diff --git a/anti-behavioral-analysis/detect-sandbox.md b/anti-behavioral-analysis/detect-sandbox.md index 3002777..fd82ac5 100644 --- a/anti-behavioral-analysis/detect-sandbox.md +++ b/anti-behavioral-analysis/detect-sandbox.md @@ -9,8 +9,8 @@ Sandbox Detection ================= Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path. -The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** techniques and their sub-techniques. - +The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior. + Methods ------- |Name|ID|Description| diff --git a/anti-behavioral-analysis/detect-vm.md b/anti-behavioral-analysis/detect-vm.md index 9cd4d11..ef7fc94 100644 --- a/anti-behavioral-analysis/detect-vm.md +++ b/anti-behavioral-analysis/detect-vm.md @@ -9,7 +9,7 @@ Virtual Machine Detection ========================= Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1) -The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** techniques and their sub-techniques. +The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior. Methods ------- diff --git a/anti-behavioral-analysis/evade-debugger.md b/anti-behavioral-analysis/evade-debugger.md index 1b151c0..00a50eb 100644 --- a/anti-behavioral-analysis/evade-debugger.md +++ b/anti-behavioral-analysis/evade-debugger.md @@ -2,7 +2,7 @@ |---|---| |**ID**|**B0002**| |**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)| -|**Related ATT&CK Technique**|[Debugger Evasion](https://attack.mitre.org/techniques/T1622/)| +|**Related ATT&CK Technique**|[Debugger Evasion (T1622)](https://attack.mitre.org/techniques/T1622/)| Debugger Evasion @@ -11,7 +11,7 @@ Behaviors that make debugging difficult. A thorough reference for anti-debugging, both detection and evasion, is given in [[1]](#1). -The subsequently defined ATT&CK technique [Debugger Evasion](https://attack.mitre.org/techniques/T1622/) is related to this MBC behavior. +The related [Debugger Evasion (T1622)](https://attack.mitre.org/techniques/T1622/) ATT&CK technique was defined subsequent to this MBC behavior. Methods ------- diff --git a/anti-behavioral-analysis/evade-dynamic-analysis.md b/anti-behavioral-analysis/evade-dynamic-analysis.md index 7af2257..4706da6 100644 --- a/anti-behavioral-analysis/evade-dynamic-analysis.md +++ b/anti-behavioral-analysis/evade-dynamic-analysis.md @@ -9,9 +9,9 @@ Dynamic Analysis Evasion ======================== Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine. -See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an emulator-specific evasion behavior, and see [Execution Guardrails](../anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. +See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an emulator-specific evasion behavior, and see [Conditional Execution](../anti-behavioral-analysis/conditional-execute.md) for a behavior that constrains dynamic execution based on environmental conditions. -See ATT&CK: **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))**. +The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior. Methods ------- diff --git a/command-and-control/domain-name-generate.md b/command-and-control/domain-name-generate.md index 7936907..4e4acf0 100644 --- a/command-and-control/domain-name-generate.md +++ b/command-and-control/domain-name-generate.md @@ -9,7 +9,7 @@ Domain Name Generation ====================== Malware generates the domain name of the controller to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced implants; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1) -The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior. +The related [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/) ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior. Malware Examples ---------------- diff --git a/execution/conditional-execute.md b/execution/conditional-execute.md index 4783f0f..d52f3d4 100644 --- a/execution/conditional-execute.md +++ b/execution/conditional-execute.md @@ -2,7 +2,7 @@ |---|---| |**ID**|**B0025**| |**Objective(s)**|[Execution](../execution), [Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)| -|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)| +|**Related ATT&CK Technique**|[Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480)| Conditional Execution @@ -11,14 +11,14 @@ Malware checks system environment conditions or characteristics to determine exe This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine. -Conditional execution may also be referred to as "execution guardrails." **See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors). +Some aspects of conditional execution are related to the ATT&CK [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480) technique; however the ATT&CK technique is not focused on anti-behavioral analysis behaviors. Methods ------- |Name|ID|Description| |---|---|---| |**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.| -|**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.| +|**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method. The subsequently defined ATT&CK sub-technique [Execution Guardrails: Environmental Keying (T1480.001)](https://attack.mitre.org/techniques/T1480/001/) is related to this MBC method. | |**GetVolumeInformation**|B0025.003|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.| |**Host Fingerprint Check**|B0025.004|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.| |**Runs as Service**|B0025.007|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[2]](#2)| diff --git a/execution/send-email.md b/execution/send-email.md index 17d4414..85109a7 100644 --- a/execution/send-email.md +++ b/execution/send-email.md @@ -9,7 +9,7 @@ Send Email ========== Sends an email message from the system on which the malware is executing to one or more recipients, mostly commonly for the purpose of spamming or for distributing a malicious attachment or URL (malspamming). -**See related ATT&CK Techniques:** [**Phishing**](https://attack.mitre.org/techniques/T1566/). This technique is defined in PRE-ATT&CK, which being related to initial access, is not included in MBC. +This behavior is related to the [Phishing (T1566)](https://attack.mitre.org/techniques/T1566/) ATT&CK technique, defined under ATT&CK's Initial Access tactic. Malware Examples ---------------- diff --git a/impact/compromise-data.md b/impact/compromise-data.md index 744267e..1436999 100644 --- a/impact/compromise-data.md +++ b/impact/compromise-data.md @@ -9,4 +9,4 @@ Compromise Data Integrity ========================= Data stored on the file system of a compromised system is manipulated to compromise its integrity. -The subsequently defined ATT&CK sub-technique [Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/) is related to this MBC behavior. +The related [Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/) ATT&CK sub-technique was defined subsequent to this MBC behavior. diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index 656c568..304c0a4 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -11,7 +11,7 @@ Malware may make a network unavailable, for example, by launching a network-base Endpoint denial of service behaviors are captured by the [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499/) technique. -The subsequently defined ATT&CK technique [Network Denial of Service](https://attack.mitre.org/techniques/T1498/) is related to this MBC behavior. +The related [Network Denial of Service](https://attack.mitre.org/techniques/T1498/) ATT&CK technique was defined subsequent to this MBC behavior. Malware Examples ---------------- diff --git a/impact/hijack-sys-resources.md b/impact/hijack-sys-resources.md index 1d1c2e6..e632f0f 100644 --- a/impact/hijack-sys-resources.md +++ b/impact/hijack-sys-resources.md @@ -9,7 +9,7 @@ Resource Hijacking ================== Uses system resources for other purposes; as a result, the system may not be available for intended uses. -The subsequently defined ATT&CK technique [Resource Hijacking](https://attack.mitre.org/techniques/T1496/) is related to this MBC behavior. +The related [Resource Hijacking](https://attack.mitre.org/techniques/T1496/) ATT&CK technique was defined subsequent to this MBC behavior. Methods ------- diff --git a/impact/manipulate-network-traffic.md b/impact/manipulate-network-traffic.md index 0a67e7f..665a5fe 100644 --- a/impact/manipulate-network-traffic.md +++ b/impact/manipulate-network-traffic.md @@ -9,7 +9,7 @@ Manipulate Network Traffic ========================== Malware intercepts and manipulates network traffic, typically accessing or modifying data, going to or originating from the system on which the malware instance is executing. Also known as a Man-in-the-Middle attack. -The subsequently defined ATT&CK sub-technique [Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/) is related to this MBC behavior. +The related [Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/) ATT&CK sub-technique was defined subsequent to this MBC behavior. Malware Examples ----------------