From d423b5a5faf50832d9c6808038cdd41283c2ca37 Mon Sep 17 00:00:00 2001 From: Ryan Xu Date: Tue, 5 Dec 2023 14:19:50 -0500 Subject: [PATCH] Adding CAPE mappings to detection section (#132) * Making spacing between sections consistent * Adding cape mappings --- anti-behavioral-analysis/capture-evasion.md | 1 - .../debugger-detection.md | 37 ++++-- anti-behavioral-analysis/debugger-evasion.md | 8 ++ .../dynamic-analysis-evasion.md | 12 ++ .../emulator-detection.md | 8 ++ .../memory-dump-evasion.md | 1 - anti-behavioral-analysis/sandbox-detection.md | 25 +++- .../virtual-machine-detection.md | 88 ++++++++++--- anti-static-analysis/disassembler-evasion.md | 2 +- .../executable-code-obfuscation.md | 25 ++-- anti-static-analysis/software-packing.md | 67 +++++++--- capa.md | 1 - cape.md | 1 - collection/cryptocurrency.md | 7 + collection/input-capture.md | 8 +- collection/keylogging.md | 9 +- collection/screen-capture.md | 8 +- command-and-control/c2-communication.md | 30 ++++- command-and-control/domain-name-generation.md | 7 + command-and-control/ingress-tool-transfer.md | 6 + .../alternative-installation-location.md | 2 - defense-evasion/bootkit.md | 10 ++ .../bypass-data-execution-prevention.md | 6 + .../disable-or-evade-security-tools.md | 44 ++++++- .../hidden-files-and-directories.md | 12 +- defense-evasion/hide-artifacts.md | 7 +- defense-evasion/hijack-execution-flow.md | 11 +- defense-evasion/indicator-blocking.md | 12 +- ...all-insecure-or-malicious-configuration.md | 12 ++ defense-evasion/modify-registry.md | 71 ++++++++++ .../obfuscated-files-or-information.md | 50 +++---- defense-evasion/polymorphic-code.md | 6 + defense-evasion/process-injection.md | 25 ++++ defense-evasion/rootkit.md | 8 +- defense-evasion/self-deletion.md | 8 +- discovery/analysis-tool-discovery.md | 13 +- discovery/application-window-discovery.md | 4 + discovery/code-discovery.md | 4 +- discovery/file-and-directory-discovery.md | 23 +++- discovery/self-discovery.md | 1 - discovery/system-information-discovery.md | 31 ++++- discovery/taskbar-discovery.md | 3 +- .../command-and-scripting-interpreter.md | 50 +++++++ execution/execution-dependency.md | 2 - .../exploitation-for-client-execution.md | 30 +++++ execution/install-additional-program.md | 11 +- execution/remote-commands.md | 16 +-- execution/send-email.md | 1 - execution/system-services.md | 1 - execution/user-execution.md | 1 - exfiltration/archive-collected-data.md | 11 +- exfiltration/automated-exfiltration.md | 1 - impact/clipboard-modification.md | 4 + impact/compromise-data-integrity.md | 1 - impact/data-destruction.md | 9 +- impact/data-encrypted-for-impact.md | 13 ++ impact/denial-of-service.md | 9 ++ impact/disk-wipe.md | 6 + impact/exploit-kit.md | 2 - impact/generate-traffic-from-victim.md | 1 - impact/manipulate-network-traffic.md | 1 - impact/remote-access.md | 47 ++++++- impact/resource-hijacking.md | 7 + lateral-movement/supply-chain-compromise.md | 1 - .../communication/dns-communication.md | 13 +- .../communication/http-communication.md | 31 ++++- .../communication/icmp-communication.md | 5 + .../interprocess-communication.md | 15 ++- .../communication/smtp-communication.md | 7 + .../communication/socket-communication.md | 8 +- micro-behaviors/communication/wininet.md | 6 + .../cryptography/crypto-library.md | 10 +- .../cryptography/cryptographic-hash.md | 6 +- micro-behaviors/cryptography/decrypt-data.md | 7 +- micro-behaviors/cryptography/encrypt-data.md | 39 +++--- .../cryptography/encryption-key.md | 11 +- .../generate-pseudorandom-sequence.md | 4 +- .../hashed-message-authentication-code.md | 2 +- micro-behaviors/data/check-string.md | 5 +- micro-behaviors/data/checksum.md | 10 +- micro-behaviors/data/compress-data.md | 4 +- micro-behaviors/data/compression-library.md | 5 +- micro-behaviors/data/decompress-data.md | 12 +- micro-behaviors/data/encode-data.md | 6 +- micro-behaviors/data/modulo.md | 2 +- micro-behaviors/data/noncryptographic-hash.md | 4 +- .../file-system/alter-file-extension.md | 8 ++ micro-behaviors/file-system/copy-file.md | 5 +- .../file-system/create-directory.md | 4 + micro-behaviors/file-system/create-file.md | 25 ++++ .../file-system/delete-directory.md | 1 - micro-behaviors/file-system/delete-file.md | 10 +- .../file-system/get-file-attributes.md | 1 - micro-behaviors/file-system/move-file.md | 5 +- micro-behaviors/file-system/read-file.md | 10 +- .../file-system/set-file-attributes.md | 1 - micro-behaviors/file-system/writes-file.md | 13 +- micro-behaviors/hardware/load-driver.md | 4 + micro-behaviors/memory/allocate-memory.md | 10 +- .../memory/change-memory-protection.md | 6 +- micro-behaviors/memory/heap-spray.md | 7 + micro-behaviors/memory/overflow-buffer.md | 1 - micro-behaviors/operating-system/console.md | 4 + .../operating-system/environment-variable.md | 2 +- micro-behaviors/operating-system/registry.md | 123 ++++++++++++++++++ micro-behaviors/operating-system/wallpaper.md | 4 + .../process/allocate-thread-local-storage.md | 1 - micro-behaviors/process/check-mutex.md | 7 + micro-behaviors/process/create-mutex.md | 54 ++++++++ micro-behaviors/process/create-process.md | 9 +- micro-behaviors/process/create-thread.md | 9 +- micro-behaviors/process/resume-thread.md | 1 - .../process/set-thread-local-storage-value.md | 1 - micro-behaviors/process/terminate-process.md | 4 + persistence/component-firmware.md | 1 - persistence/kernel-modules-and-extensions.md | 8 ++ persistence/malicious-network-driver.md | 1 - persistence/modify-existing-service.md | 10 ++ .../registry-run-keys-startup-folder.md | 8 +- xample-malware/adwind-jrat.md | 1 - xample-malware/attor.md | 3 - xample-malware/badusb.md | 3 - xample-malware/bagle.md | 2 - xample-malware/blackenergy.md | 2 - xample-malware/chopstick.md | 2 - xample-malware/clipminer.md | 2 - xample-malware/conficker.md | 1 - xample-malware/conti.md | 1 - xample-malware/cozycar.md | 2 - xample-malware/cryptolocker.md | 4 - xample-malware/cryptowall.md | 3 - xample-malware/dark-comet.md | 2 - xample-malware/dnschanger.md | 1 - xample-malware/drovorub.md | 3 - xample-malware/emotet.md | 1 - xample-malware/gamut.md | 4 - xample-malware/geneio.md | 2 - xample-malware/gobotkr.md | 4 - xample-malware/gravity-rat.md | 3 - xample-malware/heriplor.md | 1 - xample-malware/hupigon.md | 2 - xample-malware/kovter.md | 2 - xample-malware/kraken.md | 3 - xample-malware/locky-bart.md | 4 - xample-malware/matanbuchus.md | 4 - xample-malware/mazarbot.md | 3 - xample-malware/mebromi.md | 2 - xample-malware/netwalker.md | 2 - xample-malware/poison-ivy.md | 3 - xample-malware/redhip.md | 2 - xample-malware/rombertik.md | 2 - xample-malware/samsam.md | 3 - xample-malware/searchawesome.md | 2 - xample-malware/shamoon.md | 4 - xample-malware/stuxnet.md | 3 - xample-malware/synful-knock.md | 3 - xample-malware/teardrop.md | 2 - xample-malware/terminator.md | 4 - xample-malware/trickbot.md | 3 - xample-malware/up007.md | 4 - xample-malware/ursnif.md | 3 - xample-malware/vobfus.md | 5 - xample-malware/wannacry.md | 1 - xample-malware/webcobra.md | 4 - xample-malware/yispecter.md | 2 - yfaq/pafish.md | 1 - 166 files changed, 1273 insertions(+), 356 deletions(-) diff --git a/anti-behavioral-analysis/capture-evasion.md b/anti-behavioral-analysis/capture-evasion.md index f2c394a..3bba5cc 100644 --- a/anti-behavioral-analysis/capture-evasion.md +++ b/anti-behavioral-analysis/capture-evasion.md @@ -51,7 +51,6 @@ Malware has characteristics enabling it to evade capture from the infected syste |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.001|The malware downloads multiple payloads (as files and DLLs) that are stored in a memory buffer. [[4]](#4)| |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.003|Matanbuchus consists of 2 loaders. [[3]](#3) [[4]](#4)| - ## References [1] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/ diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index e832bf0..4b99d2a 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -41,7 +41,6 @@ While many methods are listed in the table below, among the most commonly used a Details on detecting debuggers can be found in the references. - ## Methods |Name|ID|Description| @@ -110,23 +109,41 @@ Details on detecting debuggers can be found in the references. |Tool: capa|Mapping|APIs| |---|---|---| -|[check for trap flag exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml)|Debugger Detection (B0001)| | -|[check for software breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml)|Debugger Detection::Software Breakpoints (B0001.025)| | +|[check for trap flag exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml)|Debugger Detection (B0001)|--| +|[check for software breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml)|Debugger Detection::Software Breakpoints (B0001.025)|--| |[check process job object](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml)|Debugger Detection (B0001)|kernel32.QueryInformationJobObject, kernel32.OpenProcess| -|[check for PEB BeingDebugged flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml)|Debugger Detection::Process Environment Block BeingDebugged (B0001.035)| | -|[check for time delay via GetTickCount](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)| | +|[check for PEB BeingDebugged flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml)|Debugger Detection::Process Environment Block BeingDebugged (B0001.035)|--| +|[check for time delay via GetTickCount](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|--| |[check for protected handle exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml)|Debugger Detection::SetHandleInformation (B0001.024)|SetHandleInformation, CloseHandle| |[check for OutputDebugString error](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml)|Debugger Detection::OutputDebugString (B0001.016)|kernel32.SetLastError, kernel32.GetLastError, kernel32.OutputDebugString| |[check for unexpected memory writes](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml)|Debugger Detection::Memory Write Watching (B0001.010)|kernel32.GetWriteWatch| -|[check for kernel debugger via shared user data structure](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml)|Debugger Detection (B0001)| | -|[check for time delay via QueryPerformanceCounter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml)|Debugger Detection::Timing/Delay Check QueryPerformanceCounter (B0001.033)| | +|[check for kernel debugger via shared user data structure](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml)|Debugger Detection (B0001)|--| +|[check for time delay via QueryPerformanceCounter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml)|Debugger Detection::Timing/Delay Check QueryPerformanceCounter (B0001.033)|--| |[check for hardware breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml)|Debugger Detection::Hardware Breakpoints (B0001.005)|kernel32.GetThreadContext| |[check ProcessDebugPort](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml)|Debugger Detection::NtQueryInformationProcess (B0001.012)|NtQueryInformationProcess| |[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::CheckRemoteDebuggerPresent (B0001.002)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent| |[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::WudfIsAnyDebuggerPresent (B0001.031)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent| -|[check for PEB NtGlobalFlag flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml)|Debugger Detection::Process Environment Block NtGlobalFlag (B0001.036)| | -|[execute anti-debugging instructions](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml)|Debugger Detection::Anti-debugging Instructions (B0001.034)| | -|[PEB access](https://github.com/mandiant/capa-rules/blob/master/lib/peb-access.yml)|Debugger Detection::Process Environment Block (B0001.019)| | +|[check for PEB NtGlobalFlag flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml)|Debugger Detection::Process Environment Block NtGlobalFlag (B0001.036)|--| +|[execute anti-debugging instructions](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml)|Debugger Detection::Anti-debugging Instructions (B0001.034)|--| +|[PEB access](https://github.com/mandiant/capa-rules/blob/master/lib/peb-access.yml)|Debugger Detection::Process Environment Block (B0001.019)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antidebug_checkremotedebuggerpresent](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_checkremotedebuggerpresent.py)|Debugger Detection (B0001)|CheckRemoteDebuggerPresent, NtQueryInformationProcess| +|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection (B0001)|LdrGetDllHandle, LdrLoadDll| +|[antiav_nthookengine_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_nthookengine_libs.py)|Debugger Detection::API Hook Detection (B0001.001)|LdrGetDllHandle, LdrLoadDll| +|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection (B0001)|SetUnhandledExceptionFilter| +|[antidebug_setunhandledexceptionfilter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_setunhandledexceptionfilter.py)|Debugger Detection::UnhandledExceptionFilter (B0001.030)|SetUnhandledExceptionFilter| +|[antidebug_addvectoredexceptionhandler](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_addvectoredexceptionhandler.py)|Debugger Detection (B0001)|AddVectoredExceptionHandler| +|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection (B0001)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA| +|[antidebug_outputdebugstring](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_outputdebugstring.py)|Debugger Detection::OutputDebugString (B0001.016)|GetLastError, SetLastError, OutputDebugStringW, OutputDebugStringA| +|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection (B0001)|GetTickCount| +|[antidebug_gettickcount](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_gettickcount.py)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)|GetTickCount| +|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection (B0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Detection::Memory Breakpoints (B0001.009)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection (B0001)|NtSetInformationThread| +|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Debugger Detection::NtSetInformationThread (B0001.014)|NtSetInformationThread| +|[antidebug_debugactiveprocess](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_debugactiveprocess.py)|Debugger Detection (B0001)|DebugActiveProcess| ## References diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index 2a41e65..2f9e5bb 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -89,6 +89,14 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162 |[hide thread from debugger](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml)|Debugger Evasion (B0002)|NtSetInformationThread, ZwSetInformationThread, GetCurrentThread| |[switch active desktop](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/switch-active-desktop.yml)|Debugger Evasion (B0002)|user32.CreateDesktop, user32.SwitchDesktop| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion (B0002)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Debugger Evasion::Guard Pages (B0002.008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Debugger Evasion (B0002)|NtCreateThreadEx| +|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion (B0002)|CreateProcessInternalW| +|[debugs_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/debugs_self.py)|Debugger Evasion::Self-Debugging (B0002.024)|CreateProcessInternalW| + ## References [1] https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md index a35ab18..2e51131 100644 --- a/anti-behavioral-analysis/dynamic-analysis-evasion.md +++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md @@ -73,6 +73,18 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |---|---|---| |[delay execution](https://github.com/mandiant/capa-rules/blob/master/lib/delay-execution.yml)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|kernel32.Sleep, kernel32.SleepEx, kernel32.WaitForSingleObject, kernel32.SignalObjectAndWait, kernel32.WaitForSingleObjectEx, kernel32.WaitForMultipleObjects, kernel32.WaitForMultipleObjectsEx, kernel32.RegisterWaitForSingleObject, WaitOnAddress, user32.MsgWaitForMultipleObjects, user32.MsgWaitForMultipleObjectsEx, NtDelayExecution, KeWaitForSingleObject, KeDelayExecutionThread, sleep, usleep| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion (B0003)|--| +|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Data Flood (B0003.002)|--| +|[api_spamming](https://github.com/CAPESandbox/community/tree/master/modules/signatures/api_spamming.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|--| +|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Dynamic Analysis Evasion (B0003)|NtSuspendThread| +|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion (B0003)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem| +|[antisandbox_restart](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_restart.py)|Dynamic Analysis Evasion::Restart (B0003.010)|ExitWindowsEx, InitiateSystemShutdownExW, NtSetSystemPowerState, InitiateSystemShutdownW, InitiateShutdownW, NtRaiseHardError, NtShutdownSystem| +|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion (B0003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime| +|[stealth_timeout](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_timeout.py)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|NtWaitForSingleObject, NtQuerySystemTime, NtTerminateProcess, GetLocalTime, NtDelayExecution, GetSystemTime, GetSystemTimeAsFileTime| +|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Dynamic Analysis Evasion (B0003)|--| + ## References [1] https://www.joesecurity.org/blog/4310408827727907098 diff --git a/anti-behavioral-analysis/emulator-detection.md b/anti-behavioral-analysis/emulator-detection.md index b4fcbfa..dd47196 100644 --- a/anti-behavioral-analysis/emulator-detection.md +++ b/anti-behavioral-analysis/emulator-detection.md @@ -55,6 +55,14 @@ Detects whether the malware instance is being executed inside an emulator. If so |---|---|---| |[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0004)|GetModuleHandle, GetProcAddress| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antiemu_windefend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_windefend.py)|Emulator Detection (B0004)|--| +|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection (B0004)|--| +|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--| +|[antiemu_wine_func](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_func.py)|Emulator Detection (B0004)|LdrGetProcedureAddress| +|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection (B0004)|--| +|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Emulator Detection::Check Emulator-related Registry Keys (B0004.003)|--| ## References diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md index 6c2e688..53d9681 100644 --- a/anti-behavioral-analysis/memory-dump-evasion.md +++ b/anti-behavioral-analysis/memory-dump-evasion.md @@ -55,7 +55,6 @@ Memory dump evasion is an anti-forensic technique in which malware hinders retri |---|---|---|---| |[**Kraken**](../xample-malware/kraken.md)|2008|--|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[4]](#4)| - ## Code Snippets ### B0006.011 Snippet diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index de40ead..9e281fb 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -50,7 +50,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |**Timing/Uptime Check**|B0007.009|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.| |**Test API Routines**|B0007.010|Calls Windows API routines with invalid arguments to identify error supression.| - ## Use in Malware |Name|Date|Method|Description| @@ -63,7 +62,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value. [[8]](#8)| |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a sandbox. [[9]](#9)| - ## Detection |Tool: capa|Mapping|APIs| @@ -75,7 +73,28 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |---|---|---| |[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--| |[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--| - +|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection (B0007)|--| +|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--| +|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection (B0007)|--| +|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|Sandbox Detection::Check Files (B0007.002)|--| +|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection (B0007)|NtDelayExecution| +|[antisandbox_sleep](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sleep.py)|Sandbox Detection::Timing/Date Check (B0007.008)|NtDelayExecution| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection (B0007)|SetWindowsHookExA, SetWindowsHookExW| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Sandbox Detection::Human User Check (B0007.003)|SetWindowsHookExA, SetWindowsHookExW| +|[antisandbox_foregroundwindows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_foregroundwindows.py)|Sandbox Detection (B0007)|GetForegroundWindow, NtDelayExecution| +|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_mutex.py)|Sandbox Detection (B0007)|--| +|[antisandbox_script_timer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_script_timer.py)|Sandbox Detection (B0007)|--| +|[antisandbox_sboxie_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll| +|[antisandbox_cuckoocrash](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoocrash.py)|Sandbox Detection (B0007)|--| +|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection (B0007)|--| +|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--| +|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection (B0007)|--| +|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|Sandbox Detection::Check Files (B0007.002)|--| +|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection (B0007)|--| +|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|Sandbox Detection::Check Files (B0007.002)|--| +|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Sandbox Detection (B0007)|NtOpenDirectoryObject| +|[antisandbox_sunbelt_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_libs.py)|Sandbox Detection (B0007)|LdrGetDllHandle, LdrLoadDll| +|[antisandbox_cuckoo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo.py)|Sandbox Detection (B0007)|--| ## Code Snippets diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index 0907df0..5b9fcb0 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -86,7 +86,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |**Unique Hardware/Firmware Check - I/O Communication Port**|B0009.025|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware. This method is related to Unprotect technique U1336.| |**Unique Hardware/Firmware Check - MAC Address**|B0009.028|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2) This method is related to Unprotect technique U1335.| - ## Use in Malware |Name|Date|Method|Description| @@ -104,28 +103,88 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t |[**Ursnif**](../xample-malware/ursnif.md)|2016|B0009.004|The malware checks if there are virtual machine processes running (Vbox, vmware, etc). [[11]](#11)| |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0009.012|The malware checks for an unmoving mouse cursor. [[12]](#12)| - ## Detection |Tool: capa|Mapping|APIs| |---|---|---| |[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Virtual Machine Detection (B0009)|GetModuleHandle| |[check for Windows sandbox via genuine state](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml)|Virtual Machine Detection (B0009)|SLIsGenuineLocal, UuidFromString| -|[reference anti-VM strings targeting Parallels](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml)|Virtual Machine Detection (B0009)| | -|[check for unmoving mouse cursor](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml)|Virtual Machine Detection::Human User Check (B0009.012)| | -|[reference anti-VM strings targeting VirtualPC](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml)|Virtual Machine Detection (B0009)| | -|[reference anti-VM strings targeting VMWare](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml)|Virtual Machine Detection (B0009)| | +|[reference anti-VM strings targeting Parallels](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml)|Virtual Machine Detection (B0009)|--| +|[check for unmoving mouse cursor](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml)|Virtual Machine Detection::Human User Check (B0009.012)|--| +|[reference anti-VM strings targeting VirtualPC](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml)|Virtual Machine Detection (B0009)|--| +|[reference anti-VM strings targeting VMWare](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml)|Virtual Machine Detection (B0009)|--| |[check for foreground window switch](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml)|Virtual Machine Detection::Human User Check (B0009.012)|Sleep| -|[detect VM via disk hardware WMI queries](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml)|Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)| | -|[reference anti-VM strings targeting Qemu](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml)|Virtual Machine Detection (B0009)| | -|[reference anti-VM strings targeting Xen](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml)|Virtual Machine Detection (B0009)| | -|[check for sandbox username or hostname](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml)|Virtual Machine Detection (B0009)| | -|[check for Windows sandbox via process name](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml)|Virtual Machine Detection (B0009)| | +|[detect VM via disk hardware WMI queries](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml)|Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)|--| +|[reference anti-VM strings targeting Qemu](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml)|Virtual Machine Detection (B0009)|--| +|[reference anti-VM strings targeting Xen](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml)|Virtual Machine Detection (B0009)|--| +|[check for sandbox username or hostname](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml)|Virtual Machine Detection (B0009)|--| +|[check for Windows sandbox via process name](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml)|Virtual Machine Detection (B0009)|--| |[check for Windows sandbox via dns suffix](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml)|Virtual Machine Detection (B0009)|GetAdaptersAddresses| -|[check for Windows sandbox via device](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml)|Virtual Machine Detection (B0009)| | -|[reference anti-VM strings targeting VirtualBox](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml)|Virtual Machine Detection (B0009)| | +|[check for Windows sandbox via device](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml)|Virtual Machine Detection (B0009)|--| +|[reference anti-VM strings targeting VirtualBox](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml)|Virtual Machine Detection (B0009)|--| |[check for Windows sandbox via registry](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml)|Virtual Machine Detection (B0009)|RegOpenKeyEx, RegEnumValue| -|[reference anti-VM strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml)|Virtual Machine Detection (B0009)| | +|[reference anti-VM strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml)|Virtual Machine Detection (B0009)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection (B0009)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile| +|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|Virtual Machine Detection::Modern Specs Check - Drive size (B0009.015)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile| +|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_mutex.py)|Virtual Machine Detection (B0009)|--| +|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection (B0009)|NtQueryDirectoryObject, NtOpenDirectoryObject| +|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|NtQueryDirectoryObject, NtOpenDirectoryObject| +|[antivm_network_adapters](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_network_adapters.py)|Virtual Machine Detection (B0009)|GetAdaptersAddresses| +|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection (B0009)|--| +|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--| +|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection (B0009)|WNetGetProviderNameW| +|[antivm_vbox_provname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_provname.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|WNetGetProviderNameW| +|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection (B0009)|--| +|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)|--| +|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|Virtual Machine Detection (B0009)|NtOpenEvent, NtCreateEvent| +|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--| +|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--| +|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection (B0009)|--| +|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|Virtual Machine Detection::Check Virtual Devices (B0009.008)|--| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection (B0009)|SetWindowsHookExA, SetWindowsHookExW| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Virtual Machine Detection::Human User Check (B0009.012)|SetWindowsHookExA, SetWindowsHookExW| +|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection (B0009)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA| +|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA| +|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll| +|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll| +|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection (B0009)|--| +|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection (B0009)|--| +|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection (B0009)|--| +|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection (B0009)|--| +|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--| +|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection (B0009)|LdrLoadDll| +|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|LdrLoadDll| +|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection (B0009)|--| +|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|Virtual Machine Detection::Check File and Directory Artifacts (B0009.001)|--| +|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA| +|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Virtual Machine Detection::Check Running Services (B0009.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA| +|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|Virtual Machine Detection (B0009)|SetupDiGetClassDevsA, SetupDiGetClassDevsW| +|[antisandbox_sboxie_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_objects.py)|Virtual Machine Detection (B0009)|NtOpenDirectoryObject| +|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Virtual Machine Detection::Check Registry Keys (B0009.005)|--| +|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection (B0009)|--| +|[antivm_vbox_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_window.py)|Virtual Machine Detection::Check Windows (B0009.009)|--| ## Code Snippets @@ -167,7 +226,6 @@ jmp short loc_401CBB - ## References [1] Check Point Research,"CP: Evasion Techniques," evasions.checkpoint.com, [Online]. Available: https://evasions.checkpoint.com. diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index 2eff33a..2507098 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -55,7 +55,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented |Tool: capa|Mapping|APIs| |---|---|---| -|[contain anti-disasm techniques](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml)|Disassembler Evasion (B0012)| | +|[contain anti-disasm techniques](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml)|Disassembler Evasion (B0012)|--| ## References diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index 5917747..0782114 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -79,19 +79,18 @@ For encryption and encoding characteristics of malware samples, as well as malwa |Tool: capa|Mapping|APIs| |---|---|---| -|[obfuscated with ADVobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with DeepSea Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with callobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with Dotfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with vs-obfuscation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-vs-obfuscation.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with Spices.Net Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with Babel Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with SmartAssembly](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-smartassembly.yml)|Executable Code Obfuscation (B0032)| | -|[obfuscated with Yano](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-yano.yml)|Executable Code Obfuscation (B0032)| | -|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Argument Obfuscation (B0032.020)| | -|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Stack Strings (B0032.017)| | -|[use .NET library EncryptDecryptUtils](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml)|Executable Code Obfuscation (B0032)| | - +|[obfuscated with ADVobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with DeepSea Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with callobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with Dotfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with vs-obfuscation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-vs-obfuscation.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with Spices.Net Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with Babel Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with SmartAssembly](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-smartassembly.yml)|Executable Code Obfuscation (B0032)|--| +|[obfuscated with Yano](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-yano.yml)|Executable Code Obfuscation (B0032)|--| +|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Argument Obfuscation (B0032.020)|--| +|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Stack Strings (B0032.017)|--| +|[use .NET library EncryptDecryptUtils](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml)|Executable Code Obfuscation (B0032)|--| ## Code Snippets diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index ef32eba..925d244 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -68,27 +68,54 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software |Tool: capa|Mapping|APIs| |---|---|---| -|[packed with pebundle](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pebundle/packed-with-pebundle.yml)|Software Packing (F0001)| | -|[packed with Themida](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/themida/packed-with-themida.yml)|Software Packing::Themida (F0001.011)| | -|[packed with VMProtect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml)|Software Packing::VMProtect (F0001.010)| | -|[packed with y0da crypter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml)|Software Packing (F0001)| | -|[packed with pelocknt](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml)|Software Packing (F0001)| | -|[packed with GoPacker](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/gopacker/packed-with-gopacker.yml)|Software Packing::Standard Compression (F0001.002)| | -|[packed with Confuser](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/confuser/packed-with-confuser.yml)|Software Packing::Confuser (F0001.009)| | -|[packed with rlpack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/rlpack/packed-with-rlpack.yml)|Software Packing (F0001)| | -|[packed with ASPack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/aspack/packed-with-aspack.yml)|Software Packing (F0001)| | -|[packed with generic packer](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/generic/packed-with-generic-packer.yml)|Software Packing::Standard Compression (F0001.002)| | -|[packed with amber](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/amber/packed-with-amber.yml)|Software Packing (F0001)| | -|[packed with petite](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/petite/packed-with-petite.yml)|Software Packing (F0001)| | -|[packed with peshield](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/peshield/packed-with-peshield.yml)|Software Packing (F0001)| | -|[packed with UPX](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upx/packed-with-upx.yml)|Software Packing::UPX (F0001.008)| | -|[packed with upack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upack/packed-with-upack.yml)|Software Packing (F0001)| | -|[packed with PECompact](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pecompact/packed-with-pecompact.yml)|Software Packing (F0001)| | -|[packed with Huan](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/huan/packed-with-huan.yml)|Software Packing (F0001)| | -|[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)| | -|[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)| | -|[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)| | +|[packed with pebundle](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pebundle/packed-with-pebundle.yml)|Software Packing (F0001)|--| +|[packed with Themida](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/themida/packed-with-themida.yml)|Software Packing::Themida (F0001.011)|--| +|[packed with VMProtect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml)|Software Packing::VMProtect (F0001.010)|--| +|[packed with y0da crypter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml)|Software Packing (F0001)|--| +|[packed with pelocknt](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml)|Software Packing (F0001)|--| +|[packed with GoPacker](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/gopacker/packed-with-gopacker.yml)|Software Packing::Standard Compression (F0001.002)|--| +|[packed with Confuser](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/confuser/packed-with-confuser.yml)|Software Packing::Confuser (F0001.009)|--| +|[packed with rlpack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/rlpack/packed-with-rlpack.yml)|Software Packing (F0001)|--| +|[packed with ASPack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/aspack/packed-with-aspack.yml)|Software Packing (F0001)|--| +|[packed with generic packer](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/generic/packed-with-generic-packer.yml)|Software Packing::Standard Compression (F0001.002)|--| +|[packed with amber](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/amber/packed-with-amber.yml)|Software Packing (F0001)|--| +|[packed with petite](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/petite/packed-with-petite.yml)|Software Packing (F0001)|--| +|[packed with peshield](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/peshield/packed-with-peshield.yml)|Software Packing (F0001)|--| +|[packed with UPX](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upx/packed-with-upx.yml)|Software Packing::UPX (F0001.008)|--| +|[packed with upack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upack/packed-with-upack.yml)|Software Packing (F0001)|--| +|[packed with PECompact](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pecompact/packed-with-pecompact.yml)|Software Packing (F0001)|--| +|[packed with Huan](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/huan/packed-with-huan.yml)|Software Packing (F0001)|--| +|[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)|--| +|[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)|--| +|[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)|--| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[packer_nspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nspack.py)|Software Packing (F0001)|--| +|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing (F0001)|--| +|[packer_vmprotect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_vmprotect.py)|Software Packing::VMProtect (F0001.010)|--| +|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing (F0001)|--| +|[packer_confuser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_confuser.py)|Software Packing::Confuser (F0001.009)|--| +|[packer_smartassembly](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_smartassembly.py)|Software Packing (F0001)|--| +|[packer_mpress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_mpress.py)|Software Packing (F0001)|--| +|[packer_enigma](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_enigma.py)|Software Packing (F0001)|--| +|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Software Packing (F0001)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|[packer_aspirecrypt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspirecrypt.py)|Software Packing (F0001)|--| +|[packer_nate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_nate.py)|Software Packing (F0001)|--| +|[packer_entropy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_entropy.py)|Software Packing (F0001)|--| +|[packer_unknown_pe_section_name](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_unknown_pe_section_name.py)|Software Packing (F0001)|--| +|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing (F0001)|--| +|[packer_upx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_upx.py)|Software Packing::UPX (F0001.008)|--| +|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing (F0001)|--| +|[packer_aspack](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_aspack.py)|Software Packing::ASPack (F0001.013)|--| +|[packer_bedsprotector](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_bedsprotector.py)|Software Packing (F0001)|--| +|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|FindWindowA| +|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|FindWindowA| +|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing (F0001)|--| +|[packer_themida](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_themida.py)|Software Packing::Themida (F0001.011)|--| +|[packer_spices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_spices.py)|Software Packing (F0001)|--| +|[packer_yoda](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_yoda.py)|Software Packing (F0001)|--| +|[packer_titan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_titan.py)|Software Packing (F0001)|--| ## References diff --git a/capa.md b/capa.md index f966586..4983247 100644 --- a/capa.md +++ b/capa.md @@ -54,7 +54,6 @@ The histograms below show the number of capa rules mapped into ATT&CK techniques |**Operating System**|11| **XXXXXXXXXXX** | |**Process**|14| **XXXXXXXXXXXXXX** | - ## ATT&CK MAPPINGS ## ### Reconnaissance ### diff --git a/cape.md b/cape.md index b85df42..261129a 100644 --- a/cape.md +++ b/cape.md @@ -90,7 +90,6 @@ This histogram indicates the number of CAPE signatures that map to an MBC micro- |**Process**|72| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** | |**Operating System**|94| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** | - ## ATT&CK MAPPINGS ## ### Reconnaissance ### diff --git a/collection/cryptocurrency.md b/collection/cryptocurrency.md index c7ddaca..48f4824 100644 --- a/collection/cryptocurrency.md +++ b/collection/cryptocurrency.md @@ -43,6 +43,13 @@ Malware accesses files that contain sensitive data or credentials related to Bit |---|---|---|---| |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency (B0028)|--| +|[infostealer_bitcoin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_bitcoin.py)|Cryptocurrency::Bitcoin (B0028.001)|--| + ## References [1] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ \ No newline at end of file diff --git a/collection/input-capture.md b/collection/input-capture.md index 78ef71b..2d48f4b 100644 --- a/collection/input-capture.md +++ b/collection/input-capture.md @@ -52,7 +52,13 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), |Tool: capa|Mapping|APIs| |---|---|---| -|[use .NET library SharpClipboard](https://github.com/mandiant/capa-rules/blob/master/collection/use-dotnet-library-sharpclipboard.yml)|Input Capture (E1056)| | +|[use .NET library SharpClipboard](https://github.com/mandiant/capa-rules/blob/master/collection/use-dotnet-library-sharpclipboard.yml)|Input Capture (E1056)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture (E1056)|SetWindowsHookExA, SetWindowsHookExW| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Input Capture::Mouse Events (E1056.m01)|SetWindowsHookExA, SetWindowsHookExW| +|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Input Capture (E1056)|JsEval, COleScript_ParseScriptText, COleScript_Compile| ## References diff --git a/collection/keylogging.md b/collection/keylogging.md index c345dbc..ec098df 100644 --- a/collection/keylogging.md +++ b/collection/keylogging.md @@ -39,7 +39,6 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te |**Application Hook**|F0002.001|Keystrokes are captured with an application hook.| |**Polling**|F0002.002|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).| - ## Use in Malware |Name|Date|Method|Description| @@ -63,7 +62,13 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te |Tool: capa|Mapping|APIs| |---|---|---| |[log keystrokes via polling](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-polling.yml)|Keylogging::Polling (F0002.002)|user32.GetAsyncKeyState, user32.GetKeyState, user32.GetKeyboardState, user32.VkKeyScan, user32.VkKeyScanEx, user32.GetKeyNameText| -|[log keystrokes via application hook](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-application-hook.yml)|Keylogging::Application Hook (F0002.001)| | +|[log keystrokes via application hook](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-application-hook.yml)|Keylogging::Application Hook (F0002.001)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging (F0002)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW| +|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Keylogging::Application Hook (F0002.001)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW| +|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|Keylogging (F0002)|JsEval, COleScript_ParseScriptText, COleScript_Compile| ## References diff --git a/collection/screen-capture.md b/collection/screen-capture.md index 4a2e4bc..4190a7f 100644 --- a/collection/screen-capture.md +++ b/collection/screen-capture.md @@ -38,7 +38,6 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/ |---|---|---| |**WinAPI**|E1113.m01|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).| - ## Use in Malware |Name|Date|Method|Description| @@ -56,7 +55,12 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/ |Tool: capa|Mapping|APIs| |---|---|---| |[capture screenshot](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot.yml)|Screen Capture::WinAPI (E1113.m01)|user32.GetWindowDC, user32.GetDC, gdi32.CreateDC, gdi32.BitBlt, gdi32.GetDIBits, gdi32.CreateCompatibleDC, gdi32.CreateCompatibleBitmap, user32.GetSystemMetrics = fetch screen dimensions, user32.GetDesktopWindow = get entire desktop, BitBlt, System.Drawing.Graphics::CopyFromScreen| -|[capture screenshot via keybd event](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot-via-keybd-event.yml)|Screen Capture (E1113)| | +|[capture screenshot via keybd event](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot-via-keybd-event.yml)|Screen Capture (E1113)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Screen Capture (E1113)|--| +|[captures_screenshot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/captures_screenshot.py)|Screen Capture (E1113)|LdrGetProcedureAddress, NtCreateFile| ## References diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md index 4136b93..51c4aa6 100644 --- a/command-and-control/c2-communication.md +++ b/command-and-control/c2-communication.md @@ -55,7 +55,6 @@ As "server" and "client" are confusing terminology, we use the terms "controller |**Server to Client File Transfer**|B0030.003|File is transferred from controller to implant.| |**Start Interactive Shell**|B0030.016|Starts an interactive shell using a built-in program (e.g. cmd.exe, PowerShell, bash). This is often implemented with polling the network connection from the controller for text commands to redirect to the shell's stdin and polling the shell's stdout and stderr to redirect over the network to the controller. This differs from Execute Shell Command because the shell process runs across multiple iterations of the recv-command(s)-send-result loop.| - ## Use in Malware |Name|Date|Method|Description| @@ -96,9 +95,31 @@ As "server" and "client" are confusing terminology, we use the terms "controller |Tool: capa|Mapping|APIs| |---|---|---| -|[send data](https://github.com/mandiant/capa-rules/blob/master/communication/send-data.yml)|C2 Communication::Send Data (B0030.001)| | -|[receive data](https://github.com/mandiant/capa-rules/blob/master/communication/receive-data.yml)|C2 Communication::Receive Data (B0030.002)| | -|[download and write a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/download-and-write-a-file.yml)|C2 Communication::Server to Client File Transfer (B0030.003)| | +|[send data](https://github.com/mandiant/capa-rules/blob/master/communication/send-data.yml)|C2 Communication::Send Data (B0030.001)|--| +|[receive data](https://github.com/mandiant/capa-rules/blob/master/communication/receive-data.yml)|C2 Communication::Receive Data (B0030.002)|--| +|[download and write a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/download-and-write-a-file.yml)|C2 Communication::Server to Client File Transfer (B0030.003)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|C2 Communication (B0030)|ConnectEx, URLDownloadToFileW| +|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication (B0030)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW| +|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|C2 Communication::Check for Payload (B0030.005)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW| +|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|C2 Communication (B0030)|--| +|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|C2 Communication (B0030)|--| +|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|C2 Communication (B0030)|HttpOpenRequestA, HttpSendRequestA| +|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|C2 Communication (B0030)|InternetOpenA, InternetOpenUrlA| +|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|C2 Communication (B0030)|--| +|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|C2 Communication (B0030)|--| +|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|C2 Communication (B0030)|--| +|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|C2 Communication (B0030)|DnsQuery_A, DnsQuery_W| +|[network_questionable_host](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_questionable_host.py)|C2 Communication (B0030)|--| +|[injection_network_traffic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_network_traffic.py)|C2 Communication (B0030)|HttpOpenRequestA, URLDownloadToFileW, HttpOpenRequestW, InternetConnectW, InternetConnectA, connect, InternetCrackUrlW, InternetCrackUrlA, WSASend| +|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|C2 Communication (B0030)|listen, bind| +|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile| +|[network_country_distribution](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_country_distribution.py)|C2 Communication (B0030)|--| +|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|C2 Communication (B0030)|--| +|[network_dyndns](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dyndns.py)|C2 Communication (B0030)|--| +|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|C2 Communication (B0030)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile| ## Code Snippets @@ -122,7 +143,6 @@ jmp short loc_4019A2 - ## References [1] https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/ diff --git a/command-and-control/domain-name-generation.md b/command-and-control/domain-name-generation.md index d4447a2..0388dc6 100644 --- a/command-and-control/domain-name-generation.md +++ b/command-and-control/domain-name-generation.md @@ -43,6 +43,13 @@ This behavior is related to Unprotect technique U0906. |[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware uses an internal domain generation algorithm. [[4]](#4)| |[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Previous interations of Ursnif have used a Domain Name Generation algorithm. [[5]](#5)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[whois_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/whois_create.py)|Domain Name Generation (B0031)|--| +|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|Domain Name Generation (B0031)|--| +|[network_dga_fraunhofer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga_fraunhofer.py)|Domain Name Generation (B0031)|--| ## References diff --git a/command-and-control/ingress-tool-transfer.md b/command-and-control/ingress-tool-transfer.md index 3e3f890..c4d0f4e 100644 --- a/command-and-control/ingress-tool-transfer.md +++ b/command-and-control/ingress-tool-transfer.md @@ -49,6 +49,12 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques |[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut receives files from the C2. [[10]](#10)| |[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[11]](#11)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[suspicious_mpcmdrun_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_mpcmdrun_use.py)|Ingress Tool Transfer (E1105)|--| +|[network_document_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_file.py)|Ingress Tool Transfer (E1105)|URLDownloadToFileW, HttpOpenRequestW, send, InternetCrackUrlW, InternetCrackUrlA, WSASend, URLDownloadToCacheFileW| ## References diff --git a/defense-evasion/alternative-installation-location.md b/defense-evasion/alternative-installation-location.md index fc5ec47..96add08 100644 --- a/defense-evasion/alternative-installation-location.md +++ b/defense-evasion/alternative-installation-location.md @@ -32,7 +32,6 @@ Malware may install itself in areas other than the hard drive [[1]](#1). Other p While the definition of fileless malware can be ambiguous, here it represents malware that lives in memory only, not on disk, and it does not preclude fileless malware from using files on the system. Microsoft and Zeltser have addressed this ambiguity by providing more context in [[4]](#4) and [[5]](#5), respectively. - ## Methods |Name|ID|Description| @@ -47,7 +46,6 @@ While the definition of fileless malware can be ambiguous, here it represents ma |[**Kovter**](../xample-malware/kovter.md)|2016|B0027.002|Kovter stores malware files in the Registry instead of on the hard drive. [[1]](#1)| |[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|B0027.001|100 memory-resident modules can be installed. [[6]](#6)| - ## References [1] https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem. diff --git a/defense-evasion/bootkit.md b/defense-evasion/bootkit.md index d1eb5c3..47b7e8c 100644 --- a/defense-evasion/bootkit.md +++ b/defense-evasion/bootkit.md @@ -39,6 +39,16 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma |[**Mebromi**](../xample-malware/mebromi.md)|2011|--|The malware is an MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [[2]](#24)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Bootkit (F0013)|--| +|[bootkit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bootkit.py)|Bootkit (F0013)|NtSetInformationFile, NtClose, DeviceIoControl, NtCreateFile, NtDuplicateObject, NtOpenFile, NtWriteFile, NtDeviceIoControlFile| +|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Bootkit (F0013)|--| +|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Bootkit (F0013)|--| +|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Bootkit (F0013)|--| +|[suspicious_ioctl_scsipassthough](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ioctl_scsipassthough.py)|Bootkit (F0013)|DeviceIoControl, NtDeviceIoControlFile| ## References diff --git a/defense-evasion/bypass-data-execution-prevention.md b/defense-evasion/bypass-data-execution-prevention.md index b5b7bc2..c9688ca 100644 --- a/defense-evasion/bypass-data-execution-prevention.md +++ b/defense-evasion/bypass-data-execution-prevention.md @@ -36,6 +36,12 @@ Malware may bypass Data Execution Prevention (DEP). |---|---|---| |**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[dep_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dep_bypass.py)|Bypass Data Execution Prevention (B0037)|VirtualProtectEx, NtProtectVirtualMemory| + ## References [1] https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce \ No newline at end of file diff --git a/defense-evasion/disable-or-evade-security-tools.md b/defense-evasion/disable-or-evade-security-tools.md index 45983dc..df9beed 100644 --- a/defense-evasion/disable-or-evade-security-tools.md +++ b/defense-evasion/disable-or-evade-security-tools.md @@ -61,12 +61,50 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta |Tool: capa|Mapping|APIs| |---|---|---| -|[64-bit execution via heavens gate](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml)|Disable or Evade Security Tools::Heavens Gate (F0004.008)| | +|[64-bit execution via heavens gate](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml)|Disable or Evade Security Tools::Heavens Gate (F0004.008)|--| |[patch Event Tracing for Windows function](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml)|Disable or Evade Security Tools (F0004)|kernel32.VirtualProtect, ntdll.NtProtectVirtualMemory, ZwProtectVirtualMemory| |[block operations on executable memory pages using Arbitrary Code Guard](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|SetProcessMitigationPolicy| |[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute| -|[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)| | -|[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)| | +|[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|--| +|[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Disable or Evade Security Tools (F0004)|--| +|[clickfraud_volume](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_volume.py)|Disable or Evade Security Tools (F0004)|CoInternetSetFeatureEnabled| +|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_1.py)|Disable or Evade Security Tools (F0004)|--| +|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_2.py)|Disable or Evade Security Tools (F0004)|--| +|[antisandbox_suspend](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_suspend.py)|Disable or Evade Security Tools (F0004)|NtSuspendThread| +|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_servicestop.py)|Disable or Evade Security Tools (F0004)|OpenServiceA, ControlService, OpenServiceW| +|[disables_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_security.py)|Disable or Evade Security Tools (F0004)|--| +|[antiav_whitespace](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_whitespace.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_windows_file_protection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_file_protection.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_crashdumps](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_crashdumps.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--| +|[clickfraud_cookies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clickfraud_cookies.py)|Disable or Evade Security Tools (F0004)|InternetSetOptionA| +|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools (F0004)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW| +|[disables_wfp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wfp.py)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)|NtWriteFile, CopyFileA, CopyFileExW, CopyFileW| +|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools (F0004)|--| +|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--| +|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Disable or Evade Security Tools (F0004)|--| +|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools (F0004)|--| +|[antisandbox_unhook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_unhook.py)|Disable or Evade Security Tools::Unhook APIs (F0004.003)|--| +|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_windows_defender](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Disable or Evade Security Tools (F0004)|--| +|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Disable or Evade Security Tools (F0004)|--| +|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Disable or Evade Security Tools (F0004)|--| +|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Disable or Evade Security Tools (F0004)|--| +|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools (F0004)|--| +|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Disable or Evade Security Tools::Modify Policy (F0004.005)|--| +|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Disable or Evade Security Tools (F0004)|--| ## References diff --git a/defense-evasion/hidden-files-and-directories.md b/defense-evasion/hidden-files-and-directories.md index 39f1810..d5c564d 100644 --- a/defense-evasion/hidden-files-and-directories.md +++ b/defense-evasion/hidden-files-and-directories.md @@ -43,7 +43,6 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https:// |**Location**|F0005.002|Malware may change or choose the location of itself, another file, or a directory to prevent detection.| |**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.| - ## Use in Malware |Name|Date|Method|Description| @@ -56,6 +55,17 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https:// |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.001|The malware also appends the filename and extension .ocx to the ProgramData folder path. [[5]](#5) [[6]](#6)| |[**WannaCry**](../xample-malware/wannacry.md)|2017|F0005.003|WannaCry uses the +h attribute to hide its files. [[7]](#7)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories (F0005)|--| +|[spoofs_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spoofs_procname.py)|Hidden Files and Directories::Location (F0005.002)|--| +|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories (F0005)|--| +|[pe_compile_timestomping](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pe_compile_timestomping.py)|Hidden Files and Directories::Timestamp (F0005.004)|--| +|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Hidden Files and Directories (F0005)|--| +|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Hidden Files and Directories (F0005)|--| +|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Hidden Files and Directories (F0005)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile| ## References diff --git a/defense-evasion/hide-artifacts.md b/defense-evasion/hide-artifacts.md index 8d40a70..9c0a007 100644 --- a/defense-evasion/hide-artifacts.md +++ b/defense-evasion/hide-artifacts.md @@ -42,7 +42,6 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/ |**Hidden Processes**|E1564.m03|Hides processes used by the adversary or malware instance. This can involve techniques such as process list unlinking.| |**Hidden Services**|E1564.m04|Hides any system services that the malware instance creates or injects itself into. Services can be hidden by hiding associated registry keys.| - ## Use in Malware |Name|Date|Method|Description| @@ -50,6 +49,12 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/ |[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users. [[1]](#1)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications, such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removable drives. [[2]](#2)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[stealth_window](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_window.py)|Hide Artifacts (E1564)|ShellExecuteExW, CreateProcessInternalW| + ## References [1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/defense-evasion/hijack-execution-flow.md b/defense-evasion/hijack-execution-flow.md index 77724fe..611e863 100644 --- a/defense-evasion/hijack-execution-flow.md +++ b/defense-evasion/hijack-execution-flow.md @@ -70,10 +70,19 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques |Tool: capa|Mapping|APIs| |---|---|---| -|[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)| | +|[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)|--| |[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats| |[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW| +|[infostealer_keylog](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_keylog.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, GetAsyncKeyState, SetWindowsHookExW| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow (F0015)|SetWindowsHookExA, SetWindowsHookExW| +|[antisandbox_mouse_hook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_mouse_hook.py)|Hijack Execution Flow::Procedure Hooking (F0015.007)|SetWindowsHookExA, SetWindowsHookExW| +|[dll_load_uncommon_file_types](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dll_load_uncommon_file_types.py)|Hijack Execution Flow (F0015)|LdrLoadDll| +|[malicious_dynamic_function_loading](https://github.com/CAPESandbox/community/tree/master/modules/signatures/malicious_dynamic_function_loading.py)|Hijack Execution Flow (F0015)|LdrGetProcedureAddress, LdrLoadDll| + ## References [1] https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf diff --git a/defense-evasion/indicator-blocking.md b/defense-evasion/indicator-blocking.md index 896d2cd..45e20bb 100644 --- a/defense-evasion/indicator-blocking.md +++ b/defense-evasion/indicator-blocking.md @@ -38,7 +38,6 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi |---|---|---| |**Remove SMS Warning Messages**|F0006.001|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.| - ## Use in Malware |Name|Date|Method|Description| @@ -48,6 +47,17 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi |[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|The malware can disable security center functions like anti-virus and firewall. [[3]](#3)| |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[4]](#4)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Indicator Blocking (F0006)|--| +|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Indicator Blocking (F0006)|--| +|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Indicator Blocking (F0006)|--| +|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Indicator Blocking (F0006)|--| +|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Indicator Blocking (F0006)|NtCreateKey, NtSetValueKey| +|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Indicator Blocking (F0006)|--| +|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Indicator Blocking (F0006)|--| ## References diff --git a/defense-evasion/install-insecure-or-malicious-configuration.md b/defense-evasion/install-insecure-or-malicious-configuration.md index 7eef4dd..a80eba8 100644 --- a/defense-evasion/install-insecure-or-malicious-configuration.md +++ b/defense-evasion/install-insecure-or-malicious-configuration.md @@ -37,6 +37,18 @@ Malware may install malicious configuration settings or may modify existing conf |[**Black Energy**](../xample-malware/blackenergy.md)|2007|--|Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [[1]](#1)| |[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware changes iOS Safari's default configuration. [[2]](#2)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Install Insecure or Malicious Configuration (B0047)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW| +|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Install Insecure or Malicious Configuration (B0047)|--| +|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Install Insecure or Malicious Configuration (B0047)|--| +|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Install Insecure or Malicious Configuration (B0047)|--| +|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Install Insecure or Malicious Configuration (B0047)|--| +|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Install Insecure or Malicious Configuration (B0047)|--| +|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Install Insecure or Malicious Configuration (B0047)|--| +|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Install Insecure or Malicious Configuration (B0047)|--| ## References diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md index 5996d72..a6b809a 100644 --- a/defense-evasion/modify-registry.md +++ b/defense-evasion/modify-registry.md @@ -45,6 +45,77 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112 |[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK may encrypt and store configuration data inside a registry key. [[7]](#7)| |[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer edits the registry. [[8]](#8)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Modify Registry (E1112)|--| +|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Modify Registry (E1112)|--| +|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Modify Registry (E1112)|--| +|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Modify Registry (E1112)|--| +|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_networking_icon.py)|Modify Registry (E1112)|--| +|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Modify Registry (E1112)|--| +|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_power_options.py)|Modify Registry (E1112)|--| +|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_cpl_disable.py)|Modify Registry (E1112)|--| +|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Modify Registry (E1112)|--| +|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey| +|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/hides_recycle_bin_icon.py)|Modify Registry (E1112)|--| +|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_restore_default_state.py)|Modify Registry (E1112)|--| +|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_auto_app_termination.py)|Modify Registry (E1112)|--| +|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_regkeys.py)|Modify Registry (E1112)|--| +|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Modify Registry (E1112)|--| +|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/prevents_safeboot.py)|Modify Registry (E1112)|--| +|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Modify Registry (E1112)|--| +|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_context_menus.py)|Modify Registry (E1112)|--| +|[reg_binary](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Modify Registry (E1112)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW| +|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Modify Registry (E1112)|--| +|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_run_command.py)|Modify Registry (E1112)|--| +|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Modify Registry (E1112)|--| +|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Modify Registry (E1112)|--| +|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_backups.py)|Modify Registry (E1112)|--| +|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_largekey.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW, NtSetValueKey| +|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_username_startmenu.py)|Modify Registry (E1112)|--| +|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Modify Registry (E1112)|--| +|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_startmenu_search.py)|Modify Registry (E1112)|--| +|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Modify Registry (E1112)|--| +|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Modify Registry (E1112)|--| +|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW| +|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey| +|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Modify Registry (E1112)|--| +|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA| +|[persistence_autorun_tasks](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun_tasks.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA| +|[persistence_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_safeboot.py)|Modify Registry (E1112)|--| +|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Modify Registry (E1112)|--| +|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_certs.py)|Modify Registry (E1112)|--| +|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Modify Registry (E1112)|--| +|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_appv_virtualization.py)|Modify Registry (E1112)|--| +|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Modify Registry (E1112)|--| +|[modify_uac_prompt](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_uac_prompt.py)|Modify Registry (E1112)|--| +|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Modify Registry (E1112)|RegQueryValueExW, RegSetValueExW| +|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rdptcp_key.py)|Modify Registry (E1112)|--| +|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_system_restore.py)|Modify Registry (E1112)|--| +|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_folder_options.py)|Modify Registry (E1112)|--| +|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Modify Registry (E1112)|--| +|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_security_maintenance_icon.py)|Modify Registry (E1112)|--| +|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Modify Registry (E1112)|--| +|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Modify Registry (E1112)|--| +|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Modify Registry (E1112)|--| +|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_startmenu_defaults.py)|Modify Registry (E1112)|--| +|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_uac.py)|Modify Registry (E1112)|--| +|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Modify Registry (E1112)|--| +|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Modify Registry (E1112)|--| +|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_perfkey.py)|Modify Registry (E1112)|--| +|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_oem_information.py)|Modify Registry (E1112)|--| +|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Modify Registry (E1112)|--| +|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Modify Registry (E1112)|--| +|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Modify Registry (E1112)|--| +|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Modify Registry (E1112)|--| +|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Modify Registry (E1112)|--| +|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windowsupdate.py)|Modify Registry (E1112)|--| +|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_pinned_programs.py)|Modify Registry (E1112)|--| +|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_regkeys.py)|Modify Registry (E1112)|--| +|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Modify Registry (E1112)|--| +|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Modify Registry (E1112)|--| ## References diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md index 81c1711..41fbd29 100644 --- a/defense-evasion/obfuscated-files-or-information.md +++ b/defense-evasion/obfuscated-files-or-information.md @@ -55,7 +55,6 @@ Instead of being listed alphabetically, methods have been grouped to better faci |**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.| |**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.| - ## Use in Malware |Name|Date|Method|Description| @@ -86,37 +85,44 @@ Instead of being listed alphabetically, methods have been grouped to better faci |[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Shamoon encodes data using XOR. [[9]](#9)| |[**UP007**](../xample-malware/up007.md)|2016|E1027.m02|The malware encodes data using XOR. [[9]](#9)| - ## Detection |Tool: capa|Mapping|APIs| |---|---|---| |[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Obfuscated Files or Information::Encryption (E1027.m04)|memfrob| -|[encrypt data using XXTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using XXTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| |[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| -|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using XTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | +|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using XTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| |[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt| |[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| -|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[decrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/decrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/encrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| | -|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| | +|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[decrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/decrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/encrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|--| +|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|--| |[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars| -|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| | -|[resolve function by Brute Ratel Badger hash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml)|Obfuscated Files or Information (E1027)| | +|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|--| +|[resolve function by Brute Ratel Badger hash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml)|Obfuscated Files or Information (E1027)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|RtlDecompressBuffer| +|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Obfuscated Files or Information (E1027)|CryptDecrypt| +|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Obfuscated Files or Information (E1027)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Obfuscated Files or Information (E1027)|--| +|[dotnet_code_compile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dotnet_code_compile.py)|Obfuscated Files or Information (E1027)|NtWriteFile, CreateProcessInternalA, NtCreateUserProcess, CreateProcessInternalW| ## References diff --git a/defense-evasion/polymorphic-code.md b/defense-evasion/polymorphic-code.md index 3adb14e..4f98212 100644 --- a/defense-evasion/polymorphic-code.md +++ b/defense-evasion/polymorphic-code.md @@ -44,6 +44,12 @@ Polymorphic code, a file with the same functionality but different execution, is |---|---|---|---| |[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny utilizes Lua scripts to exhibit polymorphism. [[2]](#2)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[polymorphic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/polymorphic.py)|Polymorphic Code (B0029)|--| + ## References [1] https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index 1f42d6b..581c42b 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -81,6 +81,31 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan |[inject shellcode using window subclass procedure](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml)|Process Injection (E1055)|user32.SetProp, PostMessage, SendNotifyMessage| |[execute shellcode via Windows fibers](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-fibers.yml)|Process Injection::Injection via Windows Fibers (E1055.m05)|ConvertThreadToFiber, CreateFiber, SwitchToFiber| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[volatility_handles_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_handles_1.py)|Process Injection (E1055)|--| +|[volatility_ldrmodules_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_1.py)|Process Injection (E1055)|--| +|[volatility_ldrmodules_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_ldrmodules_2.py)|Process Injection (E1055)|--| +|[volatility_malfind_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_1.py)|Process Injection (E1055)|--| +|[volatility_malfind_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_malfind_2.py)|Process Injection (E1055)|--| +|[volatility_modscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_modscan_1.py)|Process Injection (E1055)|--| +|[injection_explorer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_explorer.py)|Process Injection (E1055)|NtReadVirtualMemory, NtWow64ReadVirtualMemory64, NtOpenProcess, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, SetWindowLongW, FindWindowA, FindWindowW, FindWindowExW, ReadProcessMemory, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW| +|[injection_themeinitapihook](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_themeinitapihook.py)|Process Injection (E1055)|ThemeInitApiHook| +|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|Process Injection (E1055)|WinHttpConnect, WinHttpOpenRequest| +|[injection_createremotethread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_createremotethread.py)|Process Injection (E1055)|--| +|[doppelganging](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--| +|[injection_inter_process](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--| +|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--| +|[injection_process_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|--| +|[injection_set_window_long](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_set_window_long.py)|Process Injection (E1055)|NtMapViewOfSection, SetWindowLongW, FindWindowExA, SendNotifyMessageW, SendNotifyMessageA, NtCreateSection, SetWindowLongA, FindWindowA, PostMessageA, FindWindowW, FindWindowExW, PostMessageW, SetWindowLongPtrA, NtOpenSection, SetWindowLongPtrW| +|[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction| +|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection (E1055)|--| +|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--| +|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Process Injection (E1055)|--| +|[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| +|[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_shim_database.py)|Process Injection::Injection using Shims (E1055.m03)|--| +|[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_runpe.py)|Process Injection (E1055)|--| + ## References [1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process diff --git a/defense-evasion/rootkit.md b/defense-evasion/rootkit.md index 0c88d1c..9d8763c 100644 --- a/defense-evasion/rootkit.md +++ b/defense-evasion/rootkit.md @@ -53,13 +53,19 @@ Rootkits may hide artifacts (kernel modules, services, threads, userspace librar |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon has certain variants that may have rootkit functionality. [[3]](#3)| |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1014.m16|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate. [[4]](#4)| - ## Detection Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Impair Defenses, and Highjack Execution Flow. Hidden artifacts include kernel modules (hides use of kernel modules used by the malware instance), services (hides any system services that the malware instance creates or injects itself into), threads (hides one or more threads that belong to the malware instance), and userspace libraries (hides use of userspace libraries used by the malware instance). Rootkits can also be detected via memory dump analysis or virtual machine introspection. +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[spicyhotpot_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spicyhotpot_behavior.py)|Rootkit (E1014)|--| +|[accesses_primary_patition](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_primary_patition.py)|Rootkit (E1014)|--| +|[direct_hdd_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/direct_hdd_access.py)|Rootkit (E1014)|--| +|[enumerates_physical_drives](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enumerates_physical_drives.py)|Rootkit (E1014)|--| +|[physical_drive_access](https://github.com/CAPESandbox/community/tree/master/modules/signatures/physical_drive_access.py)|Rootkit (E1014)|--| ## References diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 1858fa7..33efbf6 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -40,7 +40,6 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 |---|---|---| |**COMSPEC Environment Variable**|F0007.001|Uninstalls self via COMSPEC environment variable.| - ## Use in Malware |Name|Date|Method|Description| @@ -54,8 +53,13 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 |Tool: capa|Mapping|APIs| |---|---|---| -|[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)| | +|[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)|--| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Self Deletion (F0007)|DeleteFileW| +|[deletes_executed_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_executed_files.py)|Self Deletion (F0007)|--| +|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Self Deletion (F0007)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW| ## References diff --git a/discovery/analysis-tool-discovery.md b/discovery/analysis-tool-discovery.md index 2fefdee..699f5fa 100644 --- a/discovery/analysis-tool-discovery.md +++ b/discovery/analysis-tool-discovery.md @@ -62,7 +62,18 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi |Tool: capa|Mapping|APIs| |---|---|---| -|[reference analysis tools strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/reference-analysis-tools-strings.yml)|Analysis Tool Discovery::Process detection (B0013.001)| | +|[reference analysis tools strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/reference-analysis-tools-strings.yml)|Analysis Tool Discovery::Process detection (B0013.001)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Analysis Tool Discovery (B0013)|--| +|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Analysis Tool Discovery (B0013)|--| +|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery (B0013)|--| +|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Process detection (B0013.001)|--| +|[antidebug_windows](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_windows.py)|Analysis Tool Discovery::Known Window (B0013.009)|--| +|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Analysis Tool Discovery (B0013)|--| +|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery (B0013)|--| +|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Analysis Tool Discovery::Known File Location (B0013.008)|--| ## References diff --git a/discovery/application-window-discovery.md b/discovery/application-window-discovery.md index e71428f..22acc1b 100644 --- a/discovery/application-window-discovery.md +++ b/discovery/application-window-discovery.md @@ -53,6 +53,10 @@ Malware may attempt to get a listing of open application windows. |---|---|---| |[get graphical window text](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/window/get-text/get-graphical-window-text.yml)|Application Window Discovery (E1010)|user32.IsWindowVisible, user32.SendMessage, user32.GetForegroundWindow, user32.GetWindowText| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[browser_needed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_needed.py)|Application Window Discovery (E1010)|FindWindowW, FindWindowExA, FindWindowExW, FindWindowA| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/discovery/code-discovery.md b/discovery/code-discovery.md index 141fe63..796064e 100644 --- a/discovery/code-discovery.md +++ b/discovery/code-discovery.md @@ -58,8 +58,8 @@ Malware may inspect code or enumerate aspects. |Tool: capa|Mapping|APIs| |---|---|---| -|[enumerate PE sections](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/enumerate-pe-sections.yml)|Code Discovery::Enumerate PE Sections (B0046.001)| | -|[inspect section memory permissions](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/inspect-section-memory-permissions.yml)|Code Discovery::Inspect Section Memory Permissions (B0046.002)| | +|[enumerate PE sections](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/enumerate-pe-sections.yml)|Code Discovery::Enumerate PE Sections (B0046.001)|--| +|[inspect section memory permissions](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/inspect-section-memory-permissions.yml)|Code Discovery::Inspect Section Memory Permissions (B0046.002)|--| ## References diff --git a/discovery/file-and-directory-discovery.md b/discovery/file-and-directory-discovery.md index 8644d8e..33e8c38 100644 --- a/discovery/file-and-directory-discovery.md +++ b/discovery/file-and-directory-discovery.md @@ -73,10 +73,31 @@ Malware may enumerate files and directories or may search for specific files or |[check if file exists](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/exists/check-if-file-exists.yml)|File and Directory Discovery (E1083)|kernel32.GetFileAttributes, kernel32.GetLastError, shlwapi.PathFileExists, System.IO.File::Exists| |[enumerate files on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-linux.yml)|File and Directory Discovery (E1083)|getdents, getdents64, opendir, readdir| |[enumerate files on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-windows.yml)|File and Directory Discovery (E1083)|kernel32.FindFirstFile, kernel32.FindFirstFileEx, kernel32.FindFirstFileTransacted, kernel32.FindFirstFileName, kernel32.FindFirstFileNameTransacted, kernel32.FindNextFile, kernel32.FindNextFileName, kernel32.FindClose, ntdll.NtOpenDirectoryObject, ntdll.NtQueryDirectoryObject, RtlAllocateHeap, System.IO.DirectoryInfo::GetFiles, System.IO.DirectoryInfo::EnumerateFiles, System.IO.Directory::GetFiles, System.IO.Directory::EnumerateFiles, System.IO.Directory::EnumerateFileSystemEntries, System.IO.DirectoryInfo::GetDirectories, System.IO.DirectoryInfo::EnumerateDirectories, System.IO.Directory::GetDirectories, System.IO.Directory::EnumerateDirectories| -|[enumerate files recursively](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-recursively.yml)|File and Directory Discovery (E1083)| | +|[enumerate files recursively](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-recursively.yml)|File and Directory Discovery (E1083)|--| |[read data from CLFS log container](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/clfs/read-data-from-clfs-log-container.yml)|File and Directory Discovery::Log File (E1083.m01)|clfsw32.CreateLogFile, clfsw32.CreateLogMarshallingArea, clfsw32.ReadLogRecord, clfsw32.ReadNextLogRecord| |[access the Windows event log](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/winevt/access/access-the-windows-event-log.yml)|File and Directory Discovery::Log File (E1083.m01)|OpenEventLog, ClearEventLog, OpenBackupEventLog, ReportEvent| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antisandbox_cuckoo_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_cuckoo_files.py)|File and Directory Discovery (E1083)|--| +|[antisandbox_threattrack_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_threattrack_files.py)|File and Directory Discovery (E1083)|--| +|[antivm_directory_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_directory_objects.py)|File and Directory Discovery (E1083)|NtQueryDirectoryObject, NtOpenDirectoryObject| +|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery (E1083)|NtOpenEvent, NtCreateEvent| +|[antivm_vmware_events](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_events.py)|File and Directory Discovery::Log File (E1083.m01)|NtOpenEvent, NtCreateEvent| +|[antivm_vbox_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_devices.py)|File and Directory Discovery (E1083)|--| +|[antivm_vmware_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_devices.py)|File and Directory Discovery (E1083)|--| +|[antivm_vbox_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_files.py)|File and Directory Discovery (E1083)|--| +|[antivm_vmware_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll| +|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|File and Directory Discovery (E1083)|--| +|[antivm_vpc_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_files.py)|File and Directory Discovery (E1083)|--| +|[antivm_vbox_libs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_libs.py)|File and Directory Discovery (E1083)|LdrLoadDll| +|[driver_filtermanager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_filtermanager.py)|File and Directory Discovery (E1083)|--| +|[antisandbox_joe_anubis_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_joe_anubis_files.py)|File and Directory Discovery (E1083)|--| +|[antivm_vmware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_files.py)|File and Directory Discovery (E1083)|--| +|[antisandbox_fortinet_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_fortinet_files.py)|File and Directory Discovery (E1083)|--| +|[antisandbox_sunbelt_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sunbelt_files.py)|File and Directory Discovery (E1083)|--| +|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|File and Directory Discovery (E1083)|--| + ## References [1] https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/ diff --git a/discovery/self-discovery.md b/discovery/self-discovery.md index 51126b4..48dca97 100644 --- a/discovery/self-discovery.md +++ b/discovery/self-discovery.md @@ -46,7 +46,6 @@ Name|Date|Method|Description| |[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.002|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[2]](#2)| |[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.003|WannaCry checks the data lengh of a section before decypting a dll. [[2]](#2)| - ## References [1] https://github.com/Rogdham/gif-md5-hashquine diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md index cd4939d..37f69dc 100644 --- a/discovery/system-information-discovery.md +++ b/discovery/system-information-discovery.md @@ -69,9 +69,38 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec |[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables| |[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice| |[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl| -|[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)| | +|[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)|--| |[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antivm_generic_disk](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk.py)|System Information Discovery (E1082)|DeviceIoControl, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile, NtDeviceIoControlFile| +|[recon_systeminfo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_systeminfo.py)|System Information Discovery (E1082)|--| +|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|System Information Discovery (E1082)|HttpOpenRequestA, HttpSendRequestA| +|[uses_adfind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_adfind.py)|System Information Discovery (E1082)|--| +|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|System Information Discovery (E1082)|--| +|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|System Information Discovery (E1082)|--| +|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|System Information Discovery (E1082)|--| +|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|System Information Discovery (E1082)|--| +|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|System Information Discovery (E1082)|--| +|[uses_windows_utilities_nltest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_nltest.py)|System Information Discovery (E1082)|--| +|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA| +|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|System Information Discovery (E1082)|--| +|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|System Information Discovery (E1082)|--| +|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|System Information Discovery (E1082)|--| +|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|System Information Discovery (E1082)|--| +|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|System Information Discovery (E1082)|--| +|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|System Information Discovery (E1082)|--| +|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|System Information Discovery (E1082)|--| +|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|System Information Discovery (E1082)|--| +|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|System Information Discovery (E1082)|--| +|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|System Information Discovery (E1082)|--| +|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|System Information Discovery (E1082)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA| +|[antivm_generic_disk_setupapi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_disk_setupapi.py)|System Information Discovery (E1082)|SetupDiGetClassDevsA, SetupDiGetClassDevsW| +|[antisandbox_check_userdomain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_check_userdomain.py)|System Information Discovery (E1082)|rtcEnvironBstr| +|[browser_scanbox](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_scanbox.py)|System Information Discovery (E1082)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_fingerprint.py)|System Information Discovery (E1082)|--| + ## References [1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_URSNIF.A2?_ga=2.131425807.1462021705.1559742358-1202584019.1549394279 diff --git a/discovery/taskbar-discovery.md b/discovery/taskbar-discovery.md index 4fda06f..2a41839 100644 --- a/discovery/taskbar-discovery.md +++ b/discovery/taskbar-discovery.md @@ -28,7 +28,6 @@ # Taskbar Discovery - ## Use in Malware |Name|Date|Method|Description| @@ -39,7 +38,7 @@ |Tool: capa|Mapping|APIs| |---|---|---| -|[find taskbar](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/taskbar/find/find-taskbar.yml)|Taskbar Discovery (B0043)| | +|[find taskbar](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/taskbar/find/find-taskbar.yml)|Taskbar Discovery (B0043)|--| ## References diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md index 44d8a62..9f998ea 100644 --- a/execution/command-and-scripting-interpreter.md +++ b/execution/command-and-scripting-interpreter.md @@ -63,6 +63,56 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or |[accept command line arguments](https://github.com/mandiant/capa-rules/blob/master/host-interaction/cli/accept-command-line-arguments.yml)|Command and Scripting Interpreter (E1059)|GetCommandLine, CommandLineToArgv, System.Environment::GetCommandLineArgs| |[run PowerShell expression](https://github.com/mandiant/capa-rules/blob/master/load-code/powershell/run-powershell-expression.yml)|Command and Scripting Interpreter (E1059)|System.Management.Automation.PowerShell::Create, System.Management.Automation.PowerShell::AddScript, System.Management.Automation.PowerShell::Invoke| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Command and Scripting Interpreter (E1059)|NtWriteFile| +|[js_suspicious_redirect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_suspicious_redirect.py)|Command and Scripting Interpreter (E1059)|CDocument_write, JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[odbcconf_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/odbcconf_bypass.py)|Command and Scripting Interpreter (E1059)|--| +|[regsvr32_squiblydoo_dll_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/regsvr32_squiblydoo_dll_load.py)|Command and Scripting Interpreter (E1059)|LdrLoadDll| +|[squiblydoo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblydoo_bypass.py)|Command and Scripting Interpreter (E1059)|--| +|[squiblytwo_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/squiblytwo_bypass.py)|Command and Scripting Interpreter (E1059)|--| +|[exe_dropper_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exe_dropper_js.py)|Command and Scripting Interpreter (E1059)|JsEval| +|[persistence_registry_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_registry_script.py)|Command and Scripting Interpreter (E1059)|RegSetValueExA, RegSetValueExW, NtSetValueKey| +|[ie_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ie_martian_children.py)|Command and Scripting Interpreter (E1059)|--| +|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW| +|[office_martian_children](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_martian_children.py)|Command and Scripting Interpreter (E1059)|--| +|[js_phish](https://github.com/CAPESandbox/community/tree/master/modules/signatures/js_phish.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[disables_winfirewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_winfirewall.py)|Command and Scripting Interpreter (E1059)|--| +|[script_tool_executed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_tool_executed.py)|Command and Scripting Interpreter (E1059)|--| +|[cmdline_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_obfuscation.py)|Command and Scripting Interpreter (E1059)|--| +|[cmdline_switches](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_switches.py)|Command and Scripting Interpreter (E1059)|--| +|[cmdline_terminate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_terminate.py)|Command and Scripting Interpreter (E1059)|--| +|[cmdline_forfiles_wildcard](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_forfiles_wildcard.py)|Command and Scripting Interpreter (E1059)|--| +|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|Command and Scripting Interpreter (E1059)|--| +|[cmdline_long_string](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_long_string.py)|Command and Scripting Interpreter (E1059)|--| +|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|Command and Scripting Interpreter (E1059)|--| +|[long_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/long_commandline.py)|Command and Scripting Interpreter (E1059)|--| +|[powershell_renamed_commandline](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed_commandline.py)|Command and Scripting Interpreter (E1059)|--| +|[wmi_script_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_script_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW| +|[disables_mappeddrives_autodisconnect](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_mappeddrives_autodisconnect.py)|Command and Scripting Interpreter (E1059)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW| +|[system_account_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_account_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--| +|[system_currently_loggedin_user_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_currently_loggedin_user_cmd.py)|Command and Scripting Interpreter (E1059)|--| +|[system_info_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--| +|[system_info_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_info_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--| +|[system_network_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--| +|[system_network_discovery_pwsh](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_network_discovery_pwsh.py)|Command and Scripting Interpreter (E1059)|--| +|[system_user_discovery_cmd](https://github.com/CAPESandbox/community/tree/master/modules/signatures/system_user_discovery_cmd.py)|Command and Scripting Interpreter (E1059)|--| +|[powershell_network_connection](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_network_connection.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, InternetReadFile| +|[powershell_scriptblock_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_scriptblock_logging.py)|Command and Scripting Interpreter (E1059)|--| +|[powershell_command_suspicious](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_command_suspicious.py)|Command and Scripting Interpreter (E1059)|--| +|[powershell_renamed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_renamed.py)|Command and Scripting Interpreter (E1059)|--| +|[powershell_reversed](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_reversed.py)|Command and Scripting Interpreter (E1059)|--| +|[powershell_variable_obfuscation](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powershell_variable_obfuscation.py)|Command and Scripting Interpreter (E1059)|--| +|[office_com_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_com_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll| +|[office_vb_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_vb_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll| +|[office_wmi_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_wmi_load.py)|Command and Scripting Interpreter (E1059)|LdrGetDllHandle, LdrLoadDll| +|[document_script_exe_drop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/document_script_exe_drop.py)|Command and Scripting Interpreter (E1059)|NtWriteFile| +|[windows_defender_powershell](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows_defender_powershell.py)|Command and Scripting Interpreter (E1059)|--| +|[office_suspicious_processes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_suspicious_processes.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW| +|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Command and Scripting Interpreter (E1059)|NtCreateUserProcess, CreateProcessInternalW| +|[script_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_network_activity.py)|Command and Scripting Interpreter (E1059)|URLDownloadToFileW, HttpOpenRequestW, send, WSAConnect, InternetCrackUrlW, InternetCrackUrlA, SslEncryptPacket, InternetReadFile| +|[suspicious_js_script](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_js_script.py)|Command and Scripting Interpreter (E1059)|JsEval, COleScript_ParseScriptText| + ## References [1] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy diff --git a/execution/execution-dependency.md b/execution/execution-dependency.md index 677acfa..34521c1 100644 --- a/execution/execution-dependency.md +++ b/execution/execution-dependency.md @@ -30,14 +30,12 @@ Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in **Conditional Execution ([B0025](../execution/conditional-execution.md))**, this dependency is not because of an explicit check coded into the malware by the author. - ## Use in Malware |Name|Date|Method|Description| |---|---|---|---| |[**Adwind jRAT**](../xample-malware/adwindjrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)| - ## References [1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/ \ No newline at end of file diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md index 047feea..4a29c2a 100644 --- a/execution/exploitation-for-client-execution.md +++ b/execution/exploitation-for-client-execution.md @@ -53,6 +53,36 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or |---|---|---|---| |[**SamSam**](../xample-malware/samsam.md)|2015|E1203.m01|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[office_cve2017_11882](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882.py)|Exploitation for Client Execution (E1203)|CreateProcessInternalW| +|[office_cve2017_11882_network](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_cve2017_11882_network.py)|Exploitation for Client Execution (E1203)|ConnectEx, URLDownloadToFileW| +|[office_flash_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_flash_load.py)|Exploitation for Client Execution (E1203)|CoGetClassObject, CoCreateInstance| +|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Exploitation for Client Execution (E1203)|NtWriteFile| +|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--| +|[exploit_getbasekerneladdress](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_getbasekerneladdress.py)|Exploitation for Client Execution (E1203)|EnumDeviceDrivers, LdrGetProcedureAddress, LdrLoadDll, K32EnumDeviceDrivers| +|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory| +|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Exploitation for Client Execution (E1203)|NtCreateFile| +|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_process_create.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW| +|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| +|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_curl.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--| +|[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll| +|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution (E1203)|--| +|[sysinternals_psexec](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_psexec.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--| +|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution (E1203)|--| +|[sysinternals_tools](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sysinternals_tools.py)|Exploitation for Client Execution::Sysinternals (E1203.m05)|--| +|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--| +|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Exploitation for Client Execution::Remote Desktop Protocols (E1203.m01)|--| +|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|Exploitation for Client Execution (E1203)|NtAllocateVirtualMemory| +|[rtf_aslr_bypass](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_aslr_bypass.py)|Exploitation for Client Execution (E1203)|--| +|[rtf_exploit_static](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_exploit_static.py)|Exploitation for Client Execution (E1203)|--| + ## References [1] https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/ diff --git a/execution/install-additional-program.md b/execution/install-additional-program.md index 083a4d3..1a7b975 100644 --- a/execution/install-additional-program.md +++ b/execution/install-additional-program.md @@ -40,7 +40,6 @@ Examples of droppers include malicious Droppers may be described as “single stage” or “two stage.” While the former embeds the malicious code internally, the latter installs itself before downloading additional code from a remote location [[4]](#4). - ## Use in Malware |Name|Date|Method|Description| @@ -66,8 +65,14 @@ Droppers may be described as “single stage” or “two stage.” While the fo |Tool: capa|Mapping|APIs| |---|---|---| -|[contain an embedded PE file](https://github.com/mandiant/capa-rules/blob/master/executable/subfile/pe/contain-an-embedded-pe-file.yml)|Install Additional Program (B0023)| | -|[write and execute a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/write-and-execute-a-file.yml)|Install Additional Program (B0023)| | +|[contain an embedded PE file](https://github.com/mandiant/capa-rules/blob/master/executable/subfile/pe/contain-an-embedded-pe-file.yml)|Install Additional Program (B0023)|--| +|[write and execute a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/write-and-execute-a-file.yml)|Install Additional Program (B0023)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[bitcoin_opencl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bitcoin_opencl.py)|Install Additional Program (B0023)|--| +|[dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dropper.py)|Install Additional Program (B0023)|--| +|[sniffer_winpcap](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sniffer_winpcap.py)|Install Additional Program (B0023)|--| ## References "Cyclops Blink: Malware Analysis Report, Version 1.0," National Cyber Security Centre/GCHQ, 23 Feb. 2022. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf. diff --git a/execution/remote-commands.md b/execution/remote-commands.md index 151657a..edf7911 100644 --- a/execution/remote-commands.md +++ b/execution/remote-commands.md @@ -42,14 +42,13 @@ Autonomous behaviors - those done by the malware without an active attacker - sh |Name|ID|Description| |---|---|---| -|**Delete File**|B0011.001|| -|**Download File**|B0011.002|| -|**Execute**|B0011.003|| -|**Shutdown**|B0011.004|| -|**Sleep**|B0011.005|| -|**Uninstall**|B0011.006|| -|**Upload File**|B0011.007|| - +|**Delete File**|B0011.001|--| +|**Download File**|B0011.002|--| +|**Execute**|B0011.003|--| +|**Shutdown**|B0011.004|--| +|**Sleep**|B0011.005|--| +|**Uninstall**|B0011.006|--| +|**Upload File**|B0011.007|--| ## Use in Malware @@ -61,7 +60,6 @@ Autonomous behaviors - those done by the malware without an active attacker - sh |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0011.005|The malware sleeps if it fails to send collected data or execute its commands. [[4]](#4) [[5]](#5)| |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0011.006|The malware loader can uninstall itself from the victim computer. [[4]](#4) [[5]](#5)| - ## References [1] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279 diff --git a/execution/send-email.md b/execution/send-email.md index 9002fd2..9de36f5 100644 --- a/execution/send-email.md +++ b/execution/send-email.md @@ -40,7 +40,6 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec |[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)| |[**Emotet**](../xample-malware/emotet.md)|2018|--|Spam email with the Emotet loader is sent automatically. [[3]](#3)| - ## References [1] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/ diff --git a/execution/system-services.md b/execution/system-services.md index 1243949..b7fdb8c 100644 --- a/execution/system-services.md +++ b/execution/system-services.md @@ -38,7 +38,6 @@ See ATT&CK: **System Services ([T1569](https://attack.mitre.org/techniques/T1569 |---|---|---| |**MSDTC**|E1569.m01|The Distributed Transaction Coordinator (MSDTC) coordinates transaction across multiple resource managers (databases, message queues and file systems). This legitimate Microsoft service is part of Windows 2000 and later and can be used to import and load DLLs. Malware may abuse MSDTC to import and load DLLs.[[1]](#1)| - ## References [1] https://cyware.com/news/catb-ransomware-exploits-msdtc-service-to-steal-data-3bb46fc0 \ No newline at end of file diff --git a/execution/user-execution.md b/execution/user-execution.md index 6dae7ca..b3bc12b 100644 --- a/execution/user-execution.md +++ b/execution/user-execution.md @@ -45,7 +45,6 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq |[**CryptoLocker**](../xample-malware/vobfus.md)|2013|--|The malware relies on victims to execute. [[4]](#4)| |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The user opens a disk image file which invisibly installs its components. [[6]](#6)| - ## References [1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/exfiltration/archive-collected-data.md b/exfiltration/archive-collected-data.md index 79de550..23085d9 100644 --- a/exfiltration/archive-collected-data.md +++ b/exfiltration/archive-collected-data.md @@ -43,7 +43,6 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org |**Encryption - Custom Encryption**|E1560.m06|Data is encrypted. A custom algorithm is used to encrypt the exfiltrated data.| |**Encryption - Standard Encryption**|E1560.m05|Data is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.| - ## Use in Malware |Name|Date|Method|Description| @@ -52,6 +51,16 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1560.m04|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[2]](#2)| |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|E1560.m03|Malware sends data as a Base64 string of JSON. [[3]](#3) [[4]](#4)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data (E1560)|CryptEncrypt| +|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt| +|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW| +|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW| +|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data (E1560)|CryptEncrypt, GetUserNameW, GetComputerNameW| +|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Archive Collected Data::Encryption (E1560.m02)|CryptEncrypt, GetUserNameW, GetComputerNameW| ## References diff --git a/exfiltration/automated-exfiltration.md b/exfiltration/automated-exfiltration.md index e0edd1b..9145c4b 100644 --- a/exfiltration/automated-exfiltration.md +++ b/exfiltration/automated-exfiltration.md @@ -44,7 +44,6 @@ See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org |---|---|---|---| |[**Attor**](../xample-malware/attor.md)|2013|--|Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server.[[1]](#1)| - ## References [1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file diff --git a/impact/clipboard-modification.md b/impact/clipboard-modification.md index 3e2c58b..e1c716b 100644 --- a/impact/clipboard-modification.md +++ b/impact/clipboard-modification.md @@ -50,6 +50,10 @@ ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). |---|---|---| |[write clipboard data](https://github.com/mandiant/capa-rules/blob/master/host-interaction/clipboard/write-clipboard-data.yml)|Clipboard Modification (E1510)|user32.EmptyClipboard, System.Windows.Forms.Clipboard::Clear, user32.SetClipboardData, System.Windows.Forms.Clipboard::SetAudio, System.Windows.Forms.Clipboard::SetData, System.Windows.Forms.Clipboard::SetDataObject, System.Windows.Forms.Clipboard::SetFileDropList, System.Windows.Forms.Clipboard::SetImage, System.Windows.Forms.Clipboard::SetText| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[set_clipboard_data](https://github.com/CAPESandbox/community/tree/master/modules/signatures/set_clipboard_data.py)|Clipboard Modification (E1510)|SetClipboardData| + ## References [1] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking diff --git a/impact/compromise-data-integrity.md b/impact/compromise-data-integrity.md index f730038..9f331b8 100644 --- a/impact/compromise-data-integrity.md +++ b/impact/compromise-data-integrity.md @@ -42,7 +42,6 @@ The related **Data Manipulation: Stored Data Manipulation ([T1565.001](https://a |---|---|---|---| |[**DYEPACK**](../xample-malware/dyepack.md)|2015|--|DYEPACK alters records in databases used for SWIFT transactions. [[2]](#2)| - ## References [1] "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf. diff --git a/impact/data-destruction.md b/impact/data-destruction.md index d6241c7..7d8b0a4 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -58,7 +58,14 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148 |Tool: capa|Mapping|APIs| |---|---|---| -|[delete volume shadow copies](https://github.com/mandiant/capa-rules/blob/master/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml)|Data Destruction::Delete Shadow Copies (E1485.m04)| | +|[delete volume shadow copies](https://github.com/mandiant/capa-rules/blob/master/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml)|Data Destruction::Delete Shadow Copies (E1485.m04)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Data Destruction (E1485)|--| +|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Data Destruction (E1485)|--| +|[uses_windows_utilities_cipher](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_windows_utilities_cipher.py)|Data Destruction (E1485)|--| +|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Data Destruction (E1485)|NtDeleteFile, DeleteFileW, DeleteFileA| ## References diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index 3458170..fdbb32f 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -53,6 +53,19 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni |[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom. [[5]](#5)| |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry encrypts files for ransom. [[6]](#6)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Data Encrypted for Impact (E1486)|CryptEncrypt| +|[ransomware_dmalocker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_dmalocker.py)|Data Encrypted for Impact (E1486)|RegSetValueExA| +|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_revil_regkey.py)|Data Encrypted for Impact (E1486)|--| +|[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_radamant.py)|Data Encrypted for Impact (E1486)|--| +|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Data Encrypted for Impact (E1486)|--| +|[sodinokibi_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/sodinokibi_behavior.py)|Data Encrypted for Impact (E1486)|bind, RegSetValueExW, WinHttpOpen, NtCreateUserProcess, CreateProcessInternalW| +|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Data Encrypted for Impact (E1486)|NtWriteFile| +|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Data Encrypted for Impact (E1486)|--| +|[ransomware_file_modifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_file_modifications.py)|Data Encrypted for Impact (E1486)|NtWriteFile, MoveFileWithProgressW, NtCreateFile, MoveFileWithProgressTransactedW| ## References diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index 24d996b..ba805ff 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -45,6 +45,15 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni |[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)| |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[cve_2016_7200](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016_7200.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|Denial of Service (B0033)|--| +|[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2015_2419_js.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile| +|[cve_2016-0189](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cve_2016-0189.py)|Denial of Service (B0033)|JsEval, COleScript_ParseScriptText, COleScript_Compile| + ## References [1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf diff --git a/impact/disk-wipe.md b/impact/disk-wipe.md index 8434147..d4ca10a 100644 --- a/impact/disk-wipe.md +++ b/impact/disk-wipe.md @@ -47,6 +47,12 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001]( |---|---|---| |[overwrite Master Boot Record (MBR)](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml)|Disk Wipe (F0014)|kernel32.WriteFile| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[deletes_shadow_copies](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_shadow_copies.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW| +|[deletes_system_state_backup](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_system_state_backup.py)|Disk Wipe (F0014)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW| +|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Disk Wipe (F0014)|NtWriteFile| + ## References [1] https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments diff --git a/impact/exploit-kit.md b/impact/exploit-kit.md index 5c6176e..5cebea8 100644 --- a/impact/exploit-kit.md +++ b/impact/exploit-kit.md @@ -36,14 +36,12 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver See related ATT&CK Technique: **Exploit Public-Facing Application ([T1190](https://attack.mitre.org/techniques/T1190))**, which relates to Initial Access. Under the Impact objective, exploit behaviors are considered more broadly in MBC. - ## Use in Malware |Name|Date|Method|Description| |---|---|---|---| |[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif is sometimes delivered via exploit kit. [[1]](#1)| - ## References [1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md index b8c687d..96ff997 100644 --- a/impact/generate-traffic-from-victim.md +++ b/impact/generate-traffic-from-victim.md @@ -49,7 +49,6 @@ Malware may generate traffic from the victim system such as clicks of advertisin |[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter performs click-fraud. [[4]](#4)| |[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1643.m02|The malware displays brief advertisements whenever the user opens applications on their phone. [[5]](#5)| - ## References [1] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html diff --git a/impact/manipulate-network-traffic.md b/impact/manipulate-network-traffic.md index c71378b..fc6d701 100644 --- a/impact/manipulate-network-traffic.md +++ b/impact/manipulate-network-traffic.md @@ -43,7 +43,6 @@ The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](http |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|SearchAwesome adware intercepts encrypted web traffic to inject ads. [[2]](#2)| |[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot intercepts data coming into and going out of the device. [[3]](#3)| - ## References [1] B. Feeley and B. Stone-Gross,"New Evidence Proves Ongoing WIZARD SPIDER / LUNAR SPIDER Collaboration," CrowdStrike, blog, 20 Mar. 2019. [Online]. Available: https://www.crowdstrike.com/blog/wizard-spider-lunar-spider-shared-proxy-module. diff --git a/impact/remote-access.md b/impact/remote-access.md index 30ffd80..32b5d4b 100644 --- a/impact/remote-access.md +++ b/impact/remote-access.md @@ -56,9 +56,54 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu |Tool: capa|Mapping|APIs| |---|---|---| -|[create reverse shell on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell-on-linux.yml)|Remote Access::Reverse Shell (B0022.001)| | +|[create reverse shell on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell-on-linux.yml)|Remote Access::Reverse Shell (B0022.001)|--| |[create reverse shell](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell.yml)|Remote Access::Reverse Shell (B0022.001)|kernel32.PeekNamedPipe, kernel32.CreateProcess, kernel32.ReadFile, kernel32.WriteFile| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Remote Access (B0022)|--| +|[rat_spynet](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_spynet.py)|Remote Access (B0022)|--| +|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/parallax_mutexes.py)|Remote Access (B0022)|--| +|[rat_pcclient](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_pcclient.py)|Remote Access (B0022)|--| +|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_fynloski_mutexes.py)|Remote Access (B0022)|--| +|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_beebus_mutexes.py)|Remote Access (B0022)|--| +|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Remote Access (B0022)|--| +|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_mutexes.py)|Remote Access (B0022)|--| +|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Remote Access (B0022)|--| +|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Remote Access (B0022)|--| +|[evil_grab](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW| +|[PlugX](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Remote Access (B0022)|memcpy, RtlDecompressBuffer| +|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ratsnif_mutexes.py)|Remote Access (B0022)|--| +|[netwire_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/netwire_behavior.py)|Remote Access (B0022)|RegSetValueExA| +|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Remote Access (B0022)|--| +|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_xtreme_mutexes.py)|Remote Access (B0022)|--| +|[blackrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_apis.py)|Remote Access (B0022)|CryptHashData, RtlDecompressBuffer, CreateProcessInternalW| +|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_mutexes.py)|Remote Access (B0022)|--| +|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Remote Access (B0022)|send| +|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Remote Access (B0022)|RegQueryValueExW, RegSetValueExW| +|[uses_rdp_clip](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_rdp_clip.py)|Remote Access (B0022)|--| +|[uses_remote_desktop_session](https://github.com/CAPESandbox/community/tree/master/modules/signatures/uses_remote_desktop_session.py)|Remote Access (B0022)|--| +|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_plugx_mutexes.py)|Remote Access (B0022)|--| +|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Remote Access (B0022)|--| +|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_mutexes.py)|Remote Access (B0022)|--| +|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Remote Access (B0022)|send| +|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/venomrat_mutexes.py)|Remote Access (B0022)|--| +|[trochilusrat_apis](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trochilusrat_apis.py)|Remote Access (B0022)|OutputDebugStringW, NtCreateUserProcess, RegSetValueExW, CreateProcessInternalW| +|[dcrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_behavior.py)|Remote Access (B0022)|GetAddrInfo, GetAddrInfoW, CryptHashData| +|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Remote Access (B0022)|--| +|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_mutexes.py)|Remote Access (B0022)|--| +|[karagany_system_event_objects](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_system_event_objects.py)|Remote Access (B0022)|NtCreateEventEx, NtCreateEvent| +|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Remote Access (B0022)|--| +|[orcusrat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/orcusrat_behavior.py)|Remote Access (B0022)|RegOpenKeyExW| +|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_mutexes.py)|Remote Access (B0022)|--| +|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Remote Access (B0022)|--| +|[rat_luminosity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_luminosity.py)|Remote Access (B0022)|CryptHashData, NtCreateMutant, NtCreateFile| +|[rat_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_nanocore.py)|Remote Access (B0022)|CryptHashData| +|[static_rat_config](https://github.com/CAPESandbox/community/tree/master/modules/signatures/static_rat_config.py)|Remote Access (B0022)|--| +|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Remote Access (B0022)|--| +|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Remote Access (B0022)|--| +|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Remote Access (B0022)|--| + ## References [1] https://en.wikipedia.org/wiki/Remote_access_trojan diff --git a/impact/resource-hijacking.md b/impact/resource-hijacking.md index 92b5ad6..6e2c4ea 100644 --- a/impact/resource-hijacking.md +++ b/impact/resource-hijacking.md @@ -52,6 +52,13 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[5]](#5)| |[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer uses sytem resources to mine for cryptocurrency. [[6]](#6)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[cryptopool_domains](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptopool_domains.py)|Resource Hijacking (B0018)|GetAddrInfoW| +|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking (B0018)|--| +|[cryptomining_stratum_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomining_stratum_command.py)|Resource Hijacking::Cryptojacking (B0018.002)|--| ## References [1] B. G. a. M. Ahuje,"CrowdStrike Discovers First-Ever Dero Cryptojacking Campaign Targeting Kubernetes," CrowdStrike, blog, 15 Mar. 2023. [Online]. Available: https://www.crowdstrike.com/blog/crowdstrike-discovers-first-ever-dero-cryptojacking-campaign-targeting-kubernetes/. diff --git a/lateral-movement/supply-chain-compromise.md b/lateral-movement/supply-chain-compromise.md index ffa6332..d939f73 100644 --- a/lateral-movement/supply-chain-compromise.md +++ b/lateral-movement/supply-chain-compromise.md @@ -45,7 +45,6 @@ The supply chain may be compromised to enable initial malware infection. MBC obj |[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1195.m01|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. [[1]](#1)| |[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1195.m02|Within the malware, use of the private API allows installation of malicious apps and uninstallation of legitimate apps without user notification. [[1]](#1)| - ## References [1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/micro-behaviors/communication/dns-communication.md b/micro-behaviors/communication/dns-communication.md index 1e6bae6..f4a581e 100644 --- a/micro-behaviors/communication/dns-communication.md +++ b/micro-behaviors/communication/dns-communication.md @@ -51,9 +51,20 @@ The DNS Communication micro-behavior focuses on DNS communication. |Tool: capa|Mapping|APIs| |---|---|---| -|[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)| | +|[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)|--| |[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, getaddrinfo, GetAddrInfo, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[network_dns_blockchain](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_blockchain.py)|DNS Communication (C0011)|--| +|[network_dns_idn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_idn.py)|DNS Communication (C0011)|DnsQueryA| +|[network_dns_opennic](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_opennic.py)|DNS Communication (C0011)|--| +|[network_dns_reverse_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_reverse_proxy.py)|DNS Communication (C0011)|--| +|[network_dns_suspicious_querytype](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_suspicious_querytype.py)|DNS Communication (C0011)|DnsQueryA| +|[network_dns_tunneling_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_tunneling_request.py)|DNS Communication (C0011)|DnsQuery_A, DnsQuery_W| +|[network_dns_doh_tls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dns_doh_tls.py)|DNS Communication (C0011)|--| +|[network_dga](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_dga.py)|DNS Communication (C0011)|--| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/communication/http-communication.md b/micro-behaviors/communication/http-communication.md index 261ae80..cc89a8d 100644 --- a/micro-behaviors/communication/http-communication.md +++ b/micro-behaviors/communication/http-communication.md @@ -55,7 +55,6 @@ Instead of being listed alphabetically, methods have been grouped to better faci |**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).| |**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) micro-behavior.| - ## Use in Malware |Name|Date|Method|Description| @@ -88,12 +87,38 @@ Instead of being listed alphabetically, methods have been grouped to better faci |[prepare HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/prepare-http-request.yml)|HTTP Communication::Create Request (C0002.012)|winhttp.WinHttpOpenRequest| |[create HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/create-http-request.yml)|HTTP Communication::Create Request (C0002.012)|wininet.InternetOpen, System.Net.WebRequest::Create, System.Net.WebRequest::CreateDefault, System.Net.WebRequest::CreateHttp, wininet.InternetCloseHandle| |[send file via HTTP](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/send-file-via-http.yml)|HTTP Communication::Send Data (C0002.005)|wininet.InternetWriteFile| -|[decompress HTTP response via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml)|HTTP Communication::Get Response (C0002.017)| | +|[decompress HTTP response via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml)|HTTP Communication::Get Response (C0002.017)|--| |[check HTTP status code](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/check-http-status-code.yml)|HTTP Communication::Read Header (C0002.014)|atoi, wininet.HttpQueryInfo| |[get HTTP response content encoding](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-response-content-encoding.yml)|HTTP Communication::Get Response (C0002.017)|wininet.HttpQueryInfo| |[connect to URL](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-url.yml)|HTTP Communication::Open URL (C0002.004)|wininet.InternetOpenUrl| |[connect to HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-http-server.yml)|HTTP Communication::Connect to Server (C0002.009)|wininet.InternetConnect| -|[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)| | +|[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[internet_dropper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/internet_dropper.py)|HTTP Communication (C0002)|HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW| +|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication (C0002)|--| +|[bot_madness](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_madness.py)|HTTP Communication::Send Request (C0002.003)|--| +|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication (C0002)|--| +|[bot_drive](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive.py)|HTTP Communication::Send Data (C0002.005)|--| +|[network_cnc_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_cnc_http.py)|HTTP Communication (C0002)|--| +|[recon_beacon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_beacon.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpSendRequestA| +|[network_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_http.py)|HTTP Communication (C0002)|--| +|[explorer_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/explorer_http.py)|HTTP Communication (C0002)|WinHttpConnect, WinHttpOpenRequest| +|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication (C0002)|--| +|[bot_drive2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_drive2.py)|HTTP Communication::Send Data (C0002.005)|--| +|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication (C0002)|--| +|[bot_dirtjumper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_dirtjumper.py)|HTTP Communication::Send Data (C0002.005)|--| +|[bot_athenahttp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_athenahttp.py)|HTTP Communication (C0002)|--| +|[koadic_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/koadic_network_activity.py)|HTTP Communication (C0002)|HttpOpenRequestW, WinHttpOpenRequest| +|[http_request](https://github.com/CAPESandbox/community/tree/master/modules/signatures/http_request.py)|HTTP Communication (C0002)|HttpOpenRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenUrlA, InternetConnectA, InternetOpenUrlW, WinHttpGetProxyForUrl| +|[cmdline_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_http_link.py)|HTTP Communication (C0002)|--| +|[cmdline_reversed_http_link](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cmdline_reversed_http_link.py)|HTTP Communication (C0002)|--| +|[https_urls](https://github.com/CAPESandbox/community/tree/master/modules/signatures/https_urls.py)|HTTP Communication (C0002)|InternetOpenUrlW, InternetOpenUrlA| +|[network_document_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_document_http.py)|HTTP Communication (C0002)|URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile| +|[banker_zeus_url](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_url.py)|HTTP Communication (C0002)|--| +|[downloads_from_filehosting](https://github.com/CAPESandbox/community/tree/master/modules/signatures/downloads_from_filehosting.py)|HTTP Communication (C0002)|WinHttpOpenRequest, InternetOpenUrlA| +|[purplewave_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_network_activity.py)|HTTP Communication (C0002)|InternetOpenW, HttpOpenRequestW, HttpSendRequestW, HttpAddRequestHeadersA| ## References diff --git a/micro-behaviors/communication/icmp-communication.md b/micro-behaviors/communication/icmp-communication.md index 73c48e4..500273f 100644 --- a/micro-behaviors/communication/icmp-communication.md +++ b/micro-behaviors/communication/icmp-communication.md @@ -42,3 +42,8 @@ This micro-behavior is related to ICMP communication. |Tool: capa|Mapping|APIs| |---|---|---| |[send ICMP echo request](https://github.com/mandiant/capa-rules/blob/master/communication/icmp/send-icmp-echo-request.yml)|ICMP Communication::Echo Request (C0014.002)|IcmpSendEcho, IcmpSendEcho2, IcmpSendEcho2Ex, Icmp6SendEcho2, IcmpCreateFile, Icmp6CreateFile, IcmpCloseHandle| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[suspicious_ping_use](https://github.com/CAPESandbox/community/tree/master/modules/signatures/suspicious_ping_use.py)|ICMP Communication (C0014)|--| +|[network_icmp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_icmp.py)|ICMP Communication (C0014)|--| diff --git a/micro-behaviors/communication/interprocess-communication.md b/micro-behaviors/communication/interprocess-communication.md index 48a973a..c08c104 100644 --- a/micro-behaviors/communication/interprocess-communication.md +++ b/micro-behaviors/communication/interprocess-communication.md @@ -34,10 +34,10 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat |Name|ID|Description| |---|---|---| -|**Connect Pipe**|C0003.002|| -|**Create Pipe**|C0003.001|| -|**Read Pipe**|C0003.003|| -|**Write Pipe**|C0003.004|| +|**Connect Pipe**|C0003.002|--| +|**Create Pipe**|C0003.001|--| +|**Read Pipe**|C0003.003|--| +|**Write Pipe**|C0003.004|--| ## Use in Malware @@ -54,11 +54,16 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat |[create mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/create-mailslot.yml)|Interprocess Communication (C0003)|kernel32.CreateMailslot, kernel32.GetMailslotInfo, kernel32.SetMailslotInfo| |[read from mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/read-from-mailslot.yml)|Interprocess Communication (C0003)|kernel32.GetMailslotInfo, kernel32.ReadFile, kernel32.ReadFileEx| |[create pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-pipe.yml)|Interprocess Communication::Create Pipe (C0003.001)|kernel32.CreatePipe, kernel32.CreateNamedPipe, System.IO.Pipes.AnonymousPipeClientStream::ctor, System.IO.Pipes.NamedPipeClientStream::ctor, System.IO.Pipes.AnonymousPipeServerStream::ctor, System.IO.Pipes.AnonymousPipeServerStreamAcl::Create, System.IO.Pipes.NamedPipeServerStream::ctor, System.IO.Pipes.NamedPipeServerStreamAcl::Create| -|[create two anonymous pipes](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-two-anonymous-pipes.yml)|Interprocess Communication::Create Pipe (C0003.001)| | +|[create two anonymous pipes](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-two-anonymous-pipes.yml)|Interprocess Communication::Create Pipe (C0003.001)|--| |[write pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/write/write-pipe.yml)|Interprocess Communication::Write Pipe (C0003.004)|kernel32.WriteFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe| |[connect pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/connect/connect-pipe.yml)|Interprocess Communication::Connect Pipe (C0003.002)|kernel32.ConnectNamedPipe, kernel32.CallNamedPipe, System.IO.Pipes.NamedPipeClientStream::Connect, System.IO.Pipes.NamedPipeClientStream::ConnectAsync| |[read pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/read/read-pipe.yml)|Interprocess Communication::Read Pipe (C0003.003)|kernel32.PeekNamedPipe, kernel32.ReadFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication (C0003)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile| +|[ipc_namedpipe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ipc_namedpipe.py)|Interprocess Communication::Create Pipe (C0003.001)|NtReadFile, NtCreateNamedPipeFile, NtWriteFile| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/communication/smtp-communication.md b/micro-behaviors/communication/smtp-communication.md index 1f8cda1..5bdeb99 100644 --- a/micro-behaviors/communication/smtp-communication.md +++ b/micro-behaviors/communication/smtp-communication.md @@ -36,3 +36,10 @@ This micro-behavior focuses on SMTP communication. |---|---|---| |**Request**|C0012.002|Makes SMTP request.| |**Server Connect**|C0012.001|Connects to an SMTP server.| + +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[network_smtp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_smtp.py)|SMTP Communication (C0012)|--| + diff --git a/micro-behaviors/communication/socket-communication.md b/micro-behaviors/communication/socket-communication.md index bd03bd8..8e4fab4 100644 --- a/micro-behaviors/communication/socket-communication.md +++ b/micro-behaviors/communication/socket-communication.md @@ -54,7 +54,6 @@ Instead of being listed alphabetically, methods have been grouped to better faci |**TCP Client**|C0001.008|TCP client behavior.| |**UDP Client**|C0001.013|UDP client behavior.| - ## Use in Malware |Name|Date|Method|Description| @@ -84,6 +83,13 @@ Instead of being listed alphabetically, methods have been grouped to better faci |[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send| |[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[network_excessive_udp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_excessive_udp.py)|Socket Communication (C0001)|--| +|[blackrat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_network_activity.py)|Socket Communication (C0001)|send| +|[obliquerat_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_network_activity.py)|Socket Communication (C0001)|send| +|[network_bind](https://github.com/CAPESandbox/community/tree/master/modules/signatures/network_bind.py)|Socket Communication (C0001)|listen, bind| + ## References [1] https://www.mandiant.com/resources/synful-knock-acis diff --git a/micro-behaviors/communication/wininet.md b/micro-behaviors/communication/wininet.md index 2d4bd51..735ca25 100644 --- a/micro-behaviors/communication/wininet.md +++ b/micro-behaviors/communication/wininet.md @@ -42,6 +42,12 @@ The methods below are those of most interest in malware analysis. Details can be |**InternetReadFile**|C0005.004|Reads data from an open Internet file (URL data).| |**InternetWriteFile**|C0005.005|Writes data to an open Internet file.| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[nemty_network_activity](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_network_activity.py)|WinINet (C0005)|InternetOpenA, InternetOpenUrlA| + ## References [1] https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions diff --git a/micro-behaviors/cryptography/crypto-library.md b/micro-behaviors/cryptography/crypto-library.md index 5b5e9de..4dd5ab6 100644 --- a/micro-behaviors/cryptography/crypto-library.md +++ b/micro-behaviors/cryptography/crypto-library.md @@ -41,8 +41,8 @@ Malware uses a crypto library. |Tool: capa|Mapping|APIs| |---|---|---| -|[linked against Crypto++](https://github.com/mandiant/capa-rules/blob/master/linking/static/cryptopp/linked-against-crypto.yml)|Crypto Library (C0059)| | -|[linked against wolfCrypt](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfcrypt/linked-against-wolfcrypt.yml)|Crypto Library (C0059)| | -|[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)| | -|[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)| | -|[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)| | +|[linked against Crypto++](https://github.com/mandiant/capa-rules/blob/master/linking/static/cryptopp/linked-against-crypto.yml)|Crypto Library (C0059)|--| +|[linked against wolfCrypt](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfcrypt/linked-against-wolfcrypt.yml)|Crypto Library (C0059)|--| +|[linked against OpenSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/openssl/linked-against-openssl.yml)|Crypto Library (C0059)|--| +|[linked against PolarSSL/mbed TLS](https://github.com/mandiant/capa-rules/blob/master/linking/static/polarssl/linked-against-polarsslmbed-tls.yml)|Crypto Library (C0059)|--| +|[linked against wolfSSL](https://github.com/mandiant/capa-rules/blob/master/linking/static/wolfssl/linked-against-wolfssl.yml)|Crypto Library (C0059)|--| diff --git a/micro-behaviors/cryptography/cryptographic-hash.md b/micro-behaviors/cryptography/cryptographic-hash.md index 50ab28e..a16d2fc 100644 --- a/micro-behaviors/cryptography/cryptographic-hash.md +++ b/micro-behaviors/cryptography/cryptographic-hash.md @@ -58,12 +58,12 @@ Malware may use a cryptographic hash. |Tool: capa|Mapping|APIs| |---|---|---| |[hash data via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/hash-data-via-wincrypt.yml)|Cryptographic Hash (C0029)|advapi32.CryptHashData, advapi32.CryptGetHashParam| -|[hash data using tiger](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/tiger/hash-data-using-tiger.yml)|Cryptographic Hash::Tiger (C0029.005)| | +|[hash data using tiger](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/tiger/hash-data-using-tiger.yml)|Cryptographic Hash::Tiger (C0029.005)|--| |[hash data using SHA1](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha1/hash-data-using-sha1.yml)|Cryptographic Hash::SHA1 (C0029.002)|advapi32.CryptCreateHash, System.Security.Cryptography.SHA1Managed::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash| |[hash data using SHA256](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha256/hash-data-using-sha256.yml)|Cryptographic Hash::SHA256 (C0029.003)|System.Security.Cryptography.SHA256Managed::Initialize, System.Security.Cryptography.SHA256CryptoServiceProvider::Initialize, System.Security.Cryptography.SHA256::Create, System.Security.Cryptography.SHA256Managed::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash| |[hash data with MD5](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/md5/hash-data-with-md5.yml)|Cryptographic Hash::MD5 (C0029.001)|advapi32.CryptCreateHash, System.Security.Cryptography.MD5::Create, System.Security.Cryptography.MD5CryptoServiceProvider::ctor, System.Security.Cryptography.HashAlgorithm::ComputeHash| -|[hash data using SHA224](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha224/hash-data-using-sha224.yml)|Cryptographic Hash::SHA224 (C0029.004)| | -|[resolve function by FIN8 fasthash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml)|Cryptographic Hash (C0029)| | +|[hash data using SHA224](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/sha224/hash-data-using-sha224.yml)|Cryptographic Hash::SHA224 (C0029.004)|--| +|[resolve function by FIN8 fasthash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-fin8-fasthash.yml)|Cryptographic Hash (C0029)|--| ## References diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md index 9f691df..4adcae2 100644 --- a/micro-behaviors/cryptography/decrypt-data.md +++ b/micro-behaviors/cryptography/decrypt-data.md @@ -49,7 +49,6 @@ Malware may decrypt data. |**Stream Cipher**|C0031.013|Malware decrypts data encrypted with a stream cipher.| |**Twofish**|C0031.014|Malware decrypts data encrypted with the Twofish algorithm.| - ## Use in Malware |Name|Date|Method|Description| @@ -62,7 +61,11 @@ Malware may decrypt data. |Tool: capa|Mapping|APIs| |---|---|---| |[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey| -|[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)| | +|[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decrypt Data (C0031)|CryptDecrypt| ## Code Snippets diff --git a/micro-behaviors/cryptography/encrypt-data.md b/micro-behaviors/cryptography/encrypt-data.md index 1c06f36..e60909e 100644 --- a/micro-behaviors/cryptography/encrypt-data.md +++ b/micro-behaviors/cryptography/encrypt-data.md @@ -49,7 +49,6 @@ Malware may encrypt data. |**Stream Cipher**|C0027.012|Malware encrypts with a stream cipher.| |**Twofish**|C0027.005|Malware encrypts with the Twofish algorithm.| - ## Use in Malware |Name|Date|Method|Description| @@ -76,26 +75,33 @@ Malware may encrypt data. |---|---|---| |[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Encrypt Data (C0027)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey| |[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Encrypt Data (C0027)|memfrob| -|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Encrypt Data::HC-128 (C0027.006)| | -|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Encrypt Data::HC-128 (C0027.006)| | -|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Encrypt Data::RC6 (C0027.010)| | -|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Encrypt Data::Twofish (C0027.005)| | -|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Encrypt Data::AES (C0027.001)| | +|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Encrypt Data::HC-128 (C0027.006)|--| +|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Encrypt Data::HC-128 (C0027.006)|--| +|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Encrypt Data::RC6 (C0027.010)|--| +|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Encrypt Data::Twofish (C0027.005)|--| +|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Encrypt Data::AES (C0027.001)|--| |[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Encrypt Data::AES (C0027.001)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| -|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Encrypt Data::AES (C0027.001)| | -|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Encrypt Data::AES (C0027.001)| | -|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)| | -|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)| | -|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)| | +|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Encrypt Data::AES (C0027.001)|--| +|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Encrypt Data::AES (C0027.001)|--| +|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Encrypt Data::Sosemanuk (C0027.008)|--| +|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Encrypt Data::Camellia (C0027.003)|--| +|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Encrypt Data (C0027)|--| |[encrypt data using DPAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml)|Encrypt Data (C0027)|CryptProtectMemory, CryptUnprotectMemory, crypt32.CryptProtectData, crypt32.CryptUnprotectData, System.Security.Cryptography.ProtectedData::Unprotect, System.Security.Cryptography.ProtectedData::Protect| -|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)| | +|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Encrypt Data::3DES (C0027.004)|--| |[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Encrypt Data::3DES (C0027.004)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| -|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)| | +|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Encrypt Data::RC4 (C0027.009)|--| |[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Encrypt Data::RC4 (C0027.009)|CryptImportKey, CryptAcquireContext, CryptEncrypt| |[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Encrypt Data::RC4 (C0027.009)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt| -|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encrypt Data::RC4 (C0027.009)| | -|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Encrypt Data::Skipjack (C0027.013)| | -|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Encrypt Data::Blowfish (C0027.002)| | +|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encrypt Data::RC4 (C0027.009)|--| +|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Encrypt Data::Skipjack (C0027.013)|--| +|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Encrypt Data::Blowfish (C0027.002)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encrypt Data (C0027)|CryptEncrypt| +|[encrypt_data_agenttesla_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agenttesla_http.py)|Encrypt Data (C0027)|CryptEncrypt| +|[encrypt_data_agentteslat2_http](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_agentteslat2_http.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW| +|[encrypt_data_nanocore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/encrypt_data_nanocore.py)|Encrypt Data (C0027)|CryptEncrypt, GetUserNameW, GetComputerNameW| ## Code Snippets @@ -155,7 +161,6 @@ retn - ## References [1] https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf diff --git a/micro-behaviors/cryptography/encryption-key.md b/micro-behaviors/cryptography/encryption-key.md index ca0c323..61901bb 100644 --- a/micro-behaviors/cryptography/encryption-key.md +++ b/micro-behaviors/cryptography/encryption-key.md @@ -30,7 +30,6 @@ Malware may import, generate, or otherwise use an encryption key. - ## Methods |Name|ID|Description| @@ -38,7 +37,6 @@ Malware may import, generate, or otherwise use an encryption key. |**Import Public Key**|C0028.001|Malware imports a public key.| |**RC4 KSA**|C0028.002|Malware uses the RC4 Key Scheduling Algorithm (KSA).| - ## Use in Malware |Name|Date|Method|Description| @@ -54,8 +52,13 @@ Malware may import, generate, or otherwise use an encryption key. |---|---|---| |[import public key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/import-public-key.yml)|Encryption Key::Import Public Key (C0028.001)|advapi32.CryptAcquireContext, crypt32.CryptImportPublicKeyInfo, crypt32.CryptStringToBinary, crypt32.CryptDecodeObjectEx| |[create new key via CryptAcquireContext](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml)|Encryption Key (C0028)|advapi32.CryptAcquireContext| -|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encryption Key::RC4 KSA (C0028.002)| | -|[reference public RSA key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rsa/reference-public-rsa-key.yml)|Encryption Key (C0028)| | +|[encrypt data using RC4 KSA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-ksa.yml)|Encryption Key::RC4 KSA (C0028.002)|--| +|[reference public RSA key](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rsa/reference-public-rsa-key.yml)|Encryption Key (C0028)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[mass_data_encryption](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mass_data_encryption.py)|Encryption Key (C0028)|CryptEncrypt| +|[generates_crypto_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/generates_crypto_key.py)|Encryption Key (C0028)|CryptGenKey, CryptExportKey| ## References diff --git a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md index c86e0d1..b03cfb8 100644 --- a/micro-behaviors/cryptography/generate-pseudorandom-sequence.md +++ b/micro-behaviors/cryptography/generate-pseudorandom-sequence.md @@ -50,10 +50,10 @@ The Generate Pseudo-random Sequence micro-behavior can be used for a number of p |Tool: capa|Mapping|APIs| |---|---|---| -|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Generate Pseudo-random Sequence::RC4 PRGA (C0021.004)| | +|[encrypt data using RC4 PRGA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-prga.yml)|Generate Pseudo-random Sequence::RC4 PRGA (C0021.004)|--| |[generate random numbers via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-winapi.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|BCryptGenRandom, CryptGenRandom, BCryptOpenAlgorithmProvider, BCryptCloseAlgorithmProvider, CryptAquireContext| |[generate random numbers via RtlGenRandom](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/generate-random-numbers-via-rtlgenrandom.yml)|Generate Pseudo-random Sequence::Use API (C0021.003)|SystemFunction036| -|[generate random numbers using a Mersenne Twister](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml)|Generate Pseudo-random Sequence (C0021)| | +|[generate random numbers using a Mersenne Twister](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/prng/mersenne/generate-random-numbers-using-a-mersenne-twister.yml)|Generate Pseudo-random Sequence (C0021)|--| ## References diff --git a/micro-behaviors/cryptography/hashed-message-authentication-code.md b/micro-behaviors/cryptography/hashed-message-authentication-code.md index 0d45a10..78ddac2 100644 --- a/micro-behaviors/cryptography/hashed-message-authentication-code.md +++ b/micro-behaviors/cryptography/hashed-message-authentication-code.md @@ -34,4 +34,4 @@ Malware uses a hashed message authentication code (HMAC) schema. |Tool: capa|Mapping|APIs| |---|---|---| -|[authenticate HMAC](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hmac/authenticate-hmac.yml)|Hashed Message Authentication Code (C0061)| | +|[authenticate HMAC](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hmac/authenticate-hmac.yml)|Hashed Message Authentication Code (C0061)|--| diff --git a/micro-behaviors/data/check-string.md b/micro-behaviors/data/check-string.md index cf69d7f..87785df 100644 --- a/micro-behaviors/data/check-string.md +++ b/micro-behaviors/data/check-string.md @@ -30,7 +30,6 @@ Malware may check a string for some characteristics, such as being ASCII content, credit card number, or length. - ## Use in Malware |Name|Date|Method|Description| @@ -41,8 +40,8 @@ Malware may check a string for some characteristics, such as being ASCII content |Tool: capa|Mapping|APIs| |---|---|---| -|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Check String (C0019)| | -|[parse credit card information](https://github.com/mandiant/capa-rules/blob/master/collection/credit-card/parse-credit-card-information.yml)|Check String (C0019)| | +|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Check String (C0019)|--| +|[parse credit card information](https://github.com/mandiant/capa-rules/blob/master/collection/credit-card/parse-credit-card-information.yml)|Check String (C0019)|--| ## References diff --git a/micro-behaviors/data/checksum.md b/micro-behaviors/data/checksum.md index 882f864..d5f44ff 100644 --- a/micro-behaviors/data/checksum.md +++ b/micro-behaviors/data/checksum.md @@ -30,7 +30,6 @@ Malware may derive a checksum from some block of data. The checksum is often used for data validation. - ## Methods |Name|ID|Description| @@ -40,7 +39,6 @@ Malware may derive a checksum from some block of data. The checksum is often use |**CRC32**|C0032.001|Malware computes a CRC32 checksum.| |**Luhn**|C0032.002|Malware uses Luhn algorithm, often to validate identification numbers (e.g, credit card number).| - ## Use in Malware |Name|Date|Method|Description| @@ -54,11 +52,11 @@ Malware may derive a checksum from some block of data. The checksum is often use |Tool: capa|Mapping|APIs| |---|---|---| -|[validate payment card number using luhn algorithm](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml)|Checksum::Luhn (C0032.002)| | -|[compute adler32 checksum](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/adler32/compute-adler32-checksum.yml)|Checksum::Adler (C0032.005)| | +|[validate payment card number using luhn algorithm](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/luhn/validate-payment-card-number-using-luhn-algorithm.yml)|Checksum::Luhn (C0032.002)|--|| +|[compute adler32 checksum](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/adler32/compute-adler32-checksum.yml)|Checksum::Adler (C0032.005)|--|| |[hash data with CRC32](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/checksum/crc32/hash-data-with-crc32.yml)|Checksum::CRC32 (C0032.001)|RtlComputeCrc32| -|[validate payment card number using luhn algorithm with lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml)|Checksum::Luhn (C0032.002)| | -|[validate payment card number using luhn algorithm with no lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml)|Checksum::Luhn (C0032.002)| | +|[validate payment card number using luhn algorithm with lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-lookup-table.yml)|Checksum::Luhn (C0032.002)|--|| +|[validate payment card number using luhn algorithm with no lookup table](https://github.com/mandiant/capa-rules/blob/master/lib/validate-payment-card-number-using-luhn-algorithm-with-no-lookup-table.yml)|Checksum::Luhn (C0032.002)|--|| ## References diff --git a/micro-behaviors/data/compress-data.md b/micro-behaviors/data/compress-data.md index cfd6240..c81e778 100644 --- a/micro-behaviors/data/compress-data.md +++ b/micro-behaviors/data/compress-data.md @@ -42,5 +42,5 @@ Malware may compress data. |Tool: capa|Mapping|APIs| |---|---|---| |[compress data via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-winapi.yml)|Compress Data (C0024)|RtlDecompressBuffer, RtlDecompressBufferEx, RtlDecompressBufferEx2, RtlCompressBuffer, RtlCompressBufferLZNT1| -|[compress data via ZLIB inflate or deflate](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml)|Compress Data (C0024)| | -|[compress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-using-lzo.yml)|Compress Data (C0024)| | +|[compress data via ZLIB inflate or deflate](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-via-zlib-inflate-or-deflate.yml)|Compress Data (C0024)|--| +|[compress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/compress-data-using-lzo.yml)|Compress Data (C0024)|--| diff --git a/micro-behaviors/data/compression-library.md b/micro-behaviors/data/compression-library.md index bb41dc6..c91f519 100644 --- a/micro-behaviors/data/compression-library.md +++ b/micro-behaviors/data/compression-library.md @@ -28,7 +28,6 @@ # Compression Library - ## Use in Malware |Name|Date|Method|Description| @@ -40,8 +39,8 @@ |Tool: capa|Mapping|APIs| |---|---|---| -|[linked against aPLib](https://github.com/mandiant/capa-rules/blob/master/linking/static/aplib/linked-against-aplib.yml)|Compression Library (C0060)| | -|[linked against ZLIB](https://github.com/mandiant/capa-rules/blob/master/linking/static/zlib/linked-against-zlib.yml)|Compression Library (C0060)| | +|[linked against aPLib](https://github.com/mandiant/capa-rules/blob/master/linking/static/aplib/linked-against-aplib.yml)|Compression Library (C0060)|--|| +|[linked against ZLIB](https://github.com/mandiant/capa-rules/blob/master/linking/static/zlib/linked-against-zlib.yml)|Compression Library (C0060)|--|| ## References diff --git a/micro-behaviors/data/decompress-data.md b/micro-behaviors/data/decompress-data.md index 483e2fc..e686123 100644 --- a/micro-behaviors/data/decompress-data.md +++ b/micro-behaviors/data/decompress-data.md @@ -48,11 +48,15 @@ Malware may decompress data. |Tool: capa|Mapping|APIs| |---|---|---| -|[decompress data using aPLib](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-aplib.yml)|Decompress Data::aPLib (C0025.003)| | +|[decompress data using aPLib](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-aplib.yml)|Decompress Data::aPLib (C0025.003)|--| |[decompress data via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-via-iencodingfilterfactory.yml)|Decompress Data::IEncodingFilterFactory (C0025.002)|ole32.CoCreateInstance| -|[decompress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-lzo.yml)|Decompress Data (C0025)| | -|[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)| | -|[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)| | +|[decompress data using LZO](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-lzo.yml)|Decompress Data (C0025)|--| +|[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)|--| +|[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decompress Data (C0025)|RtlDecompressBuffer| ## References diff --git a/micro-behaviors/data/encode-data.md b/micro-behaviors/data/encode-data.md index 1f1f494..3045a4d 100644 --- a/micro-behaviors/data/encode-data.md +++ b/micro-behaviors/data/encode-data.md @@ -60,10 +60,10 @@ Malware may encode data. |Tool: capa|Mapping|APIs| |---|---|---| -|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Encode Data::XOR (C0026.002)| | +|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Encode Data::XOR (C0026.002)|--| |[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Encode Data::Base64 (C0026.001)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars| -|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Encode Data::Base64 (C0026.001)| | -|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Encode Data::Base64 (C0026.001)| | +|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Encode Data::Base64 (C0026.001)|--| +|[reference Base64 string](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/reference-base64-string.yml)|Encode Data::Base64 (C0026.001)|--| ## References diff --git a/micro-behaviors/data/modulo.md b/micro-behaviors/data/modulo.md index b9a38d7..9be1a76 100644 --- a/micro-behaviors/data/modulo.md +++ b/micro-behaviors/data/modulo.md @@ -34,4 +34,4 @@ Malware calculates a modulo value. |Tool: capa|Mapping|APIs| |---|---|---| -|[calculate modulo 256 via x86 assembly](https://github.com/mandiant/capa-rules/blob/master/lib/calculate-modulo-256-via-x86-assembly.yml)|Modulo (C0058)| | +|[calculate modulo 256 via x86 assembly](https://github.com/mandiant/capa-rules/blob/master/lib/calculate-modulo-256-via-x86-assembly.yml)|Modulo (C0058)|--|| diff --git a/micro-behaviors/data/noncryptographic-hash.md b/micro-behaviors/data/noncryptographic-hash.md index f7c5d47..6f4b70e 100644 --- a/micro-behaviors/data/noncryptographic-hash.md +++ b/micro-behaviors/data/noncryptographic-hash.md @@ -45,6 +45,6 @@ Malware may use a non-cryptographic hash. |Tool: capa|Mapping|APIs| |---|---|---| -|[hash data using murmur3](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml)|Non-Cryptographic Hash::MurmurHash (C0030.001)| | +|[hash data using murmur3](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/murmur/hash-data-using-murmur3.yml)|Non-Cryptographic Hash::MurmurHash (C0030.001)|--| |[hash data using fnv](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/fnv/hash-data-using-fnv.yml)|Non-Cryptographic Hash::FNV (C0030.005)|_allmul| -|[hash data using djb2](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/djb2/hash-data-using-djb2.yml)|Non-Cryptographic Hash::djb2 (C0030.006)| | +|[hash data using djb2](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/hashing/djb2/hash-data-using-djb2.yml)|Non-Cryptographic Hash::djb2 (C0030.006)|--| diff --git a/micro-behaviors/file-system/alter-file-extension.md b/micro-behaviors/file-system/alter-file-extension.md index 0e0c4fa..fed93f9 100644 --- a/micro-behaviors/file-system/alter-file-extension.md +++ b/micro-behaviors/file-system/alter-file-extension.md @@ -35,3 +35,11 @@ Malware alters a file extension. This could be done for many reasons, including |Name|ID|Description| |---|---|---| |**Append Extension**|C0015.001|A new extension is appended.| + +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[ransomware_extensions](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_extensions.py)|Alter File Extension (C0015)|--| + +|[mimics_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mimics_extension.py)|Alter File Extension (C0015)|--| diff --git a/micro-behaviors/file-system/copy-file.md b/micro-behaviors/file-system/copy-file.md index 77495b7..2d18fd8 100644 --- a/micro-behaviors/file-system/copy-file.md +++ b/micro-behaviors/file-system/copy-file.md @@ -28,7 +28,6 @@ # Copy File - ## Use in Malware |Name|Date|Method|Description| @@ -46,6 +45,10 @@ |---|---|---| |[copy file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/copy/copy-file.yml)|Copy File (C0045)|kernel32.CopyFile, kernel32.CopyFileEx, CopyFile2, CopyFileTransacted, LZCopy, System.IO.FileInfo::CopyTo, System.IO.File::Copy, kernel32.SHFileOperation| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[injection_needextension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/injection_needextension.py)|Copy File (C0045)|NtCreateUserProcess, CreateProcessInternalW| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/create-directory.md b/micro-behaviors/file-system/create-directory.md index 487cffa..d8aba9a 100644 --- a/micro-behaviors/file-system/create-directory.md +++ b/micro-behaviors/file-system/create-directory.md @@ -46,6 +46,10 @@ |---|---|---| |[create directory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/create/create-directory.yml)|Create Directory (C0046)|kernel32.CreateDirectory, kernel32.CreateDirectoryEx, kernel32.CreateDirectoryTransacted, NtCreateDirectoryObject, ZwCreateDirectoryObject, SHCreateDirectory, SHCreateDirectoryEx, _mkdir, _wmkdir, System.IO.Directory::CreateDirectory, System.IO.DirectoryInfo::Create, System.IO.DirectoryInfo::CreateSubdirectory| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create Directory (C0046)|--| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/create-file.md b/micro-behaviors/file-system/create-file.md index 90101fa..d3f6413 100644 --- a/micro-behaviors/file-system/create-file.md +++ b/micro-behaviors/file-system/create-file.md @@ -42,3 +42,28 @@ Malware creates a file. |Tool: capa|Mapping|APIs| |---|---|---| |[create or open file](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-file.yml)|Create File (C0016)|CreateFile, CreateFileEx, IoCreateFile, IoCreateFileEx, ZwOpenFile, ZwCreateFile, NtOpenFile, NtCreateFile, LZCreateFile, LZOpenFile, fopen, fopen64, fdopen, freopen, open, openat| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[office_postscript](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_postscript.py)|Create File (C0016)|NtWriteFile| +|[spreading_autoruninf](https://github.com/CAPESandbox/community/tree/master/modules/signatures/spreading_autoruninf.py)|Create File (C0016)|--| +|[arkei_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/arkei_files.py)|Create File (C0016)|--| +|[xpertrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_files.py)|Create File (C0016)|--| +|[nemty_note](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_note.py)|Create File (C0016)|NtWriteFile| +|[warzonerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_files.py)|Create File (C0016)|--| +|[masslogger_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_files.py)|Create File (C0016)|--| +|[ransomware_message](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_message.py)|Create File (C0016)|NtWriteFile| +|[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_file_created.py)|Create File (C0016)|NtCreateFile| +|[neshta_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_files.py)|Create File (C0016)|NtCreateFile| +|[copies_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/copies_self.py)|Create File (C0016)|--| +|[office_write_exe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_write_exe.py)|Create File (C0016)|NtWriteFile| +|[stealth_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_file.py)|Create File (C0016)|NtSetInformationFile, NtClose, NtCreateFile, NtDuplicateObject, NtOpenFile| +|[obliquerat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_files.py)|Create File (C0016)|--| +|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File (C0016)|--| +|[ransomware_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_files.py)|Create File::Create Ransomware File (C0016.002)|--| +|[dcrat_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_files.py)|Create File (C0016)|--| +|[karagany_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/karagany_files.py)|Create File (C0016)|--| +|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File (C0016)|--| +|[rtf_embedded_office_file](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rtf_embedded_office_file.py)|Create File::Create Office Document (C0016.001)|--| +|[qulab_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/qulab_files.py)|Create File (C0016)|--| +|[remcos_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_files.py)|Create File (C0016)|--| diff --git a/micro-behaviors/file-system/delete-directory.md b/micro-behaviors/file-system/delete-directory.md index 49ae3e4..27ba701 100644 --- a/micro-behaviors/file-system/delete-directory.md +++ b/micro-behaviors/file-system/delete-directory.md @@ -28,7 +28,6 @@ # Delete Directory - ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/delete-file.md b/micro-behaviors/file-system/delete-file.md index c11cb07..b379bf2 100644 --- a/micro-behaviors/file-system/delete-file.md +++ b/micro-behaviors/file-system/delete-file.md @@ -28,7 +28,6 @@ # Delete File - ## Use in Malware |Name|Date|Method|Description| @@ -53,6 +52,15 @@ |---|---|---| |[delete file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/delete/delete-file.yml)|Delete File (C0047)|kernel32.DeleteFile, DeleteFileTransacted, NtDeleteFile, ZwDeleteFile, remove, _wremove, System.IO.File::Delete, System.IO.FileSystemInfo::Delete, kernel32.SHFileOperation, MoveFileEx| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[clears_logs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/clears_logs.py)|Delete File (C0047)|--| +|[removes_zoneid_ads](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_zoneid_ads.py)|Delete File (C0047)|DeleteFileW, DeleteFileA| +|[ransomware_recyclebin](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_recyclebin.py)|Delete File (C0047)|--| +|[trickbot_task_delete](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_task_delete.py)|Delete File (C0047)|DeleteFileW| +|[anomalous_deletefile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/anomalous_deletefile.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA| +|[deletes_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deletes_self.py)|Delete File (C0047)|NtDeleteFile, DeleteFileW, DeleteFileA, MoveFileWithProgressW, MoveFileWithProgressTransactedW| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/get-file-attributes.md b/micro-behaviors/file-system/get-file-attributes.md index 01facc7..e752bd4 100644 --- a/micro-behaviors/file-system/get-file-attributes.md +++ b/micro-behaviors/file-system/get-file-attributes.md @@ -28,7 +28,6 @@ # Get File Attributes - ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/move-file.md b/micro-behaviors/file-system/move-file.md index 391ca17..b08818d 100644 --- a/micro-behaviors/file-system/move-file.md +++ b/micro-behaviors/file-system/move-file.md @@ -28,7 +28,6 @@ # Move File - ## Use in Malware |Name|Date|Method|Description| @@ -46,6 +45,10 @@ |---|---|---| |[move file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/move/move-file.yml)|Move File (C0063)|kernel32.MoveFile, kernel32.MoveFileEx, MoveFileWithProgress, MoveFileTransacted, rename, _wrename, System.IO.FileInfo::MoveTo, System.IO.File::Move, kernel32.SHFileOperation| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/read-file.md b/micro-behaviors/file-system/read-file.md index 2aad77f..ae91759 100644 --- a/micro-behaviors/file-system/read-file.md +++ b/micro-behaviors/file-system/read-file.md @@ -28,7 +28,6 @@ # Read File - ## Use in Malware |Name|Date|Method|Description| @@ -57,6 +56,15 @@ |[read file on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-file-on-linux.yml)|Read File (C0051)|fgetc, fgets, getc, getchar, read, getline, getdelim, fgetwc, getwc, fscanf, vfscanf, fread| |[read .ini file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/read/read-ini-file.yml)|Read File (C0051)|GetPrivateProfileInt, GetPrivateProfileString, GetPrivateProfileStruct, GetPrivateProfileSection, GetPrivateProfileSectionNames, GetFullPathName| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[reads_self](https://github.com/CAPESandbox/community/tree/master/modules/signatures/reads_self.py)|Read File (C0051)|NtReadFile, NtSetInformationFile, NtClose, NtCreateFile, NtOpenFile| +|[accesses_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_sysvol.py)|Read File (C0051)|--| +|[antidebug_devices](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_devices.py)|Read File (C0051)|--| +|[antiav_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectfile.py)|Read File (C0051)|--| +|[infostealer_browser](https://github.com/CAPESandbox/community/tree/master/modules/signatures/infostealer_browser.py)|Read File (C0051)|NtReadFile, CopyFileA, CopyFileExW, CopyFileW| +|[antianalysis_detectfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectfile.py)|Read File (C0051)|--| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/file-system/set-file-attributes.md b/micro-behaviors/file-system/set-file-attributes.md index fb922f1..08ff587 100644 --- a/micro-behaviors/file-system/set-file-attributes.md +++ b/micro-behaviors/file-system/set-file-attributes.md @@ -28,7 +28,6 @@ # Set File Attributes - ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/file-system/writes-file.md b/micro-behaviors/file-system/writes-file.md index b11ba12..0c8d391 100644 --- a/micro-behaviors/file-system/writes-file.md +++ b/micro-behaviors/file-system/writes-file.md @@ -28,7 +28,6 @@ # Writes File - ## Use in Malware |Name|Date|Method|Description| @@ -54,6 +53,18 @@ |[write file on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/write/write-file-on-windows.yml)|Writes File (C0052)|kernel32.WriteFile, kernel32.WriteFileEx, NtWriteFile, ZwWriteFile, _fwrite, fwrite, System.IO.File::WriteAllBytes, System.IO.File::WriteAllBytesAsync, System.IO.File::WriteAllLines, System.IO.File::WriteAllLinesAsync, System.IO.File::WriteAllText, System.IO.File::WriteAllTextAsync, System.IO.File::AppendAllLines, System.IO.File::AppendAllLinesAsync, System.IO.File::AppendAllText, System.IO.File::AppendAllTextAsync, System.IO.File::AppendText, System.IO.FileInfo::AppendText| |[create process memory minidump](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/dump/create-process-memory-minidump.yml)|Writes File (C0052)|dbghelp.MiniDumpWriteDump| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[poullight_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/poullight_files.py)|Writes File (C0052)|--| +|[masslogger_artifacts](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_artifacts.py)|Writes File (C0052)|CryptDecrypt, FindFirstFileExW| +|[masslogger_version](https://github.com/CAPESandbox/community/tree/master/modules/signatures/masslogger_version.py)|Writes File (C0052)|NtWriteFile| +|[writes_sysvol](https://github.com/CAPESandbox/community/tree/master/modules/signatures/writes_sysvol.py)|Writes File (C0052)|--| +|[wiper_zeroedbytes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wiper_zeroedbytes.py)|Writes File (C0052)|NtWriteFile| +|[modify_hostfile](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_hostfile.py)|Writes File (C0052)|--| +|[apocalypse_stealer_file_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/apocalypse_stealer_file_behavior.py)|Writes File (C0052)|--| +|[echelon_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/echelon_files.py)|Writes File (C0052)|--| +|[upatre_files](https://github.com/CAPESandbox/community/tree/master/modules/signatures/upatre_files.py)|Writes File (C0052)|--| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/hardware/load-driver.md b/micro-behaviors/hardware/load-driver.md index 81e8186..9dc83db 100644 --- a/micro-behaviors/hardware/load-driver.md +++ b/micro-behaviors/hardware/load-driver.md @@ -41,3 +41,7 @@ Malware loads a device driver or minifilter. |Tool: capa|Mapping|APIs| |---|---|---| |[start minifilter driver](https://github.com/mandiant/capa-rules/blob/master/host-interaction/filter/start-minifilter-driver.yml)|Load Driver::Minifilter (C0023.001)|FltStartFiltering| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_load.py)|Load Driver (C0023)|NtLoadDriver| diff --git a/micro-behaviors/memory/allocate-memory.md b/micro-behaviors/memory/allocate-memory.md index 0145863..a1c229d 100644 --- a/micro-behaviors/memory/allocate-memory.md +++ b/micro-behaviors/memory/allocate-memory.md @@ -48,10 +48,14 @@ Malware allocates memory, often to unpack itself. |Tool: capa|Mapping|APIs| |---|---|---| -|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)| | +|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)|--| |[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory| -|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)| | -|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)| | +|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--| +|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| ## References diff --git a/micro-behaviors/memory/change-memory-protection.md b/micro-behaviors/memory/change-memory-protection.md index d5bd058..12fc778 100644 --- a/micro-behaviors/memory/change-memory-protection.md +++ b/micro-behaviors/memory/change-memory-protection.md @@ -37,7 +37,6 @@ Malware may change memory protection. For example, read-write memory may be chan |**Executable Heap**|C0008.002|The heap is made executable.| |**Executable Stack**|C0008.001|The stack is made executable.| - ## Use in Malware |Name|Date|Method|Description| @@ -45,6 +44,11 @@ Malware may change memory protection. For example, read-write memory may be chan |[**Ursnif**](../../xample-malware/ursnif.md)|2016|--|The malware changes the PE header of the child process to enable write access to that page and writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe in the target child process. The region protection is changed back to "read only" to avoid suspicion. [[1]](#1)| |[**SYNful Knock**](../../xample-malware/synful-knock.md)|2015|--|SYNful Knock modifies the translation lookaside buffer (TLB) Read/Write attributes. [[2]](#2)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antidebug_guardpages](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_guardpages.py)|Change Memory Protection (C0008)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory| ## References diff --git a/micro-behaviors/memory/heap-spray.md b/micro-behaviors/memory/heap-spray.md index cbd8ce2..86edeb6 100644 --- a/micro-behaviors/memory/heap-spray.md +++ b/micro-behaviors/memory/heap-spray.md @@ -29,3 +29,10 @@ # Heap Spray Malware may use heap spraying to write a sequence of bytes on the heap section of a process. + +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[exploit_heapspray](https://github.com/CAPESandbox/community/tree/master/modules/signatures/exploit_heapspray.py)|Heap Spray (C0006)|NtAllocateVirtualMemory| + diff --git a/micro-behaviors/memory/overflow-buffer.md b/micro-behaviors/memory/overflow-buffer.md index df1a4a8..608c1d4 100644 --- a/micro-behaviors/memory/overflow-buffer.md +++ b/micro-behaviors/memory/overflow-buffer.md @@ -30,7 +30,6 @@ Malware may overflow the buffer for various purposes. - ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/operating-system/console.md b/micro-behaviors/operating-system/console.md index af733d1..7ca4e95 100644 --- a/micro-behaviors/operating-system/console.md +++ b/micro-behaviors/operating-system/console.md @@ -36,3 +36,7 @@ Malware modifies the console. |---|---|---| |[set console window title](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/console/set-console-window-title.yml)|Console (C0033)|kernel32.SetConsoleTitle| |[manipulate console buffer](https://github.com/mandiant/capa-rules/blob/master/host-interaction/console/manipulate-console-buffer.yml)|Console (C0033)|kernel32.SetConsoleCursorPosition, kernel32.ReadConsoleOutputCharacter, kernel32.WriteConsoleOutputCharacter, kernel32.WriteConsoleOutput, kernel32.WriteConsoleInput, kernel32.GetStdHandle, System.Console::Write, System.Console::WriteLine| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[bcdedit_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bcdedit_command.py)|Console (C0033)|ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW| diff --git a/micro-behaviors/operating-system/environment-variable.md b/micro-behaviors/operating-system/environment-variable.md index 042e15e..2cd226e 100644 --- a/micro-behaviors/operating-system/environment-variable.md +++ b/micro-behaviors/operating-system/environment-variable.md @@ -48,7 +48,7 @@ Malware modifies environment variables. |Tool: capa|Mapping|APIs| |---|---|---| |[set environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/set-environment-variable.yml)|Environment Variable::Set Variable (C0034.001)|kernel32.SetEnvironmentStrings, kernel32.SetEnvironmentVariable, System.Environment::SetEnvironmentVariable| -|[get COMSPEC environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/get-comspec-environment-variable.yml)|Environment Variable (C0034)| | +|[get COMSPEC environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/get-comspec-environment-variable.yml)|Environment Variable (C0034)|--| ## References diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md index bc2703f..19e8472 100644 --- a/micro-behaviors/operating-system/registry.md +++ b/micro-behaviors/operating-system/registry.md @@ -97,6 +97,129 @@ Malware modifies the registry. |[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Create Registry Key (C0036.004)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey| |[create or open registry key](https://github.com/mandiant/capa-rules/blob/master/lib/create-or-open-registry-key.yml)|Registry::Open Registry Key (C0036.003)|advapi32.RegOpenKey, advapi32.RegOpenKeyEx, advapi32.RegCreateKey, advapi32.RegCreateKeyEx, advapi32.RegOpenCurrentUser, advapi32.RegOpenKeyTransacted, advapi32.RegOpenUserClassesRoot, advapi32.RegCreateKeyTransacted, ZwOpenKey, ZwOpenKeyEx, ZwCreateKey, ZwOpenKeyTransacted, ZwOpenKeyTransactedEx, ZwCreateKeyTransacted, NtOpenKey, NtCreateKey, SHRegOpenUSKey, SHRegCreateUSKey, RtlCreateRegistryKey, Microsoft.Win32.RegistryKey::OpenSubKey, Microsoft.Win32.RegistryKey::OpenBaseKey, Microsoft.Win32.RegistryKey::OpenRemoteBaseKey, Microsoft.Win32.RegistryKey::CreateSubKey| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[persistence_rdp_registry](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_rdp_registry.py)|Registry (C0036)|--| +|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Registry (C0036)|--| +|[browser_helper_object](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_helper_object.py)|Registry::Set Registry Value (C0036.001)|--| +|[modirat_behavior](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modirat_behavior.py)|Registry (C0036)|--| +|[darkcomet_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/darkcomet_regkeys.py)|Registry (C0036)|--| +|[ransomware_revil_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ransomware_revil_regkey.py)|Registry (C0036)|--| +|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Registry (C0036)|--| +|[browser_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_security.py)|Registry::Set Registry Value (C0036.001)|--| +|[disables_notificationcenter](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_notificationcenter.py)|Registry (C0036)|--| +|[mapped_drives_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/mapped_drives_uac.py)|Registry (C0036)|--| +|[removes_networking_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_networking_icon.py)|Registry (C0036)|--| +|[tampers_powershell_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_powershell_logging.py)|Registry (C0036)|--| +|[disables_power_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_power_options.py)|Registry (C0036)|--| +|[disables_cpl_disable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_cpl_disable.py)|Registry (C0036)|--| +|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Registry (C0036)|--| +|[browser_startpage](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_startpage.py)|Registry::Set Registry Value (C0036.001)|--| +|[hides_recycle_bin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/hides_recycle_bin_icon.py)|Registry (C0036)|--| +|[disables_restore_default_state](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_restore_default_state.py)|Registry (C0036)|--| +|[disables_auto_app_termination](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_auto_app_termination.py)|Registry (C0036)|--| +|[nemty_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_regkeys.py)|Registry (C0036)|--| +|[warzonerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/warzonerat_regkeys.py)|Registry (C0036)|--| +|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Registry (C0036)|--| +|[antivm_generic_cpu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_cpu.py)|Registry::Query Registry Key (C0036.005)|--| +|[prevents_safeboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/prevents_safeboot.py)|Registry (C0036)|--| +|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|Registry (C0036)|--| +|[accesses_mailslot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_mailslot.py)|Registry::Open Registry Key (C0036.003)|--| +|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|Registry (C0036)|--| +|[accesses_netlogon_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/accesses_netlogon_regkey.py)|Registry::Open Registry Key (C0036.003)|--| +|[disables_smartscreen](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_smartscreen.py)|Registry (C0036)|--| +|[disables_context_menus](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_context_menus.py)|Registry (C0036)|--| +|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ketrican_regkeys.py)|Registry (C0036)|--| +|[ketrican_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ketrican_regkeys.py)|Registry::Query Registry Key (C0036.005)|--| +|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Registry (C0036)|--| +|[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_bios.py)|Registry::Query Registry Key (C0036.005)|--| +|[evil_grab](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW| +|[PlugX](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|memcpy, RtlDecompressBuffer| +|[reg_binary](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Registry (C0036)|RegCreateKeyExA, RegSetValueExA, RegCreateKeyExW, RegSetValueExW| +|[stealth_hidden_extension](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hidden_extension.py)|Registry (C0036)|--| +|[disables_run_command](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_run_command.py)|Registry (C0036)|--| +|[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_ifeo.py)|Registry (C0036)|--| +|[persistence_slient_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_slient_process_exit.py)|Registry (C0036)|--| +|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Registry (C0036)|--| +|[antivm_vbox_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vbox_keys.py)|Registry::Query Registry Key (C0036.005)|--| +|[packer_armadillo_regkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_armadillo_regkey.py)|Registry (C0036)|--| +|[disables_backups](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_backups.py)|Registry (C0036)|--| +|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Registry (C0036)|--| +|[antianalysis_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antianalysis_detectreg.py)|Registry::Open Registry Key (C0036.003)|--| +|[creates_largekey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_largekey.py)|Registry (C0036)|RegSetValueExA, RegSetValueExW, NtSetValueKey| +|[removes_username_startmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_username_startmenu.py)|Registry (C0036)|--| +|[stealth_hiddenreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hiddenreg.py)|Registry (C0036)|--| +|[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_startmenu_search.py)|Registry (C0036)|--| +|[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_hide_notifications.py)|Registry (C0036)|--| +|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Registry (C0036)|--| +|[antivm_hyperv_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_hyperv_keys.py)|Registry::Query Registry Key (C0036.005)|--| +|[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_app_launch.py)|Registry (C0036)|--| +|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_regkeys.py)|Registry (C0036)|RegSetValueExA, RegSetValueExW| +|[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/creates_nullvalue.py)|Registry (C0036)|NtCreateKey, NtSetValueKey| +|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry (C0036)|--| +|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry::Set Registry Value (C0036.001)|--| +|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Registry (C0036)|--| +|[modify_attachment_manager](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_attachment_manager.py)|Registry::Set Registry Value (C0036.001)|--| +|[modify_certs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_certs.py)|Registry (C0036)|--| +|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Registry (C0036)|--| +|[modify_proxy](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_proxy.py)|Registry::Set Registry Value (C0036.001)|--| +|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Registry (C0036)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA| +|[antivm_generic_scsi](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_scsi.py)|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegQueryValueExA, RegQueryValueExW, RegOpenKeyExA| +|[disables_appv_virtualization](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_appv_virtualization.py)|Registry (C0036)|--| +|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Registry (C0036)|--| +|[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_xen_keys.py)|Registry::Query Registry Key (C0036.005)|--| +|[njrat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/njrat_regkeys.py)|Registry (C0036)|--| +|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Registry (C0036)|--| +|[antivm_parallels_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_parallels_keys.py)|Registry::Query Registry Key (C0036.005)|--| +|[blackrat_registry_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_registry_keys.py)|Registry (C0036)|RegQueryValueExW, RegSetValueExW| +|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Registry (C0036)|--| +|[antivm_generic_diskreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_diskreg.py)|Registry::Query Registry Key (C0036.005)|--| +|[dotnet_clr_usagelog_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dotnet_clr_usagelog_regkeys.py)|Registry (C0036)|--| +|[rdptcp_key](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rdptcp_key.py)|Registry (C0036)|--| +|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Registry (C0036)|--| +|[antivm_vpc_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_keys.py)|Registry::Query Registry Key (C0036.005)|--| +|[disables_system_restore](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_system_restore.py)|Registry (C0036)|--| +|[disables_folder_options](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_folder_options.py)|Registry (C0036)|--| +|[office_security](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_security.py)|Registry (C0036)|--| +|[antivm_bochs_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_bochs_keys.py)|Registry::Query Registry Key (C0036.005)|--| +|[removes_security_maintenance_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_security_maintenance_icon.py)|Registry (C0036)|--| +|[tampers_etw](https://github.com/CAPESandbox/community/tree/master/modules/signatures/tampers_etw.py)|Registry (C0036)|--| +|[disables_event_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_event_logging.py)|Registry (C0036)|--| +|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Registry (C0036)|--| +|[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_system.py)|Registry::Query Registry Key (C0036.005)|--| +|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Registry (C0036)|--| +|[browser_addon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/browser_addon.py)|Registry::Set Registry Value (C0036.001)|--| +|[enables_wdigest](https://github.com/CAPESandbox/community/tree/master/modules/signatures/enables_wdigest.py)|Registry (C0036)|--| +|[removes_startmenu_defaults](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_startmenu_defaults.py)|Registry (C0036)|--| +|[disables_uac](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_uac.py)|Registry (C0036)|--| +|[disables_wer](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_wer.py)|Registry (C0036)|--| +|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry (C0036)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA| +|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry::Query Registry Key (C0036.005)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA| +|[antivm_generic_services](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_generic_services.py)|Registry::Query Registry Value (C0036.006)|RegOpenKeyExW, RegEnumKeyExW, RegEnumKeyExA, RegOpenKeyExA| +|[office_perfkey](https://github.com/CAPESandbox/community/tree/master/modules/signatures/office_perfkey.py)|Registry (C0036)|--| +|[modify_oem_information](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_oem_information.py)|Registry (C0036)|--| +|[limerat_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_regkeys.py)|Registry (C0036)|--| +|[disables_windows_defender_dism](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_dism.py)|Registry (C0036)|--| +|[disables_windows_defender_logging](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windows_defender_logging.py)|Registry (C0036)|--| +|[removes_windows_defender_contextmenu](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_windows_defender_contextmenu.py)|Registry (C0036)|--| +|[disables_browser_warn](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_browser_warn.py)|Registry (C0036)|--| +|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Registry (C0036)|--| +|[antiemu_wine_reg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiemu_wine_reg.py)|Registry::Query Registry Key (C0036.005)|--| +|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectreg.py)|Registry (C0036)|--| +|[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_detectreg.py)|Registry::Query Registry Key (C0036.005)|--| +|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Registry (C0036)|--| +|[antivm_vmware_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_keys.py)|Registry::Query Registry Key (C0036.005)|--| +|[disables_windowsupdate](https://github.com/CAPESandbox/community/tree/master/modules/signatures/disables_windowsupdate.py)|Registry (C0036)|--| +|[recon_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_programs.py)|Registry (C0036)|RegQueryValueExA, RegQueryValueExW| +|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Registry (C0036)|--| +|[antiav_srp](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_srp.py)|Registry::Set Registry Value (C0036.001)|--| +|[recon_fingerprint](https://github.com/CAPESandbox/community/tree/master/modules/signatures/recon_fingerprint.py)|Registry (C0036)|--| +|[removes_pinned_programs](https://github.com/CAPESandbox/community/tree/master/modules/signatures/removes_pinned_programs.py)|Registry (C0036)|--| +|[medusalocker_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_regkeys.py)|Registry (C0036)|--| +|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry (C0036)|--| +|[bypass_firewall](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bypass_firewall.py)|Registry::Set Registry Value (C0036.001)|--| +|[remcos_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_regkeys.py)|Registry (C0036)|--| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/micro-behaviors/operating-system/wallpaper.md b/micro-behaviors/operating-system/wallpaper.md index 89ccef3..34cd848 100644 --- a/micro-behaviors/operating-system/wallpaper.md +++ b/micro-behaviors/operating-system/wallpaper.md @@ -35,3 +35,7 @@ Malware modifies the wallpaper. |Tool: capa|Mapping|APIs| |---|---|---| |[change the wallpaper](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/session/wallpaper/change-the-wallpaper.yml)|Wallpaper (C0035)|SystemParametersInfo| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[modify_desktop_wallpaper](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_desktop_wallpaper.py)|Wallpaper (C0035)|SystemParametersInfoA, SystemParametersInfoW| diff --git a/micro-behaviors/process/allocate-thread-local-storage.md b/micro-behaviors/process/allocate-thread-local-storage.md index f9fd69f..75b9791 100644 --- a/micro-behaviors/process/allocate-thread-local-storage.md +++ b/micro-behaviors/process/allocate-thread-local-storage.md @@ -30,7 +30,6 @@ Malware allocates thread local storage. - ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/process/check-mutex.md b/micro-behaviors/process/check-mutex.md index 5a9e197..aefcad4 100644 --- a/micro-behaviors/process/check-mutex.md +++ b/micro-behaviors/process/check-mutex.md @@ -44,6 +44,13 @@ Malware checks a mutex. |[check mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex.yml)|Check Mutex (C0043)|kernel32.OpenMutex, System.Threading.Mutex::OpenExisting, System.Threading.Mutex::TryOpenExisting, kernel32.GetLastError| |[check mutex and exit](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/check-mutex-and-exit.yml)|Check Mutex (C0043)|ExitProcess, exit, _Exit, _exit, WaitForSingleObject, GetLastError| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[antivm_vpc_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vpc_mutex.py)|Check Mutex (C0043)|--| +|[antisandbox_sboxie_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antisandbox_sboxie_mutex.py)|Check Mutex (C0043)|--| +|[antivm_vmware_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antivm_vmware_mutexes.py)|Check Mutex (C0043)|--| +|[purplewave_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/purplewave_mutexes.py)|Check Mutex (C0043)|--| + ## References [1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant diff --git a/micro-behaviors/process/create-mutex.md b/micro-behaviors/process/create-mutex.md index 74356ce..304c72e 100644 --- a/micro-behaviors/process/create-mutex.md +++ b/micro-behaviors/process/create-mutex.md @@ -48,6 +48,60 @@ Malware creates a mutex. |[create mutex](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/create-mutex.yml)|Create Mutex (C0042)|kernel32.CreateMutex, kernel32.CreateMutexEx, System.Threading.Mutex::ctor| |[lock file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/mutex/lock-file.yml)|Create Mutex (C0042)|fcntl| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[banker_zeus_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_mutex.py)|Create Mutex (C0042)|--| +|[parallax_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/parallax_mutexes.py)|Create Mutex (C0042)|--| +|[gandcrab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/gandcrab_mutexes.py)|Create Mutex (C0042)|--| +|[packer_armadillo_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/packer_armadillo_mutex.py)|Create Mutex (C0042)|--| +|[fleercivet_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/fleercivet_mutex.py)|Create Mutex (C0042)|--| +|[renamer_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/renamer_mutexes.py)|Create Mutex (C0042)|--| +|[revil_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/revil_mutexes.py)|Create Mutex (C0042)|--| +|[trickbot_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/trickbot_mutex.py)|Create Mutex (C0042)|--| +|[rat_fynloski_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_fynloski_mutexes.py)|Create Mutex (C0042)|--| +|[rat_beebus_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_beebus_mutexes.py)|Create Mutex (C0042)|--| +|[xpertrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/xpertrat_mutexes.py)|Create Mutex (C0042)|--| +|[nemty_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/nemty_mutexes.py)|Create Mutex (C0042)|--| +|[stop_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stop_ransom_mutexes.py)|Create Mutex (C0042)|--| +|[okrum_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/okrum_mutexes.py)|Create Mutex (C0042)|--| +|[pysa_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/pysa_mutexes.py)|Create Mutex (C0042)|--| +|[banker_cridex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_cridex.py)|Create Mutex (C0042)|--| +|[fonix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/fonix_mutexes.py)|Create Mutex (C0042)|--| +|[germanwiper_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/germanwiper_mutexes.py)|Create Mutex (C0042)|--| +|[ratsnif_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/ratsnif_mutexes.py)|Create Mutex (C0042)|--| +|[crat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/crat_mutexes.py)|Create Mutex (C0042)|--| +|[neshta_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/neshta_mutexes.py)|Create Mutex (C0042)|--| +|[banker_spyeye_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_spyeye_mutexes.py)|Create Mutex (C0042)|--| +|[powerpool_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/powerpool_mutexes.py)|Create Mutex (C0042)|--| +|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Create Mutex (C0042)|--| +|[deepfreeze_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/deepfreeze_mutex.py)|Create Mutex (C0042)|--| +|[rat_xtreme_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_xtreme_mutexes.py)|Create Mutex (C0042)|--| +|[lokibot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/lokibot_mutexes.py)|Create Mutex (C0042)|--| +|[blackrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/blackrat_mutexes.py)|Create Mutex (C0042)|--| +|[rat_plugx_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_plugx_mutexes.py)|Create Mutex (C0042)|--| +|[obliquerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/obliquerat_mutexes.py)|Create Mutex (C0042)|--| +|[cypherit_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cypherit_mutexes.py)|Create Mutex (C0042)|--| +|[protonbot_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/protonbot_mutexes.py)|Create Mutex (C0042)|--| +|[cryptomix_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/cryptomix_mutexes.py)|Create Mutex (C0042)|--| +|[phorpiex_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/phorpiex_mutexes.py)|Create Mutex (C0042)|--| +|[venomrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/venomrat_mutexes.py)|Create Mutex (C0042)|--| +|[dcrat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dcrat_mutexes.py)|Create Mutex (C0042)|--| +|[andromut_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/andromut_mutexes.py)|Create Mutex (C0042)|--| +|[azorult_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/azorult_mutexes.py)|Create Mutex (C0042)|--| +|[dharma_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/dharma_mutexes.py)|Create Mutex (C0042)|--| +|[rat_quasar_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_quasar_mutexes.py)|Create Mutex (C0042)|--| +|[bot_russkill](https://github.com/CAPESandbox/community/tree/master/modules/signatures/bot_russkill.py)|Create Mutex (C0042)|--| +|[snake_ransom_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/snake_ransom_mutexes.py)|Create Mutex (C0042)|--| +|[limerat_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/limerat_mutexes.py)|Create Mutex (C0042)|--| +|[qulab_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/qulab_mutexes.py)|Create Mutex (C0042)|--| +|[allaple_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/allaple_mutexes.py)|Create Mutex (C0042)|--| +|[banker_zeus_p2p](https://github.com/CAPESandbox/community/tree/master/modules/signatures/banker_zeus_p2p.py)|Create Mutex (C0042)|--| +|[carberp_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/carberp_mutex.py)|Create Mutex (C0042)|--| +|[rat_poisonivy_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/rat_poisonivy_mutexes.py)|Create Mutex (C0042)|--| +|[satan_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/satan_mutexes.py)|Create Mutex (C0042)|--| +|[medusalocker_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/medusalocker_mutexes.py)|Create Mutex (C0042)|--| +|[remcos_mutexes](https://github.com/CAPESandbox/community/tree/master/modules/signatures/remcos_mutexes.py)|Create Mutex (C0042)|--| + ## References [1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant diff --git a/micro-behaviors/process/create-process.md b/micro-behaviors/process/create-process.md index ea632a9..9373027 100644 --- a/micro-behaviors/process/create-process.md +++ b/micro-behaviors/process/create-process.md @@ -38,7 +38,6 @@ Malware creates a process. |**Create Process via WMI**|C0017.002|Malware uses WMI to create a process.| |**Create Suspended Process**|C0017.003|Malware created a suspended process.| - ## Use in Malware |Name|Date|Method|Description| @@ -68,6 +67,14 @@ Malware creates a process. |[create a process with modified I/O handles and window](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-a-process-with-modified-io-handles-and-window.yml)|Create Process (C0017)|kernel32.CreateProcess, kernel32.CreateProcessInternal, advapi32.CreateProcessAsUser, advapi32.CreateProcessWithLogon, advapi32.CreateProcessWithToken, kernel32.GetStartupInfo, System.Diagnostics.Process::Start| |[create process suspended](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/create/create-process-suspended.yml)|Create Process::Create Suspended Process (C0017.003)|kernel32.CreateProcess, advapi32.CreateProcessAsUser| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[stealth_system_procname](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stealth_system_procname.py)|Create Process (C0017)|ShellExecuteExW, CreateProcessInternalW| +|[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/stack_pivot_process_create.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW| +|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW| +|[wmi_create_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/wmi_create_process.py)|Create Process::Create Process via WMI (C0017.002)|NtCreateUserProcess, CreateProcessInternalW| +|[script_created_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/script_created_process.py)|Create Process (C0017)|NtCreateUserProcess, CreateProcessInternalW| + ## References [1] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/micro-behaviors/process/create-thread.md b/micro-behaviors/process/create-thread.md index 0137968..ed5cb1d 100644 --- a/micro-behaviors/process/create-thread.md +++ b/micro-behaviors/process/create-thread.md @@ -28,7 +28,6 @@ # Create Thread - ## Use in Malware |Name|Date|Method|Description| @@ -45,7 +44,13 @@ |Tool: capa|Mapping|APIs| |---|---|---| |[create thread](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/create/create-thread.yml)|Create Thread (C0038)|kernel32.CreateThread, _beginthread, _beginthreadex, PsCreateSystemThread, SHCreateThread, SHCreateThreadWithHandle, kernel32.CreateRemoteThread, kernel32.CreateRemoteThreadEx, RtlCreateUserThread, ntdll.NtCreateThread, ntdll.NtCreateThreadEx, ntdll.ZwCreateThread, ntdll.ZwCreateThreadEx, pthread_create, System.Threading.Thread::Start, System.Threading.Thread::ctor| -|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Create Thread (C0038)| | +|[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Create Thread (C0038)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[injection_create_remote_thread](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Create Thread (C0038)|--| +|[antidebug_ntcreatethreadex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntcreatethreadex.py)|Create Thread (C0038)|NtCreateThreadEx| +|[antidebug_ntsetinformationthread](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antidebug_ntsetinformationthread.py)|Create Thread (C0038)|NtSetInformationThread| ## References diff --git a/micro-behaviors/process/resume-thread.md b/micro-behaviors/process/resume-thread.md index 13237f4..26b60fa 100644 --- a/micro-behaviors/process/resume-thread.md +++ b/micro-behaviors/process/resume-thread.md @@ -28,7 +28,6 @@ # Resume Thread - ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/process/set-thread-local-storage-value.md b/micro-behaviors/process/set-thread-local-storage-value.md index 01fb659..acc7ca8 100644 --- a/micro-behaviors/process/set-thread-local-storage-value.md +++ b/micro-behaviors/process/set-thread-local-storage-value.md @@ -30,7 +30,6 @@ Malware allocates thread local storage. - ## Use in Malware |Name|Date|Method|Description| diff --git a/micro-behaviors/process/terminate-process.md b/micro-behaviors/process/terminate-process.md index 7c26fa9..b8b79e9 100644 --- a/micro-behaviors/process/terminate-process.md +++ b/micro-behaviors/process/terminate-process.md @@ -52,6 +52,10 @@ Malware terminates a process. |[terminate process via kill](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process-via-kill.yml)|Terminate Process (C0018)|kill| |[terminate process](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process.yml)|Terminate Process (C0018)|System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess| +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess| + ## References [1] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index 3edc01d..ea3f988 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -48,7 +48,6 @@ See ATT&CK: **Pre-OS Boot: Component Firmware ([T1542.002](https://attack.mitre. |---|---|---|---| |[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|F0009.001|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[1]](#1)| - ## References [1] https://www.mandiant.com/resources/synful-knock-acis diff --git a/persistence/kernel-modules-and-extensions.md b/persistence/kernel-modules-and-extensions.md index cd0926e..a3e770d 100644 --- a/persistence/kernel-modules-and-extensions.md +++ b/persistence/kernel-modules-and-extensions.md @@ -45,6 +45,14 @@ See ATT&CK: **Boot or Logon Autostart Execution: Kernel Modules and Extensions ( |---|---|---|---| |[**Drovorub**](../xample-malware/drovorub.md)|2020|--|Drovorub uses a kernel module rootkit for loading and for persistence. [[1]](#1)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_devicetree_1.py)|Kernel Modules and Extensions (F0010)|--| +|[volatility_devicetree_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_devicetree_1.py)|Kernel Modules and Extensions::Device Driver (F0010.001)|--| +|[driver_load](https://github.com/CAPESandbox/community/tree/master/modules/signatures/driver_load.py)|Kernel Modules and Extensions (F0010)|NtLoadDriver| + ## References [1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF \ No newline at end of file diff --git a/persistence/malicious-network-driver.md b/persistence/malicious-network-driver.md index 97a8d7a..93620b3 100644 --- a/persistence/malicious-network-driver.md +++ b/persistence/malicious-network-driver.md @@ -38,7 +38,6 @@ A malicious network driver can tunnel outside traffic into the network, allowing |---|---|---|---| |[**Malicious NDISProxy drivers**]|2018|--|The LuckyMouse APT (aka APT27) spreads Trojans via malicious NDISProxy drivers. [[1]](#1)| - ## References [1] https://www.zdnet.com/article/luckymouse-targets-govt-entities-through-malicious-ndisproxy-driver/ diff --git a/persistence/modify-existing-service.md b/persistence/modify-existing-service.md index d7c9aff..331de2d 100644 --- a/persistence/modify-existing-service.md +++ b/persistence/modify-existing-service.md @@ -42,6 +42,16 @@ See ATT&CK: **Create or Modify System Process::Windows Service ([T1543.003](http |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon enables the RemoteRegistry service to allow remote registry modification. [[5]](#5)| |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus disables Windows AutoUpdate and patches the first byte of TerminateProcess and TerminateThread API with C3 (RET Instruction) to prevent external processes from terminating the running instance of malware. [[6]](#6)| +## Detection + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[volatility_svcscan_1](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_1.py)|Modify Existing Service (F0011)|--| +|[volatility_svcscan_2](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_2.py)|Modify Existing Service (F0011)|--| +|[volatility_svcscan_3](https://github.com/CAPESandbox/community/tree/master/modules/signatures/volatility_svcscan_3.py)|Modify Existing Service (F0011)|--| +|[antiav_servicestop](https://github.com/CAPESandbox/community/tree/master/modules/signatures/antiav_servicestop.py)|Modify Existing Service (F0011)|OpenServiceA, ControlService, OpenServiceW| +|[persistence_service](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_service.py)|Modify Existing Service (F0011)|--| +|[modify_security_center_warnings](https://github.com/CAPESandbox/community/tree/master/modules/signatures/modify_security_center_warnings.py)|Modify Existing Service (F0011)|--| ## References diff --git a/persistence/registry-run-keys-startup-folder.md b/persistence/registry-run-keys-startup-folder.md index ba04251..f435ab0 100644 --- a/persistence/registry-run-keys-startup-folder.md +++ b/persistence/registry-run-keys-startup-folder.md @@ -60,7 +60,13 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol |Tool: capa|Mapping|APIs| |---|---|---| -|[persist via Run registry key](https://github.com/mandiant/capa-rules/blob/master/persistence/registry/run/persist-via-run-registry-key.yml)|Registry Run Keys / Startup Folder (F0012)| | +|[persist via Run registry key](https://github.com/mandiant/capa-rules/blob/master/persistence/registry/run/persist-via-run-registry-key.yml)|Registry Run Keys / Startup Folder (F0012)|--| + +|Tool: CAPE|Mapping|APIs| +|---|---|---| +|[persistence_bootexecute](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_bootexecute.py)|Registry Run Keys / Startup Folder (F0012)|RegSetValueExA, RegSetValueExW, NtSetValueKey| +|[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/geodo_banking_trojan.py)|Registry Run Keys / Startup Folder (F0012)|--| +|[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/persistence_autorun.py)|Registry Run Keys / Startup Folder (F0012)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA| ## References diff --git a/xample-malware/adwind-jrat.md b/xample-malware/adwind-jrat.md index 0cac6fd..37edc19 100644 --- a/xample-malware/adwind-jrat.md +++ b/xample-malware/adwind-jrat.md @@ -35,7 +35,6 @@ See ATT&CK: [jRAT - Techniques Used](https://attack.mitre.org/software/S0283/). |---|---| |[Execution::Execution Dependency (B0044)](../execution/execution-dependency.md)|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)| - ## References [1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/ \ No newline at end of file diff --git a/xample-malware/attor.md b/xample-malware/attor.md index 6bf936b..a76ffc2 100644 --- a/xample-malware/attor.md +++ b/xample-malware/attor.md @@ -29,14 +29,12 @@ Attor is a Windows-based espionage platform used in targeted attacks since 2013. See ATT&CK: [Attor - Techniques Used](https://attack.mitre.org/software/S0438/). - ## Enhanced ATT&CK Techniques |Name|Use| |---|---| |[Exfiltration::Automated Exfiltration (E1020)](../exfiltration/automated-exfiltration.md)|Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server [[1]](#1)| - ## Indicators of Compromise SHA1 Hashes @@ -46,7 +44,6 @@ SHA1 Hashes - d0528b8777d556809ac64935fa6247164aaabb4f - f7e30a3fa186361794699d7a4fac6a9b85ccbf40 - ## References [1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file diff --git a/xample-malware/badusb.md b/xample-malware/badusb.md index 6404ac7..ad32d55 100644 --- a/xample-malware/badusb.md +++ b/xample-malware/badusb.md @@ -34,14 +34,12 @@ BadUSB is an attack that exploits an inherent vulnerability in USB firmware. Suc |[Initial Access :: Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)| BadUSB can be used as a means of gaining initial access to a target machine by exploiting vulnerabilities in the USB firmware or by tricking the user into plugging in an infected USB device. [[1]](#1)| |[Collection::Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/)|BadUSB can steal sensitive data from an infected machine (e.g., login credentials) and transmit it to a remote C2 server. [[3]](#3)| - ## MBC Behaviors |Name|Use| |---|---| |[Impact::Modify Hardware (B0042)](../impact/modify-hardware.md)|BadUSB can modify USB drives. [[4]](#4)| - ## Indicators of Compromise MD5 Hashes @@ -49,7 +47,6 @@ MD5 Hashes - 0155738045b331f44d300f4a7d08cf21 - 0275585c3b871405dd299d458724db3d - ## References [1] https://www.manageengine.com/data-security/security-threats/bad-usb.html diff --git a/xample-malware/bagle.md b/xample-malware/bagle.md index 2f6e9e3..f1b90f3 100644 --- a/xample-malware/bagle.md +++ b/xample-malware/bagle.md @@ -32,7 +32,6 @@ A mass-mailing computer worm affecting Microsoft Windows. [[1]](#1) |---|---| |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Malware adds registry keys to enable its automatic execution at every system startup. [[1]](#1)| - ## MBC Behaviors |Name|Use| @@ -41,7 +40,6 @@ A mass-mailing computer worm affecting Microsoft Windows. [[1]](#1) |[Execution::Send Email (B0020)](../execution/send-email.md)|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)| |[Data::Decompress Data::aPLib (C0025.003)](../micro-behaviors/data/decompress-data.md)|Bagle decompresses data using aPLib. [[4]](#4)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/blackenergy.md b/xample-malware/blackenergy.md index 042b983..c6e90b9 100644 --- a/xample-malware/blackenergy.md +++ b/xample-malware/blackenergy.md @@ -51,7 +51,6 @@ See ATT&CK: [BlackEnergy - Techniques Used](https://attack.mitre.org/software/S0 |[Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)](../defense-evasion/obfuscated-files-or-information.md)|BlackEnergy encrypts data using RC4 via WinAPI. [[4]](#4)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|BlackEnergy gets the common file path. [[4]](#4)| - ## MBC Behaviors |Name|Use| @@ -74,7 +73,6 @@ See ATT&CK: [BlackEnergy - Techniques Used](https://attack.mitre.org/software/S0 |[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|BlackEnergy creates a process on Windows. [[4]](#4)| |[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|BlackEnergy terminates a process via fastfail. [[4]](#4)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/chopstick.md b/xample-malware/chopstick.md index a632d65..dce72c1 100644 --- a/xample-malware/chopstick.md +++ b/xample-malware/chopstick.md @@ -42,7 +42,6 @@ See ATT&CK: [CHOPSTICK - Techniques Used](https://attack.mitre.org/software/S002 |[Collection::Screen Capture (E1113)](../collection/screen-capture.md)|CHOPSTICK takes snapshots of deskop and window contents. [[1]](#1)| |[Command and Control::C2 Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|CHOPSTICK sends data to the C2 server using HTTP POST requests. [[1]](#1)| - ## MBC Behaviors |Name|Use| @@ -54,7 +53,6 @@ See ATT&CK: [CHOPSTICK - Techniques Used](https://attack.mitre.org/software/S002 SHA256 Hashes - 8ec464c36951aa028554be9ed7c7d9aa0bfcc9fa65a7874759afa853a18ecea7 - ## References [1] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf \ No newline at end of file diff --git a/xample-malware/clipminer.md b/xample-malware/clipminer.md index 3a8debd..f9311c9 100644 --- a/xample-malware/clipminer.md +++ b/xample-malware/clipminer.md @@ -34,7 +34,6 @@ Malware used for cryptocurrency mining and clipboard hijacking. |[Defense Evasion::Masquerading (T1036)](https://attack.mitre.org/techniques/T1036/)|Clipminer drops a file masquerading as a Control Panel (CPL) file. [[1]](#1)| |[Persistence::Scheduled Task/Job (T1053)](https://attack.mitre.org/techniques/T1053/)|Clipminer creates scheduled tasks for persistence. [[1]](#1)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -44,7 +43,6 @@ Malware used for cryptocurrency mining and clipboard hijacking. |[Collection::Input Capture (E1056)](../collection/input-capture.md)|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[1]](#1)| |[Impact::Clipboard Modification (E1510)](../impact/clipboard-modification.md)|Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary. [[1]](#1)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/conficker.md b/xample-malware/conficker.md index 7e524c4..201f71b 100644 --- a/xample-malware/conficker.md +++ b/xample-malware/conficker.md @@ -37,7 +37,6 @@ A worm targeting Microsoft Windows operations systems. |[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|The malware resets system restore points and deletes backup files. [[1]](#1)| |[Anti-Static Analysis::Software Packing::UPX (F0001.008)](../anti-static-analysis/software-packing.md)|Conficker is propagated as a DLL which has been backed using the UPX packer. [[2]](#2)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/conti.md b/xample-malware/conti.md index d800d62..e15afea 100644 --- a/xample-malware/conti.md +++ b/xample-malware/conti.md @@ -46,7 +46,6 @@ See ATT&CK: [Conti - Techniques Used](https://attack.mitre.org/software/S0575/). |[Process::Unmap Section View (C0070)](../micro-behaviors/process/unmap-section-view.md)|As part of process hollowing, Conti unmaps a view of a section from the virtual address space of a subject process. [[1]](#1)| |[Process::Write Process Memory (C0071)](../micro-behaviors/process/write-process-memory.md)|As part of process hollowing, Conti writes data to an area of memory in a specified process. [[1]](#1)| - ## Attack Flow A partial attack flow for Conti Ransomware based on [[1]](#1), which shows micro-behaviors associated with Conti's [Process Injection::Process Hollowing (E1055.012)](../defense-evasion/process-injection.md) behavior. diff --git a/xample-malware/cozycar.md b/xample-malware/cozycar.md index 56493b4..1762f34 100644 --- a/xample-malware/cozycar.md +++ b/xample-malware/cozycar.md @@ -39,7 +39,6 @@ See ATT&CK: [CozyCar - Techniques Used](https://attack.mitre.org/software/S0046/ |[Defense Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md)|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[1]](#1)| |[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md)|CozyCar communicates with a C2 server. [[1]](#1)| - ## MBC Behaviors |Name|Use| @@ -57,7 +56,6 @@ IP Addresses - 103.226.132.7 - 122.228.193.115 - ## References [1] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/ \ No newline at end of file diff --git a/xample-malware/cryptolocker.md b/xample-malware/cryptolocker.md index 43e5586..1a2cc07 100644 --- a/xample-malware/cryptolocker.md +++ b/xample-malware/cryptolocker.md @@ -26,7 +26,6 @@ CryptoLocker is a family of ransomware. [[1]](#1) - ## ATT&CK Techniques |Name|Use| @@ -36,7 +35,6 @@ CryptoLocker is a family of ransomware. [[1]](#1) |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses http to communicate with C2. [[1]](#1)| |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|The malware links many functions at runtime. [[2]](#2)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -49,7 +47,6 @@ CryptoLocker is a family of ransomware. [[1]](#1) |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|CryptoLocker queries environment variables. [[2]](#2)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|CryptoLocker accepts command line arguments. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -64,7 +61,6 @@ CryptoLocker is a family of ransomware. [[1]](#1) |[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|CryptoLocker allocates RWX memory. [[2]](#2)| |[Process::Resume Thread (C0054)](../micro-behaviors/process/resume-thread.md)|CryptoLocker resumes thread. [[2]](#2)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/cryptowall.md b/xample-malware/cryptowall.md index 11e7adf..303403c 100644 --- a/xample-malware/cryptowall.md +++ b/xample-malware/cryptowall.md @@ -27,7 +27,6 @@ CryptoWall is a family of ransomware. [[1]](#1) - ## ATT&CK Techniques |Name|Use| @@ -38,7 +37,6 @@ CryptoWall is a family of ransomware. [[1]](#1) |[Impact::Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)|The malware encrypts files. [[1]](#1)| |[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware tries to connect to I2P proxies. [[1]](#1)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -48,7 +46,6 @@ CryptoWall is a family of ransomware. [[1]](#1) |[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects code into a new svchost process. [[1]](#1)| |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|A copy of Crytowall is placed in the startup folder and a directory at the root of the system drive. Also adds multiple "autostart" registry keys. [[2]](#2)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/dark-comet.md b/xample-malware/dark-comet.md index 9653c1d..34c6682 100644 --- a/xample-malware/dark-comet.md +++ b/xample-malware/dark-comet.md @@ -60,7 +60,6 @@ See ATT&CK: [Dark Comet - Techniques Used](https://attack.mitre.org/software/S03 |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|DarkComet gets file version info. [[4]](#4)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|DarkComet accepts command line arguments. [[4]](#4)| - ## MBC Behaviors |Name|Use| @@ -90,7 +89,6 @@ See ATT&CK: [Dark Comet - Techniques Used](https://attack.mitre.org/software/S03 |[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|DarkComet set thread local storage values. [[4]](#4)| |[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|DarkComet suspends threads. [[4]](#4)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index fbfd150..df9e426 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -63,7 +63,6 @@ DNSChanger is used to change DNS settings to generate fraudulent advertising rev |[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|DNSChanger queries or enumerates registry values. [[3]](#3)| |[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|DNSChanger sets registry keys. [[3]](#3)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/drovorub.md b/xample-malware/drovorub.md index b4fc94b..a2fc527 100644 --- a/xample-malware/drovorub.md +++ b/xample-malware/drovorub.md @@ -29,14 +29,12 @@ Drovorub is a Linux malware toolset consisting of an implant coupled with a kern See ATT&CK: [Drovorub - Techniques Used](https://attack.mitre.org/software/S0502/). - ## Enhanced ATT&CK Techniques |Name|Use| |---|---| |[Persistence::Kernel Modules and Extensions (F0010)](../persistence/kernel-modules-and-extensions.md)|Drovorub uses a kernel module rootkit for loading and persistence. [[1]](#1)| - ## Indicators of Compromise SHA256 Hashes @@ -45,7 +43,6 @@ SHA256 Hashes - 1c0d14b530632307329de7bfb3546a91f6ebfd0256664c33a92f2b6e8ad88626 - 17bf00b67487164d1822ea48f36d62bf6f4ff9b2388cab2c0757644fdf30e5bd - ## References [1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF \ No newline at end of file diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index 5d9a30c..8bc8e56 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -62,7 +62,6 @@ Emotet is a banking trojan. [[1]](#1) |[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Emotet encrypts data using RC4 PRGA. [[6]](#6)| |[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Emotet enumerates PE sections. [[6]](#6)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md index 6e73028..eaeadc5 100644 --- a/xample-malware/gamut.md +++ b/xample-malware/gamut.md @@ -26,7 +26,6 @@ Gamut is a spamming botnet. - ## ATT&CK Techniques |Name|Use| @@ -35,7 +34,6 @@ Gamut is a spamming botnet. |[Defense Evasion::File and Directory Permissions Modification (T1222)](https://attack.mitre.org/techniques/T1222)|Gamut sets file attributes. [[3]](#3)| |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Gamut links functions at runtime on Windows. [[3]](#3)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -48,7 +46,6 @@ Gamut is a spamming botnet. |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Gamut queries environment variables. [[3]](#3)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Gamut accepts command line arguments. [[3]](#3)| - ## MBC Behaviors |Name|Use| @@ -79,7 +76,6 @@ Gamut is a spamming botnet. |[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|Gamut creates processes on Windows. [[3]](#3)| |[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Gamut sets thread local storage values. [[3]](#3)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/geneio.md b/xample-malware/geneio.md index de66a13..a81e0ee 100644 --- a/xample-malware/geneio.md +++ b/xample-malware/geneio.md @@ -43,7 +43,6 @@ The program then installs the browser extension *~/Library/Safari/Extensions/Omn When the user inputs a search query, it will appear to be carried out using Google Search, but the results will be from *genieo.com*. - ## ATT&CK Techniques |Name|Use| @@ -56,7 +55,6 @@ When the user inputs a search query, it will appear to be carried out using Goog |---|---| |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware tricks OS X keychain to create application files. Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates the app files listed in the description above. [[1]](#1)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/gobotkr.md b/xample-malware/gobotkr.md index b900fca..4ac37f0 100644 --- a/xample-malware/gobotkr.md +++ b/xample-malware/gobotkr.md @@ -28,7 +28,6 @@ GoBotKR is a modified version of a publicly available backdoor, GoBot2. The modi From [[1]](#1), “The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system.” - ## ATT&CK Techniques |Name|Use| @@ -52,7 +51,6 @@ From [[1]](#1), “The malware installs two instances of itself on the system. T |[Command and Control::Application Layer Protocol (T1071)](https://attack.mitre.org/techniques/T1071/)|GoBotKR uses HTTP or HTTPS for C&C. [[1]](#1)| |[Command and Control::Non-Standard Port (T1571)](https://attack.mitre.org/techniques/T1571/)|GoBotKR uses non-standard ports, such as 6446, 6556 and 7777, for C&C. [[1]](#1)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -68,7 +66,6 @@ From [[1]](#1), “The malware installs two instances of itself on the system. T |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|GoBotKR uses wmic, systeminfo, and ver commands to collect information about the system and the installed software and queries environment variables. [[1]](#1) [[2]](#2)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|GoBotKR checks if a file exists. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -87,7 +84,6 @@ From [[1]](#1), “The malware installs two instances of itself on the system. T |[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GoBotKR suspends threads. [[2]](#2)| |[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GoBotKR terminates processes. [[2]](#2)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/gravity-rat.md b/xample-malware/gravity-rat.md index 342a53b..8304945 100644 --- a/xample-malware/gravity-rat.md +++ b/xample-malware/gravity-rat.md @@ -26,7 +26,6 @@ GravityRAT evades detection by checking current CPU temperature. - ## ATT&CK Techniques |Name|Use| @@ -42,7 +41,6 @@ See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S02 |[Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)](../defense-evasion/hijack-execution-flow.md)|GravityRAT abuses Microsoft's Dynamic Data Exchange (DDE) protocol. [[2]](#2)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|GravityRAT enumerates files on Windows. [[4]](#4)| - ## MBC Behaviors |Name|Use| @@ -61,7 +59,6 @@ See ATT&CK: [GravityRAT - Techniques Used](https://attack.mitre.org/software/S02 |[Process::Suspend Thread (C0055)](../micro-behaviors/process/suspend-thread.md)|GravityRAT suspends threads. [[4]](#4)| |[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|GravityRAT terminates processes. [[4]](#4)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/heriplor.md b/xample-malware/heriplor.md index 85fcd5a..0dd003c 100644 --- a/xample-malware/heriplor.md +++ b/xample-malware/heriplor.md @@ -32,7 +32,6 @@ This Trojan is associated with the Energetic Bear group [[1]](#1). |---|---| |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Heriplor accesses PEB ldr_data. [[3]](#3)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/hupigon.md b/xample-malware/hupigon.md index 37f62bd..577831f 100644 --- a/xample-malware/hupigon.md +++ b/xample-malware/hupigon.md @@ -26,7 +26,6 @@ A family of backdoors. - ## ATT&CK Techniques |Name|Use| @@ -46,7 +45,6 @@ A family of backdoors. |[Persistence::Create or Modify System Process::Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003)|Hupigon starts services. [[3]](#3)| |[Privilege Escalation::Access Token Manipulation (T1134)](https://attack.mitre.org/techniques/T1134)|Hupigon acquires debug privileges. [[3]](#3)| - ## Enhanced ATT&CK Techniques |Name|Use| diff --git a/xample-malware/kovter.md b/xample-malware/kovter.md index 4a1038d..c041b55 100644 --- a/xample-malware/kovter.md +++ b/xample-malware/kovter.md @@ -26,7 +26,6 @@ A trojan that performs click-fraud. - ## ATT&CK Techniques |Name|Use| @@ -57,7 +56,6 @@ A trojan that performs click-fraud. |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Kovter gets file version info. [[3]](#3)| |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Kovter gets disk information. [[3]](#3)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/kraken.md b/xample-malware/kraken.md index 35cabfd..7ba82df 100644 --- a/xample-malware/kraken.md +++ b/xample-malware/kraken.md @@ -34,14 +34,12 @@ A family of bots. |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP to communicate with C2. [[1]](#1)| |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Kraken accesses PEB ldr_data. [[2]](#2)| - ## Enhanced ATT&CK Techniques |Name|Use| |---|---| |[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Kraken encodes data using XOR. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -51,7 +49,6 @@ A family of bots. |[Cryptography::Encrypt Data::RC4 (C0027.009)](../micro-behaviors/cryptography/encrypt-data.md)|Kraken encrypts data using RC4 PRGA. [[2]](#2)| |[Data::Encode Data::XOR (C0026.002)](../micro-behaviors/data/encode-data.md)|Kraken encodes data using XOR. [[2]](#2)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/locky-bart.md b/xample-malware/locky-bart.md index 5ae8dc4..145335d 100644 --- a/xample-malware/locky-bart.md +++ b/xample-malware/locky-bart.md @@ -36,7 +36,6 @@ The OASIS Collaborative Automated Course of Action Operations [(CACAO)](https:// |[Discovery::System Location Discovery::System Language Discovery (T1614.001)](https://attack.mitre.org/techniques/T1614/001)|Locky Bart identifies the system language via API. [[2]](#2)| |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Locky Bart parses PE headers. [[2]](#2)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -45,7 +44,6 @@ The OASIS Collaborative Automated Course of Action Operations [(CACAO)](https:// |[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Locky Bart encodes data using XOR. [[2]](#2)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|Locky Bart gets a file size. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -63,13 +61,11 @@ The OASIS Collaborative Automated Course of Action Operations [(CACAO)](https:// |[Operating System::Registry::Set Registry Key (C0036.001)](../micro-behaviors/operating-system/registry.md)|Locky Bart sets registry values. [[2]](#2)| |[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Locky Bart creates threads. [[2]](#2)| - ## Indicators of Compromise SHA256 Hashes - c285e376201e2941154ec1a9acd8658cd5e0ea975c694a3fe3e9a9897efc2680 - ## References [1] https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/ diff --git a/xample-malware/matanbuchus.md b/xample-malware/matanbuchus.md index 09935c3..8452feb 100644 --- a/xample-malware/matanbuchus.md +++ b/xample-malware/matanbuchus.md @@ -23,7 +23,6 @@ A commercial loader that consists of 2 stages used to download and execute payloads. - ## ATT&CK Techniques |Name|Use| @@ -40,7 +39,6 @@ A commercial loader that consists of 2 stages used to download and execute paylo |[Defense Evasion::System Binary Proxy Execution::Rundll32 (T1218.011)](https://attack.mitre.org/techniques/T1218/011/)|Malware loader executes DLLs by using rundll32.exe. [[2]](#2)| |[Execution::Command and Scripting Interpreter::PowerShell (T1059.001)](https://attack.mitre.org/techniques/T1059/001/)|Malware loader can run PowerShell commands. [[2]](#2)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -51,7 +49,6 @@ A commercial loader that consists of 2 stages used to download and execute paylo |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|The malware verifies that the working folder from the first stage loader exists on the system. The malware checks for the path for the Opera web browser; if it exists, the malware exits. [[1]](#1) [[2]](#2)| |[Exfiltration::Archive Collected Data::Encoding-Standard Encoding (E1560.m03)](../exfiltration/archive-collected-data.md)|The malware sends data as a Base64 string of JSON. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -72,7 +69,6 @@ A commercial loader that consists of 2 stages used to download and execute paylo |[Command and Control::C2 Communication::Execute File (B0030.013)](../command-and-control/c2-communication.md)|The payload is run by explorer.exe, potentially with parameters. [[2]](#2)| |[Execution::Remote Commands::Uninstall (B0011.006)](../execution/remote-commands.md)|Malware loader can uninstall itself from the victim computer. [[2]](#2)| - ## References [1] https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/ diff --git a/xample-malware/mazarbot.md b/xample-malware/mazarbot.md index 5571b07..661a48b 100644 --- a/xample-malware/mazarbot.md +++ b/xample-malware/mazarbot.md @@ -27,19 +27,16 @@ MazarBot targets Android phones via a poisoned text message. - ## ATT&CK Techniques See ATT&CK: [MazarBOT - Techniques Used](https://attack.mitre.org/software/S0303/). - ## Enhanced ATT&CK Techniques |Name|Use| |---|---| |[Impact::Data Destruction (E1485)](../impact/data-destruction.md)|MazarBot can erase phone data. [[3]](#3)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/mebromi.md b/xample-malware/mebromi.md index 14a8b00..443faf0 100644 --- a/xample-malware/mebromi.md +++ b/xample-malware/mebromi.md @@ -26,7 +26,6 @@ A BIOS bootkit. - ## ATT&CK Techniques |Name|Use| |---|---| @@ -39,7 +38,6 @@ A BIOS bootkit. See ATT&CK: [Mebromi - Techniques Used](https://attack.mitre.org/software/S0001/). - ## Enhanced ATT&CK Techniques |Name|Use| diff --git a/xample-malware/netwalker.md b/xample-malware/netwalker.md index 8260f75..7470430 100644 --- a/xample-malware/netwalker.md +++ b/xample-malware/netwalker.md @@ -31,7 +31,6 @@ Fileless ransomware written in PowerShell and executed directly in memory. See ATT&CK: [Netwalker - Techniques Used](https://attack.mitre.org/software/S0457/). - ## Enhanced ATT&CK Techniques |Name|Use| @@ -41,7 +40,6 @@ See ATT&CK: [Netwalker - Techniques Used](https://attack.mitre.org/software/S045 |[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Netwalker uses reflective DLL loading to inject from memory. [[1]](#1)| |[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Netwalker encrypts files for ransom. [[1]](#1)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/poison-ivy.md b/xample-malware/poison-ivy.md index f7d35e8..37877e1 100644 --- a/xample-malware/poison-ivy.md +++ b/xample-malware/poison-ivy.md @@ -30,7 +30,6 @@ Poison Ivy is a Remote Access Trojan (RAT). See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S0012/). - ## Enhanced ATT&CK Techniques |Name|Use| @@ -44,7 +43,6 @@ See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S00 |[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|The Poison Ivy implant is run on the target machine. [[2]](#2)| |[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|The malware obfuscates files. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -62,7 +60,6 @@ See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S00 |[File System::Write File (C0052)](../micro-behaviors/file-system/writes-file.md)|Poison Ivy writes files on Windows. [[5]](#5)| |[Operating System::Registry::Query Registry Value (C0036.006)](../micro-behaviors/operating-system/registry.md)|Poison Ivy queries or enumerates registry values. [[5]](#5)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/redhip.md b/xample-malware/redhip.md index c821464..f9bebce 100644 --- a/xample-malware/redhip.md +++ b/xample-malware/redhip.md @@ -37,7 +37,6 @@ Redhip is an information stealer. |[Discovery::System Owner/User Discovery (T1033)](https://attack.mitre.org/techniques/T1033)|Redhip gets a session user name. [[2]](#2)| |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|Redhip accesses PEB ldr_data. [[2]](#2)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -85,7 +84,6 @@ Redhip is an information stealer. |[Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|Redhip creates a suspended process. [[2]](#2)| |[Process::Set Thread Local Storage Value (C0041)](../micro-behaviors/process/set-thread-local-storage-value.md)|Redhip sets thread local storage values. [[2]](#2)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/rombertik.md b/xample-malware/rombertik.md index eb0f4bf..681b96e 100644 --- a/xample-malware/rombertik.md +++ b/xample-malware/rombertik.md @@ -26,7 +26,6 @@ This family of malware steals data the user enters into a browser and uses a variety of behaviors to hinder analysis. [[1]](#1) - ## ATT&CK Techniques |Name|Use| @@ -63,7 +62,6 @@ This family of malware steals data the user enters into a browser and uses a var |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Rombertik gets disk sizes. [[2]](#2)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Rombertik accepts command line arguments. [[2]](#2)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/samsam.md b/xample-malware/samsam.md index 86cd94b..eec4dd0 100644 --- a/xample-malware/samsam.md +++ b/xample-malware/samsam.md @@ -26,7 +26,6 @@ SamSam is ransomware. - ## ATT&CK Techniques See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/). @@ -42,7 +41,6 @@ See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/) |[Defense Evasion::Obfuscated Files or Information::Encryption of Code (E1027.m07)](../defense-evasion/obfuscated-files-or-information.md)|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[2]](#2)| |[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md)|SamSam enumerates files on Windows. [[4]](#4)| - ## MBC Behaviors |Name|Use| @@ -51,7 +49,6 @@ See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/) |[File System::Read File (C0051)](../micro-behaviors/file-system/read-file.md)|SamSam reads files on Windows. [[4]](#4)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index 5a9c3ec..4fcd7dc 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -36,7 +36,6 @@ SearchAwesome adware intercepts encrypted web traffic to inject ads. |[Command and Control::Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware uses mitmproxy to intercept and modify web traffic. [[1]](#1)| |[Collection::Adversary-in-the-Middle (T1557)](https://attack.mitre.org/techniques/T1557/)|After installing a certificate, the malware inserts inself into a chain of custody, typically within network packets. [[1]](#1)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -46,7 +45,6 @@ SearchAwesome adware intercepts encrypted web traffic to inject ads. |[Privilege Escalation::Install Certificate (E1608)](../privilege-escalation/install-certificate.md)|The malware installs a certificate. [[1]](#1)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The malware installs a script to inject a JavaScript script and modify web traffic. [[1]](#1)| - ## MBC Behaviors |Name|Use| diff --git a/xample-malware/shamoon.md b/xample-malware/shamoon.md index cf0f250..cf1c1f0 100644 --- a/xample-malware/shamoon.md +++ b/xample-malware/shamoon.md @@ -26,7 +26,6 @@ Shamoon is a data wiping malware. - ## ATT&CK Techniques |Name|Use| @@ -38,7 +37,6 @@ Shamoon is a data wiping malware. See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/). - ## Enhanced ATT&CK Techniques |Name|Use| @@ -56,7 +54,6 @@ See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/ |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Shamoon gets the hostname. [[5]](#5)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Shamoon accepts command line arguments. [[5]](#5)| - ## MBC Behaviors |Name|Use| @@ -77,7 +74,6 @@ See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/ |[Process::Create Thread (C0038)](../micro-behaviors/process/create-thread.md)|Shamoon creates a thread. [[5]](#5)| |[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Shamoon terminates processes. [[5]](#5)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/stuxnet.md b/xample-malware/stuxnet.md index 3575750..6ade05d 100644 --- a/xample-malware/stuxnet.md +++ b/xample-malware/stuxnet.md @@ -26,7 +26,6 @@ Stuxnet is a malicious worm targeting SCADA systems. - ## ATT&CK Techniques |Name|Use| @@ -52,7 +51,6 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/ |[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|Stuxnet encodes data using XOR. [[2]](#2)| |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Stuxnet checks OS version. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -68,7 +66,6 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/ |[Memory::Allocate Memory (C0007)](../micro-behaviors/memory/allocate-memory.md)|Stuxnet allocates RWX memory. [[2]](#2)| |[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|Stuxnet terminates processes. [[2]](#2)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/synful-knock.md b/xample-malware/synful-knock.md index 03f831c..e3affc4 100644 --- a/xample-malware/synful-knock.md +++ b/xample-malware/synful-knock.md @@ -27,7 +27,6 @@ SYNful Knock is a modification of the router's firmware images used to maintain persistence. [[1]](#1) - ## Enhanced ATT&CK Techniques |Name|Use| @@ -35,7 +34,6 @@ SYNful Knock is a modification of the router's firmware images used to maintain |[Persistence::Component Firmware::Router Firmware (F0009.001)](../persistence/component-firmware.md)|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[1]](#1)| |[Defense Evasion::Hijack Execution Flow (F0015)](../defense-evasion/hijack-execution-flow.md)|SYNful Knock hooks iOS functions to call and initialize the malware. [[1]](#1)| - ## MBC Behaviors |Name|Use| @@ -44,7 +42,6 @@ SYNful Knock is a modification of the router's firmware images used to maintain |[Communication::Socket Communication::Send TCP Data (C0001.014)](../micro-behaviors/communication/socket-communication.md)|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router. [[1]](#1)| |[Defense Evasion::Alternative Installation Location::Fileless Malware (B0027.001)](../defense-evasion/alternative-installation-location.md)|100 memory-resident modules can be installed. [[1]](#1)| - ## References [1] https://www.mandiant.com/resources/synful-knock-acis diff --git a/xample-malware/teardrop.md b/xample-malware/teardrop.md index 4a7c2fb..f78bc5d 100644 --- a/xample-malware/teardrop.md +++ b/xample-malware/teardrop.md @@ -27,7 +27,6 @@ TEARDROP is a memory-only dropper associated with the SolarWinds supply chain compromise. - ## ATT&CK Techniques See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560/). @@ -45,7 +44,6 @@ See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560 |---|---| |[Anti-Behavioral Analysis::Capture Evasion::Memory-only Payload (B0036.001)](../anti-behavioral-analysis/capture-evasion.md)|Malware loads its payload into memory. [[1]](#1)| - ## References [1] https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b/ diff --git a/xample-malware/terminator.md b/xample-malware/terminator.md index 990e481..fae9454 100644 --- a/xample-malware/terminator.md +++ b/xample-malware/terminator.md @@ -27,14 +27,12 @@ Terminator is a remote access tool (RAT). - ## ATT&CK Techniques |Name|Use| |---|---| |[Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks (T1497)](https://attack.mitre.org/techniques/T1497/)|The Terminator RAT evades sandboxes by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[2]](#2)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -43,7 +41,6 @@ Terminator is a remote access tool (RAT). |[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|The RAT sets "2019" as a Windows' startup folder by modifying a registry value. [[1]](#1)| |[Execution::User Execution (E1204)](../execution/user-execution.md)|The malware relies on user interaction to execute. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -52,7 +49,6 @@ Terminator is a remote access tool (RAT). |[Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution (B0003.003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[1]](#1)| |[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[1]](#1)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md index 7e6fad5..d9c1614 100644 --- a/xample-malware/trickbot.md +++ b/xample-malware/trickbot.md @@ -26,7 +26,6 @@ TrickBot is a trojan spyware program that has mainly been used for targeting banking sites. TrickBot is written in the C++ programming language. - ## ATT&CK Techniques |Name|Use| @@ -51,7 +50,6 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266 |[Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)](../defense-evasion/obfuscated-files-or-information.md)|TrickBot encodes data using XOR. [[7]](#7)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|TrickBot accepts command line arguments. [[7]](#7)| - ## MBC Behaviors |Name|Use| @@ -67,7 +65,6 @@ See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266 |[Process::Create Process::Create Suspended Process (C0017.003)](../micro-behaviors/process/create-process.md)|TrickBot creates a suspended process. [[7]](#7)| |[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|TrickBot terminates processes. [[7]](#7)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/up007.md b/xample-malware/up007.md index 16439e8..b90d750 100644 --- a/xample-malware/up007.md +++ b/xample-malware/up007.md @@ -26,7 +26,6 @@ UP007 is a dropper used in an espionage campaign targeting Hong Kong democracy activists. [[1]](#1) - ## ATT&CK Techniques |Name|Use| @@ -44,7 +43,6 @@ UP007 is a dropper used in an espionage campaign targeting Hong Kong democracy a |[Execution::Shared Modules (T1129)](https://attack.mitre.org/techniques/T1129)|UP007 links functions at runtime on Windows. [[2]](#2)| |[Privilege Escalation::Access Token Manipulation (T1134)](https://attack.mitre.org/techniques/T1134)|UP007 modifies access privileges. [[2]](#2)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -58,7 +56,6 @@ UP007 is a dropper used in an espionage campaign targeting Hong Kong democracy a |[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|UP007 queries environment variables. [[2]](#2)| |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|UP007 accepts command line arguments. [[2]](#2)| - ## MBC Behaviors |Name|Use| @@ -83,7 +80,6 @@ UP007 is a dropper used in an espionage campaign targeting Hong Kong democracy a |[Process::Create Process (C0017)](../micro-behaviors/process/create-process.md)|UP007 creates a process on Windows. [[2]](#2)| |[Process::Terminate Process (C0018)](../micro-behaviors/process/terminate-process.md)|UP007 terminates processes. [[2]](#2)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/ursnif.md b/xample-malware/ursnif.md index a85096a..4ab460c 100644 --- a/xample-malware/ursnif.md +++ b/xample-malware/ursnif.md @@ -26,7 +26,6 @@ Ursnif is a variant of Gozi. It is a banking trojan that uses malware macros to evade sandbox detection. - ## ATT&CK Techniques |Name|Use| @@ -47,7 +46,6 @@ See ATT&CK: [Ursnif - Techniques Used](https://attack.mitre.org/software/S0386/) |[Impact::Exploit Kit (E1190)](../impact/exploit-kit.md)|Ursnif is sometimes delivered via exploit kit. [[7]](#7)| |[Collection::Keylogging::Polling (F0002.002)](../collection/keylogging.md)|Ursnif logs keystrokes via polling. [[6]](#6)| - ## MBC Behaviors |Name|Use| @@ -62,7 +60,6 @@ See ATT&CK: [Ursnif - Techniques Used](https://attack.mitre.org/software/S0386/) |[Execution::Remote Commands (B0011)](../execution/remote-commands.md)|The malware commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download and execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, and upload a log file which contains stolen information. [[5]](#5)| |[Discovery::Code Discovery::Enumerate PE Sections (B0046.001)](../discovery/code-discovery.md)|Ursnif enumerates PE sections. [[6]](#6)| - ## Indicators of Compromise SHA256 Hashes diff --git a/xample-malware/vobfus.md b/xample-malware/vobfus.md index f7adb3a..aa68a7c 100644 --- a/xample-malware/vobfus.md +++ b/xample-malware/vobfus.md @@ -27,14 +27,12 @@ Vobfus is a Visual Basic worm that spreads across removable media and network shares. Vobfus can also download and execute additional binaries from other malware families. - ## ATT&CK Techniques |Name|Use| |---|---| |[Lateral Movement::Lateral Tool Transfer (T1570)](https://attack.mitre.org/techniques/T1570/)|Vobfus drops copies of itself to any external drives or network shares attached to the infected system. [[1]](#1)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -46,7 +44,6 @@ Vobfus is a Visual Basic worm that spreads across removable media and network sh |[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|Vobfus uses GetModuleHandle API call to check for presence of Avast Antivirus. [[1]](#1)| |[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Vobfus disables Windows AutoUpdate on the infected system. The malware patches the first byte of TerminateProcess and TerminateThread API with C3 (RET Instruction) to prevent any external processes from terminating the running instance of the malware. [[1]](#1)| - ## MBC Behaviors |Name|Use| @@ -57,7 +54,6 @@ Vobfus is a Visual Basic worm that spreads across removable media and network sh |[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|Vobfus uses GetModuleHandle API to check for the presence of a sandbox. [[1]](#1)| |[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|Vobfus checks for the presence of virtualization software, such as VMware, VirtualBox, and QEMU, by querying the system registry. [[1]](#1)| - ## Indicators of Compromise Download locations @@ -75,7 +71,6 @@ Potential File Names - Autorun.inf - Muoeyus.exe - ## References [1] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/ diff --git a/xample-malware/wannacry.md b/xample-malware/wannacry.md index 37ec98a..7d26070 100644 --- a/xample-malware/wannacry.md +++ b/xample-malware/wannacry.md @@ -46,7 +46,6 @@ See ATT&CK: [WannaCry - Techniques Used](https://attack.mitre.org/software/S0366 |[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md)|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)| |[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md)|WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)| - ## Indicators of Compromise MD5 Hashes diff --git a/xample-malware/webcobra.md b/xample-malware/webcobra.md index 6d21249..744c512 100644 --- a/xample-malware/webcobra.md +++ b/xample-malware/webcobra.md @@ -39,7 +39,6 @@ WebCobra is cryptojacking malware. [[1]](#1) |[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|The malware drops encrypted files and decrypts them on the system. [[1]](#1)| |[Defense Evasion::Indicator Removal on Host::File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/)|The malware deletes files to evade detection. [[1]](#1)| - ## Enhanced ATT&CK Techniques |Name|Use| @@ -50,7 +49,6 @@ WebCobra is cryptojacking malware. [[1]](#1) |[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects miner code into a running process. [[1]](#1)| |[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being identified by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)| - ## MBC Behaviors |Name|Use| @@ -63,13 +61,11 @@ WebCobra is cryptojacking malware. [[1]](#1) |[Anti-Behavioral Analysis::Virtual Machine Detection::Check Windows - Title Bars (B0009.022)](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code in to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in a VM. [[1]](#1)| |[Discovery::Analysis Tool Discovery::Process Detection - PCAP Utilities (B0013.004)](../discovery/analysis-tool-discovery.md)|When infecting a x64 architecture system, the malware terminates if Wireshark is running on the system. [[1]](#1)| - ## Indicators of Compromise SHA256 Hashes - 5e14478931e31cf804e08a09e8dffd091db9abd684926792dbebea9b827c9f37 - ## References [1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index b689fc0..3f2d6ef 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -41,7 +41,6 @@ See ATT&CK: [YiSpecter - Techniques Used](https://attack.mitre.org/software/S031 |[Lateral Movement::Supply Chain Compromise::Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. [[1]](#1)| |[Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643.m02)](../impact/generate-traffic-from-victim.md)|The malware displays brief advertisements whenever the user opens applications on their phone. [[1]](#1)| - ## MBC Behaviors |Name|Use| @@ -50,7 +49,6 @@ See ATT&CK: [YiSpecter - Techniques Used](https://attack.mitre.org/software/S031 |[Command and Control::C2 Communication::Send System Information (B0030.006)](../command-and-control/c2-communication.md)|The malware connects to the C2 server using HTTP to send device information. [[1]](#1)| |[Defense Evasion::Install Insecure or Malicious Configuration (B0047)](../defense-evasion/install-insecure-or-malicious-configuration.md)|The malware changes iOS Safari's default configuration. [[1]](#1)| - ## Indicators of Compromise SHA256 Hashes diff --git a/yfaq/pafish.md b/yfaq/pafish.md index bfcc79e..ccec5c5 100644 --- a/yfaq/pafish.md +++ b/yfaq/pafish.md @@ -29,7 +29,6 @@ | [Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - CPU Name (B0009.026)](../anti-behavioral-analysis/virtual-machine-detection.md) | Pafish checks the CPU name to identify virtualization. For example, Qemu is traced using the CPU brand string 'QEMU Virtual CPU', and Bochs is traced using either a typo in the CPU AMD processor name, a CPU AMD Easter egg, or a wrong value in the CPU Intel processor name. [[1]](#1)| |[Anti-Behavioral Analysis::Sandbox Detection (B0007)](../anti-behavioral-analysis/sandbox-detection.md)| Pafish checks the TLS hooks information structure (TLS_HOOK_INFO) to identify the presence of Cuckoo. [[1]](#1) | - ## References [1] https://github.com/a0rtega/pafish