diff --git a/anti-behavioral-analysis/b0007.005.md b/anti-behavioral-analysis/b0007.005.md deleted file mode 100644 index 61252fe..0000000 --- a/anti-behavioral-analysis/b0007.005.md +++ /dev/null @@ -1,78 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - -
IDB0007.005
Method of:Sandbox Detection
Objective(s)Anti-Behavioral Analysis
Version2.3
Created1 August 2019
Last Modified29 September 2022
- -Sandbox Detection::Product Key/ID Testing -========================================= -Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry. - -Use in Malware --------------- -|Name|Date|Description| -|---|---|---| -|[**Redhip**](../xample-malware/rebhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)| - -Detection ---------- -**Tool: capa** - -[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/1fee68e72e5da3cf05cbf349d8b4df13dcf47a85/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml) - -Code Snippets -------------- -**Sandbox Detection::Product Key/ID Testing** (B0007.005) - the value 55274-640-2673064-23950 corresponds to Joe Sandbox. -```asm -push ebx -add esp, 0FFFFFEF4h -xor ebx, ebx -push esp ; phkResult -push 1 ; samDesired -push 0 ; ulOptions -push offset SubKey ; "Software\Microsoft\Windows\CurrentVersi"... -push 80000002h ; hKey -call RegOpenKeyExA -test eax, eax -jnz short loc_405387 -mov [esp+110h+cbData], 101h -lea eax, [esp+110h+cbData] -push eax ; lpcbData -lea eax, [esp+114h+Data] -push eax ; lpData -push 0 ; lpType -push 0 ; lpReserved -push offset ValueName ; "ProductId" -mov eax, [esp+124h+hKey] -push eax ; hKey -call RegQueryValueExA -lea eax, [esp+110h+Data] -cmp eax, offset a55274640267306 ; "55274-640-2673064-23950" -jnz short loc_405387 -mov bl, 1 -``` - -References ----------- -[1] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html diff --git a/anti-behavioral-analysis/capture-evasion.md b/anti-behavioral-analysis/capture-evasion.md index 3312c05..d8db336 100644 --- a/anti-behavioral-analysis/capture-evasion.md +++ b/anti-behavioral-analysis/capture-evasion.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques None
Version2.0
Created18 November 2019
Last Modified28 October 2022
diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index 50c7ed3..5a4d17f 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques None
Version2.0
Created1 August 2019
Last Modified28 October 2022
diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index 2079097..6d7dbd7 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques Debugger Evasion (T1622)
Version2.0
Created1 August 2019
Last Modified28 October 2022
diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md index a4af6ac..8ffa645 100644 --- a/anti-behavioral-analysis/dynamic-analysis-evasion.md +++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques Virtualization/Sandbox Evasion (T1497, T1633)
Version2.0
Created1 August 2019
Last Modified28 October 2022
diff --git a/anti-behavioral-analysis/emulator-detection.md b/anti-behavioral-analysis/emulator-detection.md index 2faa609..63f26a3 100644 --- a/anti-behavioral-analysis/emulator-detection.md +++ b/anti-behavioral-analysis/emulator-detection.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques None
Version2.0
Created1 August 2019
Last Modified28 October 2022
diff --git a/anti-behavioral-analysis/emulator-evasion.md b/anti-behavioral-analysis/emulator-evasion.md index 04f5449..9e62787 100644 --- a/anti-behavioral-analysis/emulator-evasion.md +++ b/anti-behavioral-analysis/emulator-evasion.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques None
Version2.0
Created1 August 2019
Last Modified28 October 2022
diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md index 19bc594..b80f5db 100644 --- a/anti-behavioral-analysis/memory-dump-evasion.md +++ b/anti-behavioral-analysis/memory-dump-evasion.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques None
Version2.0
Created1 August 2019
Last Modified28 October 2022
# Memory Dump Evasion diff --git a/anti-behavioral-analysis/sandbox-detection.md b/anti-behavioral-analysis/sandbox-detection.md index 3da7a7b..9b77077 100644 --- a/anti-behavioral-analysis/sandbox-detection.md +++ b/anti-behavioral-analysis/sandbox-detection.md @@ -13,7 +13,7 @@ Version -1.2 +2.0 Created diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index feb9833..0545e48 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -1,4 +1,3 @@ - @@ -12,6 +11,18 @@ + + + + + + + + + + + +
IDRelated ATT&CK Techniques Virtualization/Sandbox Evasion (T1497, T1633)
Version2.0
Created1 August 2019
Last Modified28 October 2022
diff --git a/zscript/fill_header.py b/zscript/fill_header.py new file mode 100644 index 0000000..171c44d --- /dev/null +++ b/zscript/fill_header.py @@ -0,0 +1,157 @@ +#!/usr/bin/python + +import sys +import re +import glob +import argparse + +from fuzzywuzzy import fuzz # pip install fuzzywuzzy python-Levenshtein + +objective_list = ['anti-behavioral-analysis', 'anti-static-analysis', 'collection', 'command-and-control', 'credential-access', 'defense-evasion', 'discovery', 'execution', 'exfiltration', 'impact', 'lateral-movement', 'micro-behaviors', 'persistence', 'privilege-escalation'] + + +# Checks if 'string' in 'l' at index 'line_num'. If missing, insert 'string' into 'l' at index 'line_num' +# Return possibly modified 'l' +def insert_if_missing(l, line_num, string): + if l[line_num] != string: + l.insert(line_num, string) + + return l + +# Matches string to an entry in objective_list +def objective_search(string): + string = string.lower().replace('_', '-') + + if string not in objective_list: + raise Exception("Objective {} did not match anything: ".format(string)) + + return "../" + string + +def main(): + # Initialize parser + parser = argparse.ArgumentParser(description="Inserts a formatted header for MBC. Only add parameters that are missing. In case of bugs, only run on a second copy") + + # Adding arguments + parser.add_argument("-f", "--file", help = "File to modify", required=True) + parser.add_argument("-i", "--id", help = "ID (B0001)") + parser.add_argument("-o", "--objective", nargs='+', help = "Objectives separated by spaces, replace spaces within the name with underscore (Anti-Behavioral_Analysis Anti-Static_Analysis)") + parser.add_argument("-a", "--attack", nargs='+', help = "Related ATT&CK Techniques grouped by name and ID (Debugger_Evasion,T1622 Virtualization/Standbox_Evasion_Checks,T1497.001,T1633.001)") + parser.add_argument("-v", "--version", help="Version") + parser.add_argument("-c", "--created", help="Method Creation Date (1_August_2019)") + parser.add_argument("-m", "--last_modified", help="Last modified date (1_August_2019)") + + # Read arguments from command line + args = parser.parse_args() + + # Read file + file = args.file + with open(file) as f: + lines = f.readlines() + f.close() + + # Some files have an empty line 1, delete that + if lines[0] == '\n': + lines.pop(0) + + # Checking if first line is , if not, that means this file does not have any appropriate header formatting + lines = insert_if_missing(lines, 0, "
\n") + lines = insert_if_missing(lines, 1, "\n") + + # Adding ID field + if args.id: + lines = insert_if_missing(lines, 2, "\n") + lines.insert(3, "\n".format(args.id)) + lines.insert(4, "\n") + + # Adding Objective field + if args.objective: + lines = insert_if_missing(lines, 5, "\n") + lines = insert_if_missing(lines, 6, "\n") + + # Build objectives if multiple + obj_str = "\n" + + lines.insert(7, obj_str) + lines.insert(8, "\n") + + # Adding Related ATT&CK Techniques Field + if args.attack: + lines = insert_if_missing(lines, 9, "\n") + lines = insert_if_missing(lines, 10, "\n") + + # Build attack links if multiple + attack_str = "\n" + + lines.insert(11, attack_str) + lines.insert(12, "\n") + print(attack_str) + + # Adding version field + if args.version: + lines = insert_if_missing(lines, 13, "\n") + lines = insert_if_missing(lines, 14, "\n") + + lines.insert(15, "\n".format(args.version)) + lines.insert(16, "\n") + + # Adding Created field + if args.created: + lines = insert_if_missing(lines, 17, "\n") + lines = insert_if_missing(lines, 18, "\n") + + created = args.created.replace('_', ' ') + lines.insert(19, "\n".format(created)) + lines.insert(20, "\n") + + # Adding Last Modified Field + if args.last_modified: + lines = insert_if_missing(lines, 21, "\n") + lines = insert_if_missing(lines, 22, "\n") + + last_modified = args.last_modified.replace('_', ' ') + lines.insert(23, "\n".format(last_modified)) + lines.insert(24, "\n") + + lines = insert_if_missing(lines, 25, "
ID{}
Objective(s)" + for objective in args.objective: + obj_path = objective_search(objective) + objective = objective.replace('_', ' ') + + obj_str = obj_str + "{}, ".format(obj_path, objective) + + # Chop off last ', ' + obj_str = obj_str[:len(obj_str) - 2] + obj_str = obj_str + "
Related ATT&CK Techniques" + for attack in args.attack: + attack = attack.split(",") + attack_name = attack[0].replace('_', ' ') + + attack_str = attack_str + attack_name + " (" + + # Looking at technique IDs now + for i in range(1, len(attack)): + attack_id = attack[i] + attack_id_dash = attack_id.replace('.', '/') + + attack_str = attack_str + "{}, ".format(attack_id_dash, attack_id) + + # Chop off last ', ' + attack_str = attack_str[:len(attack_str) - 2] + attack_str = attack_str + "), " + + # Chop off last ', ' + attack_str = attack_str[:len(attack_str) - 2] + attack_str = attack_str + "
Version{}
Created{}
Last Modified{}
\n") + lines = insert_if_missing(lines, 26, "\n") + + # Now that modifications are complete, write to file + with open(file, "w") as f: + for line in lines: + f.write(line) + + f.close() + + return + +if __name__=="__main__": + main() \ No newline at end of file