admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
675 Commits 1 Branch 9 Tags
main
Commit Graph

26 Commits

Author SHA1 Message Date
Desiree Beck c3033e4061 Staging (#162) 
* update staging (#158)

* update format/wording

* Capa 7.1 rule updates (#156)

* Update self-deletion.md

Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)

* Update obfuscated-files-or-information.md

added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml

* Update disk-wipe.md

Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml

* Update dns-communication.md

Removed duplication in APIs in "Resolve DNS" CAPA rule

* Update socket-communication.md

Updated APIs for "create raw socket" CAPA rule

* Update socket-communication.md

Updated APIs on CAPA rule "get socket status"

* Update socket-communication.md

Updated CAPA rule "initialize Winsock library"

* Update socket-communication.md

Updated API listing on CAPA rule "receive data on socket"

* Update socket-communication.md

Updated API listing for "send data on socket" CAPA rule

* Update socket-communication.md

Update APIs for CAPA rule "set socket configuration"

* Update socket-communication.md

Updated CAPA rule "connect tcp socket" to add APIs

* Update socket-communication.md

Added APIs to CAPA rule "create tcp socket"

* Update socket-communication.md

Added APIs to "create UDP socket" CAPA rule

* Update encrypt-data.md

Added new APIs to "encrypt data using DPAPI" CAPA rule

* Update install-driver.md

Added APIs to CAPA rule "install driver"

* Update set-file-attributes.md

Added APIs to CAPA rule "change file permissions on Linux"

* Update writes-file.md

Updated APIs for CAPA rule "write file on linux"

* Update system-information-discovery.md

Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1

* Update create-process.md

Added API to "create process on linux" CAPA rule

* Update hijack-execution-flow.md

Added API calls to CAPA rule "execute shellcode via Windows callback function"

* Update self-deletion.md

Changed link to master

* Update obfuscated-files-or-information.md

Changed rule link to release to point to master

* Update system-information-discovery.md

Removed nursery rules

* Update disk-wipe.md

Updated link to master branch

* Update socket-communication.md

Checked for correct socket listings under the APIs

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>

* New method (#159)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

* Corpus fix (#160)

* update format/wording

* fix tables

* Edits

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

* New method (#161)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
Co-authored-by: ryan <ryanxu@wustl.edu>
 2024-08-25 10:09:33 -04:00
Ryan Xu 009ae77217 3.1 Updates (#145) 
* E/f updates (#143)

* E/F Update,  Update Install Cert ID

* Small fixes

* Update common objects link (#142)

* Update README.md

* Update 09152023.md

* Update README.md

* Update 12182023.md

* Adding descriptions to micro-behaviors

* Fixing dead links

* V3.1 updates (#144)

* minor fixes for v3.1

* correct id

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2024-02-14 09:27:20 -05:00
Desiree Beck 6ce7ebadf2 Malware types (#140) 
* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>
 2023-12-20 21:54:25 -05:00
Ryan Xu d423b5a5fa Adding CAPE mappings to detection section (#132) 
* Making spacing between sections consistent

* Adding cape mappings
 2023-12-05 14:19:50 -05:00
Ryan Xu c9b0396e0e Cleaning ref links, etc (#115) 
* Cleanup

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2023-08-17 14:08:55 -04:00
Ryan Xu 94eed133d7 Syntax change (#109) 2023-06-29 12:57:34 -04:00
Ryan Xu 275c8feec3 New Malware Examples + Editing References (#105) 
* New malware examples (#103)

* fix typos

* add new Use in Malware entries to behaviors

* new corpus entries

* remove extraneous ref

* restore original IDs

* fix typos

* Update registry.md (#101)

Update C0036.001 per "Registry micro-behavior" Discussion.

* Update registry.md (#102)

Update C0036.001 per "Registry micro-behavior" Discussion.

* correct modified date

* fix PR comments on formatting

* Editing references (#104)

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
 2023-06-12 11:10:47 -04:00
Ryan Xu 9e30d80c19 Staging (#83) 
* Adding script files

* Scripting overhaul

* Adding capa analysis from MITRE into corpus

* Adding capa analysis from MITRE into corpus

* Backtracing capa mappings to behavior pages

* Other fixes

* merge dev into staging

* Fixing capa mappings

* merge dev into staging

* fix writes file typo

* merge dev into staging

* Fix method column + cape analysis

* Updates to snippets and descriptions
 2023-03-14 09:28:34 -04:00
Lauren Parker 94fa3c86b8 Lauren malware corpus (#81) 
* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos
 2023-03-01 03:12:22 -05:00
Ryan Xu 1917b816ca Adding capa analysis to corpus and improved backtrace to behavior pages (#80) 
* Adding script files

* Scripting overhaul

* Adding capa analysis from MITRE into corpus

* Adding capa analysis from MITRE into corpus

* Backtracing capa mappings to behavior pages

* Other fixes

* merge dev into staging

* Fixing capa mappings

* merge dev into staging

* fix writes file typo

* merge dev into staging

* Fix method column + cape analysis
 2023-02-01 10:28:30 -05:00
ryan 12b8422a5f Completed syntax migration and typo fixes 2022-11-29 09:19:21 -05:00
ryan 236f706f30 Changed Markdown headers to atx-style pt2 2022-11-10 13:28:52 -05:00
ryan 9c69facf0f Changed Markdown headers to atx-style 2022-11-10 12:02:12 -05:00
ryan 322fb1248d Updating Hashes to SHA256 + typo fixes 2022-09-16 09:44:47 -04:00
ryan d9e84725bf HTML tables inside Markdown 2022-08-18 15:15:00 -04:00
ryan 7fe9a48518 Added 'Enhanced ATT&CK Techniques' section 2022-08-10 15:40:57 -04:00
ryan cd7b66d5b9 Adding PR feedback 2022-08-09 14:34:00 -04:00
ryan e07e00f4d4 Enhanced malware corpus & update file names to match behaviors 2022-08-02 10:32:52 -04:00
Emmanuelle Vargas-Gonzalez e0fffe4d5c update internal links 2021-02-09 19:26:58 -05:00
Emmanuelle Vargas-Gonzalez b7197c785d make all internal references relative 2020-08-21 17:49:32 -04:00
Emmanuelle Vargas-Gonzalez 3e5d257030 Normalizing tables, dividers, style layout, minor content typos 2020-08-20 16:05:08 -04:00
Desiree Beck b8a4d9e321 update beh names 2019-12-23 12:24:06 -05:00
Emmanuelle Vargas-Gonzalez 2f81cbc225 add an extra row for xample-malware entries to include associated ATT&CK entry 2019-11-08 18:29:59 -05:00
Desiree Beck 15df2d1b99 fix links 2019-09-17 19:11:49 -04:00
Chris Lenk 6f7812e440 Fix links to MBC 2019-08-07 09:26:33 -04:00
Desiree Beck 2cca7af5ae initial commit 2019-08-01 13:56:04 -04:00