613 Commits

Author SHA1 Message Date
Desiree Beck 4ff8c3a316 Staging (#126)
* Changing conti name

* Mbc 3 (#125)

* update version number

* update links

* update version number

* update version number

* update version number

* 2.3 to main in matrix

* link fix

* v3 faq update

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

---------

Co-authored-by: ryan <ryanxu@wustl.edu>
v3.0
2023-09-29 20:34:10 -04:00
Ryan Xu f7d92d59fa Staging (#124)
- Updating capa detection in behaviors
- Newsletter
- Conti malware
- pafish faq
2023-09-20 15:57:32 -04:00
Ryan Xu 7223fa76d6 Aug 23 update (#118) (#119)
* update faq

* update faq

* update corpus doc

* update corpus doc

* update FAQ

* update FAQ

* update FAQ

* update FAQ

* update FAQ

* update what's new

* Cleaning ref links, etc (#115) (#116)

* Cleanup

---------



* Revert "Cleaning ref links, etc (#115) (#116)" (#117)

This reverts commit 57d470ab4c.

* reorder questions

* reorder questions

* reorder questions

* reorder questions

* update faq

* update faq

* update faq

* update faq

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
2023-08-23 14:05:31 -04:00
Ryan Xu c9b0396e0e Cleaning ref links, etc (#115)
* Cleanup

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
2023-08-17 14:08:55 -04:00
Ryan Xu 94eed133d7 Syntax change (#109) 2023-06-29 12:57:34 -04:00
Ryan Xu 1a009c8077 attack flow and cacao patch (#107) (#108)
* Update README.md

fix link

* Update README.md

* add Attack Flow content for two corpus malware

* add info about attack flow and cacao

* add info about attack flow and cacao

* info about cacao playbook

* update readme for cacao and attack flow

* add text for cacao

* update readme for cacao and attack flow

Co-authored-by: Desiree Beck <dbeck@mitre.org>
2023-06-28 10:09:08 -04:00
Desiree Beck ddbb2caa46 June newsletter (#106)
* june newsletter

* June newsletter

* June newsletter

* June newsletter

* June newsletter

* June newsletter

* June newsletter

* June newsletter
2023-06-20 23:16:01 -04:00
Ryan Xu 275c8feec3 New Malware Examples + Editing References (#105)
* New malware examples (#103)

* fix typos

* add new Use in Malware entries to behaviors

* new corpus entries

* remove extraneous ref

* restore original IDs

* fix typos

* Update registry.md (#101)

Update C0036.001 per "Registry micro-behavior" Discussion.

* Update registry.md (#102)

Update C0036.001 per "Registry micro-behavior" Discussion.

* correct modified date

* fix PR comments on formatting

* Editing references (#104)

---------

Co-authored-by: Desiree Beck <dbeck@mitre.org>
2023-06-12 11:10:47 -04:00
Desiree Beck 39a49dca38 Update registry.md
Update C0036.001 per "Registry micro-behavior" Discussion.
2023-05-24 22:52:05 -04:00
Ryan Xu 17663f17f6 minor fixes (#99) 2023-05-22 10:18:37 -04:00
Ryan Xu 0400889da4 Update sandbox-detection.md (#97) 2023-05-09 13:16:38 -04:00
Ryan Xu 0238c12f6e Enhancing behavior descriptions, formatting + citation updates (#96)
* formatting and citation updates

* Adding Janet's work on behavior descriptions
2023-05-08 10:32:10 -04:00
Ryan Xu b43365cb18 New methods (#93) (#94)
* two new methods

* two new methods

* two new methods

Co-authored-by: Desiree Beck <dbeck@mitre.org>
2023-04-26 15:37:32 -04:00
Ryan Xu 337d99e890 Typo fixes in xample-malware (#92) 2023-04-03 15:09:07 -04:00
Ryan Xu 6509b3dedb Added clarification to malware corpus description (#89) 2023-03-20 13:32:34 -04:00
Ryan Xu f3a6002ab4 Adding references page (#88)
* Adding references_to_mbc page

* Adding refs
2023-03-20 09:46:42 -04:00
Ryan Xu 3dafbebc69 disk-wipe fix (#87) 2023-03-16 10:40:33 -04:00
Desiree Beck 92b76bde3d March newsletter (#86)
* march 2023 newsletter
2023-03-15 13:10:04 -04:00
Ryan Xu e1b22023c5 Staging (#85)
* Janet mbc updates (#84)

* Added Unprotect techniques to respective behaviors and or methods.

* Unprotect updates MBC

* Unprotect techniques mapped in MBC

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Fixing redundant Detection sec in sandbox detect

---------

Co-authored-by: quant23va <105243450+quant23va@users.noreply.github.com>
2023-03-15 10:20:48 -04:00
Ryan Xu 9e30d80c19 Staging (#83)
* Adding script files

* Scripting overhaul

* Adding capa analysis from MITRE into corpus

* Adding capa analysis from MITRE into corpus

* Backtracing capa mappings to behavior pages

* Other fixes

* merge dev into staging

* Fixing capa mappings

* merge dev into staging

* fix writes file typo

* merge dev into staging

* Fix method column + cape analysis

* Updates to snippets and descriptions
2023-03-14 09:28:34 -04:00
Desiree Beck 46d44c90c6 fix link typo 2023-03-11 11:15:10 -05:00
Stephen Battista c36a5217b4 Fixed dead links moved http to https (#82)
* Fixed dead links moved http to https

* Updated Joesecurity link to not use web archive
2023-03-04 13:54:02 -05:00
Desiree Beck 573b932926 Update poison-ivy.md 2023-03-01 03:17:02 -05:00
Desiree Beck bfbe6defaa Update kovter.md 2023-03-01 03:15:42 -05:00
Lauren Parker 94fa3c86b8 Lauren malware corpus (#81)
* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated info

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* updated ID number

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos

* fixed typos
2023-03-01 03:12:22 -05:00
Desiree Beck 4c418892ee Update process-injection.md
corrected link
2023-02-20 04:03:23 -05:00
Desiree Beck d6dae1437c Update cape.md
update formatting
2023-02-14 05:38:05 -05:00
Desiree Beck 2d7229c8ef Update capa.md
update formatting
2023-02-14 05:37:02 -05:00
Desiree Beck 35ea70d679 Update cape.md
Further explain histogram contents.
2023-02-14 05:27:29 -05:00
Desiree Beck 699c4f94a6 Update capa.md
update text to more clearly explain content
2023-02-14 05:20:46 -05:00
Ryan Xu 1917b816ca Adding capa analysis to corpus and improved backtrace to behavior pages (#80)
* Adding script files

* Scripting overhaul

* Adding capa analysis from MITRE into corpus

* Adding capa analysis from MITRE into corpus

* Backtracing capa mappings to behavior pages

* Other fixes

* merge dev into staging

* Fixing capa mappings

* merge dev into staging

* fix writes file typo

* merge dev into staging

* Fix method column + cape analysis
2023-02-01 10:28:30 -05:00
Desiree Beck da00a07f6b Update README.md 2022-12-29 12:56:48 -05:00
Desiree Beck 4222adac4a Update README.md
update copyright
2022-12-29 12:55:22 -05:00
Desiree Beck c84e8062aa Update 12152022.md
minor corrections
2022-12-15 23:55:52 -05:00
Desiree Beck 3c094648be Merge pull request #78 from MBCProject/dec-newsletter
Dec newsletter
2022-12-15 23:47:37 -05:00
Desiree Beck 962ff10437 Merge pull request #77 from MBCProject/obj-list
Obj list
2022-12-14 16:09:56 -05:00
Dez Beck 5b52f47491 draft dec newsletter 2022-12-14 10:41:50 -05:00
Dez Beck 0845e52f71 draft dec newsletter 2022-12-14 10:39:26 -05:00
Dez Beck 5df6d33896 draft dec newsletter 2022-12-12 13:21:15 -05:00
Dez Beck 3d754d97e9 draft dec newsletter 2022-12-12 13:17:20 -05:00
Dez Beck 04d9933540 draft dec newsletter 2022-12-12 13:05:27 -05:00
Dez Beck 31b9e73fd8 draft dec newsletter 2022-12-12 13:03:46 -05:00
Dez Beck fab70e0a04 correct typo 2022-12-12 12:58:18 -05:00
Dez Beck b478f86e3a draft dec newsletter 2022-12-12 12:57:29 -05:00
Dez Beck 85d13ea6c8 add missing data 2022-12-12 09:58:54 -05:00
Dez Beck 925207b992 fix incorrect link 2022-12-11 19:16:25 -05:00
Dez Beck 18f8fded32 add framework for cape signatures 2022-12-11 18:57:25 -05:00
Dez Beck d8f6471a23 add framework for cape signatures 2022-12-11 17:05:53 -05:00
Dez Beck 5adac81159 add framework for cape signatures 2022-12-11 16:58:29 -05:00
Dez Beck 0ef2b8a7fb add framework for cape signatures 2022-12-11 16:53:59 -05:00