admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
675 Commits 1 Branch 9 Tags
main
Commit Graph

58 Commits

Author SHA1 Message Date
Desiree Beck bd31003a22 Staging (#151) 
* Fixing links

* Code samples (#149)

* Update obfuscated-files-or-information.md

Added code sample with some proposed formatting incl. annotations explaining broad behavior patterns

* Update obfuscated-files-or-information.md

Added brief clarification to note

* Update obfuscated-files-or-information.md

Made requested changes to format

* Update system-information-discovery.md

Added code snippet from PoisonIvy RAT

* Update debugger-detection.md

Added code with example of PEB access

* Update system-information-discovery.md

Added new method based on code snippet

* Update registry.md

Added snippet for registry key query

* Update generate-pseudorandom-sequence.md

Added example of Mersenne Twister algorithm

* Update keylogging.md

Add Dark Comet keylogging code sample

* Update dns-communication.md

Added code sample from darkcomet

* Update socket-communication.md

Added DarkComet code snippet

* Update delete-file.md

Provided DarkComet sample

* Update file-and-directory-discovery.md

Added DarkComet snippet

* Update allocate-memory.md

Added DarkComet sample

* Update modulo.md

Added Hupigon snippet

* Update get-file-attributes.md

Added Hupigon sample

* Update application-window-discovery.md

Added Hupigon snippet

* Update create-process.md

Added Hupigon snippet.

* Update conditional-execution.md

Added Hupigon snippet

* Update create-thread.md

Added Hupigon snippet

* Update resume-thread.md

Added Hupigon snippet

* Update command-and-scripting-interpreter.md

Added SmokeLoader sample

* Update change-memory-protection.md

Added SmokeLoader snippet

* Update console.md

Added snippet from SmokeLoader

* Update dynamic-analysis-evasion.md

Added Industroyer sample

* Update interprocess-communication.md

Added CobaltStrike sample

* Update read-file.md

Added Cobalt Strike snippet

* Update writes-file.md

Added cobalt strike snippet

* Update noncryptographic-hash.md

Added emotet snippet

* Update clipboard-modification.md

Added emotet snippet

* Update check-mutex.md

Added emotet sampler

* Update check-mutex.md

Fixed typo

* Update create-mutex.md

Added Emotet snippet

* Update allocate-thread-local-storage.md

Added emotet snippet

* Update registry-run-keys-startup-folder.md

Added emotet snippet

* Update wininet.md

Added EnvyScout snippet

* Update http-communication.md

Added EnvyScout snippet

* Update enumerate-threads.md

Added Envyscout snippet

* Update set-thread-local-storage-value.md

Added Envyscout sample

* Update create-directory.md

Added explosive snippet

* Update delete-directory.md

Added explosive code snippet (note: the malware is called "explosive")

* Update set-file-attributes.md

Added explosive sample

* Update terminate-process.md

Added explosive snippet

* Update terminate-thread.md

Added explosive sample

* Update move-file.md

Added Finfisher snippet

* Update screen-capture.md

Added ECCENTRICBANDWAGON snippet

* Fix links (#150)

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* fix link

* update mod date

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* fix links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* update links

* Update code-discovery.md

* Update taskbar-discovery.md

* Update conditional-execution.md

* Update memory-dump-evasion.md

* Update execution-dependency.md

* Update compromise-data-integrity.md

* Update dns-communication.md

* Update http-communication.md

* Update interprocess-communication.md

* Update socket-communication.md

* Update wininet.md

* Update generate-pseudorandom-sequence.md

* Update modulo.md

* Update noncryptographic-hash.md

* Update create-directory.md

* Update delete-directory.md

* Update delete-file.md

* Update get-file-attributes.md

* Update move-file.md

* Update read-file.md

* Update terminate-thread.md

* Update set-file-attributes.md

* Update writes-file.md

* Update allocate-memory.md

* Update change-memory-protection.md

* Update console.md

* Update registry.md

* Update allocate-thread-local-storage.md

* Update check-mutex.md

* Update terminate-process.md

* Update create-mutex.md

* Update create-process.md

* Update set-thread-local-storage-value.md

* Update resume-thread.md

* Update enumerate-threads.md

* Update create-thread.md

* update for 3.1 release

* update for 3.1 release

* update for 3.1 release

---------

Co-authored-by: ryan <ryanxu@wustl.edu>
Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
 2024-05-01 16:09:33 -04:00
ryan ad05fb07ba Updating version and last modified 2024-01-02 12:58:56 -05:00
Ryan Xu d423b5a5fa Adding CAPE mappings to detection section (#132) 
* Making spacing between sections consistent

* Adding cape mappings
 2023-12-05 14:19:50 -05:00
Ryan Xu 463eef29c1 Updating Summary and Minor Fixes (#131) 
* Updating Summary

* Minor fixes (#130)

* How to cite (#127)

* Added citation-related files

* Modified type to misc. Commented out the license

* Modified main README to match output produced by CITATION.cff

* Update CITATION.cff

* Update README.md

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>

* Update dynamic-analysis-evasion.md

remove duplicated text and fix link

* Update sandbox-detection.md

Corrected technique name

* Update README.md

* Update mbc_summary.md

---------

Co-authored-by: RazviOverflow <41084837+RazviOverflow@users.noreply.github.com>

* fixes to summary

* ordering change

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
Co-authored-by: RazviOverflow <41084837+RazviOverflow@users.noreply.github.com>
 2023-11-16 09:38:32 -05:00
Desiree Beck c2df3d4e10 Staging (#126) 
* Changing conti name

* Mbc 3 (#125)

* update version number

* update links

* update version number

* update version number

* update version number

* 2.3 to main in matrix

* link fix

* v3 faq update

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

---------

Co-authored-by: ryan <ryanxu@wustl.edu>
 2023-10-03 11:36:05 -04:00
Ryan Xu f7d92d59fa Staging (#124) 
- Updating capa detection in behaviors
- Newsletter
- Conti malware
- pafish faq
 2023-09-20 15:57:32 -04:00
Ryan Xu c9b0396e0e Cleaning ref links, etc (#115) 
* Cleanup

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2023-08-17 14:08:55 -04:00
Ryan Xu 275c8feec3 New Malware Examples + Editing References (#105) 
* New malware examples (#103)

* fix typos

* add new Use in Malware entries to behaviors

* new corpus entries

* remove extraneous ref

* restore original IDs

* fix typos

* Update registry.md (#101)

Update C0036.001 per "Registry micro-behavior" Discussion.

* Update registry.md (#102)

Update C0036.001 per "Registry micro-behavior" Discussion.

* correct modified date

* fix PR comments on formatting

* Editing references (#104)

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2023-06-12 11:10:47 -04:00
Ryan Xu 17663f17f6 minor fixes (#99) 2023-05-22 10:18:37 -04:00
Ryan Xu 0238c12f6e Enhancing behavior descriptions, formatting + citation updates (#96) 
* formatting and citation updates

* Adding Janet's work on behavior descriptions
 2023-05-08 10:32:10 -04:00
Ryan Xu e1b22023c5 Staging (#85) 
* Janet mbc updates (#84)

* Added Unprotect techniques to respective behaviors and or methods.

* Unprotect updates MBC

* Unprotect techniques mapped in MBC

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Fixing redundant Detection sec in sandbox detect

---------

Co-authored-by: quant23va <105243450+quant23va@users.noreply.github.com>
 2023-03-15 10:20:48 -04:00
Stephen Battista c36a5217b4 Fixed dead links moved http to https (#82) 
* Fixed dead links moved http to https

* Updated Joesecurity link to not use web archive
 2023-03-04 13:54:02 -05:00
Lauren Parker 94fa3c86b8 Lauren malware corpus (#81) 
* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos
 2023-03-01 03:12:22 -05:00
Ryan Xu 1917b816ca Adding capa analysis to corpus and improved backtrace to behavior pages (#80) 
* Adding script files

* Scripting overhaul

* Adding capa analysis from MITRE into corpus

* Adding capa analysis from MITRE into corpus

* Backtracing capa mappings to behavior pages

* Other fixes

* merge dev into staging

* Fixing capa mappings

* merge dev into staging

* fix writes file typo

* merge dev into staging

* Fix method column + cape analysis
 2023-02-01 10:28:30 -05:00
ryan 12b8422a5f Completed syntax migration and typo fixes 2022-11-29 09:19:21 -05:00
ryan 8806c483f9 Adding Method column to 'Use in Malware' section 2022-11-21 10:55:51 -05:00
ryan 236f706f30 Changed Markdown headers to atx-style pt2 2022-11-10 13:28:52 -05:00
ryan 9c69facf0f Changed Markdown headers to atx-style 2022-11-10 12:02:12 -05:00
ryan 6201858f10 Added Anti-Analysis/Impact Tags 2022-11-08 15:22:36 -05:00
ryan 779142fb8f Added new header fields 2022-10-31 15:49:13 -04:00
Dez Beck e7777b8e63 fix objective ID 2022-10-01 13:16:43 -04:00
ryan 322fb1248d Updating Hashes to SHA256 + typo fixes 2022-09-16 09:44:47 -04:00
ryan da26628e86 Objective Header format 2022-08-22 12:07:27 -04:00
ryan 9d2dc7d065 ATT&CK + MBC reference consistent formatting 2022-08-22 10:59:49 -04:00
ryan d9e84725bf HTML tables inside Markdown 2022-08-18 15:15:00 -04:00
ryan cd7b66d5b9 Adding PR feedback 2022-08-09 14:34:00 -04:00
ryan 19be37cdd4 Merge remote-tracking branch 'origin/master' into corpus 2022-08-09 14:13:15 -04:00
Dez Beck a9b6502475 typo fix 2022-08-07 13:13:20 -04:00
Dez Beck a4e9e9ec12 update objective descriptions 2022-08-06 10:51:27 -04:00
ryan e07e00f4d4 Enhanced malware corpus & update file names to match behaviors 2022-08-02 10:32:52 -04:00
Danny Haynes af0350ec08 Update component-firmware.md 
Updated behavior description to align with ATT&CK technique.
 2022-06-02 14:56:37 -04:00
Desiree Beck 5973e9ed53 add rootkit-related methods 2021-11-08 12:09:17 -05:00
Emmanuelle Vargas-Gonzalez e0fffe4d5c update internal links 2021-02-09 19:26:58 -05:00
Emmanuelle Vargas-Gonzalez b7197c785d make all internal references relative 2020-08-21 17:49:32 -04:00
Emmanuelle Vargas-Gonzalez 28028ce5c6 shift Methods columns, sort alphabetically 2020-08-21 16:00:03 -04:00
Emmanuelle Vargas-Gonzalez 3e5d257030 Normalizing tables, dividers, style layout, minor content typos 2020-08-20 16:05:08 -04:00
Emmanuelle Vargas-Gonzalez 74d816deb1 update mbc-beta hyperlinks to mbc-markdown equivalents 2020-08-14 14:54:01 -04:00
Emmanuelle Vargas-Gonzalez 2207d845ae move and replace MBCProject/mbc-markdown with contents from MBCProject/mbc-beta 2020-08-14 14:37:45 -04:00
Desiree Beck d96dc61157 update description 2020-04-14 13:13:30 -04:00
Desiree Beck eee3cd353c update methods 2019-12-22 11:54:24 -05:00
Desiree Beck 1c233e5501 extend mod reg to persistence 2019-12-21 22:17:55 -05:00
Desiree Beck 82e4c2256c adjust methods 2019-12-21 21:32:53 -05:00
Emmanuelle Vargas-Gonzalez a5e3cd6977 find/replace Related ATT&CK Technique(s) to singular 2019-12-17 13:45:48 -05:00
Desiree Beck 1ca14fd30f remote file copy vs install add program text 2019-12-13 19:01:31 -05:00
Desiree Beck f6c4b4f6b1 add beh 2019-12-13 18:05:02 -05:00
Desiree Beck 807a29d95b add beh 2019-12-13 18:01:25 -05:00
Desiree Beck 476ca33ec4 add behavior 2019-12-13 17:40:00 -05:00
Desiree Beck 3397805f03 add to descriptions 2019-12-02 15:28:38 -05:00
Emmanuelle Vargas-Gonzalez 0ebd75beb5 couple of things in this commit: 
- Added TrickBot and Poison-Ivy as Malware Examples to behaviors
- Consistency in the tables (make them bold, add internal reference if available and typos)
 2019-11-08 18:38:27 -05:00
Desiree Beck fba3aa1ace add beh 2019-10-08 19:47:27 -04:00