MBCProject-mbc-markdown

mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Author	SHA1	Message	Date
Desiree Beck	0fab38218e	Staging (#170 ) * Update dns-communication.md * Update dns-communication.md * Update http-communication.md * Update icmp-communication.md * Update interprocess-communication.md * Update socket-communication.md * Update wininet.md * Update encrypt-data.md * Update encrypt-data.md * Update encryption-key.md * Update alter-file-extension.md * Update create-directory.md * Update create-file.md * Update create-file.md * Update delete-file.md * Update registry.md * Update wallpaper.md * Update create-process.md * Update check-mutex.md * Update writes-file.md * Update create-mutex.md --------- Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>	2024-11-18 15:03:18 -05:00
Desiree Beck	c3033e4061	Staging (#162 ) * update staging (#158) * update format/wording * Capa 7.1 rule updates (#156) * Update self-deletion.md Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml) * Update obfuscated-files-or-information.md added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml * Update disk-wipe.md Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml * Update dns-communication.md Removed duplication in APIs in "Resolve DNS" CAPA rule * Update socket-communication.md Updated APIs for "create raw socket" CAPA rule * Update socket-communication.md Updated APIs on CAPA rule "get socket status" * Update socket-communication.md Updated CAPA rule "initialize Winsock library" * Update socket-communication.md Updated API listing on CAPA rule "receive data on socket" * Update socket-communication.md Updated API listing for "send data on socket" CAPA rule * Update socket-communication.md Update APIs for CAPA rule "set socket configuration" * Update socket-communication.md Updated CAPA rule "connect tcp socket" to add APIs * Update socket-communication.md Added APIs to CAPA rule "create tcp socket" * Update socket-communication.md Added APIs to "create UDP socket" CAPA rule * Update encrypt-data.md Added new APIs to "encrypt data using DPAPI" CAPA rule * Update install-driver.md Added APIs to CAPA rule "install driver" * Update set-file-attributes.md Added APIs to CAPA rule "change file permissions on Linux" * Update writes-file.md Updated APIs for CAPA rule "write file on linux" * Update system-information-discovery.md Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1 * Update create-process.md Added API to "create process on linux" CAPA rule * Update hijack-execution-flow.md Added API calls to CAPA rule "execute shellcode via Windows callback function" * Update self-deletion.md Changed link to master * Update obfuscated-files-or-information.md Changed rule link to release to point to master * Update system-information-discovery.md Removed nursery rules * Update disk-wipe.md Updated link to master branch * Update socket-communication.md Checked for correct socket listings under the APIs --------- Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com> * New method (#159) * update format/wording * Update disassembler-evasion.md * Update disassembler-evasion.md * Corpus fix (#160) * update format/wording * fix tables * Edits --------- Co-authored-by: ryan <ryanxu@wustl.edu> * New method (#161) * update format/wording * Update disassembler-evasion.md * Update disassembler-evasion.md --------- Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com> Co-authored-by: ryan <ryanxu@wustl.edu>	2024-08-25 10:09:33 -04:00
brightmt	084ba830d3	Capa 7.1 rule updates (#156 ) * Update self-deletion.md Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml) * Update obfuscated-files-or-information.md added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml * Update disk-wipe.md Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml * Update dns-communication.md Removed duplication in APIs in "Resolve DNS" CAPA rule * Update socket-communication.md Updated APIs for "create raw socket" CAPA rule * Update socket-communication.md Updated APIs on CAPA rule "get socket status" * Update socket-communication.md Updated CAPA rule "initialize Winsock library" * Update socket-communication.md Updated API listing on CAPA rule "receive data on socket" * Update socket-communication.md Updated API listing for "send data on socket" CAPA rule * Update socket-communication.md Update APIs for CAPA rule "set socket configuration" * Update socket-communication.md Updated CAPA rule "connect tcp socket" to add APIs * Update socket-communication.md Added APIs to CAPA rule "create tcp socket" * Update socket-communication.md Added APIs to "create UDP socket" CAPA rule * Update encrypt-data.md Added new APIs to "encrypt data using DPAPI" CAPA rule * Update install-driver.md Added APIs to CAPA rule "install driver" * Update set-file-attributes.md Added APIs to CAPA rule "change file permissions on Linux" * Update writes-file.md Updated APIs for CAPA rule "write file on linux" * Update system-information-discovery.md Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1 * Update create-process.md Added API to "create process on linux" CAPA rule * Update hijack-execution-flow.md Added API calls to CAPA rule "execute shellcode via Windows callback function" * Update self-deletion.md Changed link to master * Update obfuscated-files-or-information.md Changed rule link to release to point to master * Update system-information-discovery.md Removed nursery rules * Update disk-wipe.md Updated link to master branch * Update socket-communication.md Checked for correct socket listings under the APIs	2024-08-24 13:19:12 -04:00
RazviOverflow	53771d2293	Updated MBC-CAPE signature mappings (#153 ) * Deleted deprecated signatures * Added new signature * Updated table to match new CAPE signatures' format * Added new signature mappings * Fixed table header * Deleted unspecified API * Updated table to match new CAPE signature format. Fixed existing signatures. * Deleted deprecated signatures * Added missing class * Added new signature mappings * Deleted deprecated signatures * Updated table to match new CAPE signature format * Added new signature mappings * Updated deprecated links * Updated table to match new CAPE signature format * Added new signature mapping * Updated table format, signature, and link * Fixed existing signatures' url * Deleted deprecated signatures * Updated existing signatures * Added new signature mappings * Deleted deprecated signature * Updated table. Added new signature mappings. * Deleted deprecated signatures * Updated table to new CAPE signature format * Added new signature mappings * Deleted deprecated signatures * Updated table. Added new signature mappings. * Deleted deprecated signatures * Updated table. Added new signature mappings * Fixed broken url * Updated table * Deleted deprecated signatures * Updated table format. Added new signature mapping. * Deleted deprecated signatures * Updated table. Fixed already existing signatures. * Added new signature mappings * Updated existing signatures * Updated table format. Deleted deprecated signatures. * Updated existing signatures * Added new signature mappings * Updated existing signatures * Updated table and signatures * Fixed existing signatures * Deleted deprecated signatures * Updated table * Added new signature mappings * Updated existing signatures * Updating existing signatures * Updating existing signatures * Updating exiting signature * Deleted deprecated signatures * Updated existing signatures * Updated existing signatures * Added new signature mappings * Deleted deprecated signature * Updated table * Added new signature mapping * Deleted deprecated signatures * Added new signature mappings * Deleted deprecated signatures * Added new signature mappings * Updated table and existing signatures * Deleted deprecated signatures * Updated table and existing signatures * Added new signature mappings * Fixing typos * Fixing typos II * Fixing typos III	2024-06-30 15:08:20 -04:00
Desiree Beck	bd31003a22	Staging (#151 ) * Fixing links * Code samples (#149) * Update obfuscated-files-or-information.md Added code sample with some proposed formatting incl. annotations explaining broad behavior patterns * Update obfuscated-files-or-information.md Added brief clarification to note * Update obfuscated-files-or-information.md Made requested changes to format * Update system-information-discovery.md Added code snippet from PoisonIvy RAT * Update debugger-detection.md Added code with example of PEB access * Update system-information-discovery.md Added new method based on code snippet * Update registry.md Added snippet for registry key query * Update generate-pseudorandom-sequence.md Added example of Mersenne Twister algorithm * Update keylogging.md Add Dark Comet keylogging code sample * Update dns-communication.md Added code sample from darkcomet * Update socket-communication.md Added DarkComet code snippet * Update delete-file.md Provided DarkComet sample * Update file-and-directory-discovery.md Added DarkComet snippet * Update allocate-memory.md Added DarkComet sample * Update modulo.md Added Hupigon snippet * Update get-file-attributes.md Added Hupigon sample * Update application-window-discovery.md Added Hupigon snippet * Update create-process.md Added Hupigon snippet. * Update conditional-execution.md Added Hupigon snippet * Update create-thread.md Added Hupigon snippet * Update resume-thread.md Added Hupigon snippet * Update command-and-scripting-interpreter.md Added SmokeLoader sample * Update change-memory-protection.md Added SmokeLoader snippet * Update console.md Added snippet from SmokeLoader * Update dynamic-analysis-evasion.md Added Industroyer sample * Update interprocess-communication.md Added CobaltStrike sample * Update read-file.md Added Cobalt Strike snippet * Update writes-file.md Added cobalt strike snippet * Update noncryptographic-hash.md Added emotet snippet * Update clipboard-modification.md Added emotet snippet * Update check-mutex.md Added emotet sampler * Update check-mutex.md Fixed typo * Update create-mutex.md Added Emotet snippet * Update allocate-thread-local-storage.md Added emotet snippet * Update registry-run-keys-startup-folder.md Added emotet snippet * Update wininet.md Added EnvyScout snippet * Update http-communication.md Added EnvyScout snippet * Update enumerate-threads.md Added Envyscout snippet * Update set-thread-local-storage-value.md Added Envyscout sample * Update create-directory.md Added explosive snippet * Update delete-directory.md Added explosive code snippet (note: the malware is called "explosive") * Update set-file-attributes.md Added explosive sample * Update terminate-process.md Added explosive snippet * Update terminate-thread.md Added explosive sample * Update move-file.md Added Finfisher snippet * Update screen-capture.md Added ECCENTRICBANDWAGON snippet * Fix links (#150) * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * update mod date * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * Update code-discovery.md * Update taskbar-discovery.md * Update conditional-execution.md * Update memory-dump-evasion.md * Update execution-dependency.md * Update compromise-data-integrity.md * Update dns-communication.md * Update http-communication.md * Update interprocess-communication.md * Update socket-communication.md * Update wininet.md * Update generate-pseudorandom-sequence.md * Update modulo.md * Update noncryptographic-hash.md * Update create-directory.md * Update delete-directory.md * Update delete-file.md * Update get-file-attributes.md * Update move-file.md * Update read-file.md * Update terminate-thread.md * Update set-file-attributes.md * Update writes-file.md * Update allocate-memory.md * Update change-memory-protection.md * Update console.md * Update registry.md * Update allocate-thread-local-storage.md * Update check-mutex.md * Update terminate-process.md * Update create-mutex.md * Update create-process.md * Update set-thread-local-storage-value.md * Update resume-thread.md * Update enumerate-threads.md * Update create-thread.md * update for 3.1 release * update for 3.1 release * update for 3.1 release --------- Co-authored-by: ryan <ryanxu@wustl.edu> Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>	2024-05-01 16:09:33 -04:00
ryan	ad05fb07ba	Updating version and last modified	2024-01-02 12:58:56 -05:00
Ryan Xu	d423b5a5fa	Adding CAPE mappings to detection section (#132 ) * Making spacing between sections consistent * Adding cape mappings	2023-12-05 14:19:50 -05:00
Ryan Xu	f7d92d59fa	Staging (#124 ) - Updating capa detection in behaviors - Newsletter - Conti malware - pafish faq	2023-09-20 15:57:32 -04:00
Lauren Parker	94fa3c86b8	Lauren malware corpus (#81 ) * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos	2023-03-01 03:12:22 -05:00
Ryan Xu	1917b816ca	Adding capa analysis to corpus and improved backtrace to behavior pages (#80 ) * Adding script files * Scripting overhaul * Adding capa analysis from MITRE into corpus * Adding capa analysis from MITRE into corpus * Backtracing capa mappings to behavior pages * Other fixes * merge dev into staging * Fixing capa mappings * merge dev into staging * fix writes file typo * merge dev into staging * Fix method column + cape analysis	2023-02-01 10:28:30 -05:00
ryan	8806c483f9	Adding Method column to 'Use in Malware' section	2022-11-21 10:55:51 -05:00
ryan	236f706f30	Changed Markdown headers to atx-style pt2	2022-11-10 13:28:52 -05:00
ryan	9c69facf0f	Changed Markdown headers to atx-style	2022-11-10 12:02:12 -05:00
ryan	779142fb8f	Added new header fields	2022-10-31 15:49:13 -04:00
ryan	d9e84725bf	HTML tables inside Markdown	2022-08-18 15:15:00 -04:00
ryan	e07e00f4d4	Enhanced malware corpus & update file names to match behaviors	2022-08-02 10:32:52 -04:00
Desiree Beck	0a6c7dede6	update content to support capa mapping	2020-12-04 12:30:07 -05:00

17 Commits