::EnvironmentVariableSet Variable::EnvironmentVariableCreateRegistry Key::RegistryDeleteRegistry Key::RegistrySetRegistry Key::RegistryQueryRegistry Key::RegistryDeleteRegistry Value::RegistryOpenRegistry Key::RegistryQueryRegistry Value::RegistryOperatingSystem Micro-objectiveAllocateThread Local StorageCheck MutexCreate MutexCreate ProcessCreate ThreadEnumerate ThreadsOpen ProcessOpen ThreadResume ThreadSetThread Local Storage ValueSuspend ThreadSynchronizationTerminate ProcessTerminate ThreadCreate Process viaShellcode::Create ProcessCreate SuspendedProcess::Create ProcessCreate Processvia WMI::Create ProcessCreateMutex::SynchronizationProcess Micro-objectiveBootkitComponent FirmwareHidden ArtifactsHiddenFiles and DirectoriesHijack Execution FlowHookingInstall Insecureor Malicious ConfigurationKernelModules and ExtensionsMalicious Network DriverModify Existing ServiceModify RegistryRegistryRun Keys / Startup FolderRemote AccessRemote File CopyShutdown EventRouter FirmwareHiddenUserspace LibrariesHidden ServicesHidden Kernel ModulesHidden ProcessesDirect KernelObject ManipulationLocationTimestampExtensionAttributeImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverReverse ShellPersistenceHijack Execution FlowHookingKernelModules and ExtensionsModify Existing ServiceProcess InjectionImport AddressTable (IAT) HookingAbuseWindows Function CallsSystem ServiceDispatch Table HookingExport AddressTable (EAT) HookingInline PatchingShadow System ServiceDispatch Table HookingProcedure HookingShadow SDT HookingImport AddressTable (IAT) HookingInline PatchingExport AddressTable (EAT) HookingSystem ServiceDispatch Table HookingDevice DriverPatchProcess Command LineHook Injectionvia SetWindowsHooksExInjectionvia Windows FibersInjection and Persistencevia Registry ModificationInjection using ShimsPrivilege Escalation \ No newline at end of file