admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adding CAPE mappings to detection section (#132)

Browse Source 
* Making spacing between sections consistent

* Adding cape mappings
This commit is contained in:
Ryan Xu
2023-12-05 14:19:50 -05:00
committed by GitHub
parent 463eef29c1
commit d423b5a5fa
166 changed files with 1273 additions and 356 deletions
Download Patch File Download Diff File Expand all files Collapse all files
anti-behavioral-analysis/capture-evasion.md
-1
View File
@@ -51,7 +51,6 @@ Malware has characteristics enabling it to evade capture from the infected syste
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.001|The malware downloads multiple payloads (as files and DLLs) that are stored in a memory buffer. [[4]](#4)|
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.003|Matanbuchus consists of 2 loaders. [[3]](#3) [[4]](#4)|
## References
<a name="1">[1]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
anti-behavioral-analysis/debugger-detection.md
+27 -10
View File
@@ -41,7 +41,6 @@ While many methods are listed in the table below, among the most commonly used a
Details on detecting debuggers can be found in the references.
## Methods
|Name|ID|Description|
@@ -110,23 +109,41 @@ Details on detecting debuggers can be found in the references.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[check for trap flag exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml)|Debugger Detection (B0001)| |
|[check for software breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml)|Debugger Detection::Software Breakpoints (B0001.025)| |
|[check for trap flag exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml)|Debugger Detection (B0001)|--|
|[check for software breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml)|Debugger Detection::Software Breakpoints (B0001.025)|--|
|[check process job object](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml)|Debugger Detection (B0001)|kernel32.QueryInformationJobObject, kernel32.OpenProcess|
|[check for PEB BeingDebugged flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml)|Debugger Detection::Process Environment Block BeingDebugged (B0001.035)| |
|[check for time delay via GetTickCount](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)| |
|[check for PEB BeingDebugged flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml)|Debugger Detection::Process Environment Block BeingDebugged (B0001.035)|--|
|[check for time delay via GetTickCount](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|--|
|[check for protected handle exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml)|Debugger Detection::SetHandleInformation (B0001.024)|SetHandleInformation, CloseHandle|
|[check for OutputDebugString error](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml)|Debugger Detection::OutputDebugString (B0001.016)|kernel32.SetLastError, kernel32.GetLastError, kernel32.OutputDebugString|
|[check for unexpected memory writes](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml)|Debugger Detection::Memory Write Watching (B0001.010)|kernel32.GetWriteWatch|
|[check for kernel debugger via shared user data structure](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml)|Debugger Detection (B0001)| |
|[check for time delay via QueryPerformanceCounter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml)|Debugger Detection::Timing/Delay Check QueryPerformanceCounter (B0001.033)| |
|[check for kernel debugger via shared user data structure](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml)|Debugger Detection (B0001)|--|
|[check for time delay via QueryPerformanceCounter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml)|Debugger Detection::Timing/Delay Check QueryPerformanceCounter (B0001.033)|--|
|[check for hardware breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml)|Debugger Detection::Hardware Breakpoints (B0001.005)|kernel32.GetThreadContext|
|[check ProcessDebugPort](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml)|Debugger Detection::NtQueryInformationProcess (B0001.012)|NtQueryInformationProcess|
|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::CheckRemoteDebuggerPresent (B0001.002)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent|
|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::WudfIsAnyDebuggerPresent (B0001.031)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent|
|[check for PEB NtGlobalFlag flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml)|Debugger Detection::Process Environment Block NtGlobalFlag (B0001.036)| |
|[execute anti-debugging instructions](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml)|Debugger Detection::Anti-debugging Instructions (B0001.034)| |
|[PEB access](https://github.com/mandiant/capa-rules/blob/master/lib/peb-access.yml)|Debugger Detection::Process Environment Block (B0001.019)| |
|[check for PEB NtGlobalFlag flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml)|Debugger Detection::Process Environment Block NtGlobalFlag (B0001.036)|--|
|[execute anti-debugging instructions](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml)|Debugger Detection::Anti-debugging Instructions (B0001.034)|--|
|[PEB access](https://github.com/mandiant/capa-rules/blob/master/lib/peb-access.yml)|Debugger Detection::Process Environment Block (B0001.019)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antidebug_checkremotedebuggerpresent](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_checkremotedebuggerpresent.py)|Debugger Detection (B0001)|CheckRemoteDebuggerPresent, NtQueryInformationProcess|
|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection (B0001)|LdrGetDllHandle, LdrLoadDll|
|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection::API Hook Detection (B0001.001)|LdrGetDllHandle, LdrLoadDll|
|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection (B0001)|SetUnhandledExceptionFilter|
|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection::UnhandledExceptionFilter (B0001.030)|SetUnhandledExceptionFilter|
|[antidebug_addvectoredexceptionhandler](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_addvectoredexceptionhandler.py)|Debugger Detection (B0001)|AddVectoredExceptionHandler|
|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection (B0001)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection::OutputDebugString (B0001.016)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA|
|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection (B0001)|GetTickCount|
|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|GetTickCount|
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection (B0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection::Memory Breakpoints (B0001.009)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection (B0001)|NtSetInformationThread|
|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection::NtSetInformationThread (B0001.014)|NtSetInformationThread|
|[antidebug_debugactiveprocess](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_debugactiveprocess.py)|Debugger Detection (B0001)|DebugActiveProcess|
## References
anti-behavioral-analysis/debugger-evasion.md
+8
View File
@@ -89,6 +89,14 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
|[hide thread from debugger](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml)|Debugger Evasion (B0002)|NtSetInformationThread, ZwSetInformationThread, GetCurrentThread|
|[switch active desktop](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/switch-active-desktop.yml)|Debugger Evasion (B0002)|user32.CreateDesktop, user32.SwitchDesktop|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion (B0002)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion::Guard Pages (B0002.008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Debugger Evasion (B0002)|NtCreateThreadEx|
|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion (B0002)|CreateProcessInternalW|
|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion::Self-Debugging (B0002.024)|CreateProcessInternalW|
## References
<a name="1">[1]</a> https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf
anti-behavioral-analysis/dynamic-analysis-evasion.md
+12
View File
@@ -73,6 +73,18 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|---|---|---|
|[delay execution](https://github.com/mandiant/capa-rules/blob/master/lib/delay-execution.yml)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|kernel32.Sleep, kernel32.SleepEx, kernel32.WaitForSingleObject, kernel32.SignalObjectAndWait, kernel32.WaitForSingleObjectEx, kernel32.WaitForMultipleObjects, kernel32.WaitForMultipleObjectsEx, kernel32.RegisterWaitForSingleObject, WaitOnAddress, user32.MsgWaitForMultipleObjects, user32.MsgWaitForMultipleObjectsEx, NtDelayExecution, KeWaitForSingleObject, KeDelayExecutionThread, sleep, usleep|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion (B0003)|--|
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Data Flood (B0003.002)|--|
|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|--|
|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Dynamic Analysis Evasion (B0003)|NtSuspendThread|
|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion (B0003)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion::Restart (B0003.010)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem|
|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion (B0003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime|
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Dynamic Analysis Evasion (B0003)|--|
## References
<a name="1">[1]</a> https://www.joesecurity.org/blog/4310408827727907098
anti-behavioral-analysis/emulator-detection.md
+8
View File
@@ -55,6 +55,14 @@ Detects whether the malware instance is being executed inside an emulator. If so
|---|---|---|
|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0004)|GetModuleHandle, GetProcAddress|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antiemu_windefend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_windefend.py)|Emulator Detection (B0004)|--|
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection (B0004)|--|
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
|[antiemu_wine_func](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_func.py)|Emulator Detection (B0004)|LdrGetProcedureAddress|
|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection (B0004)|--|
|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--|
## References
anti-behavioral-analysis/memory-dump-evasion.md
-1
View File
@@ -55,7 +55,6 @@ Memory dump evasion is an anti-forensic technique in which malware hinders retri
|---|---|---|---|
|[**Kraken**](../xample-malware/kraken.md)|2008|--|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[4]](#4)|
## Code Snippets
### B0006.011 Snippet
anti-behavioral-analysis/sandbox-detection.md
+22 -3
View File
@@ -50,7 +50,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|**Timing/Uptime Check**|B0007.009|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.|
|**Test API Routines**|B0007.010|Calls Windows API routines with invalid arguments to identify error supression.|
## Use in Malware
|Name|Date|Method|Description|
@@ -63,7 +62,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value. [[8]](#8)|
|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a sandbox. [[9]](#9)|
## Detection
|Tool: capa|Mapping|APIs|
@@ -75,7 +73,28 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|---|---|---|
|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection (B0007)|--|
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection (B0007)|--|
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection (B0007)|NtDelayExecution|
|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection::Timing/Date Check (B0007.008)|NtDelayExecution|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection (B0007)|SetWindowsHookExA, SetWindowsHookExW|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection::Human User Check (B0007.003)|SetWindowsHookExA, SetWindowsHookExW|
|[antisandbox_foregroundwindows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_foregroundwindows.py)|Sandbox Detection (B0007)|GetForegroundWindow, NtDelayExecution|
|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_mutex.py)|Sandbox Detection (B0007)|--|
|[antisandbox_script_timer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_script_timer.py)|Sandbox Detection (B0007)|--|
|[antisandbox_sboxie_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
|[antisandbox_cuckoocrash](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoocrash.py)|Sandbox Detection (B0007)|--|
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection (B0007)|--|
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection (B0007)|--|
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection (B0007)|--|
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Sandbox Detection (B0007)|NtOpenDirectoryObject|
|[antisandbox_sunbelt_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll|
|[antisandbox_cuckoo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo.py)|Sandbox Detection (B0007)|--|
## Code Snippets
anti-behavioral-analysis/virtual-machine-detection.md
+73 -15
View File
@@ -86,7 +86,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|**Unique Hardware/Firmware Check - I/O Communication Port**|B0009.025|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware. This method is related to Unprotect technique U1336.|
|**Unique Hardware/Firmware Check - MAC Address**|B0009.028|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2) This method is related to Unprotect technique U1335.|
## Use in Malware
|Name|Date|Method|Description|
@@ -104,28 +103,88 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0009.004|The malware checks if there are virtual machine processes running (Vbox, vmware, etc). [[11]](#11)|
|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0009.012|The malware checks for an unmoving mouse cursor. [[12]](#12)|
## Detection
|Tool: capa|Mapping|APIs|
|---|---|---|
|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Virtual Machine Detection (B0009)|GetModuleHandle|
|[check for Windows sandbox via genuine state](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml)|Virtual Machine Detection (B0009)|SLIsGenuineLocal, UuidFromString|
|[reference anti-VM strings targeting Parallels](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml)|Virtual Machine Detection (B0009)| |
|[check for unmoving mouse cursor](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml)|Virtual Machine Detection::Human User Check (B0009.012)| |
|[reference anti-VM strings targeting VirtualPC](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml)|Virtual Machine Detection (B0009)| |
|[reference anti-VM strings targeting VMWare](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml)|Virtual Machine Detection (B0009)| |
|[reference anti-VM strings targeting Parallels](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml)|Virtual Machine Detection (B0009)|--|
|[check for unmoving mouse cursor](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml)|Virtual Machine Detection::Human User Check (B0009.012)|--|
|[reference anti-VM strings targeting VirtualPC](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml)|Virtual Machine Detection (B0009)|--|
|[reference anti-VM strings targeting VMWare](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml)|Virtual Machine Detection (B0009)|--|
|[check for foreground window switch](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml)|Virtual Machine Detection::Human User Check (B0009.012)|Sleep|
|[detect VM via disk hardware WMI queries](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml)|Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)| |
|[reference anti-VM strings targeting Qemu](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml)|Virtual Machine Detection (B0009)| |
|[reference anti-VM strings targeting Xen](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml)|Virtual Machine Detection (B0009)| |
|[check for sandbox username or hostname](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml)|Virtual Machine Detection (B0009)| |
|[check for Windows sandbox via process name](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml)|Virtual Machine Detection (B0009)| |
|[detect VM via disk hardware WMI queries](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml)|Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)|--|
|[reference anti-VM strings targeting Qemu](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml)|Virtual Machine Detection (B0009)|--|
|[reference anti-VM strings targeting Xen](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml)|Virtual Machine Detection (B0009)|--|
|[check for sandbox username or hostname](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml)|Virtual Machine Detection (B0009)|--|
|[check for Windows sandbox via process name](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml)|Virtual Machine Detection (B0009)|--|
|[check for Windows sandbox via dns suffix](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
|[check for Windows sandbox via device](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml)|Virtual Machine Detection (B0009)| |
|[reference anti-VM strings targeting VirtualBox](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml)|Virtual Machine Detection (B0009)| |
|[check for Windows sandbox via device](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml)|Virtual Machine Detection (B0009)|--|
|[reference anti-VM strings targeting VirtualBox](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml)|Virtual Machine Detection (B0009)|--|
|[check for Windows sandbox via registry](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml)|Virtual Machine Detection (B0009)|RegOpenKeyEx, RegEnumValue|
|[reference anti-VM strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml)|Virtual Machine Detection (B0009)| |
|[reference anti-VM strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml)|Virtual Machine Detection (B0009)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection (B0009)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection::Modern Specs Check - Drive size (B0009.015)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_mutex.py)|Virtual Machine Detection (B0009)|--|
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection (B0009)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|[antivm_network_adapters](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_network_adapters.py)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection (B0009)|--|
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection (B0009)|WNetGetProviderNameW|
|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|WNetGetProviderNameW|
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection (B0009)|--|
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--|
|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|Virtual Machine Detection (B0009)|NtOpenEvent, NtCreateEvent|
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection (B0009)|--|
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection (B0009)|SetWindowsHookExA, SetWindowsHookExW|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection::Human User Check (B0009.012)|SetWindowsHookExA, SetWindowsHookExW|
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection (B0009)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection (B0009)|--|
|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection (B0009)|--|
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection (B0009)|--|
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection (B0009)|--|
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll|
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll|
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection (B0009)|--|
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--|
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Running Services (B0009.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|Virtual Machine Detection (B0009)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Virtual Machine Detection (B0009)|NtOpenDirectoryObject|
|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--|
|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection (B0009)|--|
|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection::Check Windows (B0009.009)|--|
## Code Snippets
@@ -167,7 +226,6 @@ jmp short loc_401CBB
</pre>
</details>
## References
<a name="1">[1]</a> Check Point Research,"CP<r>: Evasion Techniques," evasions.checkpoint.com, [Online]. Available: https://evasions.checkpoint.com.
anti-static-analysis/disassembler-evasion.md
+1 -1
View File
@@ -55,7 +55,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
|Tool: capa|Mapping|APIs|
|---|---|---|
|[contain anti-disasm techniques](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml)|Disassembler Evasion (B0012)| |
|[contain anti-disasm techniques](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml)|Disassembler Evasion (B0012)|--|
## References
anti-static-analysis/executable-code-obfuscation.md
+12 -13
View File
@@ -79,19 +79,18 @@ For encryption and encoding characteristics of malware samples, as well as malwa
|Tool: capa|Mapping|APIs|
|---|---|---|
|[obfuscated with ADVobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with DeepSea Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with callobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with Dotfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with vs-obfuscation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-vs-obfuscation.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with Spices.Net Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with Babel Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with SmartAssembly](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-smartassembly.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with Yano](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-yano.yml)|Executable Code Obfuscation (B0032)| |
|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Argument Obfuscation (B0032.020)| |
|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Stack Strings (B0032.017)| |
|[use .NET library EncryptDecryptUtils](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml)|Executable Code Obfuscation (B0032)| |
|[obfuscated with ADVobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with DeepSea Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with callobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with Dotfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with vs-obfuscation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-vs-obfuscation.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with Spices.Net Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with Babel Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with SmartAssembly](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-smartassembly.yml)|Executable Code Obfuscation (B0032)|--|
|[obfuscated with Yano](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-yano.yml)|Executable Code Obfuscation (B0032)|--|
|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Argument Obfuscation (B0032.020)|--|
|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Stack Strings (B0032.017)|--|
|[use .NET library EncryptDecryptUtils](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml)|Executable Code Obfuscation (B0032)|--|
## Code Snippets
anti-static-analysis/software-packing.md
+47 -20
View File
@@ -68,27 +68,54 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
|Tool: capa|Mapping|APIs|
|---|---|---|
|[packed with pebundle](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pebundle/packed-with-pebundle.yml)|Software Packing (F0001)| |
|[packed with Themida](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/themida/packed-with-themida.yml)|Software Packing::Themida (F0001.011)| |
|[packed with VMProtect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml)|Software Packing::VMProtect (F0001.010)| |
|[packed with y0da crypter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml)|Software Packing (F0001)| |
|[packed with pelocknt](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml)|Software Packing (F0001)| |
|[packed with GoPacker](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/gopacker/packed-with-gopacker.yml)|Software Packing::Standard Compression (F0001.002)| |
|[packed with Confuser](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/confuser/packed-with-confuser.yml)|Software Packing::Confuser (F0001.009)| |
|[packed with rlpack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/rlpack/packed-with-rlpack.yml)|Software Packing (F0001)| |
|[packed with ASPack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/aspack/packed-with-aspack.yml)|Software Packing (F0001)| |
|[packed with generic packer](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/generic/packed-with-generic-packer.yml)|Software Packing::Standard Compression (F0001.002)| |
|[packed with amber](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/amber/packed-with-amber.yml)|Software Packing (F0001)| |
|[packed with petite](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/petite/packed-with-petite.yml)|Software Packing (F0001)| |
|[packed with peshield](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/peshield/packed-with-peshield.yml)|Software Packing (F0001)| |
|[packed with UPX](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upx/packed-with-upx.yml)|Software Packing::UPX (F0001.008)| |
|[packed with upack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upack/packed-with-upack.yml)|Software Packing (F0001)| |
|[packed with PECompact](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pecompact/packed-with-pecompact.yml)|Software Packing (F0001)| |
|[packed with Huan](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/huan/packed-with-huan.yml)|Software Packing (F0001)| |
|[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)| |
|[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)| |
|[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)| |
|[packed with pebundle](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pebundle/packed-with-pebundle.yml)|Software Packing (F0001)|--|
|[packed with Themida](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/themida/packed-with-themida.yml)|Software Packing::Themida (F0001.011)|--|
|[packed with VMProtect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml)|Software Packing::VMProtect (F0001.010)|--|
|[packed with y0da crypter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml)|Software Packing (F0001)|--|
|[packed with pelocknt](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml)|Software Packing (F0001)|--|
|[packed with GoPacker](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/gopacker/packed-with-gopacker.yml)|Software Packing::Standard Compression (F0001.002)|--|
|[packed with Confuser](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/confuser/packed-with-confuser.yml)|Software Packing::Confuser (F0001.009)|--|
|[packed with rlpack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/rlpack/packed-with-rlpack.yml)|Software Packing (F0001)|--|
|[packed with ASPack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/aspack/packed-with-aspack.yml)|Software Packing (F0001)|--|
|[packed with generic packer](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/generic/packed-with-generic-packer.yml)|Software Packing::Standard Compression (F0001.002)|--|
|[packed with amber](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/amber/packed-with-amber.yml)|Software Packing (F0001)|--|
|[packed with petite](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/petite/packed-with-petite.yml)|Software Packing (F0001)|--|
|[packed with peshield](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/peshield/packed-with-peshield.yml)|Software Packing (F0001)|--|
|[packed with UPX](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upx/packed-with-upx.yml)|Software Packing::UPX (F0001.008)|--|
|[packed with upack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upack/packed-with-upack.yml)|Software Packing (F0001)|--|
|[packed with PECompact](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pecompact/packed-with-pecompact.yml)|Software Packing (F0001)|--|
|[packed with Huan](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/huan/packed-with-huan.yml)|Software Packing (F0001)|--|
|[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)|--|
|[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)|--|
|[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[packer_nspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nspack.py)|Software Packing (F0001)|--|
|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing (F0001)|--|
|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing::VMProtect (F0001.010)|--|
|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing (F0001)|--|
|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing::Confuser (F0001.009)|--|
|[packer_smartassembly](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_smartassembly.py)|Software Packing (F0001)|--|
|[packer_mpress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_mpress.py)|Software Packing (F0001)|--|
|[packer_enigma](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_enigma.py)|Software Packing (F0001)|--|
|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Software Packing (F0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|[packer_aspirecrypt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspirecrypt.py)|Software Packing (F0001)|--|
|[packer_nate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nate.py)|Software Packing (F0001)|--|
|[packer_entropy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_entropy.py)|Software Packing (F0001)|--|
|[packer_unknown_pe_section_name](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_unknown_pe_section_name.py)|Software Packing (F0001)|--|
|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing (F0001)|--|
|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing::UPX (F0001.008)|--|
|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing (F0001)|--|
|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing::ASPack (F0001.013)|--|
|[packer_bedsprotector](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_bedsprotector.py)|Software Packing (F0001)|--|
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|FindWindowA|
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|FindWindowA|
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|--|
|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|--|
|[packer_spices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_spices.py)|Software Packing (F0001)|--|
|[packer_yoda](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_yoda.py)|Software Packing (F0001)|--|
|[packer_titan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_titan.py)|Software Packing (F0001)|--|
## References
capa.md
-1
View File
@@ -54,7 +54,6 @@ The histograms below show the number of capa rules mapped into ATT&CK techniques
|**Operating System**|11| **XXXXXXXXXXX** |
|**Process**|14| **XXXXXXXXXXXXXX** |
## ATT&CK MAPPINGS ##
### Reconnaissance ###
cape.md
-1
View File
@@ -90,7 +90,6 @@ This histogram indicates the number of CAPE signatures that map to an MBC micro-
|**Process**|72| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
|**Operating System**|94| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
## ATT&CK MAPPINGS ##
### Reconnaissance ###
collection/cryptocurrency.md
+7
View File
@@ -43,6 +43,13 @@ Malware accesses files that contain sensitive data or credentials related to Bit
|---|---|---|---|
|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency (B0028)|--|
|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency::Bitcoin (B0028.001)|--|
## References
<a name="1">[1]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
collection/input-capture.md
+7 -1
View File
@@ -52,7 +52,13 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
|Tool: capa|Mapping|APIs|
|---|---|---|
|[use .NET library SharpClipboard](https://github.com/mandiant/capa-rules/blob/master/collection/use-dotnet-library-sharpclipboard.yml)|Input Capture (E1056)| |
|[use .NET library SharpClipboard](https://github.com/mandiant/capa-rules/blob/master/collection/use-dotnet-library-sharpclipboard.yml)|Input Capture (E1056)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture (E1056)|SetWindowsHookExA, SetWindowsHookExW|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture::Mouse Events (E1056.m01)|SetWindowsHookExA, SetWindowsHookExW|
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Input Capture (E1056)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
## References
collection/keylogging.md
+7 -2
View File
@@ -39,7 +39,6 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
|**Application Hook**|F0002.001|Keystrokes are captured with an application hook.|
|**Polling**|F0002.002|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).|
## Use in Malware
|Name|Date|Method|Description|
@@ -63,7 +62,13 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
|Tool: capa|Mapping|APIs|
|---|---|---|
|[log keystrokes via polling](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-polling.yml)|Keylogging::Polling (F0002.002)|user32.GetAsyncKeyState, user32.GetKeyState, user32.GetKeyboardState, user32.VkKeyScan, user32.VkKeyScanEx, user32.GetKeyNameText|
|[log keystrokes via application hook](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-application-hook.yml)|Keylogging::Application Hook (F0002.001)| |
|[log keystrokes via application hook](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-application-hook.yml)|Keylogging::Application Hook (F0002.001)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging (F0002)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging::Application Hook (F0002.001)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Keylogging (F0002)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
## References
collection/screen-capture.md
+6 -2
View File
@@ -38,7 +38,6 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
|---|---|---|
|**WinAPI**|E1113.m01|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).|
## Use in Malware
|Name|Date|Method|Description|
@@ -56,7 +55,12 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
|Tool: capa|Mapping|APIs|
|---|---|---|
|[capture screenshot](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot.yml)|Screen Capture::WinAPI (E1113.m01)|user32.GetWindowDC, user32.GetDC, gdi32.CreateDC, gdi32.BitBlt, gdi32.GetDIBits, gdi32.CreateCompatibleDC, gdi32.CreateCompatibleBitmap, user32.GetSystemMetrics = fetch screen dimensions, user32.GetDesktopWindow = get entire desktop, BitBlt, System.Drawing.Graphics::CopyFromScreen|
|[capture screenshot via keybd event](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot-via-keybd-event.yml)|Screen Capture (E1113)| |
|[capture screenshot via keybd event](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot-via-keybd-event.yml)|Screen Capture (E1113)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Screen Capture (E1113)|--|
|[captures_screenshot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/captures_screenshot.py)|Screen Capture (E1113)|LdrGetProcedureAddress, NtCreateFile|
## References
command-and-control/c2-communication.md
+25 -5
View File
@@ -55,7 +55,6 @@ As "server" and "client" are confusing terminology, we use the terms "controller
|**Server to Client File Transfer**|B0030.003|File is transferred from controller to implant.|
|**Start Interactive Shell**|B0030.016|Starts an interactive shell using a built-in program (e.g. cmd.exe, PowerShell, bash). This is often implemented with polling the network connection from the controller for text commands to redirect to the shell's stdin and polling the shell's stdout and stderr to redirect over the network to the controller. This differs from Execute Shell Command because the shell process runs across multiple iterations of the recv-command(s)-send-result loop.|
## Use in Malware
|Name|Date|Method|Description|
@@ -96,9 +95,31 @@ As "server" and "client" are confusing terminology, we use the terms "controller
|Tool: capa|Mapping|APIs|
|---|---|---|
|[send data](https://github.com/mandiant/capa-rules/blob/master/communication/send-data.yml)|C2 Communication::Send Data (B0030.001)| |
|[receive data](https://github.com/mandiant/capa-rules/blob/master/communication/receive-data.yml)|C2 Communication::Receive Data (B0030.002)| |
|[download and write a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/download-and-write-a-file.yml)|C2 Communication::Server to Client File Transfer (B0030.003)| |
|[send data](https://github.com/mandiant/capa-rules/blob/master/communication/send-data.yml)|C2 Communication::Send Data (B0030.001)|--|
|[receive data](https://github.com/mandiant/capa-rules/blob/master/communication/receive-data.yml)|C2 Communication::Receive Data (B0030.002)|--|
|[download and write a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/download-and-write-a-file.yml)|C2 Communication::Server to Client File Transfer (B0030.003)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|C2 Communication (B0030)|ConnectEx, URLDownloadToFileW|
|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication (B0030)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication::Check for Payload (B0030.005)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|C2 Communication (B0030)|--|
|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|C2 Communication (B0030)|--|
|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|C2 Communication (B0030)|HttpOpenRequestA, HttpSendRequestA|
|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|C2 Communication (B0030)|InternetOpenA, InternetOpenUrlA|
|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|C2 Communication (B0030)|--|
|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|C2 Communication (B0030)|--|
|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|C2 Communication (B0030)|--|
|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|C2 Communication (B0030)|DnsQuery_A, DnsQuery_W|
|[network_questionable_host](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_questionable_host.py)|C2 Communication (B0030)|--|
|[injection_network_traffic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_network_traffic.py)|C2 Communication (B0030)|HttpOpenRequestA, URLDownloadToFileW, HttpOpenRequestW, InternetConnectW, InternetConnectA, connect, InternetCrackUrlW, InternetCrackUrlA, WSASend|
|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|C2 Communication (B0030)|listen, bind|
|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
|[network_country_distribution](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_country_distribution.py)|C2 Communication (B0030)|--|
|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|C2 Communication (B0030)|--|
|[network_dyndns](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dyndns.py)|C2 Communication (B0030)|--|
|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
## Code Snippets
@@ -122,7 +143,6 @@ jmp short loc_4019A2
</pre>
</details>
## References
<a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
command-and-control/domain-name-generation.md
+7
View File
@@ -43,6 +43,13 @@ This behavior is related to Unprotect technique U0906.
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware uses an internal domain generation algorithm. [[4]](#4)|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Previous interations of Ursnif have used a Domain Name Generation algorithm. [[5]](#5)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[whois_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/whois_create.py)|Domain Name Generation (B0031)|--|
|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|Domain Name Generation (B0031)|--|
|[network_dga_fraunhofer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga_fraunhofer.py)|Domain Name Generation (B0031)|--|
## References
command-and-control/ingress-tool-transfer.md
+6
View File
@@ -49,6 +49,12 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques
|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut receives files from the C2. [[10]](#10)|
|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[11]](#11)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[suspicious_mpcmdrun_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_mpcmdrun_use.py)|Ingress Tool Transfer (E1105)|--|
|[network_document_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_file.py)|Ingress Tool Transfer (E1105)|URLDownloadToFileW, HttpOpenRequestW, send, InternetCrackUrlW, InternetCrackUrlA, WSASend, URLDownloadToCacheFileW|
## References
defense-evasion/alternative-installation-location.md
-2
View File
@@ -32,7 +32,6 @@ Malware may install itself in areas other than the hard drive [[1]](#1). Other p
While the definition of fileless malware can be ambiguous, here it represents malware that lives in memory only, not on disk, and it does not preclude fileless malware from using files on the system. Microsoft and Zeltser have addressed this ambiguity by providing more context in [[4]](#4) and [[5]](#5), respectively.
## Methods
|Name|ID|Description|
@@ -47,7 +46,6 @@ While the definition of fileless malware can be ambiguous, here it represents ma
|[**Kovter**](../xample-malware/kovter.md)|2016|B0027.002|Kovter stores malware files in the Registry instead of on the hard drive. [[1]](#1)|
|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|B0027.001|100 memory-resident modules can be installed. [[6]](#6)|
## References
<a name="1">[1]</a> https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem.
defense-evasion/bootkit.md
+10
View File
@@ -39,6 +39,16 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma
|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|The malware is an MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [[2]](#24)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Bootkit (F0013)|--|
|[bootkit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bootkit.py)|Bootkit (F0013)|NtSetInformationFile, NtClose, DeviceIoControl, NtCreateFile, NtDuplicateObject, NtOpenFile, NtWriteFile, NtDeviceIoControlFile|
|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Bootkit (F0013)|--|
|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Bootkit (F0013)|--|
|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Bootkit (F0013)|--|
|[suspicious_ioctl_scsipassthough](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ioctl_scsipassthough.py)|Bootkit (F0013)|DeviceIoControl, NtDeviceIoControlFile|
## References
defense-evasion/bypass-data-execution-prevention.md
+6
View File
@@ -36,6 +36,12 @@ Malware may bypass Data Execution Prevention (DEP).
|---|---|---|
|**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[dep_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dep_bypass.py)|Bypass Data Execution Prevention (B0037)|VirtualProtectEx, NtProtectVirtualMemory|
## References
<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce
defense-evasion/disable-or-evade-security-tools.md
+41 -3
View File
@@ -61,12 +61,50 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
|Tool: capa|Mapping|APIs|
|---|---|---|
|[64-bit execution via heavens gate](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml)|Disable or Evade Security Tools::Heavens Gate (F0004.008)| |
|[64-bit execution via heavens gate](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml)|Disable or Evade Security Tools::Heavens Gate (F0004.008)|--|
|[patch Event Tracing for Windows function](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml)|Disable or Evade Security Tools (F0004)|kernel32.VirtualProtect, ntdll.NtProtectVirtualMemory, ZwProtectVirtualMemory|
|[block operations on executable memory pages using Arbitrary Code Guard](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|SetProcessMitigationPolicy|
|[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute|
|[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)| |
|[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)| |
|[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|--|
|[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Disable or Evade Security Tools (F0004)|--|
|[clickfraud_volume](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_volume.py)|Disable or Evade Security Tools (F0004)|CoInternetSetFeatureEnabled|
|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_1.py)|Disable or Evade Security Tools (F0004)|--|
|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_2.py)|Disable or Evade Security Tools (F0004)|--|
|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Disable or Evade Security Tools (F0004)|NtSuspendThread|
|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_servicestop.py)|Disable or Evade Security Tools (F0004)|OpenServiceA, ControlService, OpenServiceW|
|[disables_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_security.py)|Disable or Evade Security Tools (F0004)|--|
|[antiav_whitespace](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_whitespace.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_windows_file_protection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_file_protection.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_crashdumps](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_crashdumps.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|[clickfraud_cookies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_cookies.py)|Disable or Evade Security Tools (F0004)|InternetSetOptionA|
|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools (F0004)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW|
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools (F0004)|--|
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Disable or Evade Security Tools (F0004)|--|
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools (F0004)|--|
|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools::Unhook APIs (F0004.003)|--|
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_windows_defender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Disable or Evade Security Tools (F0004)|--|
|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Disable or Evade Security Tools (F0004)|--|
|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Disable or Evade Security Tools (F0004)|--|
|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Disable or Evade Security Tools (F0004)|--|
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools (F0004)|--|
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--|
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Disable or Evade Security Tools (F0004)|--|
## References
defense-evasion/hidden-files-and-directories.md
+11 -1
View File
@@ -43,7 +43,6 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
|**Location**|F0005.002|Malware may change or choose the location of itself, another file, or a directory to prevent detection.|
|**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.|
## Use in Malware
|Name|Date|Method|Description|
@@ -56,6 +55,17 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.001|The malware also appends the filename and extension .ocx to the ProgramData folder path. [[5]](#5) [[6]](#6)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|F0005.003|WannaCry uses the +h attribute to hide its files. [[7]](#7)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories (F0005)|--|
|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories::Location (F0005.002)|--|
|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories (F0005)|--|
|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories::Timestamp (F0005.004)|--|
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Hidden Files and Directories (F0005)|--|
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Hidden Files and Directories (F0005)|--|
|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Hidden Files and Directories (F0005)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
## References
defense-evasion/hide-artifacts.md
+6 -1
View File
@@ -42,7 +42,6 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/
|**Hidden Processes**|E1564.m03|Hides processes used by the adversary or malware instance. This can involve techniques such as process list unlinking.|
|**Hidden Services**|E1564.m04|Hides any system services that the malware instance creates or injects itself into. Services can be hidden by hiding associated registry keys.|
## Use in Malware
|Name|Date|Method|Description|
@@ -50,6 +49,12 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users. [[1]](#1)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications, such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removable drives. [[2]](#2)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[stealth_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_window.py)|Hide Artifacts (E1564)|ShellExecuteExW, CreateProcessInternalW|
## References
<a name="1">[1]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
defense-evasion/hijack-execution-flow.md
+10 -1
View File
@@ -70,10 +70,19 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
|Tool: capa|Mapping|APIs|
|---|---|---|
|[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)| |
|[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)|--|
|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
|[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, SetWindowsHookExW|
|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, SetWindowsHookExW|
|[dll_load_uncommon_file_types](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dll_load_uncommon_file_types.py)|Hijack Execution Flow (F0015)|LdrLoadDll|
|[malicious_dynamic_function_loading](https://github.com/CAPESandbox/community/tree/master/modules/signatures/malicious_dynamic_function_loading.py)|Hijack Execution Flow (F0015)|LdrGetProcedureAddress, LdrLoadDll|
## References
<a name="1">[1]</a> https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf
defense-evasion/indicator-blocking.md
+11 -1
View File
@@ -38,7 +38,6 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi
|---|---|---|
|**Remove SMS Warning Messages**|F0006.001|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.|
## Use in Malware
|Name|Date|Method|Description|
@@ -48,6 +47,17 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|The malware can disable security center functions like anti-virus and firewall. [[3]](#3)|
|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[4]](#4)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Indicator Blocking (F0006)|--|
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Indicator Blocking (F0006)|--|
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Indicator Blocking (F0006)|--|
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Indicator Blocking (F0006)|--|
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Indicator Blocking (F0006)|NtCreateKey, NtSetValueKey|
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Indicator Blocking (F0006)|--|
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Indicator Blocking (F0006)|--|
## References
defense-evasion/install-insecure-or-malicious-configuration.md
+12
View File
@@ -37,6 +37,18 @@ Malware may install malicious configuration settings or may modify existing conf
|[**Black Energy**](../xample-malware/blackenergy.md)|2007|--|Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [[1]](#1)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware changes iOS Safari's default configuration. [[2]](#2)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Install Insecure or Malicious Configuration (B0047)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Install Insecure or Malicious Configuration (B0047)|--|
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Install Insecure or Malicious Configuration (B0047)|--|
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Install Insecure or Malicious Configuration (B0047)|--|
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Install Insecure or Malicious Configuration (B0047)|--|
|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Install Insecure or Malicious Configuration (B0047)|--|
|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Install Insecure or Malicious Configuration (B0047)|--|
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Install Insecure or Malicious Configuration (B0047)|--|
## References
defense-evasion/modify-registry.md
+71
View File
@@ -45,6 +45,77 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK may encrypt and store configuration data inside a registry key. [[7]](#7)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer edits the registry. [[8]](#8)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Modify Registry (E1112)|--|
|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Modify Registry (E1112)|--|
|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Modify Registry (E1112)|--|
|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Modify Registry (E1112)|--|
|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_networking_icon.py)|Modify Registry (E1112)|--|
|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Modify Registry (E1112)|--|
|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_power_options.py)|Modify Registry (E1112)|--|
|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_cpl_disable.py)|Modify Registry (E1112)|--|
|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Modify Registry (E1112)|--|
|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/hides_recycle_bin_icon.py)|Modify Registry (E1112)|--|
|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_restore_default_state.py)|Modify Registry (E1112)|--|
|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_auto_app_termination.py)|Modify Registry (E1112)|--|
|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_regkeys.py)|Modify Registry (E1112)|--|
|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Modify Registry (E1112)|--|
|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/prevents_safeboot.py)|Modify Registry (E1112)|--|
|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Modify Registry (E1112)|--|
|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_context_menus.py)|Modify Registry (E1112)|--|
|[reg_binary](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Modify Registry (E1112)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Modify Registry (E1112)|--|
|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_run_command.py)|Modify Registry (E1112)|--|
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Modify Registry (E1112)|--|
|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Modify Registry (E1112)|--|
|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_backups.py)|Modify Registry (E1112)|--|
|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_largekey.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_username_startmenu.py)|Modify Registry (E1112)|--|
|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Modify Registry (E1112)|--|
|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_startmenu_search.py)|Modify Registry (E1112)|--|
|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Modify Registry (E1112)|--|
|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Modify Registry (E1112)|--|
|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Modify Registry (E1112)|--|
|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|[persistence_autorun_tasks](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun_tasks.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
|[persistence_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_safeboot.py)|Modify Registry (E1112)|--|
|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Modify Registry (E1112)|--|
|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_certs.py)|Modify Registry (E1112)|--|
|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Modify Registry (E1112)|--|
|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_appv_virtualization.py)|Modify Registry (E1112)|--|
|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Modify Registry (E1112)|--|
|[modify_uac_prompt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_uac_prompt.py)|Modify Registry (E1112)|--|
|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Modify Registry (E1112)|RegQueryValueExW, RegSetValueExW|
|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rdptcp_key.py)|Modify Registry (E1112)|--|
|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_system_restore.py)|Modify Registry (E1112)|--|
|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_folder_options.py)|Modify Registry (E1112)|--|
|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Modify Registry (E1112)|--|
|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_security_maintenance_icon.py)|Modify Registry (E1112)|--|
|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Modify Registry (E1112)|--|
|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Modify Registry (E1112)|--|
|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Modify Registry (E1112)|--|
|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_startmenu_defaults.py)|Modify Registry (E1112)|--|
|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_uac.py)|Modify Registry (E1112)|--|
|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Modify Registry (E1112)|--|
|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Modify Registry (E1112)|--|
|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_perfkey.py)|Modify Registry (E1112)|--|
|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_oem_information.py)|Modify Registry (E1112)|--|
|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Modify Registry (E1112)|--|
|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Modify Registry (E1112)|--|
|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Modify Registry (E1112)|--|
|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Modify Registry (E1112)|--|
|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Modify Registry (E1112)|--|
|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windowsupdate.py)|Modify Registry (E1112)|--|
|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_pinned_programs.py)|Modify Registry (E1112)|--|
|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_regkeys.py)|Modify Registry (E1112)|--|
|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Modify Registry (E1112)|--|
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Modify Registry (E1112)|--|
## References
defense-evasion/obfuscated-files-or-information.md
+28 -22
View File
@@ -55,7 +55,6 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
|**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
## Use in Malware
|Name|Date|Method|Description|
@@ -86,37 +85,44 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Shamoon encodes data using XOR. [[9]](#9)|
|[**UP007**](../xample-malware/up007.md)|2016|E1027.m02|The malware encodes data using XOR. [[9]](#9)|
## Detection
|Tool: capa|Mapping|APIs|
|---|---|---|
|[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Obfuscated Files or Information::Encryption (E1027.m04)|memfrob|
|[encrypt data using XXTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using XXTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using XTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using XTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
|[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt|
|[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[decrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/decrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/encrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| |
|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[decrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/decrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/encrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--|
|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|--|
|[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars|
|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| |
|[resolve function by Brute Ratel Badger hash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml)|Obfuscated Files or Information (E1027)| |
|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|--|
|[resolve function by Brute Ratel Badger hash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml)|Obfuscated Files or Information (E1027)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|RtlDecompressBuffer|
|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|CryptDecrypt|
|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Obfuscated Files or Information (E1027)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Obfuscated Files or Information (E1027)|--|
|[dotnet_code_compile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dotnet_code_compile.py)|Obfuscated Files or Information (E1027)|NtWriteFile, CreateProcessInternalA, NtCreateUserProcess, CreateProcessInternalW|
## References
defense-evasion/polymorphic-code.md
+6
View File
@@ -44,6 +44,12 @@ Polymorphic code, a file with the same functionality but different execution, is
|---|---|---|---|
|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny utilizes Lua scripts to exhibit polymorphism. [[2]](#2)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[polymorphic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/polymorphic.py)|Polymorphic Code (B0029)|--|
## References
<a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
defense-evasion/process-injection.md
+25
View File
@@ -81,6 +81,31 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
|[inject shellcode using window subclass procedure](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml)|Process Injection (E1055)|user32.SetProp, PostMessage, SendNotifyMessage|
|[execute shellcode via Windows fibers](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-fibers.yml)|Process Injection::Injection via Windows Fibers (E1055.m05)|ConvertThreadToFiber, CreateFiber, SwitchToFiber|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[volatility_handles_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_handles_1.py)|Process Injection (E1055)|--|
|[volatility_ldrmodules_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_1.py)|Process Injection (E1055)|--|
|[volatility_ldrmodules_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_2.py)|Process Injection (E1055)|--|
|[volatility_malfind_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_1.py)|Process Injection (E1055)|--|
|[volatility_malfind_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_2.py)|Process Injection (E1055)|--|
|[volatility_modscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_modscan_1.py)|Process Injection (E1055)|--|
|[injection_explorer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_explorer.py)|Process Injection (E1055)|NtReadVirtualMemory, NtWow64ReadVirtualMemory64, NtOpenProcess, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, SetWindowLongW, FindWindowA, FindWindowW, FindWindowExW, ReadProcessMemory, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
|[injection_themeinitapihook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_themeinitapihook.py)|Process Injection (E1055)|ThemeInitApiHook|
|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|Process Injection (E1055)|WinHttpConnect, WinHttpOpenRequest|
|[injection_createremotethread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_createremotethread.py)|Process Injection (E1055)|--|
|[doppelganging](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|[injection_inter_process](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|[injection_process_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--|
|[injection_set_window_long](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_set_window_long.py)|Process Injection (E1055)|NtMapViewOfSection, SetWindowLongW, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, FindWindowA, PostMessageA, FindWindowW, FindWindowExW, PostMessageW, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW|
|[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction|
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection (E1055)|--|
|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Process Injection (E1055)|--|
|[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_shim_database.py)|Process Injection::Injection using Shims (E1055.m03)|--|
|[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_runpe.py)|Process Injection (E1055)|--|
## References
<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
defense-evasion/rootkit.md
+7 -1
View File
@@ -53,13 +53,19 @@ Rootkits may hide artifacts (kernel modules, services, threads, userspace librar
|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon has certain variants that may have rootkit functionality. [[3]](#3)|
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1014.m16|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate. [[4]](#4)|
## Detection
Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Impair Defenses, and Highjack Execution Flow. Hidden artifacts include kernel modules (hides use of kernel modules used by the malware instance), services (hides any system services that the malware instance creates or injects itself into), threads (hides one or more threads that belong to the malware instance), and userspace libraries (hides use of userspace libraries used by the malware instance).
Rootkits can also be detected via memory dump analysis or virtual machine introspection.
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[spicyhotpot_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spicyhotpot_behavior.py)|Rootkit (E1014)|--|
|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Rootkit (E1014)|--|
|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Rootkit (E1014)|--|
|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Rootkit (E1014)|--|
|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Rootkit (E1014)|--|
## References
defense-evasion/self-deletion.md
+6 -2
View File
@@ -40,7 +40,6 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
|---|---|---|
|**COMSPEC Environment Variable**|F0007.001|Uninstalls self via COMSPEC environment variable.|
## Use in Malware
|Name|Date|Method|Description|
@@ -54,8 +53,13 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
|Tool: capa|Mapping|APIs|
|---|---|---|
|[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)| |
|[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Self Deletion (F0007)|DeleteFileW|
|[deletes_executed_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_executed_files.py)|Self Deletion (F0007)|--|
|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Self Deletion (F0007)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
## References
discovery/analysis-tool-discovery.md
+12 -1
View File
@@ -62,7 +62,18 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi
|Tool: capa|Mapping|APIs|
|---|---|---|
|[reference analysis tools strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/reference-analysis-tools-strings.yml)|Analysis Tool Discovery::Process detection (B0013.001)| |
|[reference analysis tools strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/reference-analysis-tools-strings.yml)|Analysis Tool Discovery::Process detection (B0013.001)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Analysis Tool Discovery (B0013)|--|
|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Analysis Tool Discovery (B0013)|--|
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery (B0013)|--|
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Process detection (B0013.001)|--|
|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Known Window (B0013.009)|--|
|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Analysis Tool Discovery (B0013)|--|
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery (B0013)|--|
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery::Known File Location (B0013.008)|--|
## References
discovery/application-window-discovery.md
+4
View File
@@ -53,6 +53,10 @@ Malware may attempt to get a listing of open application windows.
|---|---|---|
|[get graphical window text](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/window/get-text/get-graphical-window-text.yml)|Application Window Discovery (E1010)|user32.IsWindowVisible, user32.SendMessage, user32.GetForegroundWindow, user32.GetWindowText|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[browser_needed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_needed.py)|Application Window Discovery (E1010)|FindWindowW, FindWindowExA, FindWindowExW, FindWindowA|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
discovery/code-discovery.md
+2 -2
View File
@@ -58,8 +58,8 @@ Malware may inspect code or enumerate aspects.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[enumerate PE sections](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/enumerate-pe-sections.yml)|Code Discovery::Enumerate PE Sections (B0046.001)| |
|[inspect section memory permissions](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/inspect-section-memory-permissions.yml)|Code Discovery::Inspect Section Memory Permissions (B0046.002)| |
|[enumerate PE sections](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/enumerate-pe-sections.yml)|Code Discovery::Enumerate PE Sections (B0046.001)|--|
|[inspect section memory permissions](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/inspect-section-memory-permissions.yml)|Code Discovery::Inspect Section Memory Permissions (B0046.002)|--|
## References
discovery/file-and-directory-discovery.md
+22 -1
View File
@@ -73,10 +73,31 @@ Malware may enumerate files and directories or may search for specific files or
|[check if file exists](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/exists/check-if-file-exists.yml)|File and Directory Discovery (E1083)|kernel32.GetFileAttributes, kernel32.GetLastError, shlwapi.PathFileExists, System.IO.File::Exists|
|[enumerate files on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-linux.yml)|File and Directory Discovery (E1083)|getdents, getdents64, opendir, readdir|
|[enumerate files on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-windows.yml)|File and Directory Discovery (E1083)|kernel32.FindFirstFile, kernel32.FindFirstFileEx, kernel32.FindFirstFileTransacted, kernel32.FindFirstFileName, kernel32.FindFirstFileNameTransacted, kernel32.FindNextFile, kernel32.FindNextFileName, kernel32.FindClose, ntdll.NtOpenDirectoryObject, ntdll.NtQueryDirectoryObject, RtlAllocateHeap, System.IO.DirectoryInfo::GetFiles, System.IO.DirectoryInfo::EnumerateFiles, System.IO.Directory::GetFiles, System.IO.Directory::EnumerateFiles, System.IO.Directory::EnumerateFileSystemEntries, System.IO.DirectoryInfo::GetDirectories, System.IO.DirectoryInfo::EnumerateDirectories, System.IO.Directory::GetDirectories, System.IO.Directory::EnumerateDirectories|
|[enumerate files recursively](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-recursively.yml)|File and Directory Discovery (E1083)| |
|[enumerate files recursively](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-recursively.yml)|File and Directory Discovery (E1083)|--|
|[read data from CLFS log container](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/clfs/read-data-from-clfs-log-container.yml)|File and Directory Discovery::Log File (E1083.m01)|clfsw32.CreateLogFile, clfsw32.CreateLogMarshallingArea, clfsw32.ReadLogRecord, clfsw32.ReadNextLogRecord|
|[access the Windows event log](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/winevt/access/access-the-windows-event-log.yml)|File and Directory Discovery::Log File (E1083.m01)|OpenEventLog, ClearEventLog, OpenBackupEventLog, ReportEvent|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|File and Directory Discovery (E1083)|--|
|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|File and Directory Discovery (E1083)|--|
|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|File and Directory Discovery (E1083)|NtQueryDirectoryObject, NtOpenDirectoryObject|
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery (E1083)|NtOpenEvent, NtCreateEvent|
|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery::Log File (E1083.m01)|NtOpenEvent, NtCreateEvent|
|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|File and Directory Discovery (E1083)|--|
|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|File and Directory Discovery (E1083)|--|
|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|File and Directory Discovery (E1083)|--|
|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|File and Directory Discovery (E1083)|--|
|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|File and Directory Discovery (E1083)|--|
|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll|
|[driver_filtermanager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_filtermanager.py)|File and Directory Discovery (E1083)|--|
|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|File and Directory Discovery (E1083)|--|
|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|File and Directory Discovery (E1083)|--|
|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|File and Directory Discovery (E1083)|--|
|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|File and Directory Discovery (E1083)|--|
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|File and Directory Discovery (E1083)|--|
## References
<a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
discovery/self-discovery.md
-1
View File
@@ -46,7 +46,6 @@ Name|Date|Method|Description|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.002|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[2]](#2)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.003|WannaCry checks the data lengh of a section before decypting a dll. [[2]](#2)|
## References
<a name="1">[1]</a> https://github.com/Rogdham/gif-md5-hashquine
discovery/system-information-discovery.md
+30 -1
View File
@@ -69,9 +69,38 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
|[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables|
|[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice|
|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl|
|[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)| |
|[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)|--|
|[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|System Information Discovery (E1082)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile|
|[recon_systeminfo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_systeminfo.py)|System Information Discovery (E1082)|--|
|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|System Information Discovery (E1082)|HttpOpenRequestA, HttpSendRequestA|
|[uses_adfind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_adfind.py)|System Information Discovery (E1082)|--|
|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|System Information Discovery (E1082)|--|
|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|System Information Discovery (E1082)|--|
|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|System Information Discovery (E1082)|--|
|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|System Information Discovery (E1082)|--|
|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|System Information Discovery (E1082)|--|
|[uses_windows_utilities_nltest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_nltest.py)|System Information Discovery (E1082)|--|
|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA|
|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|System Information Discovery (E1082)|--|
|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|System Information Discovery (E1082)|--|
|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|System Information Discovery (E1082)|--|
|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|System Information Discovery (E1082)|--|
|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|System Information Discovery (E1082)|--|
|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|System Information Discovery (E1082)|--|
|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|System Information Discovery (E1082)|--|
|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|System Information Discovery (E1082)|--|
|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|System Information Discovery (E1082)|--|
|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|System Information Discovery (E1082)|--|
|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA|
|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|System Information Discovery (E1082)|SetupDiGetClassDevsA, SetupDiGetClassDevsW|
|[antisandbox_check_userdomain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_check_userdomain.py)|System Information Discovery (E1082)|rtcEnvironBstr|
|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|System Information Discovery (E1082)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_fingerprint.py)|System Information Discovery (E1082)|--|
## References
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_URSNIF.A2?_ga=2.131425807.1462021705.1559742358-1202584019.1549394279
discovery/taskbar-discovery.md
+1 -2
View File
@@ -28,7 +28,6 @@
# Taskbar Discovery
## Use in Malware
|Name|Date|Method|Description|
@@ -39,7 +38,7 @@
|Tool: capa|Mapping|APIs|
|---|---|---|
|[find taskbar](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/taskbar/find/find-taskbar.yml)|Taskbar Discovery (B0043)| |
|[find taskbar](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/taskbar/find/find-taskbar.yml)|Taskbar Discovery (B0043)|--|
## References
execution/command-and-scripting-interpreter.md
+50
View File
@@ -63,6 +63,56 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
|[accept command line arguments](https://github.com/mandiant/capa-rules/blob/master/host-interaction/cli/accept-command-line-arguments.yml)|Command and Scripting Interpreter (E1059)|GetCommandLine, CommandLineToArgv, System.Environment::GetCommandLineArgs|
|[run PowerShell expression](https://github.com/mandiant/capa-rules/blob/master/load-code/powershell/run-powershell-expression.yml)|Command and Scripting Interpreter (E1059)|System.Management.Automation.PowerShell::Create, System.Management.Automation.PowerShell::AddScript, System.Management.Automation.PowerShell::Invoke|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
|[js_suspicious_redirect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_suspicious_redirect.py)|Command and Scripting Interpreter (E1059)|CDocument_write, JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[odbcconf_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/odbcconf_bypass.py)|Command and Scripting Interpreter (E1059)|--|
|[regsvr32_squiblydoo_dll_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/regsvr32_squiblydoo_dll_load.py)|Command and Scripting Interpreter (E1059)|LdrLoadDll|
|[squiblydoo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblydoo_bypass.py)|Command and Scripting Interpreter (E1059)|--|
|[squiblytwo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblytwo_bypass.py)|Command and Scripting Interpreter (E1059)|--|
|[exe_dropper_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exe_dropper_js.py)|Command and Scripting Interpreter (E1059)|JsEval|
|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Command and Scripting Interpreter (E1059)|RegSetValueExA, RegSetValueExW, NtSetValueKey|
|[ie_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ie_martian_children.py)|Command and Scripting Interpreter (E1059)|--|
|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|[office_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_martian_children.py)|Command and Scripting Interpreter (E1059)|--|
|[js_phish](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_phish.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Command and Scripting Interpreter (E1059)|--|
|[script_tool_executed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_tool_executed.py)|Command and Scripting Interpreter (E1059)|--|
|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Command and Scripting Interpreter (E1059)|--|
|[cmdline_switches](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_switches.py)|Command and Scripting Interpreter (E1059)|--|
|[cmdline_terminate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_terminate.py)|Command and Scripting Interpreter (E1059)|--|
|[cmdline_forfiles_wildcard](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_forfiles_wildcard.py)|Command and Scripting Interpreter (E1059)|--|
|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|Command and Scripting Interpreter (E1059)|--|
|[cmdline_long_string](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_long_string.py)|Command and Scripting Interpreter (E1059)|--|
|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|Command and Scripting Interpreter (E1059)|--|
|[long_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/long_commandline.py)|Command and Scripting Interpreter (E1059)|--|
|[powershell_renamed_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed_commandline.py)|Command and Scripting Interpreter (E1059)|--|
|[wmi_script_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_script_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|[disables_mappeddrives_autodisconnect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_mappeddrives_autodisconnect.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--|
|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--|
|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--|
|[powershell_network_connection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_network_connection.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, InternetReadFile|
|[powershell_scriptblock_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_scriptblock_logging.py)|Command and Scripting Interpreter (E1059)|--|
|[powershell_command_suspicious](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_command_suspicious.py)|Command and Scripting Interpreter (E1059)|--|
|[powershell_renamed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed.py)|Command and Scripting Interpreter (E1059)|--|
|[powershell_reversed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_reversed.py)|Command and Scripting Interpreter (E1059)|--|
|[powershell_variable_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_variable_obfuscation.py)|Command and Scripting Interpreter (E1059)|--|
|[office_com_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_com_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|[office_vb_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_vb_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|[office_wmi_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_wmi_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll|
|[document_script_exe_drop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/document_script_exe_drop.py)|Command and Scripting Interpreter (E1059)|NtWriteFile|
|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Command and Scripting Interpreter (E1059)|--|
|[office_suspicious_processes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_suspicious_processes.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW|
|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile|
|[suspicious_js_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_js_script.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText|
## References
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
execution/execution-dependency.md
-2
View File
@@ -30,14 +30,12 @@
Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in **Conditional Execution ([B0025](../execution/conditional-execution.md))**, this dependency is not because of an explicit check coded into the malware by the author.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Adwind jRAT**](../xample-malware/adwindjrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
execution/exploitation-for-client-execution.md
+30
View File
@@ -53,6 +53,36 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
|---|---|---|---|
|[**SamSam**](../xample-malware/samsam.md)|2015|E1203.m01|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[office_cve2017_11882](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882.py)|Exploitation for Client Execution (E1203)|CreateProcessInternalW|
|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|Exploitation for Client Execution (E1203)|ConnectEx, URLDownloadToFileW|
|[office_flash_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_flash_load.py)|Exploitation for Client Execution (E1203)|CoGetClassObject, CoCreateInstance|
|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Exploitation for Client Execution (E1203)|NtWriteFile|
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|[exploit_getbasekerneladdress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_getbasekerneladdress.py)|Exploitation for Client Execution (E1203)|EnumDeviceDrivers, LdrGetProcedureAddress, LdrLoadDll, K32EnumDeviceDrivers|
|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_process_create.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_curl.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
|[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution (E1203)|--|
|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution (E1203)|--|
|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--|
|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--|
|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|Exploitation for Client Execution (E1203)|NtAllocateVirtualMemory|
|[rtf_aslr_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_aslr_bypass.py)|Exploitation for Client Execution (E1203)|--|
|[rtf_exploit_static](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_exploit_static.py)|Exploitation for Client Execution (E1203)|--|
## References
<a name="1">[1]</a> https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/
execution/install-additional-program.md
+8 -3
View File
@@ -40,7 +40,6 @@ Examples of droppers include malicious
Droppers may be described as “single stage” or “two stage.” While the former embeds the malicious code internally, the latter installs itself before downloading additional code from a remote location [[4]](#4).
## Use in Malware
|Name|Date|Method|Description|
@@ -66,8 +65,14 @@ Droppers may be described as “single stage” or “two stage.” While the fo
|Tool: capa|Mapping|APIs|
|---|---|---|
|[contain an embedded PE file](https://github.com/mandiant/capa-rules/blob/master/executable/subfile/pe/contain-an-embedded-pe-file.yml)|Install Additional Program (B0023)| |
|[write and execute a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/write-and-execute-a-file.yml)|Install Additional Program (B0023)| |
|[contain an embedded PE file](https://github.com/mandiant/capa-rules/blob/master/executable/subfile/pe/contain-an-embedded-pe-file.yml)|Install Additional Program (B0023)|--|
|[write and execute a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/write-and-execute-a-file.yml)|Install Additional Program (B0023)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[bitcoin_opencl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bitcoin_opencl.py)|Install Additional Program (B0023)|--|
|[dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dropper.py)|Install Additional Program (B0023)|--|
|[sniffer_winpcap](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sniffer_winpcap.py)|Install Additional Program (B0023)|--|
## References
<a name="1">"Cyclops Blink: Malware Analysis Report, Version 1.0," National Cyber Security Centre/GCHQ, 23 Feb. 2022. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf.
execution/remote-commands.md
+7 -9
View File
@@ -42,14 +42,13 @@ Autonomous behaviors - those done by the malware without an active attacker - sh
|Name|ID|Description|
|---|---|---|
|**Delete File**|B0011.001||
|**Download File**|B0011.002||
|**Execute**|B0011.003||
|**Shutdown**|B0011.004||
|**Sleep**|B0011.005||
|**Uninstall**|B0011.006||
|**Upload File**|B0011.007||
|**Delete File**|B0011.001|--|
|**Download File**|B0011.002|--|
|**Execute**|B0011.003|--|
|**Shutdown**|B0011.004|--|
|**Sleep**|B0011.005|--|
|**Uninstall**|B0011.006|--|
|**Upload File**|B0011.007|--|
## Use in Malware
@@ -61,7 +60,6 @@ Autonomous behaviors - those done by the malware without an active attacker - sh
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0011.005|The malware sleeps if it fails to send collected data or execute its commands. [[4]](#4) [[5]](#5)|
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0011.006|The malware loader can uninstall itself from the victim computer. [[4]](#4) [[5]](#5)|
## References
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279
execution/send-email.md
-1
View File
@@ -40,7 +40,6 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec
|[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
|[**Emotet**](../xample-malware/emotet.md)|2018|--|Spam email with the Emotet loader is sent automatically. [[3]](#3)|
## References
<a name="1">[1]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
execution/system-services.md
-1
View File
@@ -38,7 +38,6 @@ See ATT&CK: **System Services ([T1569](https://attack.mitre.org/techniques/T1569
|---|---|---|
|**MSDTC**|E1569.m01|The Distributed Transaction Coordinator (MSDTC) coordinates transaction across multiple resource managers (databases, message queues and file systems). This legitimate Microsoft service is part of Windows 2000 and later and can be used to import and load DLLs. Malware may abuse MSDTC to import and load DLLs.[[1]](#1)|
## References
<a name="1">[1]</a> https://cyware.com/news/catb-ransomware-exploits-msdtc-service-to-steal-data-3bb46fc0
execution/user-execution.md
-1
View File
@@ -45,7 +45,6 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq
|[**CryptoLocker**](../xample-malware/vobfus.md)|2013|--|The malware relies on victims to execute. [[4]](#4)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The user opens a disk image file which invisibly installs its components. [[6]](#6)|
## References
<a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
exfiltration/archive-collected-data.md
+10 -1
View File
@@ -43,7 +43,6 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org
|**Encryption - Custom Encryption**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.|
|**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
## Use in Malware
|Name|Date|Method|Description|
@@ -52,6 +51,16 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1560.m04|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[2]](#2)|
|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|E1560.m03|Malware sends data as a Base64 string of JSON. [[3]](#3) [[4]](#4)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data (E1560)|CryptEncrypt|
|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt|
|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW|
## References
exfiltration/automated-exfiltration.md
-1
View File
@@ -44,7 +44,6 @@ See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org
|---|---|---|---|
|[**Attor**](../xample-malware/attor.md)|2013|--|Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server.[[1]](#1)|
## References
<a name="1">[1]</a> https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
impact/clipboard-modification.md
+4
View File
@@ -50,6 +50,10 @@ ATT&CK defines Clipboard Modification as a Mobile technique (Android platform).
|---|---|---|
|[write clipboard data](https://github.com/mandiant/capa-rules/blob/master/host-interaction/clipboard/write-clipboard-data.yml)|Clipboard Modification (E1510)|user32.EmptyClipboard, System.Windows.Forms.Clipboard::Clear, user32.SetClipboardData, System.Windows.Forms.Clipboard::SetAudio, System.Windows.Forms.Clipboard::SetData, System.Windows.Forms.Clipboard::SetDataObject, System.Windows.Forms.Clipboard::SetFileDropList, System.Windows.Forms.Clipboard::SetImage, System.Windows.Forms.Clipboard::SetText|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[set_clipboard_data](https://github.com/CAPESandbox/community/tree/master/modules/signatures/set_clipboard_data.py)|Clipboard Modification (E1510)|SetClipboardData|
## References
<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
impact/compromise-data-integrity.md
-1
View File
@@ -42,7 +42,6 @@ The related **Data Manipulation: Stored Data Manipulation ([T1565.001](https://a
|---|---|---|---|
|[**DYEPACK**](../xample-malware/dyepack.md)|2015|--|DYEPACK alters records in databases used for SWIFT transactions. [[2]](#2)|
## References
<a name="1">[1]</a> "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf.
impact/data-destruction.md
+8 -1
View File
@@ -58,7 +58,14 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148
|Tool: capa|Mapping|APIs|
|---|---|---|
|[delete volume shadow copies](https://github.com/mandiant/capa-rules/blob/master/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml)|Data Destruction::Delete Shadow Copies (E1485.m04)| |
|[delete volume shadow copies](https://github.com/mandiant/capa-rules/blob/master/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml)|Data Destruction::Delete Shadow Copies (E1485.m04)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Data Destruction (E1485)|--|
|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Data Destruction (E1485)|--|
|[uses_windows_utilities_cipher](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_cipher.py)|Data Destruction (E1485)|--|
|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Data Destruction (E1485)|NtDeleteFile, DeleteFileW, DeleteFileA|
## References
impact/data-encrypted-for-impact.md
+13
View File
@@ -53,6 +53,19 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom. [[5]](#5)|
|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry encrypts files for ransom. [[6]](#6)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Data Encrypted for Impact (E1486)|CryptEncrypt|
|[ransomware_dmalocker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_dmalocker.py)|Data Encrypted for Impact (E1486)|RegSetValueExA|
|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_revil_regkey.py)|Data Encrypted for Impact (E1486)|--|
|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_radamant.py)|Data Encrypted for Impact (E1486)|--|
|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Data Encrypted for Impact (E1486)|--|
|[sodinokibi_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sodinokibi_behavior.py)|Data Encrypted for Impact (E1486)|bind, RegSetValueExW, WinHttpOpen, NtCreateUserProcess, CreateProcessInternalW|
|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Data Encrypted for Impact (E1486)|NtWriteFile|
|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Data Encrypted for Impact (E1486)|--|
|[ransomware_file_modifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_file_modifications.py)|Data Encrypted for Impact (E1486)|NtWriteFile, MoveFileWithProgressW, NtCreateFile, MoveFileWithProgressTransactedW|
## References
impact/denial-of-service.md
+9
View File
@@ -45,6 +45,15 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|Denial of Service (B0033)|--|
|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
## References
<a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
impact/disk-wipe.md
+6
View File
@@ -47,6 +47,12 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001](
|---|---|---|
|[overwrite Master Boot Record (MBR)](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml)|Disk Wipe (F0014)|kernel32.WriteFile|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[deletes_shadow_copies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_shadow_copies.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|[deletes_system_state_backup](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_system_state_backup.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW|
|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Disk Wipe (F0014)|NtWriteFile|
## References
<a name="1">[1]</a> https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
impact/exploit-kit.md
-2
View File
@@ -36,14 +36,12 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver
See related ATT&CK Technique: **Exploit Public-Facing Application ([T1190](https://attack.mitre.org/techniques/T1190))**, which relates to Initial Access. Under the Impact objective, exploit behaviors are considered more broadly in MBC.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif is sometimes delivered via exploit kit. [[1]](#1)|
## References
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
impact/generate-traffic-from-victim.md
-1
View File
@@ -49,7 +49,6 @@ Malware may generate traffic from the victim system such as clicks of advertisin
|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter performs click-fraud. [[4]](#4)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1643.m02|The malware displays brief advertisements whenever the user opens applications on their phone. [[5]](#5)|
## References
<a name="1">[1]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
impact/manipulate-network-traffic.md
-1
View File
@@ -43,7 +43,6 @@ The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](http
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|SearchAwesome adware intercepts encrypted web traffic to inject ads. [[2]](#2)|
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot intercepts data coming into and going out of the device. [[3]](#3)|
## References
<a name="1">[1]</a> B. Feeley and B. Stone-Gross,"New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration," CrowdStrike, blog, 20 Mar. 2019. [Online]. Available: https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module.
impact/remote-access.md
+46 -1
View File
@@ -56,9 +56,54 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu
|Tool: capa|Mapping|APIs|
|---|---|---|
|[create reverse shell on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell-on-linux.yml)|Remote Access::Reverse Shell (B0022.001)| |
|[create reverse shell on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell-on-linux.yml)|Remote Access::Reverse Shell (B0022.001)|--|
|[create reverse shell](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell.yml)|Remote Access::Reverse Shell (B0022.001)|kernel32.PeekNamedPipe, kernel32.CreateProcess, kernel32.ReadFile, kernel32.WriteFile|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Remote Access (B0022)|--|
|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_spynet.py)|Remote Access (B0022)|--|
|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/parallax_mutexes.py)|Remote Access (B0022)|--|
|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_pcclient.py)|Remote Access (B0022)|--|
|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_fynloski_mutexes.py)|Remote Access (B0022)|--|
|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_beebus_mutexes.py)|Remote Access (B0022)|--|
|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Remote Access (B0022)|--|
|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_mutexes.py)|Remote Access (B0022)|--|
|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Remote Access (B0022)|--|
|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Remote Access (B0022)|--|
|[evil_grab](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW|
|[PlugX](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|memcpy, RtlDecompressBuffer|
|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ratsnif_mutexes.py)|Remote Access (B0022)|--|
|[netwire_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/netwire_behavior.py)|Remote Access (B0022)|RegSetValueExA|
|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Remote Access (B0022)|--|
|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_xtreme_mutexes.py)|Remote Access (B0022)|--|
|[blackrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_apis.py)|Remote Access (B0022)|CryptHashData, RtlDecompressBuffer, CreateProcessInternalW|
|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_mutexes.py)|Remote Access (B0022)|--|
|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Remote Access (B0022)|send|
|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Remote Access (B0022)|RegQueryValueExW, RegSetValueExW|
|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Remote Access (B0022)|--|
|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Remote Access (B0022)|--|
|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_plugx_mutexes.py)|Remote Access (B0022)|--|
|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Remote Access (B0022)|--|
|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_mutexes.py)|Remote Access (B0022)|--|
|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Remote Access (B0022)|send|
|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/venomrat_mutexes.py)|Remote Access (B0022)|--|
|[trochilusrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trochilusrat_apis.py)|Remote Access (B0022)|OutputDebugStringW, NtCreateUserProcess, RegSetValueExW, CreateProcessInternalW|
|[dcrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_behavior.py)|Remote Access (B0022)|GetAddrInfo, GetAddrInfoW, CryptHashData|
|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Remote Access (B0022)|--|
|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_mutexes.py)|Remote Access (B0022)|--|
|[karagany_system_event_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_system_event_objects.py)|Remote Access (B0022)|NtCreateEventEx, NtCreateEvent|
|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Remote Access (B0022)|--|
|[orcusrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/orcusrat_behavior.py)|Remote Access (B0022)|RegOpenKeyExW|
|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_mutexes.py)|Remote Access (B0022)|--|
|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Remote Access (B0022)|--|
|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_luminosity.py)|Remote Access (B0022)|CryptHashData, NtCreateMutant, NtCreateFile|
|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_nanocore.py)|Remote Access (B0022)|CryptHashData|
|[static_rat_config](https://github.com/CAPESandbox/community/tree/master/modules/signatures/static_rat_config.py)|Remote Access (B0022)|--|
|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Remote Access (B0022)|--|
|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Remote Access (B0022)|--|
|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Remote Access (B0022)|--|
## References
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Remote_access_trojan
impact/resource-hijacking.md
+7
View File
@@ -52,6 +52,13 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[5]](#5)|
|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer uses sytem resources to mine for cryptocurrency. [[6]](#6)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[cryptopool_domains](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptopool_domains.py)|Resource Hijacking (B0018)|GetAddrInfoW|
|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking (B0018)|--|
|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking::Cryptojacking (B0018.002)|--|
## References
<a name="1">[1]</a> B. G. a. M. Ahuje,"CrowdStrike Discovers First-Ever Dero Cryptojacking Campaign Targeting Kubernetes," CrowdStrike, blog, 15 Mar. 2023. [Online]. Available: https://www.crowdstrike.com/blog/crowdstrike-discovers-first-ever-dero-cryptojacking-campaign-targeting-kubernetes/.
lateral-movement/supply-chain-compromise.md
-1
View File
@@ -45,7 +45,6 @@ The supply chain may be compromised to enable initial malware infection. MBC obj
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1195.m01|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. [[1]](#1)|
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1195.m02|Within the malware, use of the private API allows installation of malicious apps and uninstallation of legitimate apps without user notification. [[1]](#1)|
## References
<a name="1">[1]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
micro-behaviors/communication/dns-communication.md
+12 -1
View File
@@ -51,9 +51,20 @@ The DNS Communication micro-behavior focuses on DNS communication.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)| |
|[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)|--|
|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, getaddrinfo, GetAddrInfo, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[network_dns_blockchain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_blockchain.py)|DNS Communication (C0011)|--|
|[network_dns_idn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_idn.py)|DNS Communication (C0011)|DnsQueryA|
|[network_dns_opennic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_opennic.py)|DNS Communication (C0011)|--|
|[network_dns_reverse_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_reverse_proxy.py)|DNS Communication (C0011)|--|
|[network_dns_suspicious_querytype](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_suspicious_querytype.py)|DNS Communication (C0011)|DnsQueryA|
|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|DNS Communication (C0011)|DnsQuery_A, DnsQuery_W|
|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_doh_tls.py)|DNS Communication (C0011)|--|
|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|DNS Communication (C0011)|--|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/communication/http-communication.md
+28 -3
View File
@@ -55,7 +55,6 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) micro-behavior.|
## Use in Malware
|Name|Date|Method|Description|
@@ -88,12 +87,38 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|[prepare HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/prepare-http-request.yml)|HTTP Communication::Create Request (C0002.012)|winhttp.WinHttpOpenRequest|
|[create HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/create-http-request.yml)|HTTP Communication::Create Request (C0002.012)|wininet.InternetOpen, System.Net.WebRequest::Create, System.Net.WebRequest::CreateDefault, System.Net.WebRequest::CreateHttp, wininet.InternetCloseHandle|
|[send file via HTTP](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/send-file-via-http.yml)|HTTP Communication::Send Data (C0002.005)|wininet.InternetWriteFile|
|[decompress HTTP response via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml)|HTTP Communication::Get Response (C0002.017)| |
|[decompress HTTP response via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml)|HTTP Communication::Get Response (C0002.017)|--|
|[check HTTP status code](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/check-http-status-code.yml)|HTTP Communication::Read Header (C0002.014)|atoi, wininet.HttpQueryInfo|
|[get HTTP response content encoding](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-response-content-encoding.yml)|HTTP Communication::Get Response (C0002.017)|wininet.HttpQueryInfo|
|[connect to URL](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-url.yml)|HTTP Communication::Open URL (C0002.004)|wininet.InternetOpenUrl|
|[connect to HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-http-server.yml)|HTTP Communication::Connect to Server (C0002.009)|wininet.InternetConnect|
|[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)| |
|[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|HTTP Communication (C0002)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW|
|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication (C0002)|--|
|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication::Send Request (C0002.003)|--|
|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication (C0002)|--|
|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication::Send Data (C0002.005)|--|
|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|HTTP Communication (C0002)|--|
|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpSendRequestA|
|[network_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_http.py)|HTTP Communication (C0002)|--|
|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|HTTP Communication (C0002)|WinHttpConnect, WinHttpOpenRequest|
|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication (C0002)|--|
|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication::Send Data (C0002.005)|--|
|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication (C0002)|--|
|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication::Send Data (C0002.005)|--|
|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|HTTP Communication (C0002)|--|
|[koadic_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/koadic_network_activity.py)|HTTP Communication (C0002)|HttpOpenRequestW, WinHttpOpenRequest|
|[http_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/http_request.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenUrlA, InternetConnectA, InternetOpenUrlW, WinHttpGetProxyForUrl|
|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|HTTP Communication (C0002)|--|
|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|HTTP Communication (C0002)|--|
|[https_urls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/https_urls.py)|HTTP Communication (C0002)|InternetOpenUrlW, InternetOpenUrlA|
|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|HTTP Communication (C0002)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile|
|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|HTTP Communication (C0002)|--|
|[downloads_from_filehosting](https://github.com/CAPESandbox/community/tree/master/modules/signatures/downloads_from_filehosting.py)|HTTP Communication (C0002)|WinHttpOpenRequest, InternetOpenUrlA|
|[purplewave_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_network_activity.py)|HTTP Communication (C0002)|InternetOpenW, HttpOpenRequestW, HttpSendRequestW, HttpAddRequestHeadersA|
## References
micro-behaviors/communication/icmp-communication.md
+5
View File
@@ -42,3 +42,8 @@ This micro-behavior is related to ICMP communication.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[send ICMP echo request](https://github.com/mandiant/capa-rules/blob/master/communication/icmp/send-icmp-echo-request.yml)|ICMP Communication::Echo Request (C0014.002)|IcmpSendEcho, IcmpSendEcho2, IcmpSendEcho2Ex, Icmp6SendEcho2, IcmpCreateFile, Icmp6CreateFile, IcmpCloseHandle|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[suspicious_ping_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ping_use.py)|ICMP Communication (C0014)|--|
|[network_icmp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_icmp.py)|ICMP Communication (C0014)|--|
micro-behaviors/communication/interprocess-communication.md
+10 -5
View File
@@ -34,10 +34,10 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|Name|ID|Description|
|---|---|---|
|**Connect Pipe**|C0003.002||
|**Create Pipe**|C0003.001||
|**Read Pipe**|C0003.003||
|**Write Pipe**|C0003.004||
|**Connect Pipe**|C0003.002|--|
|**Create Pipe**|C0003.001|--|
|**Read Pipe**|C0003.003|--|
|**Write Pipe**|C0003.004|--|
## Use in Malware
@@ -54,11 +54,16 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
|[create mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/create-mailslot.yml)|Interprocess Communication (C0003)|kernel32.CreateMailslot, kernel32.GetMailslotInfo, kernel32.SetMailslotInfo|
|[read from mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/read-from-mailslot.yml)|Interprocess Communication (C0003)|kernel32.GetMailslotInfo, kernel32.ReadFile, kernel32.ReadFileEx|
|[create pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-pipe.yml)|Interprocess Communication::Create Pipe (C0003.001)|kernel32.CreatePipe, kernel32.CreateNamedPipe, System.IO.Pipes.AnonymousPipeClientStream::ctor, System.IO.Pipes.NamedPipeClientStream::ctor, System.IO.Pipes.AnonymousPipeServerStream::ctor, System.IO.Pipes.AnonymousPipeServerStreamAcl::Create, System.IO.Pipes.NamedPipeServerStream::ctor, System.IO.Pipes.NamedPipeServerStreamAcl::Create|
|[create two anonymous pipes](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-two-anonymous-pipes.yml)|Interprocess Communication::Create Pipe (C0003.001)| |
|[create two anonymous pipes](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-two-anonymous-pipes.yml)|Interprocess Communication::Create Pipe (C0003.001)|--|
|[write pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/write/write-pipe.yml)|Interprocess Communication::Write Pipe (C0003.004)|kernel32.WriteFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe|
|[connect pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/connect/connect-pipe.yml)|Interprocess Communication::Connect Pipe (C0003.002)|kernel32.ConnectNamedPipe, kernel32.CallNamedPipe, System.IO.Pipes.NamedPipeClientStream::Connect, System.IO.Pipes.NamedPipeClientStream::ConnectAsync|
|[read pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/read/read-pipe.yml)|Interprocess Communication::Read Pipe (C0003.003)|kernel32.PeekNamedPipe, kernel32.ReadFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/communication/smtp-communication.md
+7
View File
@@ -36,3 +36,10 @@ This micro-behavior focuses on SMTP communication.
|---|---|---|
|**Request**|C0012.002|Makes SMTP request.|
|**Server Connect**|C0012.001|Connects to an SMTP server.|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[network_smtp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_smtp.py)|SMTP Communication (C0012)|--|
micro-behaviors/communication/socket-communication.md
+7 -1
View File
@@ -54,7 +54,6 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|**TCP Client**|C0001.008|TCP client behavior.|
|**UDP Client**|C0001.013|UDP client behavior.|
## Use in Malware
|Name|Date|Method|Description|
@@ -84,6 +83,13 @@ Instead of being listed alphabetically, methods have been grouped to better faci
|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[network_excessive_udp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_excessive_udp.py)|Socket Communication (C0001)|--|
|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Socket Communication (C0001)|send|
|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Socket Communication (C0001)|send|
|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|Socket Communication (C0001)|listen, bind|
## References
<a name="1">[1]</a> https://www.mandiant.com/resources/synful-knock-acis
micro-behaviors/communication/wininet.md
+6
View File
@@ -42,6 +42,12 @@ The methods below are those of most interest in malware analysis. Details can be
|**InternetReadFile**|C0005.004|Reads data from an open Internet file (URL data).|
|**InternetWriteFile**|C0005.005|Writes data to an open Internet file.|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|WinINet (C0005)|InternetOpenA, InternetOpenUrlA|
## References
<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions
micro-behaviors/cryptography/crypto-library.md
+5 -5
View File
@@ -41,8 +41,8 @@ Malware uses a crypto library.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[linked against Crypto++](https://github.com/mandiant/capa-rules/blob/master/linking/static/cryptopp/linked-against-crypto.yml)|Crypto Library (C0059)| |
|[linked against wolfCrypt](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfcrypt/linked-against-wolfcrypt.yml)|Crypto Library (C0059)| |
|[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)| |
|[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)| |
|[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)| |
|[linked against Crypto++](https://github.com/mandiant/capa-rules/blob/master/linking/static/cryptopp/linked-against-crypto.yml)|Crypto Library (C0059)|--|
|[linked against wolfCrypt](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfcrypt/linked-against-wolfcrypt.yml)|Crypto Library (C0059)|--|
|[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)|--|
|[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)|--|
|[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)|--|
micro-behaviors/cryptography/cryptographic-hash.md
+3 -3
View File
@@ -58,12 +58,12 @@ Malware may use a cryptographic hash.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[hash data via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/hash-data-via-wincrypt.yml)|Cryptographic Hash (C0029)|advapi32.CryptHashData, advapi32.CryptGetHashParam|
|[hash data using tiger](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/tiger/hash-data-using-tiger.yml)|Cryptographic Hash::Tiger (C0029.005)| |
|[hash data using tiger](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/tiger/hash-data-using-tiger.yml)|Cryptographic Hash::Tiger (C0029.005)|--|
|[hash data using SHA1](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha1/hash-data-using-sha1.yml)|Cryptographic Hash::SHA1 (C0029.002)|advapi32.CryptCreateHash, System.Security.Cryptography.SHA1Managed::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash|
|[hash data using SHA256](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha256/hash-data-using-sha256.yml)|Cryptographic Hash::SHA256 (C0029.003)|System.Security.Cryptography.SHA256Managed::Initialize, System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize, System.Security.Cryptography.SHA256::Create, System.Security.Cryptography.SHA256Managed::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash|
|[hash data with MD5](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/md5/hash-data-with-md5.yml)|Cryptographic Hash::MD5 (C0029.001)|advapi32.CryptCreateHash, System.Security.Cryptography.MD5::Create, System.Security.Cryptography.MD5CryptoServiceProvider::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash|
|[hash data using SHA224](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha224/hash-data-using-sha224.yml)|Cryptographic Hash::SHA224 (C0029.004)| |
|[resolve function by FIN8 fasthash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml)|Cryptographic Hash (C0029)| |
|[hash data using SHA224](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha224/hash-data-using-sha224.yml)|Cryptographic Hash::SHA224 (C0029.004)|--|
|[resolve function by FIN8 fasthash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml)|Cryptographic Hash (C0029)|--|
## References
micro-behaviors/cryptography/decrypt-data.md
+5 -2
View File
@@ -49,7 +49,6 @@ Malware may decrypt data.
|**Stream Cipher**|C0031.013|Malware decrypts data encrypted with a stream cipher.|
|**Twofish**|C0031.014|Malware decrypts data encrypted with the Twofish algorithm.|
## Use in Malware
|Name|Date|Method|Description|
@@ -62,7 +61,11 @@ Malware may decrypt data.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey|
|[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)| |
|[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decrypt Data (C0031)|CryptDecrypt|
## Code Snippets
micro-behaviors/cryptography/encrypt-data.md
+22 -17
View File
@@ -49,7 +49,6 @@ Malware may encrypt data.
|**Stream Cipher**|C0027.012|Malware encrypts with a stream cipher.|
|**Twofish**|C0027.005|Malware encrypts with the Twofish algorithm.|
## Use in Malware
|Name|Date|Method|Description|
@@ -76,26 +75,33 @@ Malware may encrypt data.
|---|---|---|
|[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Encrypt Data (C0027)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey|
|[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Encrypt Data (C0027)|memfrob|
|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Encrypt Data::HC-128 (C0027.006)| |
|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Encrypt Data::HC-128 (C0027.006)| |
|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Encrypt Data::RC6 (C0027.010)| |
|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Encrypt Data::Twofish (C0027.005)| |
|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Encrypt Data::AES (C0027.001)| |
|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Encrypt Data::HC-128 (C0027.006)|--|
|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Encrypt Data::HC-128 (C0027.006)|--|
|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Encrypt Data::RC6 (C0027.010)|--|
|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Encrypt Data::Twofish (C0027.005)|--|
|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Encrypt Data::AES (C0027.001)|--|
|[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Encrypt Data::AES (C0027.001)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Encrypt Data::AES (C0027.001)| |
|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Encrypt Data::AES (C0027.001)| |
|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)| |
|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)| |
|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)| |
|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Encrypt Data::AES (C0027.001)|--|
|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Encrypt Data::AES (C0027.001)|--|
|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)|--|
|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)|--|
|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)|--|
|[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect|
|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)| |
|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)|--|
|[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Encrypt Data::3DES (C0027.004)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)| |
|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)|--|
|[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Encrypt Data::RC4 (C0027.009)|CryptImportKey, CryptAcquireContext, CryptEncrypt|
|[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Encrypt Data::RC4 (C0027.009)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encrypt Data::RC4 (C0027.009)| |
|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Encrypt Data::Skipjack (C0027.013)| |
|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Encrypt Data::Blowfish (C0027.002)| |
|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encrypt Data::RC4 (C0027.009)|--|
|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Encrypt Data::Skipjack (C0027.013)|--|
|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Encrypt Data::Blowfish (C0027.002)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encrypt Data (C0027)|CryptEncrypt|
|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Encrypt Data (C0027)|CryptEncrypt|
|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW|
|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW|
## Code Snippets
@@ -155,7 +161,6 @@ retn
</pre>
</details>
## References
<a name="1">[1]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
micro-behaviors/cryptography/encryption-key.md
+7 -4
View File
@@ -30,7 +30,6 @@
Malware may import, generate, or otherwise use an encryption key.
## Methods
|Name|ID|Description|
@@ -38,7 +37,6 @@ Malware may import, generate, or otherwise use an encryption key.
|**Import Public Key**|C0028.001|Malware imports a public key.|
|**RC4 KSA**|C0028.002|Malware uses the RC4 Key Scheduling Algorithm (KSA).|
## Use in Malware
|Name|Date|Method|Description|
@@ -54,8 +52,13 @@ Malware may import, generate, or otherwise use an encryption key.
|---|---|---|
|[import public key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/import-public-key.yml)|Encryption Key::Import Public Key (C0028.001)|advapi32.CryptAcquireContext, crypt32.CryptImportPublicKeyInfo, crypt32.CryptStringToBinary, crypt32.CryptDecodeObjectEx|
|[create new key via CryptAcquireContext](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml)|Encryption Key (C0028)|advapi32.CryptAcquireContext|
|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encryption Key::RC4 KSA (C0028.002)| |
|[reference public RSA key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rsa/reference-public-rsa-key.yml)|Encryption Key (C0028)| |
|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encryption Key::RC4 KSA (C0028.002)|--|
|[reference public RSA key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rsa/reference-public-rsa-key.yml)|Encryption Key (C0028)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encryption Key (C0028)|CryptEncrypt|
|[generates_crypto_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/generates_crypto_key.py)|Encryption Key (C0028)|CryptGenKey, CryptExportKey|
## References
micro-behaviors/cryptography/generate-pseudorandom-sequence.md
+2 -2
View File
@@ -50,10 +50,10 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p
|Tool: capa|Mapping|APIs|
|---|---|---|
|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Generate Pseudo-random Sequence::RC4 PRGA (C0021.004)| |
|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Generate Pseudo-random Sequence::RC4 PRGA (C0021.004)|--|
|[generate random numbers via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-winapi.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|BCryptGenRandom, CryptGenRandom, BCryptOpenAlgorithmProvider, BCryptCloseAlgorithmProvider, CryptAquireContext|
|[generate random numbers via RtlGenRandom](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|SystemFunction036|
|[generate random numbers using a Mersenne Twister](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml)|Generate Pseudo-random Sequence (C0021)| |
|[generate random numbers using a Mersenne Twister](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml)|Generate Pseudo-random Sequence (C0021)|--|
## References
micro-behaviors/cryptography/hashed-message-authentication-code.md
+1 -1
View File
@@ -34,4 +34,4 @@ Malware uses a hashed message authentication code (HMAC) schema.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[authenticate HMAC](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hmac/authenticate-hmac.yml)|Hashed Message Authentication Code (C0061)| |
|[authenticate HMAC](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hmac/authenticate-hmac.yml)|Hashed Message Authentication Code (C0061)|--|
micro-behaviors/data/check-string.md
+2 -3
View File
@@ -30,7 +30,6 @@
Malware may check a string for some characteristics, such as being ASCII content, credit card number, or length.
## Use in Malware
|Name|Date|Method|Description|
@@ -41,8 +40,8 @@ Malware may check a string for some characteristics, such as being ASCII content
|Tool: capa|Mapping|APIs|
|---|---|---|
|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Check String (C0019)| |
|[parse credit card information](https://github.com/mandiant/capa-rules/blob/master/collection/credit-card/parse-credit-card-information.yml)|Check String (C0019)| |
|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Check String (C0019)|--|
|[parse credit card information](https://github.com/mandiant/capa-rules/blob/master/collection/credit-card/parse-credit-card-information.yml)|Check String (C0019)|--|
## References
micro-behaviors/data/checksum.md
+4 -6
View File
@@ -30,7 +30,6 @@
Malware may derive a checksum from some block of data. The checksum is often used for data validation.
## Methods
|Name|ID|Description|
@@ -40,7 +39,6 @@ Malware may derive a checksum from some block of data. The checksum is often use
|**CRC32**|C0032.001|Malware computes a CRC32 checksum.|
|**Luhn**|C0032.002|Malware uses Luhn algorithm, often to validate identification numbers (e.g, credit card number).|
## Use in Malware
|Name|Date|Method|Description|
@@ -54,11 +52,11 @@ Malware may derive a checksum from some block of data. The checksum is often use
|Tool: capa|Mapping|APIs|
|---|---|---|
|[validate payment card number using luhn algorithm](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml)|Checksum::Luhn (C0032.002)| |
|[compute adler32 checksum](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/adler32/compute-adler32-checksum.yml)|Checksum::Adler (C0032.005)| |
|[validate payment card number using luhn algorithm](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml)|Checksum::Luhn (C0032.002)|--||
|[compute adler32 checksum](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/adler32/compute-adler32-checksum.yml)|Checksum::Adler (C0032.005)|--||
|[hash data with CRC32](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/crc32/hash-data-with-crc32.yml)|Checksum::CRC32 (C0032.001)|RtlComputeCrc32|
|[validate payment card number using luhn algorithm with lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml)|Checksum::Luhn (C0032.002)| |
|[validate payment card number using luhn algorithm with no lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml)|Checksum::Luhn (C0032.002)| |
|[validate payment card number using luhn algorithm with lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml)|Checksum::Luhn (C0032.002)|--||
|[validate payment card number using luhn algorithm with no lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml)|Checksum::Luhn (C0032.002)|--||
## References
micro-behaviors/data/compress-data.md
+2 -2
View File
@@ -42,5 +42,5 @@ Malware may compress data.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[compress data via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-winapi.yml)|Compress Data (C0024)|RtlDecompressBuffer, RtlDecompressBufferEx, RtlDecompressBufferEx2, RtlCompressBuffer, RtlCompressBufferLZNT1|
|[compress data via ZLIB inflate or deflate](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml)|Compress Data (C0024)| |
|[compress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-using-lzo.yml)|Compress Data (C0024)| |
|[compress data via ZLIB inflate or deflate](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml)|Compress Data (C0024)|--|
|[compress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-using-lzo.yml)|Compress Data (C0024)|--|
micro-behaviors/data/compression-library.md
+2 -3
View File
@@ -28,7 +28,6 @@
# Compression Library
## Use in Malware
|Name|Date|Method|Description|
@@ -40,8 +39,8 @@
|Tool: capa|Mapping|APIs|
|---|---|---|
|[linked against aPLib](https://github.com/mandiant/capa-rules/blob/master/linking/static/aplib/linked-against-aplib.yml)|Compression Library (C0060)| |
|[linked against ZLIB](https://github.com/mandiant/capa-rules/blob/master/linking/static/zlib/linked-against-zlib.yml)|Compression Library (C0060)| |
|[linked against aPLib](https://github.com/mandiant/capa-rules/blob/master/linking/static/aplib/linked-against-aplib.yml)|Compression Library (C0060)|--||
|[linked against ZLIB](https://github.com/mandiant/capa-rules/blob/master/linking/static/zlib/linked-against-zlib.yml)|Compression Library (C0060)|--||
## References
micro-behaviors/data/decompress-data.md
+8 -4
View File
@@ -48,11 +48,15 @@ Malware may decompress data.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[decompress data using aPLib](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-aplib.yml)|Decompress Data::aPLib (C0025.003)| |
|[decompress data using aPLib](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-aplib.yml)|Decompress Data::aPLib (C0025.003)|--|
|[decompress data via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml)|Decompress Data::IEncodingFilterFactory (C0025.002)|ole32.CoCreateInstance|
|[decompress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-lzo.yml)|Decompress Data (C0025)| |
|[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)| |
|[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)| |
|[decompress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-lzo.yml)|Decompress Data (C0025)|--|
|[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)|--|
|[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decompress Data (C0025)|RtlDecompressBuffer|
## References
micro-behaviors/data/encode-data.md
+3 -3
View File
@@ -60,10 +60,10 @@ Malware may encode data.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Encode Data::XOR (C0026.002)| |
|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Encode Data::XOR (C0026.002)|--|
|[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Encode Data::Base64 (C0026.001)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars|
|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Encode Data::Base64 (C0026.001)| |
|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Encode Data::Base64 (C0026.001)| |
|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Encode Data::Base64 (C0026.001)|--|
|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Encode Data::Base64 (C0026.001)|--|
## References
micro-behaviors/data/modulo.md
+1 -1
View File
@@ -34,4 +34,4 @@ Malware calculates a modulo value.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[calculate modulo 256 via x86 assembly](https://github.com/mandiant/capa-rules/blob/master/lib/calculate-modulo-256-via-x86-assembly.yml)|Modulo (C0058)| |
|[calculate modulo 256 via x86 assembly](https://github.com/mandiant/capa-rules/blob/master/lib/calculate-modulo-256-via-x86-assembly.yml)|Modulo (C0058)|--||
micro-behaviors/data/noncryptographic-hash.md
+2 -2
View File
@@ -45,6 +45,6 @@ Malware may use a non-cryptographic hash.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[hash data using murmur3](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml)|Non-Cryptographic Hash::MurmurHash (C0030.001)| |
|[hash data using murmur3](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml)|Non-Cryptographic Hash::MurmurHash (C0030.001)|--|
|[hash data using fnv](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/fnv/hash-data-using-fnv.yml)|Non-Cryptographic Hash::FNV (C0030.005)|_allmul|
|[hash data using djb2](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/djb2/hash-data-using-djb2.yml)|Non-Cryptographic Hash::djb2 (C0030.006)| |
|[hash data using djb2](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/djb2/hash-data-using-djb2.yml)|Non-Cryptographic Hash::djb2 (C0030.006)|--|
micro-behaviors/file-system/alter-file-extension.md
+8
View File
@@ -35,3 +35,11 @@ Malware alters a file extension. This could be done for many reasons, including
|Name|ID|Description|
|---|---|---|
|**Append Extension**|C0015.001|A new extension is appended.|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Alter File Extension (C0015)|--|
|[mimics_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mimics_extension.py)|Alter File Extension (C0015)|--|
micro-behaviors/file-system/copy-file.md
+4 -1
View File
@@ -28,7 +28,6 @@
# Copy File
## Use in Malware
|Name|Date|Method|Description|
@@ -46,6 +45,10 @@
|---|---|---|
|[copy file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/copy/copy-file.yml)|Copy File (C0045)|kernel32.CopyFile, kernel32.CopyFileEx, CopyFile2, CopyFileTransacted, LZCopy, System.IO.FileInfo::CopyTo, System.IO.File::Copy, kernel32.SHFileOperation|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[injection_needextension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_needextension.py)|Copy File (C0045)|NtCreateUserProcess, CreateProcessInternalW|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/create-directory.md
+4
View File
@@ -46,6 +46,10 @@
|---|---|---|
|[create directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/create/create-directory.yml)|Create Directory (C0046)|kernel32.CreateDirectory, kernel32.CreateDirectoryEx, kernel32.CreateDirectoryTransacted, NtCreateDirectoryObject, ZwCreateDirectoryObject, SHCreateDirectory, SHCreateDirectoryEx, _mkdir, _wmkdir, System.IO.Directory::CreateDirectory, System.IO.DirectoryInfo::Create, System.IO.DirectoryInfo::CreateSubdirectory|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create Directory (C0046)|--|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/create-file.md
+25
View File
@@ -42,3 +42,28 @@ Malware creates a file.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[create or open file](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-file.yml)|Create File (C0016)|CreateFile, CreateFileEx, IoCreateFile, IoCreateFileEx, ZwOpenFile, ZwCreateFile, NtOpenFile, NtCreateFile, LZCreateFile, LZOpenFile, fopen, fopen64, fdopen, freopen, open, openat|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Create File (C0016)|NtWriteFile|
|[spreading_autoruninf](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spreading_autoruninf.py)|Create File (C0016)|--|
|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create File (C0016)|--|
|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Create File (C0016)|--|
|[nemty_note](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_note.py)|Create File (C0016)|NtWriteFile|
|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Create File (C0016)|--|
|[masslogger_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_files.py)|Create File (C0016)|--|
|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Create File (C0016)|NtWriteFile|
|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Create File (C0016)|NtCreateFile|
|[neshta_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_files.py)|Create File (C0016)|NtCreateFile|
|[copies_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/copies_self.py)|Create File (C0016)|--|
|[office_write_exe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_write_exe.py)|Create File (C0016)|NtWriteFile|
|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile|
|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Create File (C0016)|--|
|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File (C0016)|--|
|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File::Create Ransomware File (C0016.002)|--|
|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Create File (C0016)|--|
|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Create File (C0016)|--|
|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File (C0016)|--|
|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File::Create Office Document (C0016.001)|--|
|[qulab_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/qulab_files.py)|Create File (C0016)|--|
|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Create File (C0016)|--|
micro-behaviors/file-system/delete-directory.md
-1
View File
@@ -28,7 +28,6 @@
# Delete Directory
## Use in Malware
|Name|Date|Method|Description|
micro-behaviors/file-system/delete-file.md
+9 -1
View File
@@ -28,7 +28,6 @@
# Delete File
## Use in Malware
|Name|Date|Method|Description|
@@ -53,6 +52,15 @@
|---|---|---|
|[delete file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-file.yml)|Delete File (C0047)|kernel32.DeleteFile, DeleteFileTransacted, NtDeleteFile, ZwDeleteFile, remove, _wremove, System.IO.File::Delete, System.IO.FileSystemInfo::Delete, kernel32.SHFileOperation, MoveFileEx|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Delete File (C0047)|--|
|[removes_zoneid_ads](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_zoneid_ads.py)|Delete File (C0047)|DeleteFileW, DeleteFileA|
|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Delete File (C0047)|--|
|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Delete File (C0047)|DeleteFileW|
|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA|
|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/get-file-attributes.md
-1
View File
@@ -28,7 +28,6 @@
# Get File Attributes
## Use in Malware
|Name|Date|Method|Description|
micro-behaviors/file-system/move-file.md
+4 -1
View File
@@ -28,7 +28,6 @@
# Move File
## Use in Malware
|Name|Date|Method|Description|
@@ -46,6 +45,10 @@
|---|---|---|
|[move file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/move/move-file.yml)|Move File (C0063)|kernel32.MoveFile, kernel32.MoveFileEx, MoveFileWithProgress, MoveFileTransacted, rename, _wrename, System.IO.FileInfo::MoveTo, System.IO.File::Move, kernel32.SHFileOperation|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/read-file.md
+9 -1
View File
@@ -28,7 +28,6 @@
# Read File
## Use in Malware
|Name|Date|Method|Description|
@@ -57,6 +56,15 @@
|[read file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-file-on-linux.yml)|Read File (C0051)|fgetc, fgets, getc, getchar, read, getline, getdelim, fgetwc, getwc, fscanf, vfscanf, fread|
|[read .ini file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-ini-file.yml)|Read File (C0051)|GetPrivateProfileInt, GetPrivateProfileString, GetPrivateProfileStruct, GetPrivateProfileSection, GetPrivateProfileSectionNames, GetFullPathName|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[reads_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/reads_self.py)|Read File (C0051)|NtReadFile, NtSetInformationFile, NtClose, NtCreateFile, NtOpenFile|
|[accesses_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_sysvol.py)|Read File (C0051)|--|
|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Read File (C0051)|--|
|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|Read File (C0051)|--|
|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_browser.py)|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW|
|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Read File (C0051)|--|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/file-system/set-file-attributes.md
-1
View File
@@ -28,7 +28,6 @@
# Set File Attributes
## Use in Malware
|Name|Date|Method|Description|
micro-behaviors/file-system/writes-file.md
+12 -1
View File
@@ -28,7 +28,6 @@
# Writes File
## Use in Malware
|Name|Date|Method|Description|
@@ -54,6 +53,18 @@
|[write file on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-windows.yml)|Writes File (C0052)|kernel32.WriteFile, kernel32.WriteFileEx, NtWriteFile, ZwWriteFile, _fwrite, fwrite, System.IO.File::WriteAllBytes, System.IO.File::WriteAllBytesAsync, System.IO.File::WriteAllLines, System.IO.File::WriteAllLinesAsync, System.IO.File::WriteAllText, System.IO.File::WriteAllTextAsync, System.IO.File::AppendAllLines, System.IO.File::AppendAllLinesAsync, System.IO.File::AppendAllText, System.IO.File::AppendAllTextAsync, System.IO.File::AppendText, System.IO.FileInfo::AppendText|
|[create process memory minidump](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/dump/create-process-memory-minidump.yml)|Writes File (C0052)|dbghelp.MiniDumpWriteDump|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Writes File (C0052)|--|
|[masslogger_artifacts](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_artifacts.py)|Writes File (C0052)|CryptDecrypt, FindFirstFileExW|
|[masslogger_version](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_version.py)|Writes File (C0052)|NtWriteFile|
|[writes_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/writes_sysvol.py)|Writes File (C0052)|--|
|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Writes File (C0052)|NtWriteFile|
|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Writes File (C0052)|--|
|[apocalypse_stealer_file_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/apocalypse_stealer_file_behavior.py)|Writes File (C0052)|--|
|[echelon_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/echelon_files.py)|Writes File (C0052)|--|
|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/upatre_files.py)|Writes File (C0052)|--|
## References
<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
micro-behaviors/hardware/load-driver.md
+4
View File
@@ -41,3 +41,7 @@ Malware loads a device driver or minifilter.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[start minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/start-minifilter-driver.yml)|Load Driver::Minifilter (C0023.001)|FltStartFiltering|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_load.py)|Load Driver (C0023)|NtLoadDriver|
micro-behaviors/memory/allocate-memory.md
+7 -3
View File
@@ -48,10 +48,14 @@ Malware allocates memory, often to unpack itself.
|Tool: capa|Mapping|APIs|
|---|---|---|
|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)| |
|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)|--|
|[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory|
|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)| |
|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)| |
|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--|
|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--|
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
## References
micro-behaviors/memory/change-memory-protection.md
+5 -1
View File
@@ -37,7 +37,6 @@ Malware may change memory protection. For example, read-write memory may be chan
|**Executable Heap**|C0008.002|The heap is made executable.|
|**Executable Stack**|C0008.001|The stack is made executable.|
## Use in Malware
|Name|Date|Method|Description|
@@ -45,6 +44,11 @@ Malware may change memory protection. For example, read-write memory may be chan
|[**Ursnif**](../../xample-malware/ursnif.md)|2016|--|The malware changes the PE header of the child process to enable write access to that page and writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe in the target child process. The region protection is changed back to "read only" to avoid suspicion. [[1]](#1)|
|[**SYNful Knock**](../../xample-malware/synful-knock.md)|2015|--|SYNful Knock modifies the translation lookaside buffer (TLB) Read/Write attributes. [[2]](#2)|
## Detection
|Tool: CAPE|Mapping|APIs|
|---|---|---|
|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
## References

Some files were not shown because too many files have changed in this diff Show More