0aa720aa31
add December Newsletter ( #171 )
...
* Create 09192024.md
newsletter for MBC v3.2
* Update 09192024.md
* Update README.md
* Update 09192024.md
* Update 09192024.md
* Update 09192024.md
* Rename 09192024.md to 09242024.md
* Rename 09242024.md to 09232024.md
* Update README.md
* Update 09232024.md
* Update and rename 09232024.md to 10212024.md
* Update and rename 10212024.md to 12092024.md
* Update README.md
2024-12-09 10:41:09 -05:00
0fab38218e
Staging ( #170 )
...
* Update dns-communication.md
* Update dns-communication.md
* Update http-communication.md
* Update icmp-communication.md
* Update interprocess-communication.md
* Update socket-communication.md
* Update wininet.md
* Update encrypt-data.md
* Update encrypt-data.md
* Update encryption-key.md
* Update alter-file-extension.md
* Update create-directory.md
* Update create-file.md
* Update create-file.md
* Update delete-file.md
* Update registry.md
* Update wallpaper.md
* Update create-process.md
* Update check-mutex.md
* Update writes-file.md
* Update create-mutex.md
---------
Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com >
2024-11-18 15:03:18 -05:00
af8c8ea7ff
Merge pull request #166 from MBCProject/add-new-matrix-image
...
uploaded table drafts
2024-10-21 07:37:37 -04:00
aa63470894
Merge pull request #167 from MBCProject/update_cape_classes
...
Update cape classes
2024-10-21 07:37:22 -04:00
634e938b37
Added matrix images with alphabetic objectives
2024-10-17 12:49:58 -04:00
476b07385d
removed old tables
2024-10-17 10:44:52 -04:00
0468702b69
Added new matrix images for 3.2
2024-10-17 10:41:15 -04:00
03571e42e7
Update modify-registry.md
...
Found and repaired last broken link
2024-10-02 11:48:36 -04:00
9cdd933745
Update allocate-thread-local-storage.md
...
Changed allocate TLS detection to new CAPA link
2024-10-02 11:10:24 -04:00
7321acd0a1
Update process-injection.md
...
New link for silent process exit
2024-10-02 11:06:59 -04:00
b9021def42
Update exploitation-for-client-execution.md
...
Updated link to Windows utilities
2024-10-02 11:01:10 -04:00
95ff87565f
Update set-thread-local-storage-value.md
...
Updated link to CAPA rule
2024-10-02 10:52:33 -04:00
2ba3797884
Update registry.md
...
Updated neshta signature link
2024-10-02 10:49:09 -04:00
8dd14afae3
Update create-mutex.md
...
Updated Zeus P2P link
2024-10-02 10:40:52 -04:00
e7a3dae7e6
Update move-file.md
...
Updated CAPE link and CAPE class
2024-10-02 10:28:36 -04:00
44a35ab0d8
Update allocate-memory.md
...
Updated CAPE link and class
2024-10-02 10:26:32 -04:00
2965436b62
Update allocate-memory.md
...
Fixed bad CAPA link
2024-10-02 10:17:55 -04:00
91ec7133ff
Update allocate-memory.md
...
Updated bad CAPA rule link
2024-10-02 10:06:44 -04:00
4874fd4b35
Update terminate-process.md
...
Added new link and CAPE class for rule
2024-10-02 10:02:25 -04:00
1317809f48
Update decompress-data.md
2024-09-27 12:08:35 -04:00
f3fbf1f51b
Update decrypt-data.md
...
Added class to CAPE mapping
2024-09-27 11:58:19 -04:00
d180c7bb60
uploaded table drafts
2024-09-27 08:55:53 -04:00
70f151ebe4
Update Process micro-objective ( #164 )
...
* Update create-mutex.md
* Update create-mutex.md
* Update README.md
* Update README.md
* Delete micro-behaviors/process/synchronization.md
* Update mbc_summary.md
---------
Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com >
2024-09-16 13:50:08 -04:00
c3033e4061
Staging ( #162 )
...
* update staging (#158 )
* update format/wording
* Capa 7.1 rule updates (#156 )
* Update self-deletion.md
Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml )
* Update obfuscated-files-or-information.md
added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml
* Update disk-wipe.md
Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml " https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml
* Update system-information-discovery.md
Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml
* Update system-information-discovery.md
Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml
* Update dns-communication.md
Removed duplication in APIs in "Resolve DNS" CAPA rule
* Update socket-communication.md
Updated APIs for "create raw socket" CAPA rule
* Update socket-communication.md
Updated APIs on CAPA rule "get socket status"
* Update socket-communication.md
Updated CAPA rule "initialize Winsock library"
* Update socket-communication.md
Updated API listing on CAPA rule "receive data on socket"
* Update socket-communication.md
Updated API listing for "send data on socket" CAPA rule
* Update socket-communication.md
Update APIs for CAPA rule "set socket configuration"
* Update socket-communication.md
Updated CAPA rule "connect tcp socket" to add APIs
* Update socket-communication.md
Added APIs to CAPA rule "create tcp socket"
* Update socket-communication.md
Added APIs to "create UDP socket" CAPA rule
* Update encrypt-data.md
Added new APIs to "encrypt data using DPAPI" CAPA rule
* Update install-driver.md
Added APIs to CAPA rule "install driver"
* Update set-file-attributes.md
Added APIs to CAPA rule "change file permissions on Linux"
* Update writes-file.md
Updated APIs for CAPA rule "write file on linux"
* Update system-information-discovery.md
Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1
* Update create-process.md
Added API to "create process on linux" CAPA rule
* Update hijack-execution-flow.md
Added API calls to CAPA rule "execute shellcode via Windows callback function"
* Update self-deletion.md
Changed link to master
* Update obfuscated-files-or-information.md
Changed rule link to release to point to master
* Update system-information-discovery.md
Removed nursery rules
* Update disk-wipe.md
Updated link to master branch
* Update socket-communication.md
Checked for correct socket listings under the APIs
---------
Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com >
* New method (#159 )
* update format/wording
* Update disassembler-evasion.md
* Update disassembler-evasion.md
* Corpus fix (#160 )
* update format/wording
* fix tables
* Edits
---------
Co-authored-by: ryan <ryanxu@wustl.edu >
* New method (#161 )
* update format/wording
* Update disassembler-evasion.md
* Update disassembler-evasion.md
---------
Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com >
Co-authored-by: ryan <ryanxu@wustl.edu >
2024-08-25 10:09:33 -04:00
084ba830d3
Capa 7.1 rule updates ( #156 )
...
* Update self-deletion.md
Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml )
* Update obfuscated-files-or-information.md
added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml
* Update disk-wipe.md
Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml " https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml
* Update system-information-discovery.md
Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml
* Update system-information-discovery.md
Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml
* Update dns-communication.md
Removed duplication in APIs in "Resolve DNS" CAPA rule
* Update socket-communication.md
Updated APIs for "create raw socket" CAPA rule
* Update socket-communication.md
Updated APIs on CAPA rule "get socket status"
* Update socket-communication.md
Updated CAPA rule "initialize Winsock library"
* Update socket-communication.md
Updated API listing on CAPA rule "receive data on socket"
* Update socket-communication.md
Updated API listing for "send data on socket" CAPA rule
* Update socket-communication.md
Update APIs for CAPA rule "set socket configuration"
* Update socket-communication.md
Updated CAPA rule "connect tcp socket" to add APIs
* Update socket-communication.md
Added APIs to CAPA rule "create tcp socket"
* Update socket-communication.md
Added APIs to "create UDP socket" CAPA rule
* Update encrypt-data.md
Added new APIs to "encrypt data using DPAPI" CAPA rule
* Update install-driver.md
Added APIs to CAPA rule "install driver"
* Update set-file-attributes.md
Added APIs to CAPA rule "change file permissions on Linux"
* Update writes-file.md
Updated APIs for CAPA rule "write file on linux"
* Update system-information-discovery.md
Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1
* Update create-process.md
Added API to "create process on linux" CAPA rule
* Update hijack-execution-flow.md
Added API calls to CAPA rule "execute shellcode via Windows callback function"
* Update self-deletion.md
Changed link to master
* Update obfuscated-files-or-information.md
Changed rule link to release to point to master
* Update system-information-discovery.md
Removed nursery rules
* Update disk-wipe.md
Updated link to master branch
* Update socket-communication.md
Checked for correct socket listings under the APIs
2024-08-24 13:19:12 -04:00
ad8e58255c
update format/wording
2024-07-16 17:31:19 -04:00
e1f6657ac0
Update README.md ( #155 )
...
see Issue #152
2024-06-30 16:24:18 -04:00
53771d2293
Updated MBC-CAPE signature mappings ( #153 )
...
* Deleted deprecated signatures
* Added new signature
* Updated table to match new CAPE signatures' format
* Added new signature mappings
* Fixed table header
* Deleted unspecified API
* Updated table to match new CAPE signature format. Fixed existing signatures.
* Deleted deprecated signatures
* Added missing class
* Added new signature mappings
* Deleted deprecated signatures
* Updated table to match new CAPE signature format
* Added new signature mappings
* Updated deprecated links
* Updated table to match new CAPE signature format
* Added new signature mapping
* Updated table format, signature, and link
* Fixed existing signatures' url
* Deleted deprecated signatures
* Updated existing signatures
* Added new signature mappings
* Deleted deprecated signature
* Updated table. Added new signature mappings.
* Deleted deprecated signatures
* Updated table to new CAPE signature format
* Added new signature mappings
* Deleted deprecated signatures
* Updated table. Added new signature mappings.
* Deleted deprecated signatures
* Updated table. Added new signature mappings
* Fixed broken url
* Updated table
* Deleted deprecated signatures
* Updated table format. Added new signature mapping.
* Deleted deprecated signatures
* Updated table. Fixed already existing signatures.
* Added new signature mappings
* Updated existing signatures
* Updated table format. Deleted deprecated signatures.
* Updated existing signatures
* Added new signature mappings
* Updated existing signatures
* Updated table and signatures
* Fixed existing signatures
* Deleted deprecated signatures
* Updated table
* Added new signature mappings
* Updated existing signatures
* Updating existing signatures
* Updating existing signatures
* Updating exiting signature
* Deleted deprecated signatures
* Updated existing signatures
* Updated existing signatures
* Added new signature mappings
* Deleted deprecated signature
* Updated table
* Added new signature mapping
* Deleted deprecated signatures
* Added new signature mappings
* Deleted deprecated signatures
* Added new signature mappings
* Updated table and existing signatures
* Deleted deprecated signatures
* Updated table and existing signatures
* Added new signature mappings
* Fixing typos
* Fixing typos II
* Fixing typos III
2024-06-30 15:08:20 -04:00
bd31003a22
Staging ( #151 )
...
* Fixing links
* Code samples (#149 )
* Update obfuscated-files-or-information.md
Added code sample with some proposed formatting incl. annotations explaining broad behavior patterns
* Update obfuscated-files-or-information.md
Added brief clarification to note
* Update obfuscated-files-or-information.md
Made requested changes to format
* Update system-information-discovery.md
Added code snippet from PoisonIvy RAT
* Update debugger-detection.md
Added code with example of PEB access
* Update system-information-discovery.md
Added new method based on code snippet
* Update registry.md
Added snippet for registry key query
* Update generate-pseudorandom-sequence.md
Added example of Mersenne Twister algorithm
* Update keylogging.md
Add Dark Comet keylogging code sample
* Update dns-communication.md
Added code sample from darkcomet
* Update socket-communication.md
Added DarkComet code snippet
* Update delete-file.md
Provided DarkComet sample
* Update file-and-directory-discovery.md
Added DarkComet snippet
* Update allocate-memory.md
Added DarkComet sample
* Update modulo.md
Added Hupigon snippet
* Update get-file-attributes.md
Added Hupigon sample
* Update application-window-discovery.md
Added Hupigon snippet
* Update create-process.md
Added Hupigon snippet.
* Update conditional-execution.md
Added Hupigon snippet
* Update create-thread.md
Added Hupigon snippet
* Update resume-thread.md
Added Hupigon snippet
* Update command-and-scripting-interpreter.md
Added SmokeLoader sample
* Update change-memory-protection.md
Added SmokeLoader snippet
* Update console.md
Added snippet from SmokeLoader
* Update dynamic-analysis-evasion.md
Added Industroyer sample
* Update interprocess-communication.md
Added CobaltStrike sample
* Update read-file.md
Added Cobalt Strike snippet
* Update writes-file.md
Added cobalt strike snippet
* Update noncryptographic-hash.md
Added emotet snippet
* Update clipboard-modification.md
Added emotet snippet
* Update check-mutex.md
Added emotet sampler
* Update check-mutex.md
Fixed typo
* Update create-mutex.md
Added Emotet snippet
* Update allocate-thread-local-storage.md
Added emotet snippet
* Update registry-run-keys-startup-folder.md
Added emotet snippet
* Update wininet.md
Added EnvyScout snippet
* Update http-communication.md
Added EnvyScout snippet
* Update enumerate-threads.md
Added Envyscout snippet
* Update set-thread-local-storage-value.md
Added Envyscout sample
* Update create-directory.md
Added explosive snippet
* Update delete-directory.md
Added explosive code snippet (note: the malware is called "explosive")
* Update set-file-attributes.md
Added explosive sample
* Update terminate-process.md
Added explosive snippet
* Update terminate-thread.md
Added explosive sample
* Update move-file.md
Added Finfisher snippet
* Update screen-capture.md
Added ECCENTRICBANDWAGON snippet
* Fix links (#150 )
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* fix link
* update mod date
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* fix links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* update links
* Update code-discovery.md
* Update taskbar-discovery.md
* Update conditional-execution.md
* Update memory-dump-evasion.md
* Update execution-dependency.md
* Update compromise-data-integrity.md
* Update dns-communication.md
* Update http-communication.md
* Update interprocess-communication.md
* Update socket-communication.md
* Update wininet.md
* Update generate-pseudorandom-sequence.md
* Update modulo.md
* Update noncryptographic-hash.md
* Update create-directory.md
* Update delete-directory.md
* Update delete-file.md
* Update get-file-attributes.md
* Update move-file.md
* Update read-file.md
* Update terminate-thread.md
* Update set-file-attributes.md
* Update writes-file.md
* Update allocate-memory.md
* Update change-memory-protection.md
* Update console.md
* Update registry.md
* Update allocate-thread-local-storage.md
* Update check-mutex.md
* Update terminate-process.md
* Update create-mutex.md
* Update create-process.md
* Update set-thread-local-storage-value.md
* Update resume-thread.md
* Update enumerate-threads.md
* Update create-thread.md
* update for 3.1 release
* update for 3.1 release
* update for 3.1 release
---------
Co-authored-by: ryan <ryanxu@wustl.edu >
Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com >
2024-05-01 16:09:33 -04:00
42dc41e00b
update for attack v15 ( #148 )
...
* update for attack v15
* update modified date
2024-04-28 14:32:00 -04:00
009ae77217
3.1 Updates ( #145 )
...
* E/f updates (#143 )
* E/F Update, Update Install Cert ID
* Small fixes
* Update common objects link (#142 )
* Update README.md
* Update 09152023.md
* Update README.md
* Update 12182023.md
* Adding descriptions to micro-behaviors
* Fixing dead links
* V3.1 updates (#144 )
* minor fixes for v3.1
* correct id
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
2024-02-14 09:27:20 -05:00
ad05fb07ba
Updating version and last modified
2024-01-02 12:58:56 -05:00
356d3dc416
Update bagle.md ( #141 )
...
* Update bagle.md
* Update malware-types.md
* Update redhip.md
* Update rombertik.md
* Update snake.md
* Update malware-types.md
* Update snake.md
* Update redhip.md
* Update rombertik.md
2023-12-21 09:18:21 -05:00
6ce7ebadf2
Malware types ( #140 )
...
* Create malware-types.md
* Update README.md
added link to malware type table.
* Update malware-types.md
* Update malware-types.md
* Update malware-types.md
* Update malware-types.md
* Update malware-types.md
* Update malware-types.md
* Update geneio.md
* Update geneio.md
* Update searchawesome.md
* Update chopstick.md
* Update cozycar.md
* Update gobotkr.md
* Update heriplor.md
* Update hupigon.md
* Update synful-knock.md
* Update mebromi.md
* Update blackenergy.md
* Update cozycar.md
* Update cozycar.md
* Update drovorub.md
* Update evilbunny.md
* Update gamut.md
* Update gobotkr.md
* Update cozycar.md
* Update kovter.md
* Update kraken.md
* Update mazarbot.md
* Update blackenergy.md
* Update matanbuchus.md
* Update yispecter.md
* Update cozycar.md
* Update up007.md
* Update teardrop.md
* Update redhip.md
* Update malware-types.md
* Update rombertik.md
* Update snake.md
* Update snake.md
* Update dark-comet.md
* Update badusb.md
* Update dyepack.md
* Update conti.md
* Update cryptolocker.md
* Update cryptowall.md
* Update locky-bart.md
* Update netwalker.md
* Update samsam.md
* Update wannacry.md
* Update adwind-jrat.md
* Update electrorat.md
* Update gravity-rat.md
* Update poison-ivy.md
* Update terminator.md
* Update clipminer.md
* Update webcobra.md
* Update drovorub.md
* Update dark-comet.md
* Update attor.md
* Update geneio.md
* Update malware-types.md
* Update trickbot.md
* Update dark-comet.md
* Update dnschanger.md
* Update emotet.md
* Update kovter.md
* Update heriplor.md
* Update trickbot.md
* Update ursnif.md
* Update mazarbot.md
* Update shamoon.md
* Update bagle.md
* Update conficker.md
* Update stuxnet.md
* Update vobfus.md
* Newsletter, editing E1510, E1560 (#137 ) (#138 )
* Adding Newsletter
* Create 12182023.md
* Update README.md
---------
* Update e1510 (#134 )
* Update clipboard-modification.md
Update to account for updates to T1115.
* Update data-encrypted-for-impact.md
fix parentheses
* Update clipboard-modification.md
* Update data-encrypted-for-impact.md
* Update clipboard-modification.md
* Moving Archive Collected Data to collection, some description updates
* Updating Last Modified
---------
Co-authored-by: Ryan Xu <ryanxu@wustl.edu >
* Newsletter, editing E1510, E1560 (#137 ) (#139 )
* Adding Newsletter
* Create 12182023.md
* Update README.md
---------
* Update e1510 (#134 )
* Update clipboard-modification.md
Update to account for updates to T1115.
* Update data-encrypted-for-impact.md
fix parentheses
* Update clipboard-modification.md
* Update data-encrypted-for-impact.md
* Update clipboard-modification.md
* Moving Archive Collected Data to collection, some description updates
* Updating Last Modified
---------
Co-authored-by: Ryan Xu <ryanxu@wustl.edu >
---------
Co-authored-by: Ryan Xu <ryanxu@wustl.edu >
2023-12-20 21:54:25 -05:00
a92e8ffdfd
Newsletter, editing E1510, E1560 ( #137 )
...
* Adding Newsletter
* Create 12182023.md
* Update README.md
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
* Update e1510 (#134 )
* Update clipboard-modification.md
Update to account for updates to T1115.
* Update data-encrypted-for-impact.md
fix parentheses
* Update clipboard-modification.md
* Update data-encrypted-for-impact.md
* Update clipboard-modification.md
* Moving Archive Collected Data to collection, some description updates
* Updating Last Modified
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
2023-12-18 13:40:56 -05:00
d423b5a5fa
Adding CAPE mappings to detection section ( #132 )
...
* Making spacing between sections consistent
* Adding cape mappings
2023-12-05 14:19:50 -05:00
463eef29c1
Updating Summary and Minor Fixes ( #131 )
...
* Updating Summary
* Minor fixes (#130 )
* How to cite (#127 )
* Added citation-related files
* Modified type to misc. Commented out the license
* Modified main README to match output produced by CITATION.cff
* Update CITATION.cff
* Update README.md
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
* Update dynamic-analysis-evasion.md
remove duplicated text and fix link
* Update sandbox-detection.md
Corrected technique name
* Update README.md
* Update mbc_summary.md
---------
Co-authored-by: RazviOverflow <41084837+RazviOverflow@users.noreply.github.com >
* fixes to summary
* ordering change
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
Co-authored-by: RazviOverflow <41084837+RazviOverflow@users.noreply.github.com >
2023-11-16 09:38:32 -05:00
30d610503e
How to cite ( #127 )
...
* Added citation-related files
* Modified type to misc. Commented out the license
* Modified main README to match output produced by CITATION.cff
* Update CITATION.cff
* Update README.md
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
2023-10-30 09:37:19 -04:00
74d28a9ef9
small malware fixes ( #129 )
2023-10-26 11:33:17 -04:00
c2df3d4e10
Staging ( #126 )
...
* Changing conti name
* Mbc 3 (#125 )
* update version number
* update links
* update version number
* update version number
* update version number
* 2.3 to main in matrix
* link fix
* v3 faq update
---------
Co-authored-by: ryan <ryanxu@wustl.edu >
---------
Co-authored-by: ryan <ryanxu@wustl.edu >
2023-10-03 11:36:05 -04:00
f7d92d59fa
Staging ( #124 )
...
- Updating capa detection in behaviors
- Newsletter
- Conti malware
- pafish faq
2023-09-20 15:57:32 -04:00
7223fa76d6
Aug 23 update ( #118 ) ( #119 )
...
* update faq
* update faq
* update corpus doc
* update corpus doc
* update FAQ
* update FAQ
* update FAQ
* update FAQ
* update FAQ
* update what's new
* Cleaning ref links, etc (#115 ) (#116 )
* Cleanup
---------
* Revert "Cleaning ref links, etc (#115 ) (#116 )" (#117 )
This reverts commit 57d470ab4cdbeck@mitre.org >
2023-08-23 14:05:31 -04:00
c9b0396e0e
Cleaning ref links, etc ( #115 )
...
* Cleanup
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
2023-08-17 14:08:55 -04:00
94eed133d7
Syntax change ( #109 )
2023-06-29 12:57:34 -04:00
1a009c8077
attack flow and cacao patch ( #107 ) ( #108 )
...
* Update README.md
fix link
* Update README.md
* add Attack Flow content for two corpus malware
* add info about attack flow and cacao
* add info about attack flow and cacao
* info about cacao playbook
* update readme for cacao and attack flow
* add text for cacao
* update readme for cacao and attack flow
Co-authored-by: Desiree Beck <dbeck@mitre.org >
2023-06-28 10:09:08 -04:00
ddbb2caa46
June newsletter ( #106 )
...
* june newsletter
* June newsletter
* June newsletter
* June newsletter
* June newsletter
* June newsletter
* June newsletter
* June newsletter
2023-06-20 23:16:01 -04:00
275c8feec3
New Malware Examples + Editing References ( #105 )
...
* New malware examples (#103 )
* fix typos
* add new Use in Malware entries to behaviors
* new corpus entries
* remove extraneous ref
* restore original IDs
* fix typos
* Update registry.md (#101 )
Update C0036.001 per "Registry micro-behavior" Discussion.
* Update registry.md (#102 )
Update C0036.001 per "Registry micro-behavior" Discussion.
* correct modified date
* fix PR comments on formatting
* Editing references (#104 )
---------
Co-authored-by: Desiree Beck <dbeck@mitre.org >
2023-06-12 11:10:47 -04:00
39a49dca38
Update registry.md
...
Update C0036.001 per "Registry micro-behavior" Discussion.
2023-05-24 22:52:05 -04:00
17663f17f6
minor fixes ( #99 )
2023-05-22 10:18:37 -04:00
0400889da4
Update sandbox-detection.md ( #97 )
2023-05-09 13:16:38 -04:00
Desiree Beck