Staging (#124)

- Updating capa detection in behaviors - Newsletter - Conti malware - pafish faq
2026-06-08 11:36:36 +00:00 · 2023-09-20 15:57:32 -04:00
parent 7223fa76d6
commit f7d92d59fa
184 changed files with 1732 additions and 606 deletions
@@ -29,11 +29,11 @@ Methods are associated with behaviors and serve different roles, depending on th

 Note that a method cannot be used without a behavior.

-### Micro-behaviors ###
+### Micro-objectives / Micro-behaviors ###
 Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](./micro-behaviors/README.md) for details.

 ### <a name="ids"></a>Identifiers ###
-As shown below, the letter of an identifier relays information about a behavior. Note that letters used in MBC v2 are changed from MBC v1.
+As shown below, the letter of an identifier relays information about a behavior. Note that letters used in MBC v2 and v3 are changed from MBC v1.

 |**Letter**|**Example**|**Description**|
 |---|---|---|
@@ -73,9 +73,6 @@ This visual representation of the MBC Matrix is based on the ATT&CK Navigator. T
 ### Malware Corpus ###
 The MBC contains a [malware corpus](./xample-malware/README.md) where each malware entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports. Note that some malware types are also present in the ATT&CK software page. We refer readers to the corresponding ATT&CK page for a list of identified ATT&CK techniques. However, we will list any newly identified ATT&CK techniques in the MBC malware page. 

-## Micro-behavior Objectives ##
-[Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.
-
 ## Malware Objective Descriptions ##
 Malware objectives are defined in the table below. Follow the links to view associated behaviors. 

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>28 October 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>2 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -36,10 +36,10 @@ Malware detects whether it's being executed inside a debugger by checking for ar

 While many methods are listed in the table below, among the most commonly used are:
 - Using APIs such as IsDebuggerPresent, CheckRemoteDebuggerPresent, and OutputDebugString
- Reading the BeingDebugged bit ( is it a 1 or 0) in the Process Environment Block (PEB)
+- Reading the BeingDebugged bit (is it a 1 or 0) in the Process Environment Block (PEB)
 - Checking whether a software breakpoint instruction is used (INT3; 0xCC opcode)

-Details on detecting debuggers are given in the references.
+Details on detecting debuggers can be found in the references.


 ## Methods
@@ -106,6 +106,27 @@ Details on detecting debuggers are given in the references.
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.034|The malware executes anti-debugging instructions. [[15]](#15)|
 |[**UP007**](../xample-malware/up007.md)|2016|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check for trap flag exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml)|Debugger Detection (B0001)| |
+|[check for software breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml)|Debugger Detection::Software Breakpoints (B0001.025)| |
+|[check process job object](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml)|Debugger Detection (B0001)|kernel32.QueryInformationJobObject, kernel32.OpenProcess|
+|[check for PEB BeingDebugged flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml)|Debugger Detection::Process Environment Block BeingDebugged (B0001.035)| |
+|[check for time delay via GetTickCount](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)| |
+|[check for protected handle exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml)|Debugger Detection::SetHandleInformation (B0001.024)|SetHandleInformation, CloseHandle|
+|[check for OutputDebugString error](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml)|Debugger Detection::OutputDebugString (B0001.016)|kernel32.SetLastError, kernel32.GetLastError, kernel32.OutputDebugString|
+|[check for unexpected memory writes](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml)|Debugger Detection::Memory Write Watching (B0001.010)|kernel32.GetWriteWatch|
+|[check for kernel debugger via shared user data structure](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml)|Debugger Detection (B0001)| |
+|[check for time delay via QueryPerformanceCounter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml)|Debugger Detection::Timing/Delay Check QueryPerformanceCounter (B0001.033)| |
+|[check for hardware breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml)|Debugger Detection::Hardware Breakpoints (B0001.005)|kernel32.GetThreadContext|
+|[check ProcessDebugPort](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml)|Debugger Detection::NtQueryInformationProcess (B0001.012)|NtQueryInformationProcess|
+|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::CheckRemoteDebuggerPresent (B0001.002)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent|
+|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::WudfIsAnyDebuggerPresent (B0001.031)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent|
+|[check for PEB NtGlobalFlag flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml)|Debugger Detection::Process Environment Block NtGlobalFlag (B0001.036)| |
+|[execute anti-debugging instructions](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml)|Debugger Detection::Anti-debugging Instructions (B0001.034)| |
+|[PEB access](https://github.com/mandiant/capa-rules/blob/master/lib/peb-access.yml)|Debugger Detection::Process Environment Block (B0001.019)| |

 ## References

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>4 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -82,6 +82,12 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
 |[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[3]](#3)|
 |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a debugger. [[4]](#4)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[hide thread from debugger](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml)|Debugger Evasion (B0002)|NtSetInformationThread, ZwSetInformationThread, GetCurrentThread|
+|[switch active desktop](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/switch-active-desktop.yml)|Debugger Evasion (B0002)|user32.CreateDesktop, user32.SwitchDesktop|

 ## References

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>02 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -60,7 +60,6 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**Illusion**|B0003.009|Creates an illusion; makes the analyst think something happened when it didn't.|
 |**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.|

-
 ## Use in Malware

 |Name|Date|Method|Description|
@@ -73,6 +72,11 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.011|The malware computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively. [[5]](#5)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|B0003.012|The malware uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering). [[6]](#6)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[delay execution](https://github.com/mandiant/capa-rules/blob/master/lib/delay-execution.yml)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|kernel32.Sleep, kernel32.SleepEx, kernel32.WaitForSingleObject, kernel32.SignalObjectAndWait, kernel32.WaitForSingleObjectEx, kernel32.WaitForMultipleObjects, kernel32.WaitForMultipleObjectsEx, kernel32.RegisterWaitForSingleObject, WaitOnAddress, user32.MsgWaitForMultipleObjects, user32.MsgWaitForMultipleObjectsEx, NtDelayExecution, KeWaitForSingleObject, KeDelayExecutionThread, sleep, usleep|

 ## References

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>19 September 2023</b></td>
 </tr>
 </table>

@@ -43,21 +43,21 @@ Detects whether the malware instance is being executed inside an emulator. If so
 |**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
 |**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|

-## Detection
-
-|Tool: capa|Mapping|APIs|
-|---|---|---|
-|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|
-
-
 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[2]](#2)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0004)|GetModuleHandle, GetProcAddress|
+
+
 ## References

-<a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/
+<a name="1">[1]</a> https://search.unprotect.it/category/sandbox-evasion/

 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>4 March 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>02 May 2023</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>19 May 2023</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>4 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -33,10 +33,12 @@
 # Virtual Machine Detection

 Malware checks whether it is being executed inside a virtual environment. In performing reconnaissance of its environment, the malware will check on a variety of user or system based artifacts. Examples include: 
-	•	monitoring for user action as reflected by scrolling
-	•	verifying system characteristics through Windows Management Interface (WMI) queries, e.g., for MAC address
-	•	observing whether tool artifacts represented by strings or processes exist, e.g., VirtualBox.exe or joeboxserver.exe  
-	•	and checking specific registry keys or values [[1]](#1)
+
+- monitoring for user action as reflected by scrolling
+- verifying system characteristics through Windows Management Interface (WMI) queries, e.g., for MAC address
+- observing whether tool artifacts represented by strings or processes exist, e.g., VirtualBox.exe or joeboxserver.exe  
+- checking specific registry keys or values [[1]](#1)
+
 Upon detection of the virtual machine, conditional execution will change the malware’s behavior. For example, execution may terminate, or activity may appear benign, e.g., connecting to a benign domain.

 The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior.
@@ -61,7 +63,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
 |**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
 |**Instruction Testing**|[B0009.029](#b0009029-snippet)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type. This method is related to Unprotect technqiue U1324.|
+|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type. This method is related to Unprotect technique U1324.|
 |**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1323.|
 |**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
 |**Instruction Testing - SGDT/SLDT (no pill)**|B0009.031|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero. This method is related to Unprotect technique U1327.|
@@ -107,8 +109,23 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t

 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|
-
+|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Virtual Machine Detection (B0009)|GetModuleHandle|
+|[check for Windows sandbox via genuine state](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml)|Virtual Machine Detection (B0009)|SLIsGenuineLocal, UuidFromString|
+|[reference anti-VM strings targeting Parallels](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml)|Virtual Machine Detection (B0009)| |
+|[check for unmoving mouse cursor](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml)|Virtual Machine Detection::Human User Check (B0009.012)| |
+|[reference anti-VM strings targeting VirtualPC](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml)|Virtual Machine Detection (B0009)| |
+|[reference anti-VM strings targeting VMWare](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml)|Virtual Machine Detection (B0009)| |
+|[check for foreground window switch](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml)|Virtual Machine Detection::Human User Check (B0009.012)|Sleep|
+|[detect VM via disk hardware WMI queries](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml)|Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)| |
+|[reference anti-VM strings targeting Qemu](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml)|Virtual Machine Detection (B0009)| |
+|[reference anti-VM strings targeting Xen](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml)|Virtual Machine Detection (B0009)| |
+|[check for sandbox username or hostname](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml)|Virtual Machine Detection (B0009)| |
+|[check for Windows sandbox via process name](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml)|Virtual Machine Detection (B0009)| |
+|[check for Windows sandbox via dns suffix](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
+|[check for Windows sandbox via device](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml)|Virtual Machine Detection (B0009)| |
+|[reference anti-VM strings targeting VirtualBox](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml)|Virtual Machine Detection (B0009)| |
+|[check for Windows sandbox via registry](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml)|Virtual Machine Detection (B0009)|RegOpenKeyEx, RegEnumValue|
+|[reference anti-VM strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml)|Virtual Machine Detection (B0009)| |

 ## Code Snippets

@@ -155,7 +172,7 @@ jmp short loc_401CBB

 <a name="1">[1]</a> Check Point Research,"CP<r>: Evasion Techniques," evasions.checkpoint.com, [Online]. Available: https://evasions.checkpoint.com.

-<a name="2">[2]</a> https://search.unprotect.it/map/sandbox-evasion/
+<a name="2">[2]</a> https://search.unprotect.it/category/sandbox-evasion/

 <a name="3">[3]</a> https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -28,6 +28,6 @@ Behaviors and code characteristics that prevent or hinder static analysis of the

 ## References

-<a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/
+<a name="1">[1]</a> https://search.unprotect.it/category/sandbox-evasion/

 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>3 June 2023</b></td>
+<td><b>31 August 2023</b></td>
 </tr>
 </table>

@@ -50,7 +50,7 @@ Malicious code evades accurate call graph generation, which can be used for malw

 <a name="3">[3]</a> S. Shang, N. Zheng, J. Xu, M. Xu, and H. Zhang,"Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. [Online]. Available: https://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf.

-<a name="4">[4]</a> J. Kinable, "Malware Detection Through Call Graphs," Master thesis, Department of Telematics, Norwegian University of Science and Technology, Norway, June 2010. [Online]. Available: https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262290/353049_FU LLTEXT01.pdf?sequence=1&isAllowed=y.
+<a name="4">[4]</a> J. Kinable, "Malware Detection Through Call Graphs," Master thesis, Department of Telematics, Norwegian University of Science and Technology, Norway, June 2010. [Online]. Available: https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262290/353049_FULLTEXT01.pdf?sequence=1&isAllowed=y.

 <a name="5">[5]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>10 November 2022</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>19 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -51,6 +51,12 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|B0012.001|Hupigon contains obfuscated stack strings. [[7]](#7)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|B0012.001|Rombertik contains obfuscated stack strings. [[7]](#7)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[contain anti-disasm techniques](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml)|Disassembler Evasion (B0012)| |
+
 ## References

 <a name="1">[1]</a> M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press, 2012.
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -75,6 +75,23 @@ For encryption and encoding characteristics of malware samples, as well as malwa
 |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.017|The malware encodes data in a stack string and copies that data into a global character buffer as a form of string obfuscation. Different techniques are used to encrypt and obfuscate strings. Strings are dynamically decrypted when the malware needs to use them. [[9]](#9) [[10]](#10)|
 |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.009|The malware has 4 different export functions. [[9]](#9) [[10]](#10)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[obfuscated with ADVobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with DeepSea Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with callobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Dotfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with vs-obfuscation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-vs-obfuscation.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Spices.Net Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Babel Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with SmartAssembly](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-smartassembly.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Yano](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-yano.yml)|Executable Code Obfuscation (B0032)| |
+|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Argument Obfuscation (B0032.020)| |
+|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Stack Strings (B0032.017)| |
+|[use .NET library EncryptDecryptUtils](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml)|Executable Code Obfuscation (B0032)| |
+

 ## Code Snippets

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>10 November 2022</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>30 April 2023</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -64,6 +64,31 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)|
 |[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[packed with pebundle](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pebundle/packed-with-pebundle.yml)|Software Packing (F0001)| |
+|[packed with Themida](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/themida/packed-with-themida.yml)|Software Packing::Themida (F0001.011)| |
+|[packed with VMProtect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml)|Software Packing::VMProtect (F0001.010)| |
+|[packed with y0da crypter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml)|Software Packing (F0001)| |
+|[packed with pelocknt](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml)|Software Packing (F0001)| |
+|[packed with GoPacker](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/gopacker/packed-with-gopacker.yml)|Software Packing::Standard Compression (F0001.002)| |
+|[packed with Confuser](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/confuser/packed-with-confuser.yml)|Software Packing::Confuser (F0001.009)| |
+|[packed with rlpack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/rlpack/packed-with-rlpack.yml)|Software Packing (F0001)| |
+|[packed with ASPack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/aspack/packed-with-aspack.yml)|Software Packing (F0001)| |
+|[packed with generic packer](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/generic/packed-with-generic-packer.yml)|Software Packing::Standard Compression (F0001.002)| |
+|[packed with amber](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/amber/packed-with-amber.yml)|Software Packing (F0001)| |
+|[packed with petite](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/petite/packed-with-petite.yml)|Software Packing (F0001)| |
+|[packed with peshield](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/peshield/packed-with-peshield.yml)|Software Packing (F0001)| |
+|[packed with UPX](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upx/packed-with-upx.yml)|Software Packing::UPX (F0001.008)| |
+|[packed with upack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upack/packed-with-upack.yml)|Software Packing (F0001)| |
+|[packed with PECompact](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pecompact/packed-with-pecompact.yml)|Software Packing (F0001)| |
+|[packed with Huan](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/huan/packed-with-huan.yml)|Software Packing (F0001)| |
+|[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)| |
+|[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)| |
+|[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)| |
+

 ## References

@@ -1,20 +1,20 @@
 # capa Rule Distribution #
-15 August 2022
+19 September 2023

 ## Histograms ##
-The histograms below show the number of capa rules mapped into ATT&CK techniques (organized by tactic), MBC behaviors (organized by objective), and MBC micro-behaviors (organized by micro-objective). The explicit techniques, behaviors, and micro-behaviors follow.
+The histograms below show the number of capa rules mapped into ATT&CK techniques (organized by tactic), MBC behaviors (organized by objective), and MBC micro-behaviors (organized by micro-objective). The count tracks ATT&CK techniques and sub-techniques and MBC behaviors and methods individually. For example, both B0009 and B0009.012 are counted under the Anti-Behavioral Analysis objective. The explicit techniques/sub-techiques, behaviors/methods, and micro-behaviors/micro-methods follow the histograms.

 ### ATT&CK Mapping Histogram ###

 | **TACTIC** | **Number of Techniques**  |  |
 |-----|-----|-----|
-|Reconnaissance |0| |
+|Reconnaissance|0| |
 |Resource Development|0| |
-|Initial Access |0| |
+|Initial Access|0| |
 |**Execution**|8| **XXXXXXXX** |
-|**Persistence**|13| **XXXXXXXXXXXXX** |
-|**Privilege Escalation**|1 | **X** |
-|**Defense Evasion**|32| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Persistence**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
+|**Privilege Escalation**|1| **X** |
+|**Defense Evasion**|37| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
 |**Credential Access**|4| **XXXX** |
 |**Discovery**|17| **XXXXXXXXXXXXXXXXX** |
 |Lateral Movement|0| |
@@ -23,31 +23,31 @@ The histograms below show the number of capa rules mapped into ATT&CK techniques
 |Exfiltration|0| |
 |**Impact**|5| **XXXXX** |

-### MBC Mapping Histogram ###
+### MBC Mapping Histogram (Objectives) ###

 | **OBJECTIVE** | **Number of Behaviors** |  |
 |-----|-----|-----|
-|**Anti-Behavioral Analysis** |20| **XXXXXXXXXXXXXXXXXXXX**|
-|**Anti-Static Analysis**|9| **XXXXXXXXX** |
-|**Collection**|4| **XXXX** |
+|**Anti-Behavioral Analysis**|24| **XXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Anti-Static Analysis**|10| **XXXXXXXXXX** |
+|**Collection**|5| **XXXXX** |
 |**Command and Control**|3| **XXX** |
 |Credential Access|0| |
-|**Defense Evasion**|13| **XXXXXXXXXXXXX** |
-|**Discovery**|6| **XXXXXX** |
-|**Execution**|1| **X** |
+|**Defense Evasion**|15| **XXXXXXXXXXXXXXX** |
+|**Discovery**|8| **XXXXXXXX** |
+|**Execution**|2| **XX** |
 |Exfiltration|0| |
-|**Impact**|5| **XXXXX** |
+|**Impact**|6| **XXXXXX** |
 |Lateral Movement|0| |
-|Persistence|0| |
-|Privilege Escalation|0 | |
+|**Persistence**|2| **XX** |
+|Privilege Escalation|0| |

-### MBC Mapping Histogram ###
+### MBC Mapping Histogram (Micro-Objectives) ###

 | **MICRO-OBJECTIVE** | **Number of Micro-Behaviors**  |  |
 |-----|-----|-----|
-|**Communication** |34| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX**|
-|**Cryptography**|16| **XXXXXXXXXXXXXXXX** |
-|**Data**|15| **XXXXXXXXXXXXXXX** |
+|**Communication**|38| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Cryptography**|27| **XXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Data**|16| **XXXXXXXXXXXXXXXX** |
 |**File System**|11| **XXXXXXXXXXX** |
 |**Hardware**|4| **XXXX** |
 |**Memory**|2| **XX** |
@@ -57,392 +57,411 @@ The histograms below show the number of capa rules mapped into ATT&CK techniques

 ## ATT&CK MAPPINGS ##

-### Collection: ###
-  num: 7
-  - Archive Collected Data::Archive via Library [T1560.002]
-  - Clipboard Data [T1115]
-  - Video Capture [T1125]
-  - Input Capture::Keylogging [T1056.001]
-  - Data from Information Repositories [T1213]
-  - Audio Capture [T1123]
-  - Screen Capture [T1113]
-  
-### Command and Control: ###
-  num: 1
-  - Ingress Tool Transfer [T1105]
-  
-### Credential Access: ###
-  num: 4
-  - Credentials from Password Stores::Windows Credential Manager [T1555.004]
-  - Credentials from Password Stores::Password Managers [T1555.005]
-  - Credentials from Password Stores [T1555]
-  - Credentials from Password Stores::Credentials from Web Browsers [T1555.003]
-  
-### Defense Evasion: ###
-  num: 32
-  - Obfuscated Files or Information::Software Packing [T1027.002]
-  - Virtualization/Sandbox Evasion::System Checks [T1497.001]
-  - Impair Defenses::Disable or Modify Tools [T1562.001]
-  - Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002]
-  - Virtualization/Sandbox Evasion [T1497]
-  - Indicator Removal on Host [T1070]
-  - Impair Defenses::Disable Windows Event Logging [T1562.002]
-  - Process Injection [T1055]
-  - Access Token Manipulation::Parent PID Spoofing [T1134.004]
-  - Indicator Removal on Host::Clear Windows Event Logs [T1070.001]
-  - Indicator Removal on Host::File Deletion [T1070.004]
-  - Indicator Removal on Host::Timestomp [T1070.006]
-  - Obfuscated Files or Information [T1027]
-  - Obfuscated Files or Information::Indicator Removal from Tools [T1027.005]
-  - Deobfuscate/Decode Files or Information [T1140]
-  - Obfuscated Files or Information [T1027.002]
-  - Subvert Trust Controls::Mark-of-the-Web Bypass [T1553.005]
-  - File and Directory Permissions Modification [T1222]
-  - Hide Artifacts::Hidden Window [T1564.003]
-  - Hide Artifacts [T1564]
-  - "Process Injection::Process Doppelg\xE4nging [T1055.013]"
-  - Process Injection::Portable Executable Injection [T1055.002]
-  - Process Injection::Dynamic-link Library Injection [T1055.001]
-  - Process Injection::Thread Execution Hijacking [T1055.003]
-  - Process Injection::Asynchronous Procedure Call [T1055.004]
-  - Process Injection::Process Hollowing [T1055.012]
-  - Modify Registry [T1112]
-  - Impair Defenses::Safe Mode Boot [T1562.009]
-  - Subvert Trust Controls::Code Signing Policy Modification [T1553.006]
-  - Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002]
-  - Hijack Execution Flow [T1574]
-  - BITS Jobs [T1197]
-  
-### Discovery: ###
-  num: 17
-   
-  - File and Directory Discovery [T1083]
-  - System Information Discovery [T1082]
-  - Process Discovery [T1057]
-  - System Location Discovery::System Language Discovery [T1614.001]
-  - System Service Discovery [T1007]
-  - Application Window Discovery [T1010]
-  - System Owner/User Discovery [T1033]
-  - Account Discovery [T1087]
-  - Query Registry [T1012]
-  - Software Discovery::Security Software Discovery [T1518.001]
-  - Software Discovery [T1518]
-  - System Network Configuration Discovery::Internet Connection Discovery [T1016.001]
-  - System Network Configuration Discovery [T1016]
-  - Network Sniffing [T1040]
-  - System Location Discovery [T1614]
-  - Group Policy Discovery [T1615]
-  - Domain Trust Discovery [T1482]
-  
-### Execution: ###
-  num: 8
-   
-  - Command and Scripting Interpreter [T1059]
-  - Windows Management Instrumentation [T1047]
-  - System Services::Service Execution [T1569.002]
-  - Command and Scripting Interpreter::PowerShell [T1059.001]
-  - Shared Modules [T1129]
-  - Command and Scripting Interpreter::Python [T1059.006]
-  - Command and Scripting Interpreter::Unix Shell [T1059.004]
-  - Command and Scripting Interpreter::Windows Command Shell [T1059.003]
-  
-### Exfiltration: ###
+### Reconnaissance ###
  num: 0
-  
-### Impact: ###
-  num: 5
-   
-  - Endpoint Denial of Service [T1499]
-  - System Shutdown/Reboot [T1529]
-  - Data Manipulation::Transmitted Data Manipulation [T1565.002]
-  - Inhibit System Recovery [T1490]
-  - Disk Wipe::Disk Structure Wipe [T1561.002]
-  
-### Initial Access: ###
-  num: 0
-  
-### Lateral Movement: ###
-  num: 0
-  
-### Persistence: ###
-  num: 13
-   
-  - Create or Modify System Process::Windows Service [T1543.003]
-  - Event Triggered Execution::Unix Shell Configuration Modification [T1546.004]
-  - Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013]
-  - Server Software Component::IIS Components [T1505.004]
-  - Modify Authentication Process [T1556]
-  - Modify Authentication Process::Password Filter DLL [T1556.002]
-  - Boot or Logon Initialization Scripts::RC Scripts [T1037.004]
-  - Scheduled Task/Job::Scheduled Task [T1053.005]
-  - Boot or Logon Autostart Execution::Active Setup [T1547.014]
-  - Event Triggered Execution::AppInit DLLs [T1546.010]
-  - Event Triggered Execution [T1546]
-  - Boot or Logon Autostart Execution::Winlogon Helper DLL [T1547.004]
-  - Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]
-  
-### Privilege Escalation: ###
-  num: 1
-   
-  - Access Token Manipulation [T1134]
-  
-### Reconnaissance: ###
-  num: 0
-  
-### Resource Development: ###
-  num: 0
-  

+### Resource Development ###
+  num: 0
+
+### Initial Access ###
+  num: 0
+
+### Execution ###
+  num: 8
+  - Command and Scripting Interpreter [T1059] Count-3
+  - Windows Management Instrumentation [T1047] Count-1
+  - System Services::Service Execution [T1569.002] Count-1
+  - Shared Modules [T1129] Count-8
+  - Command and Scripting Interpreter::PowerShell [T1059.001] Count-1
+  - Command and Scripting Interpreter::Unix Shell [T1059.004] Count-2
+  - Command and Scripting Interpreter::Windows Command Shell [T1059.003] Count-2
+  - Command and Scripting Interpreter::Python [T1059.006] Count-2
+
+### Persistence ###
+  num: 22
+  - Hijack Execution Flow [T1574] Count-1
+  - Create or Modify System Process::Windows Service [T1543.003] Count-9
+  - Pre-OS Boot::System Firmware [T1542.001] Count-2
+  - Boot or Logon Autostart Execution::Shortcut Modification [T1547.009] Count-1
+  - Server Software Component [T1505] Count-2
+  - Event Triggered Execution::Unix Shell Configuration Modification [T1546.004] Count-1
+  - Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013] Count-1
+  - Server Software Component::IIS Components [T1505.004] Count-2
+  - Office Application Startup::Add-ins [T1137.006] Count-3
+  - Modify Authentication Process::Network Provider DLL [T1556.008] Count-1
+  - Boot or Logon Autostart Execution::Security Support Provider [T1547.005] Count-1
+  - Boot or Logon Autostart Execution::Authentication Package [T1547.002] Count-1
+  - Modify Authentication Process::Password Filter DLL [T1556.002] Count-1
+  - Boot or Logon Initialization Scripts::RC Scripts [T1037.004] Count-1
+  - Server Software Component::Transport Agent [T1505.002] Count-1
+  - Scheduled Task/Job::Scheduled Task [T1053.005] Count-2
+  - Scheduled Task/Job::At [T1053.002] Count-1
+  - Boot or Logon Autostart Execution::Active Setup [T1547.014] Count-1
+  - Event Triggered Execution::AppInit DLLs [T1546.010] Count-2
+  - Event Triggered Execution [T1546] Count-1
+  - Boot or Logon Autostart Execution::Winlogon Helper DLL [T1547.004] Count-1
+  - Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] Count-3
+
+### Privilege Escalation ###
+  num: 1
+  - Access Token Manipulation [T1134] Count-2
+
+### Defense Evasion ###
+  num: 37
+  - Obfuscated Files or Information::Software Packing [T1027.002] Count-20
+  - Virtualization/Sandbox Evasion::System Checks [T1497.001] Count-16
+  - Impair Defenses::Indicator Blocking [T1562.006] Count-1
+  - Impair Defenses::Disable or Modify Tools [T1562.001] Count-3
+  - Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002] Count-2
+  - Virtualization/Sandbox Evasion [T1497] Count-1
+  - Debugger Evasion [T1622] Count-2
+  - Indicator Removal [T1070] Count-2
+  - Impair Defenses::Disable Windows Event Logging [T1562.002] Count-1
+  - Process Injection [T1055] Count-7
+  - Access Token Manipulation::Parent PID Spoofing [T1134.004] Count-1
+  - Indicator Removal::Clear Windows Event Logs [T1070.001] Count-1
+  - Indicator Removal::File Deletion [T1070.004] Count-1
+  - Indicator Removal::Timestomp [T1070.006] Count-1
+  - Obfuscated Files or Information [T1027] Count-44
+  - Obfuscated Files or Information::Indicator Removal from Tools [T1027.005] Count-1
+  - Deobfuscate/Decode Files or Information [T1140] Count-2
+  - Subvert Trust Controls::Mark-of-the-Web Bypass [T1553.005] Count-1
+  - Hide Artifacts::Hidden File System [T1564.005] Count-1
+  - File and Directory Permissions Modification [T1222] Count-1
+  - Hide Artifacts::Hidden Window [T1564.003] Count-1
+  - Hide Artifacts [T1564] Count-1
+  - Process Injection::Process Doppelgänging [T1055.013] Count-1
+  - Process Injection::Portable Executable Injection [T1055.002] Count-1
+  - Process Injection::Dynamic-link Library Injection [T1055.001] Count-2
+  - Process Injection::Thread Execution Hijacking [T1055.003] Count-2
+  - Process Injection::Extra Window Memory Injection [T1055.011] Count-1
+  - Process Injection::Asynchronous Procedure Call [T1055.004] Count-1
+  - Process Injection::Process Hollowing [T1055.012] Count-1
+  - Modify Registry [T1112] Count-4
+  - Impair Defenses::Safe Mode Boot [T1562.009] Count-1
+  - Subvert Trust Controls::Code Signing Policy Modification [T1553.006] Count-1
+  - Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] Count-4
+  - Reflective Code Loading [T1620] Count-1
+  - Obfuscated Files or Information::Dynamic API Resolution [T1027.007] Count-1
+  - Hijack Execution Flow [T1574] Count-1
+  - BITS Jobs [T1197] Count-1
+
+### Credential Access ###
+  num: 4
+  - Credentials from Password Stores::Windows Credential Manager [T1555.004] Count-1
+  - Credentials from Password Stores::Password Managers [T1555.005] Count-1
+  - Credentials from Password Stores [T1555] Count-48
+  - Credentials from Password Stores::Credentials from Web Browsers [T1555.003] Count-2
+
+### Discovery ###
+  num: 17
+  - File and Directory Discovery [T1083] Count-10
+  - System Information Discovery [T1082] Count-16
+  - Process Discovery [T1057] Count-9
+  - System Location Discovery::System Language Discovery [T1614.001] Count-2
+  - System Service Discovery [T1007] Count-3
+  - Application Window Discovery [T1010] Count-2
+  - System Owner/User Discovery [T1033] Count-4
+  - Account Discovery [T1087] Count-2
+  - Query Registry [T1012] Count-3
+  - Software Discovery::Security Software Discovery [T1518.001] Count-1
+  - Software Discovery [T1518] Count-1
+  - System Network Configuration Discovery::Internet Connection Discovery [T1016.001] Count-1
+  - System Network Configuration Discovery [T1016] Count-8
+  - Network Sniffing [T1040] Count-1
+  - System Location Discovery [T1614] Count-1
+  - Group Policy Discovery [T1615] Count-1
+  - Domain Trust Discovery [T1482] Count-1
+
+### Lateral Movement ###
+  num: 0
+
+### Collection ###
+  num: 7
+  - Archive Collected Data::Archive via Library [T1560.002] Count-1
+  - Clipboard Data [T1115] Count-3
+  - Video Capture [T1125] Count-1
+  - Input Capture::Keylogging [T1056.001] Count-3
+  - Data from Information Repositories [T1213] Count-2
+  - Audio Capture [T1123] Count-1
+  - Screen Capture [T1113] Count-2
+
+### Command and Control ###
+  num: 1
+  - Ingress Tool Transfer [T1105] Count-1
+
+### Exfiltration ###
+  num: 0
+
+### Impact ###
+  num: 5
+  - Endpoint Denial of Service [T1499] Count-1
+  - System Shutdown/Reboot [T1529] Count-1
+  - Data Manipulation::Transmitted Data Manipulation [T1565.002] Count-1
+  - Inhibit System Recovery [T1490] Count-1
+  - Disk Wipe::Disk Structure Wipe [T1561.002] Count-1

 ## MBC MAPPINGS ##

-### Anti-Behavioral Analysis: ###
-  num: 20
-   
-  - Emulator Detection [B0004]
-  - Virtual Machine Detection [B0009]
-  - Virtual Machine Detection::Human User Check [B0009.012]
-  - Sandbox Detection::Product Key/ID Testing [B0007.005]
-  - Debugger Detection [B0001]
-  - Debugger Detection::Software Breakpoints [B0001.025]
-  - Debugger Detection::Process Environment Block BeingDebugged [B0001.035]
-  - Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]
-  - Debugger Detection::SetHandleInformation [B0001.024]
-  - Debugger Detection::OutputDebugString [B0001.016]
-  - Debugger Detection::Memory Write Watching [B0001.010]
-  - Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033]
-  - Debugger Detection::Hardware Breakpoints [B0001.005]
-  - Debugger Detection::NtQueryInformationProcess [B0001.012]
-  - Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]
-  - Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036]
-  - Debugger Detection::Anti-debugging Instructions [B0001.034]
-  - Conditional Execution::Runs as Service [B0025.007]
-  - Debugger Detection::Process Environment Block [B0001.019]
-  - Dynamic Analysis Evasion::Delayed Execution [B0003.003]
-  
-### Anti-Static Analysis: ###
-  num: 9
-   
-  - Disassembler Evasion [B0012]
-  - Software Packing [F0001]
-  - Software Packing::Themida [F0001.011]
-  - Software Packing::VMProtect [F0001.010]
-  - Software Packing::Standard Compression [F0001.002]
-  - Software Packing::Confuser [F0001.009]
-  - Software Packing::UPX [F0001.008]
-  - Executable Code Obfuscation [B0032]
-  - Disassembler Evasion::Argument Obfuscation [B0012.001]
-  
-### Collection: ###
-  num: 4
-   
-  - Keylogging::Polling [F0002.002]
-  - Keylogging::Application Hook [F0002.001]
-  - Screen Capture::WinAPI [E1113.m01]
-  - Screen Capture [E1113]
-  
-### Command and Control: ###
-  num: 3
-   
-  - C2 Communication::Send Data [B0030.001]
-  - C2 Communication::Receive Data [B0030.002]
-  - C2 Communication::Server to Client File Transfer [B0030.003]
-  
-### Credential Access: ###
-  num: 0
-  
-### Defense Evasion: ###
-  num: 13
-   
-  - Disable or Evade Security Tools::Heavens Gate [F0004.008]
-  - Disable or Evade Security Tools::Modify Policy [F0004.005]
-  - Process Injection::Patch Process Command Line [E1055.m04]
-  - Self Deletion::COMSPEC Environment Variable [F0007.001]
-  - Obfuscated Files or Information::Encryption [E1027.m04]
-  - Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05]
-  - Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]
-  - Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007]
-  - Process Injection [E1055]
-  - Disable or Evade Security Tools::Disable Code Integrity [F0004.009]
-  - Hijack Execution Flow::Abuse Windows Function Calls [F0015.006]
-  - Process Injection::Injection via Windows Fibers [E1055.m05]
-  - Hijack Execution Flow::Import Address Table (IAT) Hooking [F0015.003]
-  
-### Discovery: ###
-  num: 6
-   
-  - Analysis Tool Discovery::Process detection [B0013.001]
-  - Application Window Discovery::Window Text [E1010.m01]
-  - Taskbar Discovery [B0043]
-  - File and Directory Discovery::Log File [E1083.m01]
-  - Code Discovery::Enumerate PE Sections [B0046.001]
-  - Code Discovery::Inspect Section Memory Permissions [B0046.002]
-  
-### Execution: ###
-  num: 1
-   
-  - Install Additional Program [B0023]
-  
-### Exfiltration: ###
-  num: 0
-  
-### Impact: ###
+### Anti-Behavioral Analysis ###
+  num: 24
+  - Emulator Detection [B0004] Count-1
+  - Virtual Machine Detection [B0009] Count-14
+  - Sandbox Detection [B0007] Count-1
+  - Virtual Machine Detection::Human User Check [B0009.012] Count-2
+  - Virtual Machine Detection::Unique Hardware/Firmware Check [B0009.023] Count-1
+  - Sandbox Detection::Product Key/ID Testing [B0007.005] Count-1
+  - Debugger Evasion [B0002] Count-2
+  - Debugger Detection [B0001] Count-3
+  - Debugger Detection::Software Breakpoints [B0001.025] Count-1
+  - Debugger Detection::Process Environment Block BeingDebugged [B0001.035] Count-1
+  - Debugger Detection::Timing/Delay Check GetTickCount [B0001.032] Count-1
+  - Debugger Detection::SetHandleInformation [B0001.024] Count-1
+  - Debugger Detection::OutputDebugString [B0001.016] Count-1
+  - Debugger Detection::Memory Write Watching [B0001.010] Count-1
+  - Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033] Count-1
+  - Debugger Detection::Hardware Breakpoints [B0001.005] Count-1
+  - Debugger Detection::NtQueryInformationProcess [B0001.012] Count-1
+  - Debugger Detection::CheckRemoteDebuggerPresent [B0001.002] Count-1
+  - Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031] Count-1
+  - Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036] Count-1
+  - Debugger Detection::Anti-debugging Instructions [B0001.034] Count-1
+  - Conditional Execution::Runs as Service [B0025.007] Count-1
+  - Debugger Detection::Process Environment Block [B0001.019] Count-1
+  - Dynamic Analysis Evasion::Delayed Execution [B0003.003] Count-1
+
+### Anti-Static Analysis ###
+  num: 10
+  - Disassembler Evasion [B0012] Count-1
+  - Software Packing [F0001] Count-14
+  - Software Packing::Themida [F0001.011] Count-1
+  - Software Packing::VMProtect [F0001.010] Count-1
+  - Software Packing::Standard Compression [F0001.002] Count-2
+  - Software Packing::Confuser [F0001.009] Count-1
+  - Software Packing::UPX [F0001.008] Count-1
+  - Executable Code Obfuscation [B0032] Count-10
+  - Executable Code Obfuscation::Argument Obfuscation [B0032.020] Count-1
+  - Executable Code Obfuscation::Stack Strings [B0032.017] Count-1
+
+### Collection ###
  num: 5
-   
-  - Modify Hardware::Mouse [B0042.002]
-  - Modify Hardware::CDROM [B0042.001]
-  - Clipboard Modification [E1510]
-  - Data Destruction::Delete Shadow Copies [E1485.m04]
-  - Remote Access::Reverse Shell [B0022.001]
-  
-### Lateral Movement: ###
-  num: 0
-  
-### Persistence: ###
-  num: 0
-  
-### Privilege Escalation: ###
+  - Input Capture [E1056] Count-1
+  - Keylogging::Polling [F0002.002] Count-1
+  - Keylogging::Application Hook [F0002.001] Count-1
+  - Screen Capture::WinAPI [E1113.m01] Count-1
+  - Screen Capture [E1113] Count-1
+
+### Command and Control ###
+  num: 3
+  - C2 Communication::Send Data [B0030.001] Count-1
+  - C2 Communication::Receive Data [B0030.002] Count-1
+  - C2 Communication::Server to Client File Transfer [B0030.003] Count-1
+
+### Credential Access ###
  num: 0

+### Defense Evasion ###
+  num: 15
+  - Disable or Evade Security Tools::Heavens Gate [F0004.008] Count-1
+  - Disable or Evade Security Tools [F0004] Count-1
+  - Disable or Evade Security Tools::Modify Policy [F0004.005] Count-2
+  - Process Injection::Patch Process Command Line [E1055.m04] Count-1
+  - Self Deletion::COMSPEC Environment Variable [F0007.001] Count-1
+  - Obfuscated Files or Information::Encryption [E1027.m04] Count-1
+  - Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05] Count-21
+  - Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02] Count-3
+  - Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007] Count-1
+  - Process Injection [E1055] Count-4
+  - Disable or Evade Security Tools::Disable Code Integrity [F0004.009] Count-1
+  - Process Injection::Injection via Windows Fibers [E1055.m05] Count-1
+  - Hijack Execution Flow::Abuse Windows Function Calls [F0015.006] Count-1
+  - Hijack Execution Flow::Import Address Table Hooking [F0015.003] Count-1
+  - Obfuscated Files or Information [E1027] Count-1
+
+### Discovery ###
+  num: 8
+  - Analysis Tool Discovery::Process detection [B0013.001] Count-1
+  - System Information Discovery [E1082] Count-5
+  - File and Directory Discovery [E1083] Count-7
+  - Application Window Discovery [E1010] Count-1
+  - Taskbar Discovery [B0043] Count-1
+  - File and Directory Discovery::Log File [E1083.m01] Count-2
+  - Code Discovery::Enumerate PE Sections [B0046.001] Count-1
+  - Code Discovery::Inspect Section Memory Permissions [B0046.002] Count-1
+
+### Execution ###
+  num: 2
+  - Command and Scripting Interpreter [E1059] Count-2
+  - Install Additional Program [B0023] Count-2
+
+### Exfiltration ###
+  num: 0
+
+### Impact ###
+  num: 6
+  - Modify Hardware::Mouse [B0042.002] Count-1
+  - Modify Hardware::CDROM [B0042.001] Count-1
+  - Clipboard Modification [E1510] Count-1
+  - Remote Access::Reverse Shell [B0022.001] Count-2
+  - Data Destruction::Delete Shadow Copies [E1485.m04] Count-1
+  - Disk Wipe [F0014] Count-1
+
+### Lateral Movement ###
+  num: 0
+
+### Persistence ###
+  num: 2
+  - Hijack Execution Flow [F0015] Count-1
+  - Registry Run Keys / Startup Folder [F0012] Count-1
+
+### Privilege Escalation ###
+  num: 0

 ## MBC MICRO-BEHAVIOR MAPPINGS ##

-### Communication: ###
-  num: 34
-   
-  - DNS Communication::Resolve [C0011.001]
-  - HTTP Communication::Read Header [C0002.014]
-  - HTTP Communication::WinHTTP [C0002.008]
-  - HTTP Communication::IWebBrowser [C0002.010]
-  - HTTP Communication::Set Header [C0002.013]
-  - HTTP Communication::Start Server [C0002.018]
-  - HTTP Communication::Receive Request [C0002.015]
-  - HTTP Communication::Send Response [C0002.016]
-  - HTTP Communication::Get Response [C0002.017]
-  - HTTP Communication::Send Request [C0002.003]
-  - HTTP Communication::Download URL [C0002.006]
-  - HTTP Communication::Create Request [C0002.012]
-  - HTTP Communication::Send Data [C0002.005]
-  - HTTP Communication::Open URL [C0002.004]
-  - HTTP Communication::Connect to Server [C0002.009]
-  - HTTP Communication::Extract Body [C0002.011]
-  - Socket Communication::Start TCP Server [C0001.005]
-  - Socket Communication::TCP Client [C0001.008]
-  - Interprocess Communication::Create Pipe [C0003.001]
-  - Interprocess Communication::Write Pipe [C0003.004]
-  - Interprocess Communication::Connect Pipe [C0003.002]
-  - Interprocess Communication::Read Pipe [C0003.003]
-  - FTP Communication::Send File [C0004.001]
-  - DNS Communication::Server Connect [C0011.002]
-  - Socket Communication::Get Socket Status [C0001.012]
-  - Socket Communication::Set Socket Config [C0001.001]
-  - Socket Communication::Initialize Winsock Library [C0001.009]
-  - Socket Communication::Connect Socket [C0001.004]
-  - Socket Communication::Create TCP Socket [C0001.011]
-  - Socket Communication::Send TCP Data [C0001.014]
-  - Socket Communication::Create UDP Socket [C0001.010]
-  - Socket Communication::Send Data [C0001.007]
-  - Socket Communication::Receive Data [C0001.006]
-  - ICMP Communication::Echo Request [C0014.002]
+### Communication ###
+  num: 38
+  - Interprocess Communication [C0003] Count-2
+  - HTTP Communication::Read Header [C0002.014] Count-2
+  - HTTP Communication::WinHTTP [C0002.008] Count-1
+  - HTTP Communication::IWebBrowser [C0002.010] Count-2
+  - HTTP Communication [C0002] Count-2
+  - HTTP Communication::Set Header [C0002.013] Count-1
+  - HTTP Communication::Start Server [C0002.018] Count-1
+  - HTTP Communication::Receive Request [C0002.015] Count-1
+  - HTTP Communication::Send Response [C0002.016] Count-1
+  - HTTP Communication::Get Response [C0002.017] Count-5
+  - HTTP Communication::Send Request [C0002.003] Count-1
+  - HTTP Communication::Download URL [C0002.006] Count-1
+  - HTTP Communication::Create Request [C0002.012] Count-2
+  - HTTP Communication::Send Data [C0002.005] Count-1
+  - HTTP Communication::Open URL [C0002.004] Count-1
+  - HTTP Communication::Connect to Server [C0002.009] Count-1
+  - HTTP Communication::Extract Body [C0002.011] Count-1
+  - Socket Communication::Start TCP Server [C0001.005] Count-1
+  - Socket Communication::TCP Client [C0001.008] Count-1
+  - Interprocess Communication::Create Pipe [C0003.001] Count-2
+  - Interprocess Communication::Write Pipe [C0003.004] Count-1
+  - Interprocess Communication::Connect Pipe [C0003.002] Count-1
+  - Interprocess Communication::Read Pipe [C0003.003] Count-1
+  - FTP Communication::Send File [C0004.001] Count-1
+  - FTP Communication::WinINet [C0004.002] Count-1
+  - DNS Communication::Server Connect [C0011.002] Count-1
+  - DNS Communication::Resolve [C0011.001] Count-1
+  - Socket Communication::Get Socket Status [C0001.012] Count-1
+  - Socket Communication::Create Socket [C0001.003] Count-2
+  - Socket Communication::Set Socket Config [C0001.001] Count-1
+  - Socket Communication::Initialize Winsock Library [C0001.009] Count-1
+  - Socket Communication::Connect Socket [C0001.004] Count-1
+  - Socket Communication::Create TCP Socket [C0001.011] Count-2
+  - Socket Communication::Send TCP Data [C0001.014] Count-2
+  - Socket Communication::Create UDP Socket [C0001.010] Count-1
+  - Socket Communication::Send Data [C0001.007] Count-1
+  - Socket Communication::Receive Data [C0001.006] Count-1
+  - ICMP Communication::Echo Request [C0014.002] Count-1

-### Cryptography: ###
+### Cryptography ###
+  num: 27
+  - Encryption Key::Import Public Key [C0028.001] Count-1
+  - Decrypt Data [C0031] Count-1
+  - Encrypt Data [C0027] Count-4
+  - Encryption Key [C0028] Count-2
+  - Encrypt Data::HC-128 [C0027.006] Count-2
+  - Encrypt Data::RC6 [C0027.010] Count-1
+  - Encrypt Data::Twofish [C0027.005] Count-1
+  - Encrypt Data::AES [C0027.001] Count-4
+  - Decrypt Data::AES [C0031.001] Count-1
+  - Encrypt Data::Sosemanuk [C0027.008] Count-1
+  - Encrypt Data::Camellia [C0027.003] Count-1
+  - Encrypt Data::3DES [C0027.004] Count-2
+  - Encrypt Data::RC4 [C0027.009] Count-4
+  - Generate Pseudo-random Sequence::RC4 PRGA [C0021.004] Count-1
+  - Encryption Key::RC4 KSA [C0028.002] Count-1
+  - Encrypt Data::Skipjack [C0027.013] Count-1
+  - Encrypt Data::Blowfish [C0027.002] Count-1
+  - Cryptographic Hash [C0029] Count-2
+  - Cryptographic Hash::Tiger [C0029.005] Count-1
+  - Cryptographic Hash::SHA1 [C0029.002] Count-1
+  - Cryptographic Hash::SHA256 [C0029.003] Count-1
+  - Cryptographic Hash::MD5 [C0029.001] Count-1
+  - Cryptographic Hash::SHA224 [C0029.004] Count-1
+  - Hashed Message Authentication Code [C0061] Count-1
+  - Generate Pseudo-random Sequence::Use API [C0021.003] Count-2
+  - Generate Pseudo-random Sequence [C0021] Count-1
+  - Crypto Library [C0059] Count-5
+
+### Data ###
  num: 16
-   
-  - Encryption Key::Import Public Key [C0028.001]
-  - Decrypt Data [C0031]
-  - Encryption Key [C0028]
-  - Decrypt Data::AES [C0031.001]
-  - Encrypt Data [C0027]
-  - Encrypt Data::RC4 [C0027.009]
-  - Cryptographic Hash [C0029]
-  - Cryptographic Hash::Tiger [C0029.005]
-  - Cryptographic Hash::SHA1 [C0029.002]
-  - Cryptographic Hash::SHA256 [C0029.003]
-  - Cryptographic Hash::MD5 [C0029.001]
-  - Cryptographic Hash::SHA224 [C0029.004]
-  - Hashed Message Authentication Code [C0061]
-  - Generate Pseudo-random Sequence::Use API [C0021.003]
-  - Generate Pseudo-random Sequence::Mersenne Twister [C0021.005]
-  - Crypto Library [C0059]
+  - Checksum::Luhn [C0032.002] Count-3
+  - Checksum::Adler [C0032.005] Count-1
+  - Checksum::CRC32 [C0032.001] Count-1
+  - Non-Cryptographic Hash::MurmurHash [C0030.001] Count-1
+  - Non-Cryptographic Hash::FNV [C0030.005] Count-1
+  - Non-Cryptographic Hash::djb2 [C0030.006] Count-1
+  - Encode Data::XOR [C0026.002] Count-1
+  - Encode Data::Base64 [C0026.001] Count-3
+  - Check String [C0019] Count-2
+  - Decompress Data::aPLib [C0025.003] Count-1
+  - Decompress Data::IEncodingFilterFactory [C0025.002] Count-1
+  - Compress Data [C0024] Count-3
+  - Decompress Data [C0025] Count-2
+  - Decompress Data::QuickLZ [C0025.001] Count-1
+  - Modulo [C0058] Count-1
+  - Compression Library [C0060] Count-2

-### Data: ###
-  num: 15
-   
-  - Checksum::CRC32 [C0032.001]
-  - Checksum::Luhn [C0032.002]
-  - Checksum::Adler [C0032.005]
-  - Non-Cryptographic Hash::MurmurHash [C0030.001]
-  - Non-Cryptographic Hash::FNV [C0030.005]
-  - Non-Cryptographic Hash [C0030]
-  - Encode Data::Base64 [C0026.001]
-  - Decompress Data::aPLib [C0025.003]
-  - Decompress Data::IEncodingFilterFactory [C0025.002]
-  - Compress Data [C0024]
-  - Decompress Data::QuickLZ [C0025.001]
-  - Decompress Data [C0025]
-  - Check String [C0019]
-  - Modulo [C0058]
-  - Compression Library [C0060]
-  
-### File System: ###
+### File System ###
  num: 11
-   
-  - Set File Attributes [C0050]
-  - Create Directory [C0046]
-  - Delete File [C0047]
-  - Delete Directory [C0048]
-  - Get File Attributes [C0049]
-  - Move File [C0063]
-  - Writes File [C0052]
-  - Copy File [C0045]
-  - Read File [C0051]
-  - Read Virtual Disk [C0056]
-  - Create File [C0016]
+  - Set File Attributes [C0050] Count-2
+  - Create Directory [C0046] Count-1
+  - Delete File [C0047] Count-1
+  - Delete Directory [C0048] Count-1
+  - Get File Attributes [C0049] Count-1
+  - Move File [C0063] Count-1
+  - Writes File [C0052] Count-3
+  - Copy File [C0045] Count-1
+  - Read File [C0051] Count-4
+  - Read Virtual Disk [C0056] Count-1
+  - Create File [C0016] Count-1

-### Hardware: ###
+### Hardware ###
  num: 4
-   
-  - Simulate Hardware::Ctrl-Alt-Del [C0057.001]
-  - Install Driver [C0037]
-  - Install Driver::Minifilter [C0037.001]
-  - Load Driver::Minifilter [C0023.001]
+  - Simulate Hardware::Ctrl-Alt-Del [C0057.001] Count-1
+  - Install Driver [C0037] Count-1
+  - Install Driver::Minifilter [C0037.001] Count-1
+  - Load Driver::Minifilter [C0023.001] Count-1

-### Memory: ###
+### Memory ###
  num: 2
-   
-  - Free Memory [C0044]
-  - Allocate Memory [C0007]
+  - Free Memory [C0044] Count-1
+  - Allocate Memory [C0007] Count-4

-### Operating System: ###
+### Operating System ###
  num: 11
-   
-  - Environment Variable::Set Variable [C0034.001]
-  - Environment Variable::Get Variable [C0034.002]
-  - Wallpaper [C0035]
-  - Console [C0033]
-  - Registry::Set Registry Key [C0036.001]
-  - Registry::Create Registry Key [C0036.004]
-  - Registry::Open Registry Key [C0036.003]
-  - Registry::Query Registry Key [C0036.005]
-  - Registry::Query Registry Value [C0036.006]
-  - Registry::Delete Registry Key [C0036.002]
-  - Registry::Delete Registry Value [C0036.007]
-  
-### Process: ###
+  - Environment Variable::Set Variable [C0034.001] Count-1
+  - Environment Variable [C0034] Count-1
+  - Wallpaper [C0035] Count-1
+  - Console [C0033] Count-2
+  - Registry::Set Registry Key [C0036.001] Count-2
+  - Registry::Open Registry Key [C0036.003] Count-2
+  - Registry::Query Registry Key [C0036.005] Count-1
+  - Registry::Query Registry Value [C0036.006] Count-2
+  - Registry::Create Registry Key [C0036.004] Count-2
+  - Registry::Delete Registry Key [C0036.002] Count-1
+  - Registry::Delete Registry Value [C0036.007] Count-1
+
+### Process ###
  num: 14
-   
-  - Create Thread [C0038]
-  - Suspend Thread [C0055]
-  - Terminate Thread [C0039]
-  - Resume Thread [C0054]
-  - Enumerate Threads [C0064]
-  - Create Mutex [C0042]
-  - Check Mutex [C0043]
-  - Allocate Thread Local Storage [C0040]
-  - Set Thread Local Storage Value [C0041]
-  - Create Process [C0017]
-  - Create Process::Create Suspended Process [C0017.003]
-  - Terminate Process [C0018]
-  - Open Process [C0065]
-  - Open Thread [C0066]
-  
+  - Create Thread [C0038] Count-2
+  - Suspend Thread [C0055] Count-1
+  - Terminate Thread [C0039] Count-1
+  - Resume Thread [C0054] Count-1
+  - Enumerate Threads [C0064] Count-1
+  - Create Mutex [C0042] Count-2
+  - Check Mutex [C0043] Count-2
+  - Terminate Process [C0018] Count-3
+  - Allocate Thread Local Storage [C0040] Count-1
+  - Set Thread Local Storage Value [C0041] Count-1
+  - Create Process [C0017] Count-4
+  - Create Process::Create Suspended Process [C0017.003] Count-1
+  - Open Process [C0065] Count-1
+  - Open Thread [C0066] Count-1
@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>29 November 2022</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>3 June 2023</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -48,6 +48,11 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),
 |[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[5]](#5)|
 |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[6]](#6)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[use .NET library SharpClipboard](https://github.com/mandiant/capa-rules/blob/master/collection/use-dotnet-library-sharpclipboard.yml)|Input Capture (E1056)| |

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -58,6 +58,12 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[log keystrokes via polling](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-polling.yml)|Keylogging::Polling (F0002.002)|user32.GetAsyncKeyState, user32.GetKeyState, user32.GetKeyboardState, user32.VkKeyScan, user32.VkKeyScanEx, user32.GetKeyNameText|
+|[log keystrokes via application hook](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-application-hook.yml)|Keylogging::Application Hook (F0002.001)| |

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -51,6 +51,12 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/
 |[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[capture screenshot](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot.yml)|Screen Capture::WinAPI (E1113.m01)|user32.GetWindowDC, user32.GetDC, gdi32.CreateDC, gdi32.BitBlt, gdi32.GetDIBits, gdi32.CreateCompatibleDC, gdi32.CreateCompatibleBitmap, user32.GetSystemMetrics = fetch screen dimensions, user32.GetDesktopWindow = get entire desktop, BitBlt, System.Drawing.Graphics::CopyFromScreen|
+|[capture screenshot via keybd event](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot-via-keybd-event.yml)|Screen Capture (E1113)| |

 ## References

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>29 November 2022</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -92,6 +92,13 @@ As "server" and "client" are confusing terminology, we use the terms "controller
 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002|The malware receives data from the C2 server. [[18]](#18)|
 |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat communicates to a Pastebin site via HTTP. [[20]](#20)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[send data](https://github.com/mandiant/capa-rules/blob/master/communication/send-data.yml)|C2 Communication::Send Data (B0030.001)| |
+|[receive data](https://github.com/mandiant/capa-rules/blob/master/communication/receive-data.yml)|C2 Communication::Receive Data (B0030.002)| |
+|[download and write a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/download-and-write-a-file.yml)|C2 Communication::Server to Client File Transfer (B0030.003)| |

 ## Code Snippets

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>15 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>29 November 2022</b></td>
 </tr>
 </table>

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>01 May 2023</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>10 November 2022</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -57,6 +57,16 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta
 |[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger prevents the infected system from installing anti-virus software updates. [[2]](#2)|
 |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of Avast Antivirus. [[5]](#5)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[64-bit execution via heavens gate](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml)|Disable or Evade Security Tools::Heavens Gate (F0004.008)| |
+|[patch Event Tracing for Windows function](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml)|Disable or Evade Security Tools (F0004)|kernel32.VirtualProtect, ntdll.NtProtectVirtualMemory, ZwProtectVirtualMemory|
+|[block operations on executable memory pages using Arbitrary Code Guard](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|SetProcessMitigationPolicy|
+|[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute|
+|[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)| |
+|[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)| |

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2023</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>4 March 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -66,6 +66,13 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.003|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[11]](#11)|
 |[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.007|WTR4141.tmp hooks APIs from kernel32.dll and ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[11]](#11)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)| |
+|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
+|[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress|

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>4 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>19 September 2023</b></td>
 </tr>
 </table>

@@ -56,7 +56,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112

 <a name="4">[4]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/

-<a name="5">[5]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
+<a name="5">[5]</a> https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem.

 <a name="6">[6]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -87,6 +87,37 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[**UP007**](../xample-malware/up007.md)|2016|E1027.m02|The malware encodes data using XOR. [[9]](#9)|


+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Obfuscated Files or Information::Encryption (E1027.m04)|memfrob|
+|[encrypt data using XXTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
+|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using XTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
+|[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt|
+|[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
+|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[decrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/decrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/encrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| |
+|[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars|
+|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| |
+|[resolve function by Brute Ratel Badger hash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml)|Obfuscated Files or Information (E1027)| |
+
 ## References

 <a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>19 May 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -68,7 +68,18 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
 |[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory. [[10]](#10)|
 |[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|The malware can attach user process memory. [[13]](#13)|
 |[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)|
+|[**Conti**](../xample-malware/conti.md)|2019|E1055.012|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space.|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[patch process command line](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/patch-process-command-line.yml)|Process Injection::Patch Process Command Line (E1055.m04)|VirtualProtect, GetProcAddress, ReadProcessMemory|
+|[attach user process memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/attach-user-process-memory.yml)|Process Injection (E1055)|ntoskrnl.KeStackAttachProcess, ntoskrnl.KeUnstackDetachProcess|
+|[inject shellcode using extra window memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-extra-window-memory.yml)|Process Injection (E1055)|SetWindowLong, SetWindowLongPtr, PostMessage, SendNotifyMessage|
+|[inject shellcode using a file mapping object](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml)|Process Injection (E1055)|CreateFileMapping, MapViewOfFile, MapViewOfFileNuma2|
+|[inject shellcode using window subclass procedure](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml)|Process Injection (E1055)|user32.SetProp, PostMessage, SendNotifyMessage|
+|[execute shellcode via Windows fibers](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-fibers.yml)|Process Injection::Injection via Windows Fibers (E1055.m05)|ConvertThreadToFiber, CreateFiber, SwitchToFiber|

 ## References
 <a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -20,7 +20,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -50,6 +50,12 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630
 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)|
 |[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)| |
+

 ## References

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>4 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -53,11 +53,16 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If Emotet receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits. [[1]](#1)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If Emotet receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it receives an "upgrade" command which calls the ShellExecuteW function and exits. [[1]](#1)|
 |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one of the analysis tools is running. [[2]](#2) [[3]](#3)|
 |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0013.010|Poison Ivy goes through all the running program windows to check if any Windows class name contains a special string to determine if an analysis tool is running. [[2]](#2) [[3]](#3)|
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|B0013.004|When infecting a x64 architecture system, the malware terminates if Wireshark is running on the system. [[4]](#4)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[reference analysis tools strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/reference-analysis-tools-strings.yml)|Analysis Tool Discovery::Process detection (B0013.001)| |

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>19 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -47,6 +47,12 @@ Malware may attempt to get a listing of open application windows.
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|E1010.m01|Rombertik gets graphical window texts. [[1]](#1)|
 |[**UP007**](../xample-malware/up007.md)|2016|E1010.m01|UP007 gets graphical window text. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[get graphical window text](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/window/get-text/get-graphical-window-text.yml)|Application Window Discovery (E1010)|user32.IsWindowVisible, user32.SendMessage, user32.GetForegroundWindow, user32.GetWindowText|
+
 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>19 May 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -54,6 +54,13 @@ Malware may inspect code or enumerate aspects.
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|TrickBot inspects section memory permissions. [[1]](#1)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Ursnif enumerates PE sections. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[enumerate PE sections](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/enumerate-pe-sections.yml)|Code Discovery::Enumerate PE Sections (B0046.001)| |
+|[inspect section memory permissions](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/inspect-section-memory-permissions.yml)|Code Discovery::Inspect Section Memory Permissions (B0046.002)| |
+
 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -63,6 +63,19 @@ Malware may enumerate files and directories or may search for specific files or
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)|
 |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[7]](#7)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[get common file path](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/get-common-file-path.yml)|File and Directory Discovery (E1083)|kernel32.GetTempPath, kernel32.GetTempFileName, kernel32.GetSystemDirectory, kernel32.GetWindowsDirectory, kernel32.GetSystemWow64Directory, GetAllUsersProfileDirectory, GetAppContainerFolderPath, GetCurrentDirectory, GetDefaultUserProfileDirectory, GetProfilesDirectory, GetUserProfileDirectory, SHGetFolderPathAndSubDir, shell32.SHGetFolderPath, shell32.SHGetFolderLocation, shell32.SHGetKnownFolderPath, shell32.SHGetSpecialFolderPath, shell32.SHGetSpecialFolderLocation, System.IO.Directory::GetCurrentDirectory, System.Environment::GetFolderPath|
+|[get file version info](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-version-info.yml)|File and Directory Discovery (E1083)|version.GetFileVersionInfo, version.GetFileVersionInfoEx, System.Diagnostics.FileVersionInfo::GetVersionInfo, version.VerQueryValue, version.GetFileVersionInfoSize, version.GetFileVersionInfoSizeEx|
+|[get file size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-size.yml)|File and Directory Discovery (E1083)|kernel32.GetFileSize, kernel32.GetFileSizeEx|
+|[check if file exists](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/exists/check-if-file-exists.yml)|File and Directory Discovery (E1083)|kernel32.GetFileAttributes, kernel32.GetLastError, shlwapi.PathFileExists, System.IO.File::Exists|
+|[enumerate files on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-linux.yml)|File and Directory Discovery (E1083)|getdents, getdents64, opendir, readdir|
+|[enumerate files on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-windows.yml)|File and Directory Discovery (E1083)|kernel32.FindFirstFile, kernel32.FindFirstFileEx, kernel32.FindFirstFileTransacted, kernel32.FindFirstFileName, kernel32.FindFirstFileNameTransacted, kernel32.FindNextFile, kernel32.FindNextFileName, kernel32.FindClose, ntdll.NtOpenDirectoryObject, ntdll.NtQueryDirectoryObject, RtlAllocateHeap, System.IO.DirectoryInfo::GetFiles, System.IO.DirectoryInfo::EnumerateFiles, System.IO.Directory::GetFiles, System.IO.Directory::EnumerateFiles, System.IO.Directory::EnumerateFileSystemEntries, System.IO.DirectoryInfo::GetDirectories, System.IO.DirectoryInfo::EnumerateDirectories, System.IO.Directory::GetDirectories, System.IO.Directory::EnumerateDirectories|
+|[enumerate files recursively](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-recursively.yml)|File and Directory Discovery (E1083)| |
+|[read data from CLFS log container](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/clfs/read-data-from-clfs-log-container.yml)|File and Directory Discovery::Log File (E1083.m01)|clfsw32.CreateLogFile, clfsw32.CreateLogMarshallingArea, clfsw32.ReadLogRecord, clfsw32.ReadNextLogRecord|
+|[access the Windows event log](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/winevt/access/access-the-windows-event-log.yml)|File and Directory Discovery::Log File (E1083.m01)|OpenEventLog, ClearEventLog, OpenBackupEventLog, ReportEvent|

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>3 June 2023</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>3 June 2023</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -62,6 +62,15 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
 |[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables|
+|[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice|
+|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl|
+|[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)| |
+|[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname|

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -35,6 +35,12 @@
 |---|---|---|---|
 |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[find taskbar](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/taskbar/find/find-taskbar.yml)|Taskbar Discovery (B0043)| |
+
 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>29 November 2022</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -56,6 +56,12 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot accepts command line arguments. [[9]](#9)|
 |[**UP007**](../xample-malware/up007.md)|2016|--|The malware accepts command line arguments. [[9]](#9)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[accept command line arguments](https://github.com/mandiant/capa-rules/blob/master/host-interaction/cli/accept-command-line-arguments.yml)|Command and Scripting Interpreter (E1059)|GetCommandLine, CommandLineToArgv, System.Environment::GetCommandLineArgs|
+|[run PowerShell expression](https://github.com/mandiant/capa-rules/blob/master/load-code/powershell/run-powershell-expression.yml)|Command and Scripting Interpreter (E1059)|System.Management.Automation.PowerShell::Create, System.Management.Automation.PowerShell::AddScript, System.Management.Automation.PowerShell::Invoke|

 ## References

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b> 4 May 2023</b></td>
+<td><b>19 September 2023</b></td>
 </tr>
 </table>

@@ -64,6 +64,11 @@ Some aspects of this Conditional Execution behavior are related to the [Executio
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|B0025.007|Hupigon can run as a service. [[7]](#7)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|B0025.007|Shamoon can run as a service. [[7]](#7)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[run as service](https://github.com/mandiant/capa-rules/blob/master/host-interaction/service/run-as-service.yml)|Conditional Execution::Runs as Service (B0025.007)|RegisterServiceCtrlHandler, RegisterServiceCtrlHandlerEx, StartServiceCtrlDispatcher, System.ServiceProcess.ServiceBase::Run|

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>3 June 2023</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -62,6 +62,12 @@ Droppers may be described as “single stage” or “two stage.” While the fo
 |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)|
 |[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[20]](#20)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[contain an embedded PE file](https://github.com/mandiant/capa-rules/blob/master/executable/subfile/pe/contain-an-embedded-pe-file.yml)|Install Additional Program (B0023)| |
+|[write and execute a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/write-and-execute-a-file.yml)|Install Additional Program (B0023)| |

 ## References
 <a name="1">"Cyclops Blink: Malware Analysis Report, Version 1.0," National Cyber Security Centre/GCHQ, 23 Feb. 2022. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf.
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>01 May 2023</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 February 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>29 November 2022</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>4 June 2023</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -44,6 +44,11 @@ ATT&CK defines Clipboard Modification as a Mobile technique (Android platform).
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon replaces clipboard data. [[2]](#2)|
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware replaces clipboard data. [[2]](#2)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[write clipboard data](https://github.com/mandiant/capa-rules/blob/master/host-interaction/clipboard/write-clipboard-data.yml)|Clipboard Modification (E1510)|user32.EmptyClipboard, System.Windows.Forms.Clipboard::Clear, user32.SetClipboardData, System.Windows.Forms.Clipboard::SetAudio, System.Windows.Forms.Clipboard::SetData, System.Windows.Forms.Clipboard::SetDataObject, System.Windows.Forms.Clipboard::SetFileDropList, System.Windows.Forms.Clipboard::SetImage, System.Windows.Forms.Clipboard::SetText|

 ## References

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>3 June 2023</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -54,6 +54,11 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148
 |[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker resets system restore points and deletes backup files. [[4]](#4)|
 |[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot can erase phone data. [[5]](#5)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[delete volume shadow copies](https://github.com/mandiant/capa-rules/blob/master/impact/inhibit-system-recovery/delete-volume-shadow-copies.yml)|Data Destruction::Delete Shadow Copies (E1485.m04)| |

 ## References

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2023</b></td>
+<td><b>31 August 2023</b></td>
 </tr>
 </table>

@@ -51,7 +51,7 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni
 |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart encrypts files for ransom without any connection to the Internet. [[3]](#3)|
 |[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam encrypts data to hold for ransom. [[4]](#4)|
 |[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom. [[5]](#5)|
-|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0025|WannaCry encrypts files for ransom. [[6]](#6)|
+|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry encrypts files for ransom. [[6]](#6)|


 ## References
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>01 May 2023</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -41,6 +41,12 @@ This description refines the ATT&CK **Disk Wipe: Disk Content Wipe ([T1561.001](
 |---|---|---|---|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|An overwrite component will overwrite the MBR so that the compromised computer can no longer start. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[overwrite Master Boot Record (MBR)](https://github.com/mandiant/capa-rules/blob/master/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml)|Disk Wipe (F0014)|kernel32.WriteFile|
+
 ## References

 <a name="1">[1]</a> https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=281521ea-2d18-4bf9-9e88-8b1dc41cfdb6&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>12 June 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>01 May 2023</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>6 June 2023</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -48,6 +48,13 @@ Name|Date|Method|Description|
 |---|---|---|---|
 |[**BadUSB**](../xample-malware/badusb.md)|2014|--| BadUSB can modify USB drives. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[swap mouse buttons](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/mouse/swap-mouse-buttons.yml)|Modify Hardware::Mouse (B0042.002)|user32.SwapMouseButton|
+|[manipulate CD-ROM drive](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml)|Modify Hardware::CDROM (B0042.001)|winmm.mciSendString|
+
 ## References

 <a name="1">[1]</a> https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -52,6 +52,12 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu
 |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet allows an attacker to control the system via a GUI. [[3]](#3)|
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware acts as a backdoor. [[4]](#4)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[create reverse shell on Linux](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell-on-linux.yml)|Remote Access::Reverse Shell (B0022.001)| |
+|[create reverse shell](https://github.com/mandiant/capa-rules/blob/master/communication/c2/shell/create-reverse-shell.yml)|Remote Access::Reverse Shell (B0022.001)|kernel32.PeekNamedPipe, kernel32.CreateProcess, kernel32.ReadFile, kernel32.WriteFile|

 ## References

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>01 May 2023</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -25,7 +25,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>29 November 2022</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>17 August 2023</b></td>
 </tr>
 </table>

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -47,6 +47,13 @@ The DNS Communication micro-behavior focuses on DNS communication.
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|C0011.001|Hupigon resolves DNS. [[1]](#1)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|C0011.001|Shamoon resolves DNS. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[reference DNS over HTTPS endpoints](https://github.com/mandiant/capa-rules/blob/master/communication/dns/reference-dns-over-https-endpoints.yml)|DNS Communication::Server Connect (C0011.002)| |
+|[resolve DNS](https://github.com/mandiant/capa-rules/blob/master/communication/dns/resolve-dns.yml)|DNS Communication::Resolve (C0011.001)|ws2_32.gethostbyname, DnsQuery_A, DnsQuery_W, DnsQuery_UTF8, DnsQueryEx, getaddrinfo, GetAddrInfo, GetAddrInfoEx, gethostbyname, getaddrinfo, getnameinfo, gethostent, System.Net.Dns::GetHostAddresses|
+
 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -36,3 +36,10 @@ The FTP Communication micro-behavior focuses on FTP communication.
 |---|---|---|
 |**Send File**|C0004.001|Send FTP file.|
 |**WinINet**|C0004.002|Send FTP command via WinINet.|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[send file using FTP](https://github.com/mandiant/capa-rules/blob/master/communication/ftp/send/send-file-using-ftp.yml)|FTP Communication::Send File (C0004.001)|wininet.FtpPutFile, wininet.FtpSetCurrentDirectory, wininet.InternetConnect, System.Net.WebRequest::Create|
+|[send file using FTP](https://github.com/mandiant/capa-rules/blob/master/communication/ftp/send/send-file-using-ftp.yml)|FTP Communication::WinINet (C0004.002)|wininet.FtpPutFile, wininet.FtpSetCurrentDirectory, wininet.InternetConnect, System.Net.WebRequest::Create|
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -66,6 +66,34 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[**Kovter**](../xample-malware/kovter.md)|2016|C0002.009|Kovter connects to a HTTP server. [[1]](#1)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|C0002.012|Kovter creates a HTTP request. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[read HTTP header](https://github.com/mandiant/capa-rules/blob/master/communication/http/read-http-header.yml)|HTTP Communication::Read Header (C0002.014)|winhttp.WinHttpQueryHeaders|
+|[initialize WinHTTP library](https://github.com/mandiant/capa-rules/blob/master/communication/http/initialize-winhttp-library.yml)|HTTP Communication::WinHTTP (C0002.008)|winhttp.WinHttpOpen|
+|[initialize IWebBrowser2](https://github.com/mandiant/capa-rules/blob/master/communication/http/initialize-iwebbrowser2.yml)|HTTP Communication::IWebBrowser (C0002.010)|ole32.CoCreateInstance|
+|[get HTTP content length](https://github.com/mandiant/capa-rules/blob/master/communication/http/get-http-content-length.yml)|HTTP Communication (C0002)|wininet.HttpQueryInfo|
+|[set HTTP header](https://github.com/mandiant/capa-rules/blob/master/communication/http/set-http-header.yml)|HTTP Communication::Set Header (C0002.013)|winhttp.WinHttpAddRequestHeaders, System.Net.WebHeaderCollection::Add|
+|[reference HTTP User-Agent string](https://github.com/mandiant/capa-rules/blob/master/communication/http/reference-http-user-agent-string.yml)|HTTP Communication (C0002)|urlmon.ObtainUserAgentString|
+|[start HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/server/start-http-server.yml)|HTTP Communication::Start Server (C0002.018)|httpapi.HttpInitialize, httpapi.HttpTerminate, System.Net.HttpListener::Start|
+|[receive HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/server/receive-http-request.yml)|HTTP Communication::Receive Request (C0002.015)|httpapi.HttpReceiveHttpRequest, httpapi.HttpReceiveRequestEntityBody|
+|[send HTTP response](https://github.com/mandiant/capa-rules/blob/master/communication/http/server/send-http-response.yml)|HTTP Communication::Send Response (C0002.016)|httpapi.HttpSendHttpResponse, httpapi.HttpSendResponseEntityBody|
+|[receive HTTP response](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/receive-http-response.yml)|HTTP Communication::Get Response (C0002.017)|System.Net.WebRequest::GetResponse, winhttp.WinHttpReceiveResponse, winhttp.WinHttpReadData, winhttp.WinHttpQueryDataAvailable|
+|[send HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/send-http-request.yml)|HTTP Communication::Send Request (C0002.003)|System.Net.WebRequest::GetResponse, System.Net.WebRequest::GetResponseAsync, wininet.HttpOpenRequest, wininet.InternetConnect, wininet.HttpSendRequest, wininet.HttpSendRequestEx, winhttp.WinHttpSendRequest, winhttp.WinHttpWriteData, winhttp.WinHttpOpenRequest, winhttp.WinHttpConnect|
+|[read data from Internet](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/read-data-from-internet.yml)|HTTP Communication::Get Response (C0002.017)|wininet.InternetReadFile, wininet.InternetReadFileEx, System.Net.WebClient::DownloadString, System.Net.WebClient::DownloadStringAsync, System.Net.WebClient::DownloadStringTaskAsync, System.Net.WebClient::DownloadData, System.Net.WebClient::DownloadDataAsync, System.Net.WebClient::DownloadDataTaskAsync|
+|[get HTTP document via IWebBrowser2](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-document-via-iwebbrowser2.yml)|HTTP Communication::Get Response (C0002.017)|oleaut32.SysAllocString, oleaut32.VariantInit|
+|[get HTTP document via IWebBrowser2](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-document-via-iwebbrowser2.yml)|HTTP Communication::IWebBrowser (C0002.010)|oleaut32.SysAllocString, oleaut32.VariantInit|
+|[download URL](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/download-url.yml)|HTTP Communication::Download URL (C0002.006)|urlmon.URLDownloadToFile, urlmon.URLDownloadToCacheFile, urlmon.URLOpenBlockingStream, urlmon.URLOpenPullStream, urlmon.URLOpenStream, System.Net.WebClient::DownloadFile, System.Net.WebClient::DownloadFileAsync, System.Net.WebClient::DownloadFileTaskAsync, Microsoft.VisualBasic.Devices.Network::DownloadFile|
+|[prepare HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/prepare-http-request.yml)|HTTP Communication::Create Request (C0002.012)|winhttp.WinHttpOpenRequest|
+|[create HTTP request](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/create-http-request.yml)|HTTP Communication::Create Request (C0002.012)|wininet.InternetOpen, System.Net.WebRequest::Create, System.Net.WebRequest::CreateDefault, System.Net.WebRequest::CreateHttp, wininet.InternetCloseHandle|
+|[send file via HTTP](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/send-file-via-http.yml)|HTTP Communication::Send Data (C0002.005)|wininet.InternetWriteFile|
+|[decompress HTTP response via IEncodingFilterFactory](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/decompress-http-response-via-iencodingfilterfactory.yml)|HTTP Communication::Get Response (C0002.017)| |
+|[check HTTP status code](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/check-http-status-code.yml)|HTTP Communication::Read Header (C0002.014)|atoi, wininet.HttpQueryInfo|
+|[get HTTP response content encoding](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/get-http-response-content-encoding.yml)|HTTP Communication::Get Response (C0002.017)|wininet.HttpQueryInfo|
+|[connect to URL](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-url.yml)|HTTP Communication::Open URL (C0002.004)|wininet.InternetOpenUrl|
+|[connect to HTTP server](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/connect-to-http-server.yml)|HTTP Communication::Connect to Server (C0002.009)|wininet.InternetConnect|
+|[extract HTTP body](https://github.com/mandiant/capa-rules/blob/master/communication/http/client/extract-http-body.yml)|HTTP Communication::Extract Body (C0002.011)| |

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -36,3 +36,9 @@ This micro-behavior is related to ICMP communication.
 |---|---|---|
 |**Echo Request**|C0014.002|Send ICMP echo request.|
 |**Generate Traffic**|C0014.001|Generate ICMP traffic.|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[send ICMP echo request](https://github.com/mandiant/capa-rules/blob/master/communication/icmp/send-icmp-echo-request.yml)|ICMP Communication::Echo Request (C0014.002)|IcmpSendEcho, IcmpSendEcho2, IcmpSendEcho2Ex, Icmp6SendEcho2, IcmpCreateFile, Icmp6CreateFile, IcmpCloseHandle|
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -47,6 +47,18 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.004|Hupigon writes pipes. [[1]](#1)|
 |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0003.004|Poison Ivy writes pipes. [[1]](#1)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[create mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/create-mailslot.yml)|Interprocess Communication (C0003)|kernel32.CreateMailslot, kernel32.GetMailslotInfo, kernel32.SetMailslotInfo|
+|[read from mailslot](https://github.com/mandiant/capa-rules/blob/master/communication/mailslot/read-from-mailslot.yml)|Interprocess Communication (C0003)|kernel32.GetMailslotInfo, kernel32.ReadFile, kernel32.ReadFileEx|
+|[create pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-pipe.yml)|Interprocess Communication::Create Pipe (C0003.001)|kernel32.CreatePipe, kernel32.CreateNamedPipe, System.IO.Pipes.AnonymousPipeClientStream::ctor, System.IO.Pipes.NamedPipeClientStream::ctor, System.IO.Pipes.AnonymousPipeServerStream::ctor, System.IO.Pipes.AnonymousPipeServerStreamAcl::Create, System.IO.Pipes.NamedPipeServerStream::ctor, System.IO.Pipes.NamedPipeServerStreamAcl::Create|
+|[create two anonymous pipes](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/create/create-two-anonymous-pipes.yml)|Interprocess Communication::Create Pipe (C0003.001)| |
+|[write pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/write/write-pipe.yml)|Interprocess Communication::Write Pipe (C0003.004)|kernel32.WriteFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe|
+|[connect pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/connect/connect-pipe.yml)|Interprocess Communication::Connect Pipe (C0003.002)|kernel32.ConnectNamedPipe, kernel32.CallNamedPipe, System.IO.Pipes.NamedPipeClientStream::Connect, System.IO.Pipes.NamedPipeClientStream::ConnectAsync|
+|[read pipe](https://github.com/mandiant/capa-rules/blob/master/communication/named-pipe/read/read-pipe.yml)|Interprocess Communication::Read Pipe (C0003.003)|kernel32.PeekNamedPipe, kernel32.ReadFile, kernel32.TransactNamedPipe, kernel32.CallNamedPipe|
+
 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>1 March 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>21 November 2022</b></td>
+<td><b>13 September 2023</b></td>
 </tr>
 </table>

@@ -64,6 +64,25 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |[**Rombertik**](../xample-malware/rombertik.md)|2015|C0001.011|Rombertik creates a TCP socket. [[2]](#2)|
 |[**Shamoon**](../xample-malware/shamoon.md)|2012|C0001.009|Shamoon initializes a Winsock library. [[2]](#2)|

+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[start TCP server](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/serve/start-tcp-server.yml)|Socket Communication::Start TCP Server (C0001.005)|listen, accept, WSAAccept, System.Net.Sockets.TcpListener::Start, System.Net.Sockets.TcpListener::AcceptTcpClient, System.Net.Sockets.TcpListener::BeginAcceptTcpClient, System.Net.Sockets.TcpListener::AcceptTcpClientAsync, System.Net.Sockets.TcpListener::AcceptSocket, System.Net.Sockets.TcpListener::BeginAcceptSocket, System.Net.Sockets.TcpListener::AcceptSocketAsync|
+|[act as TCP client](https://github.com/mandiant/capa-rules/blob/master/communication/tcp/client/act-as-tcp-client.yml)|Socket Communication::TCP Client (C0001.008)|System.Net.Sockets.TcpClient::ctor|
+|[get socket status](https://github.com/mandiant/capa-rules/blob/master/communication/socket/get-socket-status.yml)|Socket Communication::Get Socket Status (C0001.012)|ws2_32.select|
+|[create raw socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-raw-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, ws2_32.WSASocketA|
+|[set socket configuration](https://github.com/mandiant/capa-rules/blob/master/communication/socket/set-socket-configuration.yml)|Socket Communication::Set Socket Config (C0001.001)|ws2_32.setsockopt, ws2_32.ioctlsocket|
+|[create VMCI socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/create-vmci-socket.yml)|Socket Communication::Create Socket (C0001.003)|socket, DeviceIoControl, socket, ioctl|
+|[initialize Winsock library](https://github.com/mandiant/capa-rules/blob/master/communication/socket/initialize-winsock-library.yml)|Socket Communication::Initialize Winsock Library (C0001.009)|ws2_32.WSAStartup|
+|[connect TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/connect-tcp-socket.yml)|Socket Communication::Connect Socket (C0001.004)|connect, ws2_32.connect, ws2_32.WSAConnect, ConnectEx, WSAIoctl, setsockopt, bind|
+|[create TCP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket.yml)|Socket Communication::Create TCP Socket (C0001.011)|ws2_32.socket, ws2_32.WSASocket, socket|
+|[create TCP socket via raw AFD driver](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/create-tcp-socket-via-raw-afd-driver.yml)|Socket Communication::Create TCP Socket (C0001.011)|kernel32.CreateEvent, NtCreateFile, NtDeviceIoControlFile, kernel32.WaitForSingleObject|
+|[obtain TransmitPackets callback function via WSAIoctl](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/obtain-transmitpackets-callback-function-via-wsaioctl.yml)|Socket Communication::Send TCP Data (C0001.014)|WSAIoctl, WSAGetLastError|
+|[send TCP data via WFP API](https://github.com/mandiant/capa-rules/blob/master/communication/socket/tcp/send/send-tcp-data-via-wfp-api.yml)|Socket Communication::Send TCP Data (C0001.014)|fwpkclnt.FwpsStreamInjectAsync0|
+|[create UDP socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/udp/send/create-udp-socket.yml)|Socket Communication::Create UDP Socket (C0001.010)|ws2_32.socket, ws2_32.WSASocket, socket, System.Net.Sockets.Socket::ctor, System.Net.Sockets.UdpClient::ctor|
+|[send data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/send/send-data-on-socket.yml)|Socket Communication::Send Data (C0001.007)|ws2_32.send, ws2_32.sendto, ws2_32.WSASend, ws2_32.WSASendMsg, ws2_32.WSASendTo, send, System.Net.Sockets.Socket::Send, System.Net.Sockets.Socket::SendAsync, System.Net.Sockets.Socket::SendTo, System.Net.Sockets.Socket::SendToAsync, System.Net.Sockets.UdpClient::Send|
+|[receive data on socket](https://github.com/mandiant/capa-rules/blob/master/communication/socket/receive/receive-data-on-socket.yml)|Socket Communication::Receive Data (C0001.006)|ws2_32.recv, ws2_32.recvfrom, ws2_32.WSARecv, ws2_32.WSARecvDisconnect, ws2_32.WSARecvEx, ws2_32.WSARecvFrom, ws2_32.WSARecvMsg, recv, System.Net.Sockets.Socket::Receive, System.Net.Sockets.Socket::ReceiveAsync, System.Net.Sockets.Socket::ReceiveFrom, System.Net.Sockets.Socket::ReceiveFromAsync, System.Net.Sockets.Socket::ReceiveMessageFrom, System.Net.Sockets.Socket::ReceiveMessageFromAsync, System.Net.Sockets.Socket::BeginReceive, System.Net.Sockets.Socket::BeginReceiveFrom, System.Net.Sockets.Socket::BeginReceiveMessageFrom, System.Net.Sockets.Socket::EndReceive, System.Net.Sockets.Socket::EndReceiveFrom, System.Net.Sockets.Socket::EndReceiveMessageFrom|

 ## References

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>10 November 2022</b></td>
 </tr>
 </table>

@@ -8,7 +8,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>8 May 2023</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>10 November 2022</b></td>
 </tr>
 </table>

@@ -21,7 +21,7 @@
 </tr>
 <tr>
 <td><b>Last Modified</b></td>
-<td><b>31 October 2022</b></td>
+<td><b>10 November 2022</b></td>
 </tr>
 </table>

--- a/Show More
+++ b/Show More