anti-behavioral-analysis header changes

anti-behavioral-analysis/b0007.005.md

@@ -1,78 +0,0 @@
-<table>
-<tr>
-<td><b>ID</b></td>
-<td><b>B0007.005</b></td>
-</tr>
-<tr>
-<td><b>Method of:</b></td>
-<td><b><a href="./sandbox-detection.md">Sandbox Detection</a></b></td>
-</tr>
-<tr>
-<td><b>Objective(s)</b></td>
-<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
-</tr>
-<tr>
-<td><b>Version</b></td>
-<td><b>2.3</b></td>
-</tr>
-<tr>
-<td><b>Created</b></td>
-<td><b>1 August 2019</b></td>
-</tr>
-<tr>
-<td><b>Last Modified</b></td>
-<td><b>29 September 2022</b></td>
-</tr>
-</table>
-
-Sandbox Detection::Product Key/ID Testing
-=========================================
-Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.
-
-Use in Malware
---------------
-|Name|Date|Description|
-|---|---|---|
-|[**Redhip**](../xample-malware/rebhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
-
-Detection
----------
-**Tool: capa**
-
-[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/1fee68e72e5da3cf05cbf349d8b4df13dcf47a85/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)
-
-<a name="snippet"></a>Code Snippets
--------------
-**Sandbox Detection::Product Key/ID Testing** (B0007.005) - the value 55274-640-2673064-23950 corresponds to Joe Sandbox.
-```asm
-push    ebx
-add     esp, 0FFFFFEF4h
-xor     ebx, ebx
-push    esp             ; phkResult
-push    1               ; samDesired
-push    0               ; ulOptions
-push    offset SubKey   ; "Software\Microsoft\Windows\CurrentVersi"...
-push    80000002h       ; hKey
-call    RegOpenKeyExA
-test    eax, eax
-jnz     short loc_405387
-mov     [esp+110h+cbData], 101h
-lea     eax, [esp+110h+cbData]
-push    eax             ; lpcbData
-lea     eax, [esp+114h+Data]
-push    eax             ; lpData
-push    0               ; lpType 
-push    0               ; lpReserved
-push    offset ValueName ; "ProductId"
-mov     eax, [esp+124h+hKey]
-push    eax             ; hKey
-call    RegQueryValueExA
-lea     eax, [esp+110h+Data]
-cmp     eax, offset a55274640267306 ; "55274-640-2673064-23950"
-jnz     short loc_405387
-mov     bl, 1
-```
-
-References
-----------
-<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 

anti-behavioral-analysis/capture-evasion.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>None</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>18 November 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 

anti-behavioral-analysis/debugger-detection.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>None</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 

anti-behavioral-analysis/debugger-evasion.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>Debugger Evasion (<a href="https://attack.mitre.org/techniques/T1622/">T1622</a>)</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 

anti-behavioral-analysis/dynamic-analysis-evasion.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>Virtualization/Sandbox Evasion (<a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a>)</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 

anti-behavioral-analysis/emulator-detection.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>None</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 

anti-behavioral-analysis/emulator-evasion.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>None</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 

anti-behavioral-analysis/memory-dump-evasion.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>None</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 # Memory Dump Evasion

anti-behavioral-analysis/sandbox-detection.md

@@ -13,7 +13,7 @@
 </tr>
 <tr>
 <td><b>Version</b></td>
-<td><b>1.2</b></td>
+<td><b>2.0</b></td>
 </tr>
 <tr>
 <td><b>Created</b></td>

anti-behavioral-analysis/virtual-machine-detection.md

@@ -1,4 +1,3 @@
-
 <table>
 <tr>
 <td><b>ID</b></td>
@@ -12,6 +11,18 @@
 <td><b>Related ATT&CK Techniques</b></td>
 <td><b>Virtualization/Sandbox Evasion (<a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a>)</b></td>
 </tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>28 October 2022</b></td>
+</tr>
 </table>
 
 

zscript/fill_header.py

@@ -0,0 +1,157 @@
+#!/usr/bin/python
+
+import sys
+import re
+import glob
+import argparse
+
+from fuzzywuzzy import fuzz  # pip install fuzzywuzzy python-Levenshtein
+
+objective_list = ['anti-behavioral-analysis', 'anti-static-analysis', 'collection', 'command-and-control', 'credential-access', 'defense-evasion', 'discovery', 'execution', 'exfiltration', 'impact', 'lateral-movement', 'micro-behaviors', 'persistence', 'privilege-escalation']
+
+
+# Checks if 'string' in 'l' at index 'line_num'. If missing, insert 'string' into 'l' at index 'line_num'
+# Return possibly modified 'l'
+def insert_if_missing(l, line_num, string):
+    if l[line_num] != string:
+        l.insert(line_num, string)
+
+    return l
+
+# Matches string to an entry in objective_list
+def objective_search(string):
+    string = string.lower().replace('_', '-')
+   
+    if string not in objective_list:
+        raise Exception("Objective {} did not match anything: ".format(string))
+
+    return "../" + string
+
+def main():
+    # Initialize parser
+    parser = argparse.ArgumentParser(description="Inserts a formatted header for MBC. Only add parameters that are missing. In case of bugs, only run on a second copy")
+    
+    # Adding arguments
+    parser.add_argument("-f", "--file", help = "File to modify", required=True)
+    parser.add_argument("-i", "--id", help = "ID (B0001)")
+    parser.add_argument("-o", "--objective", nargs='+', help = "Objectives separated by spaces, replace spaces within the name with underscore (Anti-Behavioral_Analysis Anti-Static_Analysis)")
+    parser.add_argument("-a", "--attack", nargs='+', help = "Related ATT&CK Techniques grouped by name and ID (Debugger_Evasion,T1622 Virtualization/Standbox_Evasion_Checks,T1497.001,T1633.001)")
+    parser.add_argument("-v", "--version", help="Version")
+    parser.add_argument("-c", "--created", help="Method Creation Date (1_August_2019)")
+    parser.add_argument("-m", "--last_modified", help="Last modified date (1_August_2019)")
+
+    # Read arguments from command line
+    args = parser.parse_args()
+    
+    # Read file
+    file = args.file
+    with open(file) as f:
+        lines = f.readlines()
+        f.close()
+
+    # Some files have an empty line 1, delete that
+    if lines[0] == '\n':
+        lines.pop(0)
+
+    # Checking if first line is <table>, if not, that means this file does not have any appropriate header formatting
+    lines = insert_if_missing(lines, 0, "<table>\n")
+    lines = insert_if_missing(lines, 1, "<tr>\n")
+    
+    # Adding ID field
+    if args.id:
+        lines = insert_if_missing(lines, 2, "<td><b>ID</b></td>\n")
+        lines.insert(3, "<td><b>{}</b></td>\n".format(args.id))
+        lines.insert(4, "</tr>\n")
+
+    # Adding Objective field
+    if args.objective:
+        lines = insert_if_missing(lines, 5, "<tr>\n")
+        lines = insert_if_missing(lines, 6, "<td><b>Objective(s)</b></td>\n")
+        
+        # Build objectives if multiple
+        obj_str = "<td><b>"
+        for objective in args.objective:
+            obj_path = objective_search(objective)
+            objective = objective.replace('_', ' ')
+
+            obj_str = obj_str + "<a href=\"{}\">{}</a>, ".format(obj_path, objective)
+        
+        # Chop off last ', '
+        obj_str = obj_str[:len(obj_str) - 2]
+        obj_str = obj_str + "</b></td>\n"
+
+        lines.insert(7, obj_str)
+        lines.insert(8, "</tr>\n")
+
+    # Adding Related ATT&CK Techniques Field
+    if args.attack:
+        lines = insert_if_missing(lines, 9, "<tr>\n")
+        lines = insert_if_missing(lines, 10, "<td><b>Related ATT&CK Techniques</b></td>\n")
+
+        # Build attack links if multiple
+        attack_str = "<td><b>"
+        for attack in args.attack:
+            attack = attack.split(",")
+            attack_name = attack[0].replace('_', ' ')
+            
+            attack_str = attack_str + attack_name + " ("
+
+            # Looking at technique IDs now
+            for i in range(1, len(attack)):
+                attack_id = attack[i]
+                attack_id_dash = attack_id.replace('.', '/')
+
+                attack_str = attack_str + "<a href=\"https://attack.mitre.org/techniques/{}/\">{}</a>, ".format(attack_id_dash, attack_id)
+
+            # Chop off last ', '
+            attack_str = attack_str[:len(attack_str) - 2]
+            attack_str = attack_str + "), "
+
+        # Chop off last ', '
+        attack_str = attack_str[:len(attack_str) - 2]
+        attack_str = attack_str + "</b></td>\n"
+
+        lines.insert(11, attack_str)
+        lines.insert(12, "</tr>\n")
+        print(attack_str)
+
+    # Adding version field
+    if args.version:
+        lines = insert_if_missing(lines, 13, "<tr>\n")
+        lines = insert_if_missing(lines, 14, "<td><b>Version</b></td>\n")
+
+        lines.insert(15, "<td><b>{}</b></td>\n".format(args.version))
+        lines.insert(16, "</tr>\n")
+
+    # Adding Created field
+    if args.created:
+        lines = insert_if_missing(lines, 17, "<tr>\n")
+        lines = insert_if_missing(lines, 18, "<td><b>Created</b></td>\n")
+
+        created = args.created.replace('_', ' ')
+        lines.insert(19, "<td><b>{}</b></td>\n".format(created))
+        lines.insert(20, "</tr>\n")
+    
+    # Adding Last Modified Field
+    if args.last_modified:
+        lines = insert_if_missing(lines, 21, "<tr>\n")
+        lines = insert_if_missing(lines, 22, "<td><b>Last Modified</b></td>\n")
+
+        last_modified = args.last_modified.replace('_', ' ')
+        lines.insert(23, "<td><b>{}</b></td>\n".format(last_modified))
+        lines.insert(24, "</tr>\n")
+
+    lines = insert_if_missing(lines, 25, "</table>\n")
+    lines = insert_if_missing(lines, 26, "\n")
+
+    # Now that modifications are complete, write to file
+    with open(file, "w") as f:
+        for line in lines:
+            f.write(line)
+
+    f.close()
+           
+    return
+
+if __name__=="__main__":
+    main()