Staging (#126)

* Changing conti name

* Mbc 3 (#125)

* update version number

* update links

* update version number

* update version number

* update version number

* 2.3 to main in matrix

* link fix

* v3 faq update

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

README.md

@@ -1,16 +1,21 @@
-# <a name="mbc"></a>Malware Behavior Catalog v2.1 #
-The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions.
+# <a name="mbc"></a>Malware Behavior Catalog v3.0 #
+The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions, and read the [newsletters](./ynewsletters/README.md) for information on the most recent MBC updates and activity.
 
-Check out the MBC presentations:
+Open-source malware analysis tools map their output to MBC and ATT&CK:
+
+* [capa](https://github.com/fireeye/capa-rules) - see the [capa rule mapping distribution](./capa.md)
+* [CAPE](https://github.com/kevoreilly/community/tree/master/modules/signatures) - see the [CAPE signature mapping distribution](./cape.md)
+
+MBC supports other community efforts:
+
+* [CACAO](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cacao) - a [playbook](https://github.com/oasis-tcs/cacao/tree/master/Examples/CACAO-2.0) for the MBC corpus malware [Locky Bart](./xample-malware/locky-bart.md) shows how CACAO can reference MBC behaviors.
+* [Attack Flow](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/corpus) - flow diagrams for the MBC corpus malware [Shamoon](./xample-malware/shamoon.md) and [SearchAwesome](./xample-malware/searchawesome.md) illustrate how Attack Flow can reference MBC behaviors.
+
+Check out MBC presentations:
 
 * [Standardized Reporting with the Malware Behavior Catalog](https://youtu.be/qZef-SoREdY), VB2020 localhost (October 2020)
 * [Malware Behavior Catalog](https://youtu.be/KY8Ty-0sdVU), BSides DC (October 2019)
 
-We've also mapped MBC (and ATT&CK) to two open-source malware analysis tools:
-
-* [Cuckoo community signatures](https://github.com/MBCProject/community)
-* [capa rules](https://github.com/fireeye/capa-rules)
-
 To join the **MBC mailing list**, please send a request to mbc@mitre.org.
 
 ### Objectives ###
@@ -24,11 +29,11 @@ Methods are associated with behaviors and serve different roles, depending on th
 
 Note that a method cannot be used without a behavior.
 
-### Micro-behaviors ###
+### Micro-objectives / Micro-behaviors ###
 Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](./micro-behaviors/README.md) for details.
 
 ### <a name="ids"></a>Identifiers ###
-As shown below, the letter of an identifier relays information about a behavior. Note that letters used in MBC 2.0 are changed from previous versions.
+As shown below, the letter of an identifier relays information about a behavior. Note that letters used in MBC v2 and v3 are changed from MBC v1.
 
 |**Letter**|**Example**|**Description**|
 |---|---|---|
@@ -45,38 +50,100 @@ Two letters of an identifier relay information about an objective.
 |**OB**|*OB0001*|An MBC objective.|
 |**OC**|*OC0003*|An MBC micro-objective.|
 
-Identifiers of methods are formatted in the same say as ATT&CK sub-techniques. If MBC defines a new method for an existing ATT&CK technique, the identifier is changed from "T" to "E" and an "m" identifier is added (e.g., a method added to T1234 would be denoted *E1234.m01* and is different than *T1234.001*, although both refer to the T1234 ATT&CK technique). Method identifiers of "B", "C", and "F" behaviors are defined without the "m" (e.g., *B0008.009*; *C0005.002*; *F0001.005*).
+Identifiers of methods are formatted in the same way as ATT&CK sub-techniques. If MBC defines a new method for an existing ATT&CK technique, the identifier is changed from "T" to "E" and an "m" identifier is added (e.g., a method added to T1234 would be denoted *E1234.m01* and is different than *T1234.001*, although both refer to the T1234 ATT&CK technique). Method identifiers of "B", "C", and "F" behaviors are defined without the "m" (e.g., *B0008.009*; *C0005.002*; *F0001.005*).
 
 When two or more MBC behaviors refine the same ATT&CK technique, each is given an MBC identifier and each references the ATT&CK identifier. When a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier is preserved and the new ATT&CK identifier is referenced.
 
+In cases where an MBC behavior enhances a technique/sub-technique that is defined in both ATT&CK Mobile and Enterprise, the "E" identifier used in MBC corresponds to the Enterprise identifier. For example, the Obfuscated Files or Information technique has identifier <a href="https://attack.mitre.org/techniques/T1027/">T1027</a> in Enterprise, identifier <a href="https://attack.mitre.org/techniques/T1406/">T1406</a> in Mobile, and identifier <a href="./defense-evasion/obfuscated-files-or-information.md">E1027</a> in MBC.
+
 ### Canonical Representation ###
 The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**. For example, *ANTI-BEHAVIORAL ANALYSIS::Debugger Detection::Process Environment Block*. 
 
 Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.
 
-### Example Malware ###
-The MBC also contains a collection of [example malware](./xample-malware/README.md) that are characterized with malware behaviors.
+### STIX 2.1 Representation ###
+A STIX 2.1 representation for MBC v3.0 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior) that includes new STIX domain objects for MBC objectives, behaviors, and methods.
 
-## Micro-behavior Objectives ##
-[Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.
+### Navigator View ###
+This visual representation of the MBC Matrix is based on the ATT&CK Navigator. Two views are available: 
+
+* <a href="https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_with_ids.svg" target="_blank">Matrix with identifiers</a>
+* <a href="https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_without_ids.svg" target="_blank">Matrix without identifiers</a>
+
+### Malware Corpus ###
+The MBC contains a [malware corpus](./xample-malware/README.md) where each malware entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports. Note that some malware types are also present in the ATT&CK software page. We refer readers to the corresponding ATT&CK page for a list of identified ATT&CK techniques. However, we will list any newly identified ATT&CK techniques in the MBC malware page. 
 
 ## Malware Objective Descriptions ##
-Malware objectives are defined in the table below. Follow the links to view associated behaviors. A visual representation of the MBC Matrix is also available (opens in a new window). There is another version under [FAQ](./yfaq/) with behavior ids.
-
-<img src="https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_without_ids.svg" alt="mbc matrix without ids">
+Malware objectives are defined in the table below. Follow the links to view associated behaviors. 
 
 |**Objective**|**Description**|
 |---|---|
-|[**Anti-Behavioral Analysis**](./anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
-|[**Anti-Static Analysis**](./anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
-|[**Collection**](./collection/README.md)|Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
-|[**Command and Control**](./command-and-control/README.md)|Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
-|[**Credential Access**](./credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
-|[**Defense Evasion**](./defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
-|[**Discovery**](./discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
-|[**Execution**](./execution/README.md)|Malware aims to execute its code on a system to achieve a variety of goals.|
-|[**Exfiltration**](./exfiltration/README.md)|Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
-|[**Impact**](./impact/README.md)|Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
-|[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
-|[**Persistence**](./persistence/README.md)|Malware aims to remain on a system regardless of system events.|
-|[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
+|[**Anti-Behavioral Analysis**](./anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis, such as analysis done using a sandbox or debugger.|
+|[**Anti-Static Analysis**](./anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult.|
+|[**Collection**](./collection/README.md)|Malware aims to identify and gather information from a machine or network.|
+|[**Command and Control**](./command-and-control/README.md)|Malware aims to communicate with compromised systems to control them.|
+|[**Credential Access**](./credential-access/README.md)|Malware aims to steal account names and passwords.|
+|[**Defense Evasion**](./defense-evasion/README.md)|Malware aims to evade detection.|
+|[**Discovery**](./discovery/README.md)|Malware aims to gain knowledge about the environment.|
+|[**Execution**](./execution/README.md)|Malware aims to execute code on a system.|
+|[**Exfiltration**](./exfiltration/README.md)|Malware aims to steal data.|
+|[**Impact**](./impact/README.md)|Malware aims to manipulate, interrupt, or destroy systems or data.|
+|[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate or otherwise move through an environment. Lateral movement may be active, happening via direct machine access, or may be passive (for example, done via malicious email).|
+|[**Persistence**](./persistence/README.md)|Malware aims to remain on a system.|
+|[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain higher level permissions.|
+
+## MBC Behaviors ##
+The table below lists MBC behaviors and related ATT&CK techniques. In most cases, related ATT&CK techniques were defined *after* the MBC behavior was defined. Please see the [MBC Summary](./mbc_summary.md) for a listing of all MBC content.
+
+|**ID**|**Objective(s)**|**Behavior**|**Related ATT&CK Technique**|
+|---|---|---|---|
+|**B0001**|ANTI-BEHAVIORAL ANALYSIS|**Debugger Detection**|*none*|
+|**B0002**|ANTI-BEHAVIORAL ANALYSIS|**Debugger Evasion**|Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T1622))|
+|**B0003**|ANTI-BEHAVIORAL ANALYSIS|**Dynamic Analysis Evasion**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))|
+|**B0004**|ANTI-BEHAVIORAL|**Emulator Detection**|*none*|
+|**B0005**|ANTI-BEHAVIORAL|**Emulator Evasion**|*none*|
+|**B0006**|ANTI-BEHAVIORAL|**Memory Dump Evasion**|*none*|
+|**B0007**|ANTI-BEHAVIORAL|**Sandbox Detection**|Virtualization/Sandbox Evasion: System Checks ([T1497.001](https://attack.mitre.org/techniques/T1497/001),[T1633.001](https://attack.mitre.org/techniques/T1633/001)); Virtualization/Sandbox Evasion: User Activity Based Checks ([T1497.002](https://attack.mitre.org/techniques/T1497/002))|
+|**B0008**|ANTI-BEHAVIORAL ANALYSIS, ANTI-STATIC ANALYSIS|**Executable Code Virtualization**|*none*|
+|**B0009**|ANTI-BEHAVIORAL ANALYSIS|**Virtual Machine Detection**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))|
+|**B0010**|ANTI-STATIC ANALYSIS|**Call Graph Generation Evasion**|*none*|
+|**B0011**|EXECUTION|**Remote Commands**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))|
+|**B0012**|ANTI-STATIC ANALYSIS|**Disassembler Evasion**|*none*|
+|**B0013**|DISCOVERY|**Analysis Tool Discovery**|*none*|
+|**B0014**|DISCOVERY|**SMTP Connection Discovery**|*none*|
+|**B0015**|*not defined*|---|---|
+|**B0016**|IMPACT|**Compromise Data Integrity**|Data Manipulation: Stored Data Manipulation ([T1565.001](https://attack.mitre.org/techniques/T1565/001))|
+|**B0017**|IMPACT|**Destroy Hardware**|*none*|
+|**B0018**|IMPACT|**Resource Hijacking**|Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1496))|
+|**B0019**|IMPACT|**Manipulate Network Traffic**|Data Manipulation: Transmitted Data Manipulation ([T1565.002](https://attack.mitre.org/techniques/T1565/002))|
+|**B0020**|EXECUTION, LATERAL MOVEMENT|**Send Email**|Phishing ([T1566](https://attack.mitre.org/techniques/T1566))|
+|**B0021**|EXECUTION, LATERAL MOVEMENT|**Send Poisoned Email**|*none*|
+|**B0022**|IMPACT, PERSISTENCE|**Remote Access**|*none*|
+|**B0023**|EXECUTION|**Install Additional Program**|*none*|
+|**B0024**|EXECUTION|**Prevent Concurrent Execution**|*none*|
+|**B0025**|ANTI-BEHAVIORAL ANALYSIS//EXECUTION|**Conditional Execution**|Execution Guardrails ([T1480](https://attack.mitre.org/techniques/T1480))|
+|**B0026**|LATERAL MOVEMENT, PERSISTENCE|**Malicious Network Driver**|*none*|
+|**B0027**|DEFENSE EVASION|**Alternative Installation Location**|*none*|
+|**B0028**|CREDENTIAL ACCESS|**Cryptocurrency**|*none*|
+|**B0029**|DEFENSE EVASION|**Polymorphic Code**|*none*|
+|**B0030**|COMMAND AND CONTROL|**Command and Control Communication**|*none*|
+|**B0031**|COMMAND AND CONTROL|**Domain Name Generation**|Dynamic Resolution: Domain Name Generation ([T1568.002](https://attack.mitre.org/techniques/T1568/002))|
+|**B0032**|ANTI-STATIC ANALYSIS|**Executable Code Obfuscation**|*none*|
+|**B0033**|IMPACT|**Denial of Service**|Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498))|
+|**B0034**|ANTI-STATIC ANALYSIS|**Executable Code Obfuscation**|*none*|
+|**B0035**|PERSISTENCE|**Shutdown Event**|*none*|
+|**B0036**|ANTI-BEHAVIORAL ANALYSIS|**Capture Evasion**|*none*|
+|**B0037**|DEFENSE EVASION|**Bypass Data Execution Prevention**|*none*|
+|**B0038**|DISCOVERY|**Self Discovery**|*none*|
+|**B0039**|IMPACT|**Spamming**|*none*|
+|**B0040**|DEFENSE EVASION|**Covert Location**|*none*|
+|**B0041**|*not defined*|---|---|
+|**B0042**|IMPACT|**Modify Hardware**|*none*|
+|**B0043**|DISCOVERY|**Taskbar Discovery**|*none*|
+|**B0044**|EXECUTION|**Execution Dependency**|*none*|
+|**B0045**|ANTI-STATIC ANALYSIS|**Data Flow Analysis Evasion**|*none*|
+|**B0046**|DISCOVERY|**Code Discovery**|*none*|
+|**B0047**|DEFENSE EVASION, PERSISTENCE|**Install Insecure or Malicious Code**|*none*|
+
+**Copyright © 2021-2023, The MITRE Corporation.  [Terms of Use.](./tou.md)**
+

anti-behavioral-analysis/README.md

@@ -1,29 +1,37 @@
-|||
-|---|---|
-|**ID**|**OB0001**|
-
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0001</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
 
 # Anti-Behavioral Analysis
-Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger). 
 
-Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).
+Behaviors that prevent, obstruct, or evade behavioral analysis of malware--for example, analysis done using a sandbox or debugger. Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas.
 
-* **Capture Evasion** [B0036](../anti-behavioral-analysis/evade-capture.md)
-* **Debugger Detection** [B0001](../anti-behavioral-analysis/detect-debugger.md)
-* **Debugger Evasion** [B0002](../anti-behavioral-analysis/evade-debugger.md)
-* **Dynamic Analysis Evasion** [B0003](../anti-behavioral-analysis/evade-dynamic-analysis.md)
-* **Emulator Detection** [B0004](../anti-behavioral-analysis/detect-emulator.md)
-* **Emulator Evasion** [B0005](../anti-behavioral-analysis/evade-emulator.md)
-* **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
-* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
-* **Hooking** [F0003](../credential-access/hooking.md)
-* **Memory Dump Evasion** [B0006](../anti-behavioral-analysis/evade-memory-dump.md)
-* **Sandbox Detection** [B0007](../anti-behavioral-analysis/detect-sandbox.md)
+* **Capture Evasion** [B0036](../anti-behavioral-analysis/capture-evasion.md)
+* **Conditional Execution** [B0025](../execution/conditional-execution.md)
+* **Debugger Detection** [B0001](../anti-behavioral-analysis/debugger-detection.md)
+* **Debugger Evasion** [B0002](../anti-behavioral-analysis/debugger-evasion.md)
+* **Dynamic Analysis Evasion** [B0003](../anti-behavioral-analysis/dynamic-analysis-evasion.md)
+* **Emulator Detection** [B0004](../anti-behavioral-analysis/emulator-detection.md)
+* **Emulator Evasion** [B0005](../anti-behavioral-analysis/emulator-evasion.md)
+* **Executable Code Virtualization** [B0008](../anti-static-analysis/executable-code-virtualization.md)
+* **Hijack Execution Flow** [F0015](../defense-evasion/hijack-execution-flow.md)
+* **Memory Dump Evasion** [B0006](../anti-behavioral-analysis/memory-dump-evasion.md)
+* **Sandbox Detection** [B0007](../anti-behavioral-analysis/sandbox-detection.md)
 * **Software Packing** [F0001](../anti-static-analysis/software-packing.md)
-* **Virtual Machine Detection** [B0009](../anti-behavioral-analysis/detect-vm.md)
+* **Virtual Machine Detection** [B0009](../anti-behavioral-analysis/virtual-machine-detection.md)
 
-References
-----------
-<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map
+## References
+
+<a name="1">[1]</a> https://search.unprotect.it/map/
 
 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking

anti-behavioral-analysis/capture-evasion.md

@@ -0,0 +1,63 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0036</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>18 November 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>1 March 2023</b></td>
+</tr>
+</table>
+
+
+# Capture Evasion
+
+Malware has characteristics enabling it to evade capture from the infected system.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Encrypted Payloads**|B0036.002|The decryption key is stored external to the executable or never touches the disk.|
+|**Memory-only Payload**|B0036.001|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).|
+|**Multiple Stages of Loaders**|B0036.003|Multiple stages of loaders are used with an encoded payload.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|B0036.002|Vobfus is downloaded in an encrypted form then decrypted. [[1]](#1)|
+|[**TEARDROP**](../xample-malware/teardrop.md)|2018|B0036.001|TEARDROP loads its payload only into memory. [[2]](#2)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.001|The malware downloads multiple payloads (as files and DLLs) that are stored in a memory buffer. [[4]](#4)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.003|Matanbuchus consists of 2 loaders. [[3]](#3) [[4]](#4)|
+
+
+## References
+
+<a name="1">[1]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="2">[2]</a> https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b
+
+<a name="3">[3]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="4">[4]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader

anti-behavioral-analysis/debugger-detection.md

@@ -0,0 +1,161 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0001</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Debugger Detection
+
+Malware detects whether it's being executed inside a debugger by checking for artifacts such as DLLs, processes, and registry keys [[1]](#1). If malware detects a debugger,  it may change its execution path or change its code to initiate a crash [[2]](#2).
+
+While many methods are listed in the table below, among the most commonly used are:
+- Using APIs such as IsDebuggerPresent, CheckRemoteDebuggerPresent, and OutputDebugString
+- Reading the BeingDebugged bit (is it a 1 or 0) in the Process Environment Block (PEB)
+- Checking whether a software breakpoint instruction is used (INT3; 0xCC opcode)
+
+Details on detecting debuggers can be found in the references.
+
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**API Hook Detection**|B0001.001|Module bounds based [[7]](#7).|
+|**Anti-debugging Instructions**|B0001.034|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).|
+|**CheckRemoteDebuggerPresent**|B0001.002|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).This method is related to Unprotect technique U0121.|
+|**Check Processes**|B0001.038|The malware may check running processes for specific strings such as "malw" to detect a analysis environment.|
+|**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7) This method is related to Unprotect technique U0114.|
+|**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
+|**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details. This method is related to Unprotect technique U0127.|
+|**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware. Examples include Interrupt 0x2d and Interrupt 1 [[7]](#7). This method is related to Unprotect technique U0129.|
+|**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.This method is related to Unprotect technique U0122.|
+|**Memory Breakpoints**|B0001.009|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details. This method is related to Unprotect technique U0102.|
+|**Memory Write Watching**|B0001.010|[[7]](#7)|
+|**Monitoring Thread**|B0001.011|Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.|
+|**NtQueryInformationProcess**|B0001.012|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method). This method is related to Unprotect technique U0120.|
+|**NtQueryObject**|B0001.013|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection. This method is related to Unprotect technique U0118.|
+|**NtSetInformationThread**|B0001.014|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)This method is related to Unprotect technique U0119.|
+|**NtYieldExecution/SwitchToThread**|B0001.015|[[7]](#7)|
+|**OutputDebugString**|B0001.016|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details. This method is related to Unprotect technique U0117.|
+|**Page Exception Breakpoint Detection**|B0001.017|[[7]](#7)|
+|**Parent Process**|B0001.018|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)|
+|**Process Environment Block**|B0001.019|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method). This method is related to Unprotect technique U0113.|
+|**Process Environment Block BeingDebugged**|B0001.035|The BeingDebugged field is tested to determine whether the process is being debugged.|
+|**Process Environment Block IsDebugged**|B0001.037|The IsDebugged field is tested to determine whether the process is being debugged.|
+|**Process Environment Block NtGlobalFlag**|B0001.036|The NtGlobalFlag field is tested to determine whether the process is being debugged. This method is related to Unprotect technique U0111.|
+|**Process Jobs**|B0001.020|[[7]](#7)|
+|**ProcessHeap**|B0001.021|Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).This method is related to Unprotect technique U0112.|
+|**RtlAdjustPrivilege**|B0001.022|Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).|
+|**SeDebugPrivilege**|B0001.023|(Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)|
+|**SetHandleInformation**|B0001.024|(Protected Handle)|
+|**Software Breakpoints**|B0001.025|(INT3/0xCC) This method is related to Unprotect technique U0105.|
+|**Stack Canary**|B0001.026|Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.|
+|**TIB Aware**|B0001.027|Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).|
+|**TLS Callbacks**|B0001.029|[[7]](#7)|
+|**Timing/Delay Check**|B0001.028|Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging. This method is related to Unprotect techniques U110 and U1308.|
+|**Timing/Delay Check GetTickCount**|B0001.032|Malware uses GetTickCount function in a timing/delay check. This method is related to Unprotect technique U0125.|
+|**Timing/Delay Check QueryPerformanceCounter**|B0001.033|Malware uses QueryPerformanceCounter in a timing/delay check. This method is related to Unprotect techniques U110 and U1309.|
+|**UnhandledExceptionFilter**|B0001.030|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details. Row 11 This method is related to Unprotect technique U0108.|
+|**WudfIsAnyDebuggerPresent**|B0001.031|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|B0001.032|Redhip checks for a time delay using GetTickCount. [[15]](#15)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|B0001.035|Redhip checks for PEB BeingDebugged flag. [[15]](#15)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0001.006|The malware detects debuggers using an INT 03h trap. [[8]](#8)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0001.008|The malware detects debuggers using IsDebuggerPresent. [[8]](#8)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.016|The malware calls the Windows API OutputDebugString function 335,000 times. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.038|An anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[9]](#9)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0001.005|Poison Ivy Variant checks for breakpoints and exits immediately if found. [[13]](#13)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0001.008|Poison Ivy uses the IsDebuggerPresent API function call to check if the process is running in a debugger. [[13]](#13)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0001.032|The malware calls GetTickCount64 to retrieve timestamp. Malware executes Sleep and Beep in a repeated loop for 10 times. [[11]](#11) [[12]](#12)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0001.028|The malware manipulates TLS Callbacks while injecting to a child process. [[12]](#12)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.025|The malware checks for software breakpoints. [[15]](#15)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.034|The malware executes anti-debugging instructions. [[15]](#15)|
+|[**UP007**](../xample-malware/up007.md)|2016|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check for trap flag exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-trap-flag-exception.yml)|Debugger Detection (B0001)| |
+|[check for software breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-software-breakpoints.yml)|Debugger Detection::Software Breakpoints (B0001.025)| |
+|[check process job object](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml)|Debugger Detection (B0001)|kernel32.QueryInformationJobObject, kernel32.OpenProcess|
+|[check for PEB BeingDebugged flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-beingdebugged-flag.yml)|Debugger Detection::Process Environment Block BeingDebugged (B0001.035)| |
+|[check for time delay via GetTickCount](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-gettickcount.yml)|Debugger Detection::Timing/Delay Check GetTickCount (B0001.032)| |
+|[check for protected handle exception](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml)|Debugger Detection::SetHandleInformation (B0001.024)|SetHandleInformation, CloseHandle|
+|[check for OutputDebugString error](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml)|Debugger Detection::OutputDebugString (B0001.016)|kernel32.SetLastError, kernel32.GetLastError, kernel32.OutputDebugString|
+|[check for unexpected memory writes](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-unexpected-memory-writes.yml)|Debugger Detection::Memory Write Watching (B0001.010)|kernel32.GetWriteWatch|
+|[check for kernel debugger via shared user data structure](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-kernel-debugger-via-shared-user-data-structure.yml)|Debugger Detection (B0001)| |
+|[check for time delay via QueryPerformanceCounter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml)|Debugger Detection::Timing/Delay Check QueryPerformanceCounter (B0001.033)| |
+|[check for hardware breakpoints](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-hardware-breakpoints.yml)|Debugger Detection::Hardware Breakpoints (B0001.005)|kernel32.GetThreadContext|
+|[check ProcessDebugPort](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-processdebugport.yml)|Debugger Detection::NtQueryInformationProcess (B0001.012)|NtQueryInformationProcess|
+|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::CheckRemoteDebuggerPresent (B0001.002)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent|
+|[check for debugger via API](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-debugger-via-api.yml)|Debugger Detection::WudfIsAnyDebuggerPresent (B0001.031)|kernel32.CheckRemoteDebuggerPresent, WUDFPlatform.WudfIsAnyDebuggerPresent, WUDFPlatform.WudfIsKernelDebuggerPresent, WUDFPlatform.WudfIsUserDebuggerPresent|
+|[check for PEB NtGlobalFlag flag](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/check-for-peb-ntglobalflag-flag.yml)|Debugger Detection::Process Environment Block NtGlobalFlag (B0001.036)| |
+|[execute anti-debugging instructions](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-detection/execute-anti-debugging-instructions.yml)|Debugger Detection::Anti-debugging Instructions (B0001.034)| |
+|[PEB access](https://github.com/mandiant/capa-rules/blob/master/lib/peb-access.yml)|Debugger Detection::Process Environment Block (B0001.019)| |
+
+## References
+
+<a name="1">[1]</a> S. Yosef,"RASPBERRY ROBIN: ANTI-EVASION HOW-TO & EXPLOIT ANALYSIS," https://research.checkpoint.com/, 18 Apr 2023. [Online]. Available: https://research.checkpoint.com/2023/raspberry-robin-anti-evasion-how-to-exploit-analysis/.  
+
+<a name="2">[2]</a> M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press, 2012. 
+
+<a name="3">[3]</a> Peter Ferrie, "The 'Ultimate' Anti-Debugging Reference," 4 May 2011. https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf.
+
+<a name="4">[4]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+
+<a name="5">[5]</a> Ayoub Faouzi (LordNoteworthy), Al-Khaser v0.79. https://github.com/LordNoteworthy/al-khaser
+
+<a name="6">[6]</a> Nicolas Falliere, Symantec, "Windows Anti-Debug Reference," 11 September 2007. https://www.symantec.com/connect/articles/windows-anti-debug-reference.
+
+<a name="7">[7]</a> Anti Debugging Tricks, Al-Khaser. https://github.com/LordNoteworthy/al-khaser/wiki/Anti-Debugging-Tricks
+
+<a name="8">[8]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+
+<a name="9">[9]</a> https://blogs.cisco.com/security/talos/rombertik
+
+<a name="10">[10]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+
+<a name="11">[11]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="12">[12]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="13">[13]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
+
+<a name="14">[14]</a> https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
+
+<a name="15">[15]</a> capa v4.0, analyzed at MITRE on 10/12/2022

anti-behavioral-analysis/debugger-evasion.md

@@ -1,28 +1,55 @@
-|||
-|---|---|
-|**ID**|**B0002**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0002</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Debugger Evasion (<a href="https://attack.mitre.org/techniques/T1622/">T1622</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
 
 
-Debugger Evasion
-================
-Behaviors that make debugging difficult.
+# Debugger Evasion
+
+Debugger evasion is employed by malware to foil a debugger and avoid analysis. For example, to hinder the malware analyst and debugger, malware may use exception handling to execute non-obvious execution paths (exception misdirection method) or may use several parallel threads (parallel threads method). Additional debugger evasion methods are described below.
 
 A thorough reference for anti-debugging, both detection and evasion, is given in [[1]](#1).
 
-Methods
--------
+The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T1622/))** ATT&CK technique was defined subsequent to this MBC behavior.
+
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Block Interrupts**|B0002.001|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.|
 |**Break Point Clearing**|B0002.002|Intentionally clearing software or hardware breakpoints.|
 |**Byte Stealing**|B0002.003|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.|
-|**Change SizeOfImage**|B0002.004|Changing this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.|
+|**Change SizeOfImage**|B0002.004|Changing this value during run time can prevent some debuggers from attaching and also confuses some unpackers and dumpers.|
 |**Code Integrity Check**|B0002.005|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.|
 |**Exception Misdirection**|B0002.006|Using exception handling (SEH) to cause flow of program to non-obvious paths.|
 |**Get Base Indirectly**|B0002.007|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.|
-|**Guard Pages**|B0002.008|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
+|**Guard Pages**|B0002.008|Encrypt blocks of code individually and decrypt temporarily only upon execution. This method is related to Unprotect technique U0102.|
 |**Hook Interrupt**|B0002.009|Modification of interrupt vector or descriptor tables.|
 |**Import Obfuscation**|B0002.010|Add obfuscation between imports calls and APIs.|
 |**Inlining**|B0002.011|Variation of static linking where full API code inserted everywhere it would have been called.|
@@ -46,24 +73,28 @@ Methods
 |**Thread Timeout**|B0002.029|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.|
 |**Use Interrupts**|B0002.030|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".|
 
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)|
-|**Dridex**|March 2015|[[3]](#3)|
-|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|**Fake Adobe Flash Update OS X**|2016|--|Malware contains code that manually detects a debugger. [[2]](#2)|
+|**Dridex**|2015|--|[[3]](#3)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[3]](#3)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a debugger. [[4]](#4)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[hide thread from debugger](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml)|Debugger Evasion (B0002)|NtSetInformationThread, ZwSetInformationThread, GetCurrentThread|
+|[switch active desktop](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/switch-active-desktop.yml)|Debugger Evasion (B0002)|user32.CreateDesktop, user32.SwitchDesktop|
+
+## References
 
-References
-----------
 <a name="1">[1]</a> https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf
 
-<a name="2">[2]</a> https://www.synack.com/2016/02/17/analyzing-the-anti-analysis-logic-of-an-adware-installer/
+<a name="2">[2]</a> https://web.archive.org/web/20210225195315/https://www.synack.com/blog/analyzing-the-anti-analysis-logic-of-an-adware-installer/
 
-<a name="3">[3]</a> http://phishme.com/dridex-code-breaking-modify-the-malware-to-bypass-the-vm-bypass/
+<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
 
-<a name="4">[4]</a> http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/
-
-<a name="5">[5]</a> https://search.unprotect.it/map/
-
-<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+<a name="4">[4]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/

anti-behavioral-analysis/detect-debugger.md

@@ -1,76 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0001**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Debugger Detection
-==================
-Malware detects whether it's being executed inside a debugger. If so, conditional execution selects a benign execution path. [[1]](#1), [[2]](#2)
-
-Details on methods of detecting debuggers are given in the references; many are listed below.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**API Hook Detection**|B0001.001|Module bounds based [[7]](#7).|
-|**Anti-debugging Instructions**|B0001.034|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).|
-|**CheckRemoteDebuggerPresent**|B0001.002|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).|
-|**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)|
-|**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
-|**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.|
-|**Interrupt 0x2d**|B0001.006|If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.|
-|**Interrupt 1**|B0001.007|[[7]](#7)|
-|**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.|
-|**Memory Breakpoints**|B0001.009|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.|
-|**Memory Write Watching**|B0001.010|[[7]](#7)|
-|**Monitoring Thread**|B0001.011|Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.|
-|**NtQueryInformationProcess**|B0001.012|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).|
-|**NtQueryObject**|B0001.013|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.|
-|**NtSetInformationThread**|B0001.014|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)|
-|**NtYieldExecution/SwitchToThread**|B0001.015|[[7]](#7)|
-|**OutputDebugString**|B0001.016|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.|
-|**Page Exception Breakpoint Detection**|B0001.017|[[7]](#7)|
-|**Parent Process**|B0001.018|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)|
-|**Process Environment Block**|B0001.019|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method).|
-|**Process Environment Block BeingDebugged**|B0001.035|The BeingDebugged field is tested to determine whether the process is being debugged.|
-|**Process Environment Block IsDebugged**|B0001.037|The IsDebugged field is tested to determine whether the process is being debugged.|
-|**Process Environment Block NtGlobalFlag**|B0001.036|The NtGlobalFlag field is tested to determine whether the process is being debugged.|
-|**Process Jobs**|B0001.020|[[7]](#7)|
-|**ProcessHeap**|B0001.021|Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).|
-|**RtlAdjustPrivilege**|B0001.022|Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).|
-|**SeDebugPrivilege**|B0001.023|(Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)|
-|**SetHandleInformation**|B0001.024|(Protected Handle)|
-|**Software Breakpoints**|B0001.025|(INT3/0xCC)|
-|**Stack Canary**|B0001.026|Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.|
-|**TIB Aware**|B0001.027|Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).|
-|**TLS Callbacks**|B0001.029|[[7]](#7)|
-|**Timing/Delay Check**|B0001.028|Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging.|
-|**Timing/Delay Check GetTickCount**|B0001.032|Malware uses GetTickCount function in a timing/delay check.|
-|**Timing/Delay Check QueryPerformanceCounter**|B0001.033|Malware uses QueryPerformanceCounter in a timing/delay check.|
-|**UnhandledExceptionFilter**|B0001.030|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.|
-|**WudfIsAnyDebuggerPresent**|B0001.031|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Redhip**](../xample-malware/redhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
-
-References
-----------
-<a name="1">[1]</a> Alexander Antukh, "Anti-debugging Techniques Cheat Sheet," 19 January 2015.  http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet. 
-
-<a name="2">[2]</a> Joshua Cannell, Malwarebytes Labs, "Five Anti-Analysis Tricks that sometimes Fool Analysts," 31 March 2016. https://blog.malwarebytes.com/threat-analysis/2014/09/five-anti-debugging-tricks-that-sometimes-fool-analysts.
-
-<a name="3">[3]</a> Peter Ferrie, "The 'Ultimate' Anti-Debugging Reference," 4 May 2011. https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf.
-
-<a name="4">[4]</a> Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html. 
-
-<a name="5">[5]</a> Ayoub Faouzi (LordNoteworthy), Al-Khaser v0.79. https://github.com/LordNoteworthy/al-khaser
-
-<a name="6">[6]</a> Nicolas Falliere, Symantec, "Windows Anti-Debug Reference," 11 September 2007. https://www.symantec.com/connect/articles/windows-anti-debug-reference.
-
-<a name="7">[7]</a> Anti Debugging Tricks, Al-Khaser. https://github.com/LordNoteworthy/al-khaser/wiki/Anti-Debugging-Tricks

anti-behavioral-analysis/detect-emulator.md

@@ -1,23 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0004**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Emulator Detection
-==================
-Detects whether the malware instance is being executed inside an emulator. If so, conditional execution selects a benign execution path.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Check Emulator-related Registry Keys**|B0004.003|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)|
-|**Check for Emulator-related Files**|B0004.001|Checks whether particular files (e.g., QEMU files) exist.|
-|**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
-|**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|
-
-References
-----------
-<a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/

anti-behavioral-analysis/detect-sandbox.md

@@ -1,77 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0007**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Sub-techniques**|[Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/), [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/)|
-
-
-Sandbox Detection
-=================
-Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.
-
-The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Check Clipboard Data**|B0007.001|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
-|**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
-|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
-|**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
-|**Product Key/ID Testing**|B0007.005|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
-|**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|
-|**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.|
-|**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.|
-|**Timing/Uptime Check**|B0007.009|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Redhip**](../xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|May 2015|[[2]](#2)|
-|[**Terminator**](../xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|
-
-Code Snippets
--------------
-**Sandbox Detection::Product Key/ID Testing** (B0007.005) - the value 55274-640-2673064-23950 corresponds to Joe Sandbox.
-```
-push    ebx
-add     esp, 0FFFFFEF4h
-xor     ebx, ebx
-push    esp             ; phkResult
-push    1               ; samDesired
-push    0               ; ulOptions
-push    offset SubKey   ; "Software\Microsoft\Windows\CurrentVersi"...
-push    80000002h       ; hKey
-call    RegOpenKeyExA
-test    eax, eax
-jnz     short loc_405387
-mov     [esp+110h+cbData], 101h
-lea     eax, [esp+110h+cbData]
-push    eax             ; lpcbData
-lea     eax, [esp+114h+Data]
-push    eax             ; lpData
-push    0               ; lpType 
-push    0               ; lpReserved
-push    offset ValueName ; "ProductId"
-mov     eax, [esp+124h+hKey]
-push    eax             ; hKey
-call    RegQueryValueExA
-lea     eax, [esp+110h+Data]
-cmp     eax, offset a55274640267306 ; "55274-640-2673064-23950"
-jnz     short loc_405387
-mov     bl, 1
-```
-
-References
-----------
-<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 
- 
-<a name="2">[2]</a> http://labs.lastline.com/exposing-rombertik-turning-the-tables-on-evasive-malware
-
-<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
-
-<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf

anti-behavioral-analysis/detect-vm.md

@@ -1,77 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0009**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
-
-
-Virtual Machine Detection
-=========================
-Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)
-
-The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Check File and Directory Artifacts**|B0009.001|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)|
-|**Check Memory Artifacts**|B0009.002|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)|
-|**Check Named System Objects**|B0009.003|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.|
-|**Check Processes**|B0009.004|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)|
-|**Check Registry Keys**|B0009.005|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)|
-|**Check Running Services**|B0009.006|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)|
-|**Check Software**|B0009.007|Malware may check software version; for example, to determine whether the software is relatively current.|
-|**Check Virtual Devices**|B0009.008|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)|
-|**Check Windows**|B0009.009|Malware may check windows for VM-related characteristics.|
-|**Check Windows - Title bars**|B0009.022|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
-|**Check Windows - Unique windows**|B0009.021|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.|
-|**Check Windows - Window size**|B0009.020|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.|
-|**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
-|**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
-|**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
-|**Instruction Testing**|B0009.029|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type.|
-|**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - SGDT/SLDT (no pill)**|B0009.031|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.|
-|**Instruction Testing - SIDT (red pill)**|B0009.030|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
-|**Instruction Testing - SMSW**|B0009.032|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - STR**|B0009.033|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - VMCPUID**|B0009.037|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Instruction Testing - VPCEXT**|B0009.038|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-|**Modern Specs Check**|B0009.013|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.|
-|**Modern Specs Check - Drive size**|B0009.015|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
-|**Modern Specs Check - Keyboard layout**|B0009.019|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Check keyboard layout.|
-|**Modern Specs Check - Printer**|B0009.017|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
-|**Modern Specs Check - Processor count**|B0009.018|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks number of processors; single CPU machines are suspect.|
-|**Modern Specs Check - Total physical memory**|B0009.014|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
-|**Modern Specs Check - USB drive**|B0009.016|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
-|**Unique Hardware/Firmware Check**|B0009.023|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment.|
-|**Unique Hardware/Firmware Check - BIOS**|B0009.024|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Characteristics of the BIOS, such as version, can indicate virtualization.|
-|**Unique Hardware/Firmware Check - CPU Location**|B0009.027|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
-|**Unique Hardware/Firmware Check - CPU Name**|B0009.026|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Checks the CPU name to determine virtualization.|
-|**Unique Hardware/Firmware Check - I/O Communication Port**|B0009.025|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
-|**Unique Hardware/Firmware Check - MAC Address**|B0009.028|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
-|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
-
-References
-----------
-<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
-
-<a name="2">[2]</a> https://search.unprotect.it/map/sandbox-evasion/
-
-<a name="3">[3]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
-
-<a name="4">[4]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
-
-<a name="5">[5]</a> https://github.com/LordNoteworthy/al-khaser
-
-<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

anti-behavioral-analysis/dynamic-analysis-evasion.md

@@ -0,0 +1,94 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0003</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Virtualization/Sandbox Evasion (<a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Dynamic Analysis Evasion
+
+Malware may obstruct dynamic analysis in a sandbox or virtual machine. An analyst detonates the specimen in these controlled environments to understand the malware's behavior. However, the code may exhibit a variety of anti-analysis methods, including delayed execution and code integrity checks. Additional methods are listed in the table below.
+
+See Emulator Evasion (B0004) for an emulator-specific evasion behavior. See Conditional Execution (B0025) for a behavior that constrains dynamic execution based on environmental conditions.
+
+The related Virtualization/Sandbox Evasion (T1497, T1633) ATT&CK techniques were defined subsequent to this MBC behavior.
+
+
+See **Emulator Evasion ([B0004](../anti-behavioral-analysis/emulator-evasion.md))** for an emulator-specific evasion behavior, and see **Conditional Execution ([B0025](../anti-behavioral-analysis/execution-guardrails.md))** for a behavior that constrains dynamic execution based on environmental conditions. 
+
+The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Alternative ntdll.dll**|B0003.001|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.|
+|**API Hammering**|B0003.012|Uses of a huge number of calls to Windows APIs as a form of extended sleep to evade analysis in sandbox environments. This method is related to Unprotect technique U1305.|
+|**Code Integrity Check**|B0003.011|Compares memory-based and disk-based versions of itself. If differences are detected, the malware alters its execution, possibly acting destructively.|
+|**Data Flood**|B0003.002|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)|
+|**Delayed Execution**|B0003.003|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique. This method is related to Unprotect technique U1318.|
+|**Demo Mode**|B0003.004|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.|
+|**Drop Code**|B0003.005|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).|
+|**Encode File**|B0003.006|Encode a file on disk, such as an implant's config file.|
+|**Hook File System**|B0003.007|Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.|
+|**Hook Interrupt**|B0003.008|Modification of interrupt vector or descriptor tables.|
+|**Illusion**|B0003.009|Creates an illusion; makes the analyst think something happened when it didn't.|
+|**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Terminator**](../xample-malware/terminator.md)|2013|B0003.003|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
+|**Nap**|2013|--|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
+|**Smokeloader**|2019|--|Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [[4]](#4)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0003.001|The malware loads ntdll.dll and user32.dll as data files and overwrites the first 8 bytes of those functions to avoid API hooking by security products. [[7]](#7)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.002|The malware stalls by writing a byte of random data to memory 960 million times which complicates analysis. It also calls specific Windows API functions. [[5]](#5)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.011|The malware computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively. [[5]](#5)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0003.012|The malware uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering). [[6]](#6)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[delay execution](https://github.com/mandiant/capa-rules/blob/master/lib/delay-execution.yml)|Dynamic Analysis Evasion::Delayed Execution (B0003.003)|kernel32.Sleep, kernel32.SleepEx, kernel32.WaitForSingleObject, kernel32.SignalObjectAndWait, kernel32.WaitForSingleObjectEx, kernel32.WaitForMultipleObjects, kernel32.WaitForMultipleObjectsEx, kernel32.RegisterWaitForSingleObject, WaitOnAddress, user32.MsgWaitForMultipleObjects, user32.MsgWaitForMultipleObjectsEx, NtDelayExecution, KeWaitForSingleObject, KeDelayExecutionThread, sleep, usleep|
+
+## References
+
+<a name="1">[1]</a> https://www.joesecurity.org/blog/4310408827727907098
+
+<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
+
+<a name="4">[4]</a> https://research.checkpoint.com/2019-resurgence-of-smokeloader/
+
+<a name="5">[5]</a> https://blogs.cisco.com/security/talos/rombertik
+
+<a name="6">[6]</a> https://www.joesecurity.org/blog/498839998833561473
+

anti-behavioral-analysis/emulator-detection.md

@@ -0,0 +1,63 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0004</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>19 September 2023</b></td>
+</tr>
+</table>
+
+
+# Emulator Detection
+
+Detects whether the malware instance is being executed inside an emulator. If so, conditional execution selects a benign execution path.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Check Emulator-related Registry Keys**|B0004.003|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)|
+|**Check for Emulator-related Files**|B0004.001|Checks whether particular files (e.g., QEMU files) exist.|
+|**Check for WINE Version**|B0004.002|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
+|**Failed Network Connections**|B0004.004|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[2]](#2)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0004)|GetModuleHandle, GetProcAddress|
+
+
+## References
+
+<a name="1">[1]</a> https://search.unprotect.it/category/sandbox-evasion/
+
+<a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

anti-behavioral-analysis/emulator-evasion.md

@@ -0,0 +1,51 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0005</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>4 March 2023</b></td>
+</tr>
+</table>
+
+
+# Emulator Evasion
+
+Behaviors that obstruct analysis in an emulator.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Different Opcode Sets**|B0005.001|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.|
+|**Extra Loops/Time Locks**|B0005.004|Add extra loops to make time-constraint emulators give up.|
+|**Undocumented/Unimplemented Opcodes**|B0005.002|Use rare, undocumented, or unimplemented opcodes to block non-exhaustive emulators.|
+|**Unusual/Undocumented API Calls**|B0005.003|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0005.004|The malware evades emulator-based analysis by using an infinite loop to check all open windows and compare each window's title bar to a list of strings. [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+

anti-behavioral-analysis/evade-capture.md

@@ -1,18 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0036**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Capture Evasion
-===============
-Malware has characteristics enabling it to evade capture from the infected system.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Encrypted Payloads**|B0036.002|Decryption key is stored external to the executable or never touches the disk.|
-|**Memory-only Payload**|B0036.001|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).|
-|**Multiple Stages of Loaders**|B0036.003|Multiple stages of loaders are used with an encoded payload.|

anti-behavioral-analysis/evade-dynamic-analysis.md

@@ -1,48 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0003**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
-
-
-Dynamic Analysis Evasion
-========================
-Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine. 
-
-See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](../anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Alternative ntdll.dll**|B0003.001|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.|
-|**Data Flood**|B0003.002|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)|
-|**Delayed Execution**|B0003.003|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.|
-|**Demo Mode**|B0003.004|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.|
-|**Drop Code**|B0003.005|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).|
-|**Encode File**|B0003.006|Encode a file on disk, such as an implant's config file.|
-|**Hook File System**|B0003.007|Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.|
-|**Hook Interrupt**|B0003.008|Modification of interrupt vector or descriptor tables.|
-|**Illusion**|B0003.009|Creates an illusion; makes the analyst think something happened when it didn't.|
-|**Restart**|B0003.010|Restarts or shuts down system to bypass sandboxing.|
-
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Ursnif**](../xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
-|[**Terminator**](../xample-malware/terminator.md)|October 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
-|**Nap**|2013|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
-|**Smokeloader**|2019|Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [[4]](#4)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|Evades dynamic analysis.)|
-
-References
-----------
-<a name="1">[1]</a> http://joe4security.blogspot.com/2013/06/overloading-sandboxes-new-generic.html
-
-<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
-
-<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
-
-<a name="4">[4]</a> https://research.checkpoint.com/2019-resurgence-of-smokeloader/

anti-behavioral-analysis/evade-emulator.md

@@ -1,25 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0005**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Emulator Evasion
-================
-Behaviors that obstruct analysis in an emulator.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Different Opcode Sets**|B0005.001|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.|
-|**Extra Loops/Time Locks**|B0005.004|Add extra loops to make time-constraint emulators give up.|
-|**Undocumented Opcodes**|B0005.002|Use rare or undocumented opcodes to block non-exhaustive emulators.|
-|**Unusual/Undocumented API Calls**|B0005.003|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|

anti-behavioral-analysis/evade-memory-dump.md

@@ -1,40 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0006**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Memory Dump Evasion
-===================
-Malware hinders retrieval and/or discovery of the contents of the physical memory of the system on which the malware instance is executing [[1]](#1).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Code Encryption in Memory**|B0006.001|Encrypt the executing malware instance code in memory.|
-|**Erase the PE header**|B0006.002|Erase PE header from memory.|
-|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](../credential-access/hooking.md).|
-|**Flow Opcode Obstruction**|B0006.009|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).|
-|**Guard Pages**|B0006.006|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
-|**Hide virtual memory**|B0006.003|Hide arbitrary segments of virtual memory.|
-|**On-the-Fly APIs**|B0006.007|Resolve API addresses before each use to prevent complete dumping.|
-|**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.|
-|**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[Kraken](../xample-malware/kraken.md)|April 2008|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
-
-References
-----------
-<a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, https://www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf
-
-<a name="2">[2]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
-
-<a name="3">[3]</a> http://waleedassar.blogspot.com/search/label/anti-dump
-
-<a name="4">[4]</a> https://www.gironsec.com/code/packers.pdf

anti-behavioral-analysis/execution-guardrails.md

@@ -1,31 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1480**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
-
-
-Execution Guardrails
-====================
-Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
-
-**See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Deposited Keys**|E1480.m01|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
-|**Environmental Keys**|E1480.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
-|**GetVolumeInformation**|E1480.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
-|**Host Fingerprint Check**|E1480.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
-|**Runs as Service**|E1480.m07|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[1]](#1)|
-|**Secure Triggers**|E1480.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
-|**Token Check**|E1480.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
-
-References
-----------
-<a name="1">[1]</a> 
-https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
-
-

anti-behavioral-analysis/memory-dump-evasion.md

@@ -0,0 +1,118 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0006</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>8 May 2023</b></td>
+</tr>
+</table>
+
+# Memory Dump Evasion
+
+Memory dump evasion is an anti-forensic technique in which malware hinders retrieval and/or discovery of the contents of the physical memory of the system on which the malware instance is executing [[1]](#1). Tools enabling capture of malware code from memory can be software-based or hardware-based. Malicious code thwarts software-based tools by relying on such methods as resolving API addresses before each use (on-the-fly APIs method) and erasing or corrupting specific file parts to prevent rebuilding (tampering method) [[2]](#2),[[3]](#3). 
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Code Encryption in Memory**|B0006.001|Encrypt the executing malware instance code in memory.|
+|**Erase the PE header**|B0006.002|Erase PE header from memory.|
+|**Feed Misinformation**|B0006.008|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](../credential-access/hooking.md).|
+|**Flow Opcode Obstruction**|B0006.009|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[6]](#6).|
+|**Guard Pages**|B0006.006|Encrypt blocks of code individually and decrypt temporarily only upon execution. This method is related to Unprotect technique U0102.|
+|**Hide virtual memory**|B0006.003|Hide arbitrary segments of virtual memory.|
+|**On-the-Fly APIs**|B0006.007|Resolve API addresses before each use to prevent complete dumping.|
+|**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.|
+|**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
+|**Hook memory mapping APIs**|B0006.010|Hooking prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
+|**Patch MmGetPhysicalMemoryRanges**|[B0006.011](#b0006011-snippet)|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Kraken**](../xample-malware/kraken.md)|2008|--|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[4]](#4)|
+
+
+## Code Snippets
+
+### B0006.011 Snippet
+<details>
+<summary> Memory Dump::Code Encryption in Memory </summary>
+SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
+<pre>
+asm
+mov cl, 65h ; 'e'
+mov al, 70h ; 'p'
+mov [ebp+var_23], cl
+mov [ebp+var_1F], cl
+mov [ebp+String], bl
+mov [ebp+var_12], bl
+mov [ebp+var_2E], al
+mov [ebp+var_2D], al
+lea ecx, [ebp+String]
+mov al, 74h ; 't'
+mov bl, 2Eh ; '.'
+push ecx
+mov [ebp+var_13], 30h
+mov [ebp+var_11], 30h
+mov [ebp+var_10], 0
+mov [ebp+cp]
+mov [ebp+var_2F], 75h
+mov [ebp+var_2C], 6Fh
+mov [ebp+var_2B], 72h
+mov [ebp+var_2A], al
+mov [ebp+var_29], bl
+mov [ebp+var_28], 62h
+mov [ebp+var_27], 79h
+mov [ebp+var_26], 69h
+mov [ebp+var_25], dl
+mov [ebp+var_24], al
+mov [ebp+var_22], 72h
+mov [ebp+var_21], bl
+mov [ebp+var_20], dl
+mov [ebp+var_1E], al
+mov [ebp+var_1D], 0
+call ds:atoi
+add esp, 4
+mov dword ptr [ebp+hostshort], eax
+jmp short loc_401326
+</pre>
+</details>
+
+## References
+
+<a name="1">[1]</a> J. Stüttgen and M. Cohen,"Anti-Forensic Resilient Memory Acquisition," in DFRWS USA 2013 Conference, 2013. [Online]. Available: https://dfrws.org/presentation/anti-forensic-resilient-memory-acquisition/. 
+
+<a name="2">[2]</a> L. Maffia, D. Nisi, P. Kotzias, G. Lagorio, S. Aonzo, and D. Balzarotti, "Longitudinal Study of the Prevalence of Malware Evasive Techniques," arXiv:2112.11289 , 21 Dec 2021. [Online]. Available: https://arxiv.org/pdf/2112.11289.pdf.
+
+<a name="3">[3]</a> "PlugX: Memory Forensics Lifecycle with Volatility," Volatility Labs, blog, 6 Nov. 2015. [Online]. Available: https://volatility-labs.blogspot.com/2015/11/plugx-memory-forensics-lifecycle-with.html.
+
+<a name="4">[4]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
+
+<a name="5">[5]</a> https://waleedassar.blogspot.com/search/label/anti-dump
+
+<a name="6">[6]</a> https://www.gironsec.com/code/packers.pdf
+

anti-behavioral-analysis/sandbox-detection.md

@@ -0,0 +1,136 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0007</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Virtualization/Sandbox Evasion Checks (<a href="https://attack.mitre.org/techniques/T1497/001/">T1497.001</a>, <a href="https://attack.mitre.org/techniques/T1633/001/">T1633.001</a>), Virtualization/Sandbox Evasion: User Activity Based Checks (<a href="https://attack.mitre.org/techniques/T1497/002/">T1497.002</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>17 August 2023</b></td>
+</tr>
+</table>
+
+# Sandbox Detection
+
+Malware checks whether it is being executed inside an instrumented and isolated sandbox (test) environment. In performing reconnaissance of its environment, the malware will check a variety of user or system based artifacts. Examples include monitoring for user action as reflected by mouse clicks or timing checks [[1]](#1), [[2]](#2). Upon detection of the sandbox, conditional execution will change the malware’s behavior. For example, execution may terminate, or activity may appear benign, e.g., connecting to a benign domain. 
+
+The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior.
+ 
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Check Clipboard Data**|B0007.001|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
+|**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
+|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[5]](#5). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique. This method is also related to Unprotect techniques U1316 and U1317.|
+|**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
+|**Product Key/ID Testing**|[B0007.005](#b0007005-snippet)|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
+|**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox. This method is related to Unprotect technique U1315.|
+|**Self Check**|B0007.007|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name. This method is related to Unprotect technique U1303.|
+|**Timing/Date Check**|B0007.008|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments. This method is related to Unprotect technique U1005.|
+|**Timing/Uptime Check**|B0007.009|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.|
+|**Test API Routines**|B0007.010|Calls Windows API routines with invalid arguments to identify error supression.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Redhip**](../xample-malware/redhip.md)|2011|B0007.005|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs and checks for sandboxes and AV modules. [[3]](#3)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0007.010|The malware checks for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[4]](#4)|
+|[**Terminator**](../xample-malware/terminator.md)|2013|--|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[6]](#6)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0007.007|Ursnif uses malware macros to evade sandbox detection - checking whether the filename contains only hexadecimal characters before the extension. [[10]](#10)|
+|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[7]](#7)|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value. [[8]](#8)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a sandbox. [[9]](#9)|
+
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|Sandbox Detection::Product Key/ID Testing (B0007.005)|CreateFile|
+|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle|
+
+|Tool: CAPE|Mapping|APIs|
+|---|---|---|
+|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+
+
+## Code Snippets
+
+### B0007.005 Snippet
+<details>
+<summary> Sandbox Detection::Product Key/ID Testing </summary>
+<pre>
+asm
+push    ebx
+add     esp, 0FFFFFEF4h
+xor     ebx, ebx
+push    esp             ; phkResult
+push    1               ; samDesired
+push    0               ; ulOptions
+push    offset SubKey   ; "Software\Microsoft\Windows\CurrentVersi"...
+push    80000002h       ; hKey
+call    RegOpenKeyExA
+test    eax, eax
+jnz     short loc_405387
+mov     [esp+110h+cbData], 101h
+lea     eax, [esp+110h+cbData]
+push    eax             ; lpcbData
+lea     eax, [esp+114h+Data]
+push    eax             ; lpData
+push    0               ; lpType 
+push    0               ; lpReserved
+push    offset ValueName ; "ProductId"
+mov     eax, [esp+124h+hKey]
+push    eax             ; hKey
+call    RegQueryValueExA
+lea     eax, [esp+110h+Data]
+cmp     eax, offset a55274640267306 ; "55274-640-2673064-23950"
+jnz     short loc_405387
+mov     bl, 1
+</pre>
+</details>
+
+## References
+
+<a name="1">[1]</a> Check Point Research,"CP<r>: Evasion Techniques," evasions.checkpoint.com, [Online]. Available: https://evasions.checkpoint.com.
+
+<a name="2">[2]</a> Splunk Threat Research Team,"From Macros to No Macros: Continuous Malware Improvements by QakBot," Splunk, blog,, 01 December 2022. [Online]. Available: https://www.splunk.com/en_us/blog/security/from-macros-to-no-macros-continuous-malware-improvements-by-qakbot.html.
+
+<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 
+
+<a name="4">[4]</a> https://blogs.cisco.com/security/talos/rombertik
+
+<a name="5">[5]</a> https://github.com/LordNoteworthy/al-khaser
+
+<a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
+
+<a name="7">[7]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="8">[8]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
+
+<a name="9">[9]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="10">[10]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques

anti-behavioral-analysis/virtual-machine-detection.md

@@ -0,0 +1,197 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0009</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Virtualization/Sandbox Evasion (<a href="https://attack.mitre.org/techniques/T1497/">T1497</a>, <a href="https://attack.mitre.org/techniques/T1633/">T1633</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Detection</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Virtual Machine Detection
+
+Malware checks whether it is being executed inside a virtual environment. In performing reconnaissance of its environment, the malware will check on a variety of user or system based artifacts. Examples include: 
+
+- monitoring for user action as reflected by scrolling
+- verifying system characteristics through Windows Management Interface (WMI) queries, e.g., for MAC address
+- observing whether tool artifacts represented by strings or processes exist, e.g., VirtualBox.exe or joeboxserver.exe  
+- checking specific registry keys or values [[1]](#1)
+
+Upon detection of the virtual machine, conditional execution will change the malware’s behavior. For example, execution may terminate, or activity may appear benign, e.g., connecting to a benign domain.
+
+The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** ATT&CK techniques were defined subsequent to this MBC behavior.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Check File and Directory Artifacts**|B0009.001|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)|
+|**Check Memory Artifacts**|B0009.002|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)|
+|**Check Named System Objects**|B0009.003|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.|
+|**Check Processes**|B0009.004|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the processes and searches for the VMware string. Processes related to Virtualbox can be detected by the malware by querying the process list. [[2]](#2) This method is related to Unprotect technique U1334.|
+|**Check Registry Keys**|B0009.005|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or a virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)|
+|**Check Running Services**|B0009.006|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)|
+|**Check Software**|B0009.007|Malware may check software version; for example, to determine whether the software is relatively current.|
+|**Check Virtual Devices**|B0009.008|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)|
+|**Check Windows**|B0009.009|Malware may check windows for VM-related characteristics.|
+|**Check Windows - Title bars**|B0009.022|Malware may check windows for VM-related characteristics. May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
+|**Check Windows - Unique windows**|B0009.021|Malware may check windows for VM-related characteristics. May check for the presence of known windows from analysis tools running in a VM.|
+|**Check Windows - Window size**|B0009.020|Malware may check windows for VM-related characteristics. Tiny window size may indicate a VM.|
+|**Guest Process Testing**|B0009.010|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
+|**HTML5 Performance Object Check**|B0009.011|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
+|**Human User Check**|B0009.012|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
+|**Instruction Testing**|[B0009.029](#b0009029-snippet)|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
+|**Instruction Testing - CPUID**|B0009.034|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Checking the CPU ID found within the registry can provide information to system type. This method is related to Unprotect technique U1324.|
+|**Instruction Testing - IN**|B0009.035|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1323.|
+|**Instruction Testing - RDTSC**|B0009.036|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
+|**Instruction Testing - SGDT/SLDT (no pill)**|B0009.031|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero. This method is related to Unprotect technique U1327.|
+|**Instruction Testing - SIDT (red pill)**|B0009.030|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned. This method is related to Unprotect technique U1328.|
+|**Instruction Testing - SMSW**|B0009.032|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1326.|
+|**Instruction Testing - STR**|B0009.033|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1325.|
+|**Instruction Testing - VMCPUID**|B0009.037|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1322.|
+|**Instruction Testing - VPCEXT**|B0009.038|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2) This method is related to Unprotect technique U1321.|
+|**Modern Specs Check**|B0009.013|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.|
+|**Modern Specs Check - Drive size**|B0009.015|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5). This method is related to Unprotect technique U1312.|
+|**Modern Specs Check - Keyboard layout**|B0009.019|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Check keyboard layout.|
+|**Modern Specs Check - Printer**|B0009.017|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected. This method is related to Unprotect technique U1309.|
+|**Modern Specs Check - Processor count**|B0009.018|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks number of processors; single CPU machines are suspect. This method is related to Unprotect technique U1340.|
+|**Modern Specs Check - Total physical memory**|B0009.014|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5). This method is related to Unprotect technique U1313.|
+|**Modern Specs Check - USB drive**|B0009.016|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment. Checks whether there is a potential USB drive; if not a virtual environment is suspected. This method is related to Unprotect technique U1310.|
+|**Unique Hardware/Firmware Check**|B0009.023|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment.|
+|**Unique Hardware/Firmware Check - BIOS**|B0009.024|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Characteristics of the BIOS, such as version, can indicate virtualization.|
+|**Unique Hardware/Firmware Check - CPU Location**|B0009.027|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
+|**Unique Hardware/Firmware Check - CPU Name**|B0009.026|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Checks the CPU name to determine virtualization.|
+|**Unique Hardware/Firmware Check - I/O Communication Port**|B0009.025|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware. This method is related to Unprotect technique U1336.|
+|**Unique Hardware/Firmware Check - MAC Address**|B0009.028|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2) This method is related to Unprotect technique U1335.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.018|GravityRAT determines the machine is a VM if the core count is 1. [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.023|GravityRAT checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual," "Vmware," or "Virtualbox." [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.024|GravityRAT creates a WMI request to identify the BIOS version. [[13]](#13)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.028|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developers. [[3]](#3)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0009.022|WebCobra injects malicious code in to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in a VM. [[4]](#4)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip detects VMWare, Virtual PC, and Virtual Box. It also detects VM environments in general by considering time lapses. [[6]](#6)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0009.010|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names. [[7]](#7)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus checks for the presence of virtualization software by querying the system registry. [[8]](#8)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0009.003|Malware checks if it is running in a sandbox. If it is, the malware exits. [[9]](#9) [[10]](#10)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0009.004|The malware checks if there are virtual machine processes running (Vbox, vmware, etc). [[11]](#11)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0009.012|The malware checks for an unmoving mouse cursor. [[12]](#12)|
+
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Virtual Machine Detection (B0009)|GetModuleHandle|
+|[check for Windows sandbox via genuine state](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml)|Virtual Machine Detection (B0009)|SLIsGenuineLocal, UuidFromString|
+|[reference anti-VM strings targeting Parallels](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml)|Virtual Machine Detection (B0009)| |
+|[check for unmoving mouse cursor](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml)|Virtual Machine Detection::Human User Check (B0009.012)| |
+|[reference anti-VM strings targeting VirtualPC](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml)|Virtual Machine Detection (B0009)| |
+|[reference anti-VM strings targeting VMWare](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml)|Virtual Machine Detection (B0009)| |
+|[check for foreground window switch](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-foreground-window-switch.yml)|Virtual Machine Detection::Human User Check (B0009.012)|Sleep|
+|[detect VM via disk hardware WMI queries](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml)|Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)| |
+|[reference anti-VM strings targeting Qemu](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml)|Virtual Machine Detection (B0009)| |
+|[reference anti-VM strings targeting Xen](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml)|Virtual Machine Detection (B0009)| |
+|[check for sandbox username or hostname](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml)|Virtual Machine Detection (B0009)| |
+|[check for Windows sandbox via process name](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml)|Virtual Machine Detection (B0009)| |
+|[check for Windows sandbox via dns suffix](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml)|Virtual Machine Detection (B0009)|GetAdaptersAddresses|
+|[check for Windows sandbox via device](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml)|Virtual Machine Detection (B0009)| |
+|[reference anti-VM strings targeting VirtualBox](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml)|Virtual Machine Detection (B0009)| |
+|[check for Windows sandbox via registry](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml)|Virtual Machine Detection (B0009)|RegOpenKeyEx, RegEnumValue|
+|[reference anti-VM strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml)|Virtual Machine Detection (B0009)| |
+
+## Code Snippets
+
+### B0009.029 Snippet
+<details>
+<summary> Virtual Machine Detection::Instruction Testing </summary>
+SHA256: cfaf863181e49906df33f9104795678f2fb41a007a8fd066a84fd99f613d7ef3
+<pre>
+asm
+; ___unwind { // __except handler4
+push ebp
+mov ebp, esp
+push 0FFFFFFFEh
+push offset stru_413980
+push offset __except handler4
+mov eax, large fs:0
+push eax
+sub esp, 14h
+push ebx
+push esi
+push edi
+mov eax, ___security_cookie
+xor [epb+ms_exc.registration.ScopeTable], eax
+xor eax, ebp
+push eax
+lea eax, [ebp+ms_exc.registration]
+mov large fs:0 eax
+mov [ebp+var_19], al
+;  __try { // __except at loc_401CB8
+mov [ebp+ms_exc.registration.TryLevel], eax
+push ebx
+mov ebx, 0
+mov eax, 1
+vpcext 7, 08h
+test ebx, ebx
+setz [ebp+var_19]
+pop ebx
+jmp short loc_401CBB
+</pre>
+</details>
+
+
+## References
+
+<a name="1">[1]</a> Check Point Research,"CP<r>: Evasion Techniques," evasions.checkpoint.com, [Online]. Available: https://evasions.checkpoint.com.
+
+<a name="2">[2]</a> https://search.unprotect.it/category/sandbox-evasion/
+
+<a name="3">[3]</a> https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html
+
+<a name="4">[4]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="5">[5]</a> https://github.com/LordNoteworthy/al-khaser
+
+<a name="6">[6]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+
+<a name="7">[7]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
+
+<a name="8">[8]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="9">[9]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="10">[10]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="11">[11]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
+
+<a name="12">[12]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="12">[12]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/

anti-static-analysis/README.md

@@ -1,23 +1,33 @@
-|||
-|---|---|
-|**ID**|**OB0002**|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0002</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
 
 
 # Anti-Static Analysis
-Behaviors and code characteristics that prevent static analysis or make it more difficult. Simple static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.
 
-Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).
+Behaviors and code characteristics that prevent or hinder static analysis of the malware. Simple static analysis identifies features such as embedded strings, header information, or file metadata. More involved static analysis involves the disassembly of the binary code.
 
-* **Call Graph Generation Evasion** [B0010](../anti-static-analysis/evade-call-graph.md)
-* **Disassembler Evasion** [B0012](../anti-static-analysis/evade-disassembler.md)
-* **Executable Code Obfuscation** [B0032](../anti-static-analysis/exe-code-obfuscate.md)
-* **Executable Code Optimization** [B0034](../anti-static-analysis/exe-code-optimize.md)
-* **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
-* **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscate-files.md)
+* **Call Graph Generation Evasion** [B0010](../anti-static-analysis/call-graph-generation-evasion.md)
+* **Disassembler Evasion** [B0012](../anti-static-analysis/disassembler-evasion.md)
+* **Data Flow Analysis Evasion** [B0045](../anti-static-analysis/data-flow-analysis-evasion.md)
+* **Executable Code Obfuscation** [B0032](../anti-static-analysis/executable-code-obfuscation.md)
+* **Executable Code Optimization** [B0034](../anti-static-analysis/executable-code-optimization.md)
+* **Executable Code Virtualization** [B0008](../anti-static-analysis/executable-code-virtualization.md)
+* **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscated-files-or-information.md)
 * **Software Packing** [F0001](../anti-static-analysis/software-packing.md)
 
-References
-----------
-<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map/sandbox-evasion/
+## References
+
+<a name="1">[1]</a> https://search.unprotect.it/category/sandbox-evasion/
 
 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking

anti-static-analysis/call-graph-generation-evasion.md

@@ -0,0 +1,57 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0010</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>31 August 2023</b></td>
+</tr>
+</table>
+
+
+# Call Graph Generation Evasion
+
+Malicious code evades accurate call graph generation, which can be used for malware detection during disassembly of the binary [[1]](#1). Evading accurate call graph generation can also hinder follow-on analysis. For instance, using randomization of call graphs, malware can defeat call graph-based similarity analysis in which analysts calculate similarity between pairs of malicious binaries [[2]](#2), [[3]](#3). Application of clustering algorithms to malware call graphs has also resulted in the discovery of malware families [[4]] (#4). 
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[5]](#5)|
+|**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[5]](#5)|
+|**Shadow Process Communication**|B0010.003| Uses multiple processes (instead of one process) to make behavior detection more difficult. [[6]](#6)|
+
+## References
+
+<a name="1">[1]</a> P. Deshpande and M. Stamp,"Metamorphic Malware Detection Using Function Call Graph Analysis," MIS Review, Vol. 21, Nos. 1/2, Sept.(2015)/Mar.(2016), [Online]. Available: https://pdfs.semanticscholar.org/8db2/69106ea6e1f59e4dac0889665dd3336ee9b1.pdf.
+
+<a name="2">[2]</a> K. Blokhin, D. Mentis, and J. Saxe,"Malware Similarity Identification Using Call Graph Based System Call Subsequence Features," 2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, July 2013. [Online]. Available: https://www.researchgate.net/publication/269326967_Malware_Similarity_Identification_Using_Call_Graph_Based_System_Call_Subsequence_Features.
+
+<a name="3">[3]</a> S. Shang, N. Zheng, J. Xu, M. Xu, and H. Zhang,"Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. [Online]. Available: https://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf.
+
+<a name="4">[4]</a> J. Kinable, "Malware Detection Through Call Graphs," Master thesis, Department of Telematics, Norwegian University of Science and Technology, Norway, June 2010. [Online]. Available: https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262290/353049_FULLTEXT01.pdf?sequence=1&isAllowed=y.
+
+<a name="5">[5]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html
+
+<a name="6">[6]</a> Weiqin Ma, Pu Duan, Sanmin Liu, Guofei Gu and Jyh-Charn Liu,"Shadow Attacks: Automatically Evading System-Call-Behavior Based Malware Detection" https://people.engr.tamu.edu/guofei/paper/ShadowAttacks_final-onecolumn.pdf

anti-static-analysis/data-flow-analysis-evasion.md

@@ -0,0 +1,47 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0045</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>26 June 2021</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>10 November 2022</b></td>
+</tr>
+</table>
+
+
+# Data Flow Analysis Evasion
+
+Malware code evades data flow analysis (also known as information flow analysis and taint-tracking).
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Control Dependence**|B0045.001|Data is propagated via an if-then-else clause instead of direct assignment.[[1]](#1)|
+|**Implicit Flows**|B0045.002|Data is propagated via semantic relationships, for example one variable not changing its state could imply the state of another variable.[[1]](#1)|
+|**Arbitrary Memory Corruption**|B0045.003|Data is propagated by corrupting memory, for example overwriting a region of stack space where a file pointer is held.[[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> http://www.seclab.cs.sunysb.edu/seclab/pubs/antitaint.pdf

anti-static-analysis/disassembler-evasion.md

@@ -0,0 +1,75 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0012</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+# Disassembler Evasion
+
+Anti-disassembly techniques take advantage of weaknesses in either flow-oriented (also referred to as recursive) or linear disassembler algorithms, resulting in inaccurate or incomplete disassembly or the disassembly process halting with an error. Reportedly, the most common anti-disassembly technique is one that employs two consecutive conditional jump instructions (jz followed by jnz) that point to the same target address [[1]](#1).
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
+|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; may be identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
+|**Desynchronizing Opaque Predicates**|B0012.006|Opaque predicates inject superfluous branches into the disassembly, resulting in disassembly desynchronization, as well as code bloat. The junk bytes introduced damage the disassembly process when the bytes are treated as code. [[6]](#6) This method is related to Unprotect technique U0201.|
+|**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[4]](#4) for an analysis of a VBA-Stomped malicious VBA Office document. See [[5]](#5) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
+|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often in the same basic block or function.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0012.001|BlackEnergy contains obfuscated stack strings. [[2]](#2) [[7]](#7)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0012.001|Hupigon contains obfuscated stack strings. [[7]](#7)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0012.001|Rombertik contains obfuscated stack strings. [[7]](#7)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[contain anti-disasm techniques](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/contain-anti-disasm-techniques.yml)|Disassembler Evasion (B0012)| |
+
+## References
+
+<a name="1">[1]</a> M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press, 2012.
+
+<a name="2">[2]</a> https://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf
+
+<a name="3">[3]</a> https://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf
+
+<a name="4">[4]</a> https://isc.sans.edu/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870
+
+<a name="5">[5]</a> https://boingboing.net/2019/05/05/p-code-r-us.html
+
+<a name="6">[6]</a> https://www.ndss-symposium.org/wp-content/uploads/2020/04/bar2020-23004-paper.pdf
+
+<a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+

anti-static-analysis/evade-call-graph.md

@@ -1,27 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0010**|
-|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Call Graph Generation Evasion
-=============================
-Malware code evades accurate call graph generation during disassembly. Call graphs are used by malware similarity tools and algorithms ([[1]](#1), [[4]](#4)), as well as for malware detection [[2]](#2).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)|
-|**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[3]](#3)|
-
-References
-----------
-<a name="1">[1]</a> K. Blokhin, D. Mentis, J. Saxe, "Malware Similarity Identification Using Call Graph Based System Call Subsequence Features," 2013 IEEE 33rd International Conference on Distributed Computing Systems Workshops, July 2013. https://www.researchgate.net/publication/269326967_Malware_Similarity_Identification_Using_Call_Graph_Based_System_Call_Subsequence_Features
-
-<a name="2">[2]</a> P. Deshpande, M. Stamp, "Metamorphic Malware Detection Using Function Call Graph Analysis," MIS Review Vol. 21, Nos. 1/2, September(2015)/March(2016). https://pdfs.semanticscholar.org/8db2/69106ea6e1f59e4dac0889665dd3336ee9b1.pdf
-
-<a name="3">[3]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html
-
-<a name="4">[4]</a> S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. http://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf

anti-static-analysis/evade-disassembler.md

@@ -1,30 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0012**|
-|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Disassembler Evasion
-====================
-Malware code evades disassembly in a recursive or linear disassembler. Some methods apply to both types of disassemblers; others apply to one type and not the other.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Argument Obfuscation**|B0012.001|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
-|**Conditional Misdirection**|B0012.002|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
-|**VBA Stomping**|B0012.005|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.|
-|**Value Dependent Jumps**|B0012.003|Explicit use of computed values for control flow, often many times in the same basic block or function.|
-|**Variable Recomposition**|B0012.004|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.|
-
-References
-----------
-<a name="1">[1]</a> http://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf
-
-<a name="2">[2]</a> http://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf
-
-<a name="3">[3]</a> https://isc.sans.edu/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870
-
-<a name="4">[4]</a> https://boingboing.net/2019/05/05/p-code-r-us.html

anti-static-analysis/exe-code-obfuscate.md

@@ -1,51 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0032**|
-|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Executable Code Obfuscation
-===========================
-Executable code can be obfuscated to hinder disassembly and static code analysis. This behavior is specific to a malware sample's executable code (data and text sections).
-
-For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see [**Obfuscated Files or Information**](../defense-evasion/obfuscate-files.md).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**API Hashing**|B0032.001|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)|
-|**Code Insertion**|B0032.002|Insert code to impede disassembly.|
-|**Data Value Obfuscation**|B0032.008|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*.  [NEEDS REVIEW]|
-|**Dead Code Insertion**|B0032.003|Include "dead" code with no real functionality.|
-|**Entry Point Obfuscation**|B0032.009|Obfuscate the entry point of the malware executable.|
-|**Fake Code Insertion**|B0032.004|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.|
-|**Guard Pages**|B0032.010|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
-|**Import Address Table Obfuscation**|B0032.011|Obfuscate the import address table.|
-|**Import Compression**|B0032.012|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.|
-|**Instruction Overlap**|B0032.013|Jump after the first byte of an instruction to confuse disassembler.|
-|**Interleaving Code**|B0032.014|Split code into sections that may be rearranged and are connected by unconditional jumps.|
-|**Jump Insertion**|B0032.005|Insert jumps to make analysis visually harder.|
-|**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
-|**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.|
-|**Stack Strings**|B0032.017|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
-|**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See  [[3]](#3).|
-|**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.|
-|**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
-   
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Heriplor**](../xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-
-References
-----------
-<a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html
-
-<a name="2">[2]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/
-
-<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons

anti-static-analysis/exe-code-virtualize.md

@@ -1,30 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0008**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Anti-Static Analysis](../anti-static-analysis)|
-|**Related ATT&CK Technique**|None|
-
-
-Executable Code Virtualization
-==============================
-Original executable code is virtualized by translating the code into a special format that only a special virtual machine (VM) can run; the VM uses a customized virtual instruction set. A "stub" function calls the VM when the code is run. Virtualized code makes static analysis and reverse engineering more difficult; dumped code won’t run without the VM.
-
-Virtualized code is a software protection technique. Themida is a commercial tool; WPProtect is an open source tool. [[1]](#1) 
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Multiple VMs**|B0008.001|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|
-
-References
-----------
-<a name="1">[1]</a> https://github.com/xiaoweime/WProtect
-
-<a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/

anti-static-analysis/executable-code-obfuscation.md

@@ -0,0 +1,163 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0032</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+# Executable Code Obfuscation
+
+Executable code is obfuscated to hinder static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). While the Executable Code Obfuscation behavior makes the analysis process more difficult, it does not cause incorrect or incomplete disassembly, which is how this behavior differs from the Disassembler Evasion behavior.
+
+For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware sample files and information, see **Obfuscated Files or Information ([E1027](../defense-evasion/obfuscated-files-or-information.md))**.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Argument Obfuscation**|B0032.020|Simple number or string arguments to API calls are calculated at runtime, making analysis more difficult.|
+|**API Hashing**|B0032.001|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1) This method is related to Unprotect technique U0217.|
+|**Code Insertion**|B0032.002|Insert code to impede disassembly and make analysis more difficult.|
+|**Data Value Obfuscation**|B0032.008|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*.  [NEEDS REVIEW]|
+|**Dead Code Insertion**|B0032.003|Include "dead" code with no real functionality. When executing, malware may skip over such code via an opaque predicate.|
+|**Entry Point Obfuscation**|B0032.009|Obfuscate the entry point of the malware executable.|
+|**Fake Code Insertion**|B0032.004|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.|
+|**Guard Pages**|B0032.010|Encrypt blocks of code individually and decrypt temporarily only upon execution. This method is related to Unprotect technique U0102.|
+|**Import Address Table Obfuscation**|B0032.011|Obfuscate the import address table.|
+|**Import Compression**|B0032.012|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.|
+|**Instruction Overlap**|B0032.013|Jump after the first byte of an instruction to confuse disassembler.|
+|**Interleaving Code**|B0032.014|Split code into sections that may be rearranged and may be connected by unconditional jumps. When instructions are out of order, writing a function signature is more difficult.|
+|**Jump Insertion**|B0032.005|Insert jumps to make analysis visually harder.|
+|**Junk Code Insertion**|B0032.007|Insert dummy code between relevant opcodes. Can make signature writing more complex. This method is related to Unprotect technique U0204.|
+|**Merged Code Sections**|B0032.015|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section depe
+|**Opaque Predicate**|B0032.019|An opaque predicate either always jumps (jumping over dead or junk code) or never jumps (executing essential code), but determining the execution path can be difficult. This method is related to Unprotect technique U0201.|
+|**Stack Strings**|[B0032.017](#b0032017-snippet)|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
+|**Structured Exception Handling (SEH)**|B0032.016|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See [[3]](#3). This method is related to Unprotect technique U0218.|
+|**Symbol Obfuscation**|B0032.018|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.|
+|**Thunk Code Insertion**|B0032.006|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
+|**Variable Recomposition**|B0032.021|Variables, often strings, are broken into multiple parts and stored out of order, in different memory ranges, or both. They must then be recomposed before use, making analysis difficult.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Heriplor**](../xample-malware/heriplor.md)|2012|B0032.001|The Heriplor Trojan uses API Hashing. [[1]](#1)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0032.007|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
+|[**Rombertik**](../anti-static-analysis/executable-code-obfuscation.md)|2015|B0032.002|Most of the malware file consists of unnecessary code or unnecessary data. [[4]](#4)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0032.017|Poison Ivy variant encrypts all its strings. [[6]](#6)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[7]](#7)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m01|The configuration data block is encoded with a NOT XOR 0xFF operation. [[8]](#8)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.001|The function to import APIs uses a hash value and the DLL name of the target API. The API address returned from the function is stored into a global variance. API calls are obfuscated in the same manner as the stack strings and are resolved dynamically as the malware needs to use them. The malware encodes data in a stack string and copies that data into a global character buffer as a form of string obfuscation. [[9]](#9) [[10]](#10)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.017|The malware encodes data in a stack string and copies that data into a global character buffer as a form of string obfuscation. Different techniques are used to encrypt and obfuscate strings. Strings are dynamically decrypted when the malware needs to use them. [[9]](#9) [[10]](#10)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.009|The malware has 4 different export functions. [[9]](#9) [[10]](#10)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[obfuscated with ADVobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-advobfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with DeepSea Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-deepsea-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with callobfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-callobfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Dotfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-dotfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with vs-obfuscation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-vs-obfuscation.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Spices.Net Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-spicesdotnet-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Babel Obfuscator](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-babel-obfuscator.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with SmartAssembly](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-smartassembly.yml)|Executable Code Obfuscation (B0032)| |
+|[obfuscated with Yano](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/obfuscated-with-yano.yml)|Executable Code Obfuscation (B0032)| |
+|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Argument Obfuscation (B0032.020)| |
+|[contain obfuscated stackstrings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/obfuscation/string/stackstring/contain-obfuscated-stackstrings.yml)|Executable Code Obfuscation::Stack Strings (B0032.017)| |
+|[use .NET library EncryptDecryptUtils](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml)|Executable Code Obfuscation (B0032)| |
+
+
+## Code Snippets
+
+### B0032.017 Snippet
+<details>
+<summary> Executable Code Obfuscation::Stack Strings </summary>
+SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
+<pre>
+asm
+mov cl, 65h ; 'e'
+mov al, 70h ; 'p'
+mov [ebp+var_23], cl
+mov [ebp_var_1f], cl
+mov [ebp_Str], bl
+mov [ebp+var_12], bl
+mov [ebp+var_2E], al
+mov [ebp+var_2D], al
+lea ecx, [ebp+Str]
+mov al, 74h ; 't'
+mov bl, 2Eh ; '.'
+mov dl. 6Eh ; 'n'
+push ecx ; STR
+mov [ebp+var_13], 30h ; '0'
+mov [ebp+var_11], 30h ; '0'
+mov [ebp+var_10], 0
+mov [ebp+cp], 73h ; 's'
+mov [ebp+var_2F], 75h ; u'
+mov [ebp+var_2C], 6Fh ; 'o'
+mov [ebp+var_2B], 72h ; 'r'
+mov [ebp+var_2A], al
+mov [ebp+var_29], bl
+mov [ebp+var_28], 62h ; 'b'
+mov [ebp+var_27], 79h ; 'y'
+mov [ebp+var_26], 69h ; 'i'
+mov [ebp+var_25], dl
+mov [ebp+var_24], al
+mov [ebp+var_22], 72h ; 'r'
+mov [ebp+var_21], bl
+mov [ebp+var_20], dl
+mov [ebp+var_1E], al
+mov [ebp+var_1D], h
+call ds:atoi
+add esp, 4
+mov dword ptr [ebp+hostshort], eax
+jmp short loc_401326
+</pre>
+</details>
+
+## References
+
+<a name="1">[1]</a> https://insights.sei.cmu.edu/blog/api-hashing-tool-imagine-that/
+
+<a name="2">[2]</a> https://cofense.com/blog/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/
+
+<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons
+
+<a name="4">[4]</a> https://blogs.cisco.com/security/talos/rombertik
+
+<a name="5">[5]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
+
+<a name="6">[6]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
+
+<a name="7">[7]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html
+
+<a name="8">[8]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+
+<a name="9">[9]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="10">[10]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader

anti-static-analysis/executable-code-optimization.md

@@ -1,21 +1,46 @@
-|||
-|---|---|
-|**ID**|**B0034**|
-|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
-|**Related ATT&CK Technique**|None|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0034</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>10 November 2022</b></td>
+</tr>
+</table>
 
 
-Executable Code Optimization
-============================
+# Executable Code Optimization
+
 Code is optimized, making it harder to statically analyze.
 
-Methods
--------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Jump/Call Absolute Address**|B0034.001|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.|
 |**Minification**|B0034.002|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.|
 
-References
-----------
+## References
+
 <a name="1">[1]</a> https://en.wikipedia.org/wiki/Minification_(programming)

anti-static-analysis/executable-code-virtualization.md

@@ -0,0 +1,57 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0008</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../anti-static-analysis">Anti-Static Analysis</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>8 May 2023</b></td>
+</tr>
+</table>
+
+
+# Executable Code Virtualization
+
+Code virtualization obfuscates code to hinder static analysis and reverse engineering of the binary, allowing successful masking of the code’s malicious behavior.  Code virtualization selects specific parts of original executable code and transforms them “to bytecode in a new, custom virtual instruction set architecture (ISA)”[[1]](#1).  As explained further in [[1]](#), “At execution time, the bytecode is emulated by an embedded virtual machine (or interpreter) on the real machine. The new ISA can be designed independently, and thus the bytecode and interpreter greatly differ from those in every protected instance. In this way, the program’s original code never reappears.” 
+
+While malicious actors can create a custom VM-based obfuscator as observed in Wslink [[2]](#2), other options are available to them such as Themida, a commercial tool, and VMProtect, an open source tool.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Multiple VMs**|B0008.001|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Code virtualization is added to the Locky Bart binary using WPProtect. [[3]](#3)|
+
+## References
+
+<a name="1">[1]</a> D. Xu, J. Ming, Y. Fu, and D. Wu, "Verifiable Approach to Partially-Virtualized Binary Code Simplification," in 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS ’18),Toronto, ON, Canada, pp. 442-458, [Online]. Available: https://doi.org/10.1145/3243734.3243827.
+
+<a name="2">[2]</a> V. Hrčka, "Under the hood of Wslink’s multilayered virtual machine," welivesecurity.com, 28 March 2022. [Online]. Available: https://www.welivesecurity.com/2022/03/28/under-hood-wslink-multilayered-virtual-machine.
+
+<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/

anti-static-analysis/software-packing.md

@@ -1,21 +1,46 @@
-|||
-|---|---|
-|**ID**|**F0001**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Obfuscated Files or Information: Software Packing](https://attack.mitre.org/techniques/T1027/002)|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0001</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../anti-static-analysis">Anti-Static Analysis</a>, <a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Obfuscated Files or Information: Software Packing (<a href="https://attack.mitre.org/techniques/T1027/002/">T1027.002</a>, <a href="https://attack.mitre.org/techniques/T1406/002/">T1406.002</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+# Software Packing
 
-Software Packing
-================
 This code characteristic - Software Packing - can make static and behavioral analysis difficult and includes packing with software protectors, such as Themida and Armadillo [[1]](#1). Methods related to anti-analysis are below. This behavior covers both characteristics of the malware (i.e., how it is packed) as well as behaviors of the malware (e.g., the malware packs another executable file).
 
-This description refines the ATT&CK [**Obfuscated Files or Information: Software Packing**](https://attack.mitre.org/techniques/T1027/002) sub-technique.
+This description refines the ATT&CK **Obfuscated Files or Information: Software Packing ([T1027.002](https://attack.mitre.org/techniques/T1027/002/), [T1406.002](https://attack.mitre.org/techniques/T1406/002/))** techniques.
+
+## Methods
 
-Methods
--------
 |Name|ID|Description|
 |---|---|---|
 |**Armadillo**|F0001.012|Uses Armadillo.|
-|**ASPack**|F0001.013|Uses ASPack.|
+|**ASPack**|F0001.013|Uses ASPack. This method is related to Unprotect technique U1411.|
 |**Confuser**|F0001.009|Uses Confuser packer.|
 |**Custom Compression**|F0001.005|Uses a custom algorithm to compress an executable file.|
 |**Custom Compression of Code**|F0001.006|Uses a custom algorithm to compress opcode mnemonics.|
@@ -24,20 +49,62 @@ Methods
 |**Standard Compression**|F0001.002|Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.|
 |**Standard Compression of Code**|F0001.003|Uses a standard algorithm to compress the opcode mnemonics.|
 |**Standard Compression of Data**|F0001.004|Uses a standard algorithm to compress strings and variables (executable file data).|
-|**Themida**|F0001.011|Uses Themida.|
-|**UPX**|F0001.008|Uses UPX packer.|
-|**VMProtect**|F0001.010|Uses VMProtect.|
+|**Themida**|F0001.011|Uses Themida.This method is related to Unprotect technique U1406.|
+|**UPX**|F0001.008|Uses UPX packer. This method is related to Unprotect technique U1402.|
+|**VMProtect**|F0001.010|Uses VMProtect. This method is related to Unprotect technique U1410.|
 
-Malware Examples
-----------------
-|Name|Date|Description|
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip samples are packed with different custom packers. [[3]](#3)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware comes packed by a crypter/FUD. [[4]](#4)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|F0001.008|Conficker is propagated as a DLL which has been backed using the UPX packer. [[5]](#5)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet has the option to compress its payload using UPX or MPRESS.  [[6]](#6)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
 |---|---|---|
-|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|
+|[packed with pebundle](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pebundle/packed-with-pebundle.yml)|Software Packing (F0001)| |
+|[packed with Themida](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/themida/packed-with-themida.yml)|Software Packing::Themida (F0001.011)| |
+|[packed with VMProtect](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml)|Software Packing::VMProtect (F0001.010)| |
+|[packed with y0da crypter](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/y0da/packed-with-y0da-crypter.yml)|Software Packing (F0001)| |
+|[packed with pelocknt](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pelocknt/packed-with-pelocknt.yml)|Software Packing (F0001)| |
+|[packed with GoPacker](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/gopacker/packed-with-gopacker.yml)|Software Packing::Standard Compression (F0001.002)| |
+|[packed with Confuser](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/confuser/packed-with-confuser.yml)|Software Packing::Confuser (F0001.009)| |
+|[packed with rlpack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/rlpack/packed-with-rlpack.yml)|Software Packing (F0001)| |
+|[packed with ASPack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/aspack/packed-with-aspack.yml)|Software Packing (F0001)| |
+|[packed with generic packer](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/generic/packed-with-generic-packer.yml)|Software Packing::Standard Compression (F0001.002)| |
+|[packed with amber](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/amber/packed-with-amber.yml)|Software Packing (F0001)| |
+|[packed with petite](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/petite/packed-with-petite.yml)|Software Packing (F0001)| |
+|[packed with peshield](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/peshield/packed-with-peshield.yml)|Software Packing (F0001)| |
+|[packed with UPX](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upx/packed-with-upx.yml)|Software Packing::UPX (F0001.008)| |
+|[packed with upack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/upack/packed-with-upack.yml)|Software Packing (F0001)| |
+|[packed with PECompact](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pecompact/packed-with-pecompact.yml)|Software Packing (F0001)| |
+|[packed with Huan](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/huan/packed-with-huan.yml)|Software Packing (F0001)| |
+|[packed with nspack](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/nspack/packed-with-nspack.yml)|Software Packing (F0001)| |
+|[packed with kkrunchy](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/kkrunchy/packed-with-kkrunchy.yml)|Software Packing (F0001)| |
+|[packed with PESpin](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/packer/pespin/packed-with-pespin.yml)|Software Packing (F0001)| |
+
+
+## References
 
-References
-----------
 <a name="1">[1]</a> Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf
 
-<a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.
+<a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771
 
 <a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+
+<a name="4">[4]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
+
+<a name="5">[5]</a> http://www.csl.sri.com/users/vinod/papers/Conficker/
+
+<a name="6">[6]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="7">[7]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
+
+<a name="8">[8]</a> https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf
+

capa.md

@@ -0,0 +1,467 @@
+# capa Rule Distribution #
+19 September 2023
+
+## Histograms ##
+The histograms below show the number of capa rules mapped into ATT&CK techniques (organized by tactic), MBC behaviors (organized by objective), and MBC micro-behaviors (organized by micro-objective). The count tracks ATT&CK techniques and sub-techniques and MBC behaviors and methods individually. For example, both B0009 and B0009.012 are counted under the Anti-Behavioral Analysis objective. The explicit techniques/sub-techiques, behaviors/methods, and micro-behaviors/micro-methods follow the histograms.
+
+### ATT&CK Mapping Histogram ###
+
+| **TACTIC** | **Number of Techniques**  |  |
+|-----|-----|-----|
+|Reconnaissance|0| |
+|Resource Development|0| |
+|Initial Access|0| |
+|**Execution**|8| **XXXXXXXX** |
+|**Persistence**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
+|**Privilege Escalation**|1| **X** |
+|**Defense Evasion**|37| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Credential Access**|4| **XXXX** |
+|**Discovery**|17| **XXXXXXXXXXXXXXXXX** |
+|Lateral Movement|0| |
+|**Collection**|7| **XXXXXXX** |
+|**Command and Control**|1| **X** |
+|Exfiltration|0| |
+|**Impact**|5| **XXXXX** |
+
+### MBC Mapping Histogram (Objectives) ###
+
+| **OBJECTIVE** | **Number of Behaviors** |  |
+|-----|-----|-----|
+|**Anti-Behavioral Analysis**|24| **XXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Anti-Static Analysis**|10| **XXXXXXXXXX** |
+|**Collection**|5| **XXXXX** |
+|**Command and Control**|3| **XXX** |
+|Credential Access|0| |
+|**Defense Evasion**|15| **XXXXXXXXXXXXXXX** |
+|**Discovery**|8| **XXXXXXXX** |
+|**Execution**|2| **XX** |
+|Exfiltration|0| |
+|**Impact**|6| **XXXXXX** |
+|Lateral Movement|0| |
+|**Persistence**|2| **XX** |
+|Privilege Escalation|0| |
+
+### MBC Mapping Histogram (Micro-Objectives) ###
+
+| **MICRO-OBJECTIVE** | **Number of Micro-Behaviors**  |  |
+|-----|-----|-----|
+|**Communication**|38| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Cryptography**|27| **XXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Data**|16| **XXXXXXXXXXXXXXXX** |
+|**File System**|11| **XXXXXXXXXXX** |
+|**Hardware**|4| **XXXX** |
+|**Memory**|2| **XX** |
+|**Operating System**|11| **XXXXXXXXXXX** |
+|**Process**|14| **XXXXXXXXXXXXXX** |
+
+
+## ATT&CK MAPPINGS ##
+
+### Reconnaissance ###
+  num: 0
+
+### Resource Development ###
+  num: 0
+
+### Initial Access ###
+  num: 0
+
+### Execution ###
+  num: 8
+  - Command and Scripting Interpreter [T1059] Count-3
+  - Windows Management Instrumentation [T1047] Count-1
+  - System Services::Service Execution [T1569.002] Count-1
+  - Shared Modules [T1129] Count-8
+  - Command and Scripting Interpreter::PowerShell [T1059.001] Count-1
+  - Command and Scripting Interpreter::Unix Shell [T1059.004] Count-2
+  - Command and Scripting Interpreter::Windows Command Shell [T1059.003] Count-2
+  - Command and Scripting Interpreter::Python [T1059.006] Count-2
+
+### Persistence ###
+  num: 22
+  - Hijack Execution Flow [T1574] Count-1
+  - Create or Modify System Process::Windows Service [T1543.003] Count-9
+  - Pre-OS Boot::System Firmware [T1542.001] Count-2
+  - Boot or Logon Autostart Execution::Shortcut Modification [T1547.009] Count-1
+  - Server Software Component [T1505] Count-2
+  - Event Triggered Execution::Unix Shell Configuration Modification [T1546.004] Count-1
+  - Boot or Logon Autostart Execution::XDG Autostart Entries [T1547.013] Count-1
+  - Server Software Component::IIS Components [T1505.004] Count-2
+  - Office Application Startup::Add-ins [T1137.006] Count-3
+  - Modify Authentication Process::Network Provider DLL [T1556.008] Count-1
+  - Boot or Logon Autostart Execution::Security Support Provider [T1547.005] Count-1
+  - Boot or Logon Autostart Execution::Authentication Package [T1547.002] Count-1
+  - Modify Authentication Process::Password Filter DLL [T1556.002] Count-1
+  - Boot or Logon Initialization Scripts::RC Scripts [T1037.004] Count-1
+  - Server Software Component::Transport Agent [T1505.002] Count-1
+  - Scheduled Task/Job::Scheduled Task [T1053.005] Count-2
+  - Scheduled Task/Job::At [T1053.002] Count-1
+  - Boot or Logon Autostart Execution::Active Setup [T1547.014] Count-1
+  - Event Triggered Execution::AppInit DLLs [T1546.010] Count-2
+  - Event Triggered Execution [T1546] Count-1
+  - Boot or Logon Autostart Execution::Winlogon Helper DLL [T1547.004] Count-1
+  - Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001] Count-3
+
+### Privilege Escalation ###
+  num: 1
+  - Access Token Manipulation [T1134] Count-2
+
+### Defense Evasion ###
+  num: 37
+  - Obfuscated Files or Information::Software Packing [T1027.002] Count-20
+  - Virtualization/Sandbox Evasion::System Checks [T1497.001] Count-16
+  - Impair Defenses::Indicator Blocking [T1562.006] Count-1
+  - Impair Defenses::Disable or Modify Tools [T1562.001] Count-3
+  - Virtualization/Sandbox Evasion::User Activity Based Checks [T1497.002] Count-2
+  - Virtualization/Sandbox Evasion [T1497] Count-1
+  - Debugger Evasion [T1622] Count-2
+  - Indicator Removal [T1070] Count-2
+  - Impair Defenses::Disable Windows Event Logging [T1562.002] Count-1
+  - Process Injection [T1055] Count-7
+  - Access Token Manipulation::Parent PID Spoofing [T1134.004] Count-1
+  - Indicator Removal::Clear Windows Event Logs [T1070.001] Count-1
+  - Indicator Removal::File Deletion [T1070.004] Count-1
+  - Indicator Removal::Timestomp [T1070.006] Count-1
+  - Obfuscated Files or Information [T1027] Count-44
+  - Obfuscated Files or Information::Indicator Removal from Tools [T1027.005] Count-1
+  - Deobfuscate/Decode Files or Information [T1140] Count-2
+  - Subvert Trust Controls::Mark-of-the-Web Bypass [T1553.005] Count-1
+  - Hide Artifacts::Hidden File System [T1564.005] Count-1
+  - File and Directory Permissions Modification [T1222] Count-1
+  - Hide Artifacts::Hidden Window [T1564.003] Count-1
+  - Hide Artifacts [T1564] Count-1
+  - Process Injection::Process Doppelgänging [T1055.013] Count-1
+  - Process Injection::Portable Executable Injection [T1055.002] Count-1
+  - Process Injection::Dynamic-link Library Injection [T1055.001] Count-2
+  - Process Injection::Thread Execution Hijacking [T1055.003] Count-2
+  - Process Injection::Extra Window Memory Injection [T1055.011] Count-1
+  - Process Injection::Asynchronous Procedure Call [T1055.004] Count-1
+  - Process Injection::Process Hollowing [T1055.012] Count-1
+  - Modify Registry [T1112] Count-4
+  - Impair Defenses::Safe Mode Boot [T1562.009] Count-1
+  - Subvert Trust Controls::Code Signing Policy Modification [T1553.006] Count-1
+  - Abuse Elevation Control Mechanism::Bypass User Account Control [T1548.002] Count-4
+  - Reflective Code Loading [T1620] Count-1
+  - Obfuscated Files or Information::Dynamic API Resolution [T1027.007] Count-1
+  - Hijack Execution Flow [T1574] Count-1
+  - BITS Jobs [T1197] Count-1
+
+### Credential Access ###
+  num: 4
+  - Credentials from Password Stores::Windows Credential Manager [T1555.004] Count-1
+  - Credentials from Password Stores::Password Managers [T1555.005] Count-1
+  - Credentials from Password Stores [T1555] Count-48
+  - Credentials from Password Stores::Credentials from Web Browsers [T1555.003] Count-2
+
+### Discovery ###
+  num: 17
+  - File and Directory Discovery [T1083] Count-10
+  - System Information Discovery [T1082] Count-16
+  - Process Discovery [T1057] Count-9
+  - System Location Discovery::System Language Discovery [T1614.001] Count-2
+  - System Service Discovery [T1007] Count-3
+  - Application Window Discovery [T1010] Count-2
+  - System Owner/User Discovery [T1033] Count-4
+  - Account Discovery [T1087] Count-2
+  - Query Registry [T1012] Count-3
+  - Software Discovery::Security Software Discovery [T1518.001] Count-1
+  - Software Discovery [T1518] Count-1
+  - System Network Configuration Discovery::Internet Connection Discovery [T1016.001] Count-1
+  - System Network Configuration Discovery [T1016] Count-8
+  - Network Sniffing [T1040] Count-1
+  - System Location Discovery [T1614] Count-1
+  - Group Policy Discovery [T1615] Count-1
+  - Domain Trust Discovery [T1482] Count-1
+
+### Lateral Movement ###
+  num: 0
+
+### Collection ###
+  num: 7
+  - Archive Collected Data::Archive via Library [T1560.002] Count-1
+  - Clipboard Data [T1115] Count-3
+  - Video Capture [T1125] Count-1
+  - Input Capture::Keylogging [T1056.001] Count-3
+  - Data from Information Repositories [T1213] Count-2
+  - Audio Capture [T1123] Count-1
+  - Screen Capture [T1113] Count-2
+
+### Command and Control ###
+  num: 1
+  - Ingress Tool Transfer [T1105] Count-1
+
+### Exfiltration ###
+  num: 0
+
+### Impact ###
+  num: 5
+  - Endpoint Denial of Service [T1499] Count-1
+  - System Shutdown/Reboot [T1529] Count-1
+  - Data Manipulation::Transmitted Data Manipulation [T1565.002] Count-1
+  - Inhibit System Recovery [T1490] Count-1
+  - Disk Wipe::Disk Structure Wipe [T1561.002] Count-1
+
+## MBC MAPPINGS ##
+
+### Anti-Behavioral Analysis ###
+  num: 24
+  - Emulator Detection [B0004] Count-1
+  - Virtual Machine Detection [B0009] Count-14
+  - Sandbox Detection [B0007] Count-1
+  - Virtual Machine Detection::Human User Check [B0009.012] Count-2
+  - Virtual Machine Detection::Unique Hardware/Firmware Check [B0009.023] Count-1
+  - Sandbox Detection::Product Key/ID Testing [B0007.005] Count-1
+  - Debugger Evasion [B0002] Count-2
+  - Debugger Detection [B0001] Count-3
+  - Debugger Detection::Software Breakpoints [B0001.025] Count-1
+  - Debugger Detection::Process Environment Block BeingDebugged [B0001.035] Count-1
+  - Debugger Detection::Timing/Delay Check GetTickCount [B0001.032] Count-1
+  - Debugger Detection::SetHandleInformation [B0001.024] Count-1
+  - Debugger Detection::OutputDebugString [B0001.016] Count-1
+  - Debugger Detection::Memory Write Watching [B0001.010] Count-1
+  - Debugger Detection::Timing/Delay Check QueryPerformanceCounter [B0001.033] Count-1
+  - Debugger Detection::Hardware Breakpoints [B0001.005] Count-1
+  - Debugger Detection::NtQueryInformationProcess [B0001.012] Count-1
+  - Debugger Detection::CheckRemoteDebuggerPresent [B0001.002] Count-1
+  - Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031] Count-1
+  - Debugger Detection::Process Environment Block NtGlobalFlag [B0001.036] Count-1
+  - Debugger Detection::Anti-debugging Instructions [B0001.034] Count-1
+  - Conditional Execution::Runs as Service [B0025.007] Count-1
+  - Debugger Detection::Process Environment Block [B0001.019] Count-1
+  - Dynamic Analysis Evasion::Delayed Execution [B0003.003] Count-1
+
+### Anti-Static Analysis ###
+  num: 10
+  - Disassembler Evasion [B0012] Count-1
+  - Software Packing [F0001] Count-14
+  - Software Packing::Themida [F0001.011] Count-1
+  - Software Packing::VMProtect [F0001.010] Count-1
+  - Software Packing::Standard Compression [F0001.002] Count-2
+  - Software Packing::Confuser [F0001.009] Count-1
+  - Software Packing::UPX [F0001.008] Count-1
+  - Executable Code Obfuscation [B0032] Count-10
+  - Executable Code Obfuscation::Argument Obfuscation [B0032.020] Count-1
+  - Executable Code Obfuscation::Stack Strings [B0032.017] Count-1
+
+### Collection ###
+  num: 5
+  - Input Capture [E1056] Count-1
+  - Keylogging::Polling [F0002.002] Count-1
+  - Keylogging::Application Hook [F0002.001] Count-1
+  - Screen Capture::WinAPI [E1113.m01] Count-1
+  - Screen Capture [E1113] Count-1
+
+### Command and Control ###
+  num: 3
+  - C2 Communication::Send Data [B0030.001] Count-1
+  - C2 Communication::Receive Data [B0030.002] Count-1
+  - C2 Communication::Server to Client File Transfer [B0030.003] Count-1
+
+### Credential Access ###
+  num: 0
+
+### Defense Evasion ###
+  num: 15
+  - Disable or Evade Security Tools::Heavens Gate [F0004.008] Count-1
+  - Disable or Evade Security Tools [F0004] Count-1
+  - Disable or Evade Security Tools::Modify Policy [F0004.005] Count-2
+  - Process Injection::Patch Process Command Line [E1055.m04] Count-1
+  - Self Deletion::COMSPEC Environment Variable [F0007.001] Count-1
+  - Obfuscated Files or Information::Encryption [E1027.m04] Count-1
+  - Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05] Count-21
+  - Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02] Count-3
+  - Disable or Evade Security Tools::Bypass Windows File Protection [F0004.007] Count-1
+  - Process Injection [E1055] Count-4
+  - Disable or Evade Security Tools::Disable Code Integrity [F0004.009] Count-1
+  - Process Injection::Injection via Windows Fibers [E1055.m05] Count-1
+  - Hijack Execution Flow::Abuse Windows Function Calls [F0015.006] Count-1
+  - Hijack Execution Flow::Import Address Table Hooking [F0015.003] Count-1
+  - Obfuscated Files or Information [E1027] Count-1
+
+### Discovery ###
+  num: 8
+  - Analysis Tool Discovery::Process detection [B0013.001] Count-1
+  - System Information Discovery [E1082] Count-5
+  - File and Directory Discovery [E1083] Count-7
+  - Application Window Discovery [E1010] Count-1
+  - Taskbar Discovery [B0043] Count-1
+  - File and Directory Discovery::Log File [E1083.m01] Count-2
+  - Code Discovery::Enumerate PE Sections [B0046.001] Count-1
+  - Code Discovery::Inspect Section Memory Permissions [B0046.002] Count-1
+
+### Execution ###
+  num: 2
+  - Command and Scripting Interpreter [E1059] Count-2
+  - Install Additional Program [B0023] Count-2
+
+### Exfiltration ###
+  num: 0
+
+### Impact ###
+  num: 6
+  - Modify Hardware::Mouse [B0042.002] Count-1
+  - Modify Hardware::CDROM [B0042.001] Count-1
+  - Clipboard Modification [E1510] Count-1
+  - Remote Access::Reverse Shell [B0022.001] Count-2
+  - Data Destruction::Delete Shadow Copies [E1485.m04] Count-1
+  - Disk Wipe [F0014] Count-1
+
+### Lateral Movement ###
+  num: 0
+
+### Persistence ###
+  num: 2
+  - Hijack Execution Flow [F0015] Count-1
+  - Registry Run Keys / Startup Folder [F0012] Count-1
+
+### Privilege Escalation ###
+  num: 0
+
+## MBC MICRO-BEHAVIOR MAPPINGS ##
+
+### Communication ###
+  num: 38
+  - Interprocess Communication [C0003] Count-2
+  - HTTP Communication::Read Header [C0002.014] Count-2
+  - HTTP Communication::WinHTTP [C0002.008] Count-1
+  - HTTP Communication::IWebBrowser [C0002.010] Count-2
+  - HTTP Communication [C0002] Count-2
+  - HTTP Communication::Set Header [C0002.013] Count-1
+  - HTTP Communication::Start Server [C0002.018] Count-1
+  - HTTP Communication::Receive Request [C0002.015] Count-1
+  - HTTP Communication::Send Response [C0002.016] Count-1
+  - HTTP Communication::Get Response [C0002.017] Count-5
+  - HTTP Communication::Send Request [C0002.003] Count-1
+  - HTTP Communication::Download URL [C0002.006] Count-1
+  - HTTP Communication::Create Request [C0002.012] Count-2
+  - HTTP Communication::Send Data [C0002.005] Count-1
+  - HTTP Communication::Open URL [C0002.004] Count-1
+  - HTTP Communication::Connect to Server [C0002.009] Count-1
+  - HTTP Communication::Extract Body [C0002.011] Count-1
+  - Socket Communication::Start TCP Server [C0001.005] Count-1
+  - Socket Communication::TCP Client [C0001.008] Count-1
+  - Interprocess Communication::Create Pipe [C0003.001] Count-2
+  - Interprocess Communication::Write Pipe [C0003.004] Count-1
+  - Interprocess Communication::Connect Pipe [C0003.002] Count-1
+  - Interprocess Communication::Read Pipe [C0003.003] Count-1
+  - FTP Communication::Send File [C0004.001] Count-1
+  - FTP Communication::WinINet [C0004.002] Count-1
+  - DNS Communication::Server Connect [C0011.002] Count-1
+  - DNS Communication::Resolve [C0011.001] Count-1
+  - Socket Communication::Get Socket Status [C0001.012] Count-1
+  - Socket Communication::Create Socket [C0001.003] Count-2
+  - Socket Communication::Set Socket Config [C0001.001] Count-1
+  - Socket Communication::Initialize Winsock Library [C0001.009] Count-1
+  - Socket Communication::Connect Socket [C0001.004] Count-1
+  - Socket Communication::Create TCP Socket [C0001.011] Count-2
+  - Socket Communication::Send TCP Data [C0001.014] Count-2
+  - Socket Communication::Create UDP Socket [C0001.010] Count-1
+  - Socket Communication::Send Data [C0001.007] Count-1
+  - Socket Communication::Receive Data [C0001.006] Count-1
+  - ICMP Communication::Echo Request [C0014.002] Count-1
+
+### Cryptography ###
+  num: 27
+  - Encryption Key::Import Public Key [C0028.001] Count-1
+  - Decrypt Data [C0031] Count-1
+  - Encrypt Data [C0027] Count-4
+  - Encryption Key [C0028] Count-2
+  - Encrypt Data::HC-128 [C0027.006] Count-2
+  - Encrypt Data::RC6 [C0027.010] Count-1
+  - Encrypt Data::Twofish [C0027.005] Count-1
+  - Encrypt Data::AES [C0027.001] Count-4
+  - Decrypt Data::AES [C0031.001] Count-1
+  - Encrypt Data::Sosemanuk [C0027.008] Count-1
+  - Encrypt Data::Camellia [C0027.003] Count-1
+  - Encrypt Data::3DES [C0027.004] Count-2
+  - Encrypt Data::RC4 [C0027.009] Count-4
+  - Generate Pseudo-random Sequence::RC4 PRGA [C0021.004] Count-1
+  - Encryption Key::RC4 KSA [C0028.002] Count-1
+  - Encrypt Data::Skipjack [C0027.013] Count-1
+  - Encrypt Data::Blowfish [C0027.002] Count-1
+  - Cryptographic Hash [C0029] Count-2
+  - Cryptographic Hash::Tiger [C0029.005] Count-1
+  - Cryptographic Hash::SHA1 [C0029.002] Count-1
+  - Cryptographic Hash::SHA256 [C0029.003] Count-1
+  - Cryptographic Hash::MD5 [C0029.001] Count-1
+  - Cryptographic Hash::SHA224 [C0029.004] Count-1
+  - Hashed Message Authentication Code [C0061] Count-1
+  - Generate Pseudo-random Sequence::Use API [C0021.003] Count-2
+  - Generate Pseudo-random Sequence [C0021] Count-1
+  - Crypto Library [C0059] Count-5
+
+### Data ###
+  num: 16
+  - Checksum::Luhn [C0032.002] Count-3
+  - Checksum::Adler [C0032.005] Count-1
+  - Checksum::CRC32 [C0032.001] Count-1
+  - Non-Cryptographic Hash::MurmurHash [C0030.001] Count-1
+  - Non-Cryptographic Hash::FNV [C0030.005] Count-1
+  - Non-Cryptographic Hash::djb2 [C0030.006] Count-1
+  - Encode Data::XOR [C0026.002] Count-1
+  - Encode Data::Base64 [C0026.001] Count-3
+  - Check String [C0019] Count-2
+  - Decompress Data::aPLib [C0025.003] Count-1
+  - Decompress Data::IEncodingFilterFactory [C0025.002] Count-1
+  - Compress Data [C0024] Count-3
+  - Decompress Data [C0025] Count-2
+  - Decompress Data::QuickLZ [C0025.001] Count-1
+  - Modulo [C0058] Count-1
+  - Compression Library [C0060] Count-2
+
+### File System ###
+  num: 11
+  - Set File Attributes [C0050] Count-2
+  - Create Directory [C0046] Count-1
+  - Delete File [C0047] Count-1
+  - Delete Directory [C0048] Count-1
+  - Get File Attributes [C0049] Count-1
+  - Move File [C0063] Count-1
+  - Writes File [C0052] Count-3
+  - Copy File [C0045] Count-1
+  - Read File [C0051] Count-4
+  - Read Virtual Disk [C0056] Count-1
+  - Create File [C0016] Count-1
+
+### Hardware ###
+  num: 4
+  - Simulate Hardware::Ctrl-Alt-Del [C0057.001] Count-1
+  - Install Driver [C0037] Count-1
+  - Install Driver::Minifilter [C0037.001] Count-1
+  - Load Driver::Minifilter [C0023.001] Count-1
+
+### Memory ###
+  num: 2
+  - Free Memory [C0044] Count-1
+  - Allocate Memory [C0007] Count-4
+
+### Operating System ###
+  num: 11
+  - Environment Variable::Set Variable [C0034.001] Count-1
+  - Environment Variable [C0034] Count-1
+  - Wallpaper [C0035] Count-1
+  - Console [C0033] Count-2
+  - Registry::Set Registry Key [C0036.001] Count-2
+  - Registry::Open Registry Key [C0036.003] Count-2
+  - Registry::Query Registry Key [C0036.005] Count-1
+  - Registry::Query Registry Value [C0036.006] Count-2
+  - Registry::Create Registry Key [C0036.004] Count-2
+  - Registry::Delete Registry Key [C0036.002] Count-1
+  - Registry::Delete Registry Value [C0036.007] Count-1
+
+### Process ###
+  num: 14
+  - Create Thread [C0038] Count-2
+  - Suspend Thread [C0055] Count-1
+  - Terminate Thread [C0039] Count-1
+  - Resume Thread [C0054] Count-1
+  - Enumerate Threads [C0064] Count-1
+  - Create Mutex [C0042] Count-2
+  - Check Mutex [C0043] Count-2
+  - Terminate Process [C0018] Count-3
+  - Allocate Thread Local Storage [C0040] Count-1
+  - Set Thread Local Storage Value [C0041] Count-1
+  - Create Process [C0017] Count-4
+  - Create Process::Create Suspended Process [C0017.003] Count-1
+  - Open Process [C0065] Count-1
+  - Open Thread [C0066] Count-1

cape.md

@@ -0,0 +1,602 @@
+# CAPE Rule Distribution #
+February 2023
+
+## Histograms ##
+The histograms below show the number of CAPE rules mapped to ATT&CK techniques (organized by tactic), MBC behaviors (organized by objective), and MBC micro-behaviors (organized by micro-objective). The explicit techniques, behaviors, and micro-behaviors follow. 
+
+The data below reflects [community repository signatures](https://github.com/kevoreilly/community/tree/master/modules/signatures) (not including deprecated signatures), as well as [CAPEv2 signatures](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py). 
+
+Information on CAPE signatures can be found [here](https://github.com/kevoreilly/CAPEv2/blob/master/docs/book/src/customization/signatures.rst).
+
+### ATT&CK Mapping Histogram ###
+
+| **TACTIC** | **Number of Techniques**  |  |
+|-----|-----|-----|
+|**Reconnaissance**|5| **XXXXX** |
+|**Resource Development**|2| **XX** |
+|**Initial Access**|4| **XXXX** |
+|**Execution**|18| **XXXXXXXXXXXXXXXXXX** |
+|**Persistence**|34| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Privilege Escalation**|27| **XXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Defense Evasion**|70| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Credential Access**|15| **XXXXXXXXXXXXXXX** |
+|**Discovery**|19| **XXXXXXXXXXXXXXXXXXX** |
+|**Lateral Movement**|3| **XXX** |
+|**Collection**|10| **XXXXXXXXXX** |
+|**Command And Control**|18| **XXXXXXXXXXXXXXXXXX** |
+|**Exfiltration**|4| **XXXX** |
+|**Impact**|11| **XXXXXXXXXXX** |
+
+### MBC Mapping Histogram ###
+
+| **OBJECTIVE** | **Number of Behaviors** |  |
+|-----|-----|-----|
+|**Anti-behavioral Analysis**|36| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Anti-static Analysis**|7| **XXXXXXX** |
+|**Collection**|6| **XXXXXX** |
+|**Command And Control**|4| **XXXX** |
+|**Credential Access**|6| **XXXXXX** |
+|**Defense Evasion**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
+|**Discovery**|7| **XXXXXXX** |
+|**Execution**|3| **XXX** |
+|**Exfiltration**|1| **X** |
+|**Impact**|9| **XXXXXXXXX** |
+|**Lateral Movement**|1| **X** |
+|**Persistence**|11| **XXXXXXXXXXX** |
+|**Privilege Escalation**|4| **XXXX** |
+
+### MBC Mapping Histogram ###
+
+| **MICRO-OBJECTIVE** | **Number of Micro-Behaviors**  |  |
+|-----|-----|-----|
+|**Communication**|13| **XXXXXXXXXXXXX** |
+|**Cryptography**|3| **XXX** |
+|**Data**|1| **X** |
+|**File System**|9| **XXXXXXXXX** |
+|**Hardware**|1| **X** |
+|**Memory**|3| **XXX** |
+|**Process**|5| **XXXXX** |
+|**Operating System**|7| **XXXXXXX** |
+
+### Objective-only Mapping Counts ###
+This histogram indicates the number of CAPE signatures that map to an MBC objective.
+
+| **OBJECTIVE** | **Number of CAPE signatures** |  |
+|-----|-----|-----|
+|**Anti-behavioral Analysis**|84| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Anti-static Analysis**|23| **XXXXXXXXXXXXXXXXXXXXXXX** |
+|**Collection**|10| **XXXXXXXXXX** |
+|**Command And Control**|15| **XXXXXXXXXXXXXXX** |
+|**Credential Access**|16| **XXXXXXXXXXXXXXXX** |
+|**Defense Evasion**|98| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Discovery**|68| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Execution**|72| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Exfiltration**|3| **XXX** |
+|**Impact**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
+|Lateral Movement|0| |
+|**Persistence**|22| **XXXXXXXXXXXXXXXXXXXXXX** |
+|**Privilege Escalation**|4| **XXXX** |
+
+This histogram indicates the number of CAPE signatures that map to an MBC micro-objective.
+
+| **MICRO-OBJECTIVE** | **Number of CAPE signatures**  |  |
+|-----|-----|-----|
+|**Communication**|45| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Cryptography**|12| **XXXXXXXXXXXX** |
+|**Data**|1| **X** |
+|**File System**|51| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Hardware**|1| **X** |
+|**Memory**|3| **XXX** |
+|**Process**|72| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+|**Operating System**|94| **XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX** |
+
+
+## ATT&CK MAPPINGS ##
+
+### Reconnaissance ###
+  num: 5
+  - Gather Victim Host Information [T1592] Count-2
+  - Client Configurations [T1592.004] Count-2
+  - Gather Victim Identity Information [T1589] Count-1
+  - Credentials [T1589.001] Count-1
+  - Software [T1592.002] Count-1
+
+### Resource Development ###
+  num: 2
+  - Develop Capabilities [T1587] Count-1
+  - Digital Certificates [T1587.003] Count-1
+
+### Initial Access ###
+  num: 4
+  - Replication Through Removable Media [T1091] Count-1
+  - Spearphishing Link [T1192] Count-1
+  - Phishing [T1566] Count-1
+  - Spearphishing Link [T1566.002] Count-1
+
+### Execution ###
+  num: 18
+  - Exploitation for Client Execution [T1203] Count-19
+  - Command and Scripting Interpreter [T1059] Count-52
+  - Native API [T1106] Count-13
+  - Scripting [T1064] Count-20
+  - JavaScript [T1059.007] Count-5
+  - PowerShell [T1086] Count-12
+  - Regsvr32 [T1117] Count-4
+  - PowerShell [T1059.001] Count-14
+  - Visual Basic [T1059.005] Count-5
+  - Windows Command Shell [T1059.003] Count-2
+  - InstallUtil [T1118] Count-2
+  - User Execution [T1204] Count-6
+  - Scheduled Task/Job [T1053] Count-2
+  - Scheduled Task [T1053.005] Count-2
+  - At [T1053.002] Count-1
+  - Windows Management Instrumentation [T1047] Count-5
+  - Malicious File [T1204.002] Count-4
+  - Shared Modules [T1129] Count-2
+
+### Persistence ###
+  num: 34
+  - Office Application Startup [T1137] Count-20
+  - Browser Extensions [T1176] Count-2
+  - Modify Existing Service [T1031] Count-6
+  - New Service [T1050] Count-5
+  - Create or Modify System Process [T1543] Count-6
+  - Windows Service [T1543.003] Count-6
+  - Bootkit [T1067] Count-6
+  - Pre-OS Boot [T1542] Count-5
+  - Bootkit [T1542.003] Count-5
+  - Office Template Macros [T1137.001] Count-6
+  - Hidden Files and Directories [T1158] Count-3
+  - Image File Execution Options Injection [T1183] Count-2
+  - Event Triggered Execution [T1546] Count-4
+  - Image File Execution Options Injection [T1546.012] Count-2
+  - Server Software Component [T1505] Count-3
+  - Web Shell [T1505.003] Count-3
+  - Registry Run Keys / Startup Folder [T1060] Count-4
+  - Boot or Logon Autostart Execution [T1547] Count-5
+  - Registry Run Keys / Startup Folder [T1547.001] Count-4
+  - Scheduled Task/Job [T1053] Count-2
+  - Scheduled Task [T1053.005] Count-2
+  - At [T1053.002] Count-1
+  - Accessibility Features [T1015] Count-1
+  - Accessibility Features [T1546.008] Count-1
+  - Hijack Execution Flow [T1574] Count-2
+  - Kernel Modules and Extensions [T1215] Count-1
+  - Kernel Modules and Extensions [T1547.006] Count-1
+  - DLL Side-Loading [T1574.002] Count-1
+  - Add-ins [T1137.006] Count-1
+  - Create Account [T1136] Count-2
+  - Local Account [T1136.001] Count-2
+  - Account Manipulation [T1098] Count-1
+  - Application Shimming [T1138] Count-1
+  - Application Shimming [T1546.011] Count-1
+
+### Privilege Escalation ###
+  num: 27
+  - Process Injection [T1055] Count-20
+  - New Service [T1050] Count-5
+  - Create or Modify System Process [T1543] Count-6
+  - Windows Service [T1543.003] Count-6
+  - Extra Window Memory Injection [T1055.011] Count-2
+  - Image File Execution Options Injection [T1183] Count-2
+  - Event Triggered Execution [T1546] Count-4
+  - Image File Execution Options Injection [T1546.012] Count-2
+  - Boot or Logon Autostart Execution [T1547] Count-5
+  - Registry Run Keys / Startup Folder [T1547.001] Count-4
+  - Scheduled Task/Job [T1053] Count-2
+  - Scheduled Task [T1053.005] Count-2
+  - At [T1053.002] Count-1
+  - Accessibility Features [T1015] Count-1
+  - Accessibility Features [T1546.008] Count-1
+  - Hijack Execution Flow [T1574] Count-2
+  - Kernel Modules and Extensions [T1547.006] Count-1
+  - Bypass User Account Control [T1088] Count-5
+  - Abuse Elevation Control Mechanism [T1548] Count-6
+  - Bypass User Account Control [T1548.002] Count-5
+  - DLL Side-Loading [T1574.002] Count-1
+  - Application Shimming [T1138] Count-1
+  - Application Shimming [T1546.011] Count-1
+  - Portable Executable Injection [T1055.002] Count-1
+  - Process Hollowing [T1055.012] Count-2
+  - Extra Window Memory Injection [T1181] Count-1
+  - Process Doppelgänging [T1055.013] Count-1
+
+### Defense Evasion ###
+  num: 70
+  - Virtualization/Sandbox Evasion [T1497] Count-39
+  - Time Based Evasion [T1497.003] Count-4
+  - Modify Registry [T1112] Count-75
+  - Masquerading [T1036] Count-11
+  - Masquerade Task or Service [T1036.004] Count-1
+  - Match Legitimate Name or Location [T1036.005] Count-3
+  - Disabling Security Tools [T1089] Count-22
+  - Impair Defenses [T1562] Count-30
+  - Disable or Modify Tools [T1562.001] Count-17
+  - Hidden Window [T1143] Count-1
+  - Hide Artifacts [T1564] Count-6
+  - Hidden Window [T1564.003] Count-1
+  - System Checks [T1497.001] Count-12
+  - Scripting [T1064] Count-20
+  - Software Packing [T1045] Count-21
+  - Obfuscated Files or Information [T1027] Count-30
+  - Software Packing [T1027.002] Count-22
+  - Indicator Blocking [T1054] Count-7
+  - Impair Command History Logging [T1562.003] Count-1
+  - Indicator Blocking [T1562.006] Count-7
+  - Regsvr32 [T1117] Count-4
+  - System Binary Proxy Execution [T1218] Count-8
+  - Regsvr32 [T1218.010] Count-4
+  - Rootkit [T1014] Count-4
+  - Process Injection [T1055] Count-20
+  - Disable or Modify System Firewall [T1562.004] Count-3
+  - Timestomp [T1099] Count-4
+  - Indicator Removal [T1070] Count-11
+  - Timestomp [T1070.006] Count-4
+  - Pre-OS Boot [T1542] Count-5
+  - Bootkit [T1542.003] Count-5
+  - Extra Window Memory Injection [T1055.011] Count-2
+  - Code Signing [T1116] Count-2
+  - Subvert Trust Controls [T1553] Count-5
+  - Code Signing [T1553.002] Count-3
+  - Invalid Code Signature [T1036.001] Count-2
+  - Hidden Files and Directories [T1158] Count-3
+  - Hidden Files and Directories [T1564.001] Count-3
+  - InstallUtil [T1118] Count-2
+  - Trusted Developer Utilities Proxy Execution [T1127] Count-3
+  - InstallUtil [T1218.004] Count-2
+  - Image File Execution Options Injection [T1183] Count-2
+  - Clear Windows Event Logs [T1070.001] Count-1
+  - NTFS File Attributes [T1096] Count-3
+  - NTFS File Attributes [T1564.004] Count-2
+  - Indirect Command Execution [T1202] Count-4
+  - Rename System Utilities [T1036.003] Count-1
+  - Install Root Certificate [T1130] Count-1
+  - Deobfuscate/Decode Files or Information [T1140] Count-4
+  - Install Root Certificate [T1553.004] Count-2
+  - Compile After Delivery [T1500] Count-3
+  - Compile After Delivery [T1027.004] Count-3
+  - File Deletion [T1107] Count-2
+  - File Deletion [T1070.004] Count-2
+  - User Activity Based Checks [T1497.002] Count-1
+  - Hijack Execution Flow [T1574] Count-2
+  - Bypass User Account Control [T1088] Count-5
+  - Abuse Elevation Control Mechanism [T1548] Count-6
+  - Bypass User Account Control [T1548.002] Count-5
+  - DLL Side-Loading [T1073] Count-1
+  - DLL Side-Loading [T1574.002] Count-1
+  - Disable Windows Event Logging [T1562.002] Count-1
+  - CMSTP [T1218.003] Count-1
+  - Template Injection [T1221] Count-1
+  - Portable Executable Injection [T1055.002] Count-1
+  - Process Hollowing [T1093] Count-2
+  - Process Hollowing [T1055.012] Count-2
+  - Extra Window Memory Injection [T1181] Count-1
+  - Process Doppelgänging [T1186] Count-1
+  - Process Doppelgänging [T1055.013] Count-1
+
+### Credential Access ###
+  num: 15
+  - Credentials in Files [T1081] Count-7
+  - OS Credential Dumping [T1003] Count-18
+  - Unsecured Credentials [T1552] Count-8
+  - Credentials In Files [T1552.001] Count-7
+  - Input Capture [T1056] Count-3
+  - Keylogging [T1056.001] Count-2
+  - Credentials from Password Stores [T1555] Count-6
+  - Credentials from Web Browsers [T1503] Count-5
+  - Credentials from Web Browsers [T1555.003] Count-5
+  - Group Policy Preferences [T1552.006] Count-1
+  - Steal Web Session Cookie [T1539] Count-1
+  - LSASS Memory [T1003.001] Count-1
+  - Security Account Manager [T1003.002] Count-4
+  - LSA Secrets [T1003.004] Count-1
+  - Network Sniffing [T1040] Count-1
+
+### Discovery ###
+  num: 19
+  - Process Discovery [T1057] Count-35
+  - File and Directory Discovery [T1083] Count-31
+  - Virtualization/Sandbox Evasion [T1497] Count-39
+  - Time Based Evasion [T1497.003] Count-4
+  - System Information Discovery [T1082] Count-24
+  - System Checks [T1497.001] Count-12
+  - Security Software Discovery [T1063] Count-18
+  - Software Discovery [T1518] Count-21
+  - Security Software Discovery [T1518.001] Count-18
+  - Application Window Discovery [T1010] Count-3
+  - Permission Groups Discovery [T1069] Count-2
+  - Query Registry [T1012] Count-21
+  - System Owner/User Discovery [T1033] Count-3
+  - System Network Configuration Discovery [T1016] Count-4
+  - Domain Trust Discovery [T1482] Count-2
+  - Account Discovery [T1087] Count-3
+  - User Activity Based Checks [T1497.002] Count-1
+  - System Service Discovery [T1007] Count-1
+  - Network Sniffing [T1040] Count-1
+
+### Lateral Movement ###
+  num: 3
+  - Remote Services [T1021] Count-4
+  - Remote Desktop Protocol [T1021.001] Count-3
+  - Replication Through Removable Media [T1091] Count-1
+
+### Collection ###
+  num: 10
+  - Data from Local System [T1005] Count-7
+  - Email Collection [T1114] Count-2
+  - Input Capture [T1056] Count-3
+  - Keylogging [T1056.001] Count-2
+  - Data Staged [T1074] Count-1
+  - Screen Capture [T1113] Count-2
+  - Clipboard Data [T1115] Count-3
+  - Archive Collected Data [T1560] Count-4
+  - Browser Session Hijacking [T1185] Count-3
+  - Automated Collection [T1119] Count-1
+
+### Command And Control ###
+  num: 18
+  - Application Layer Protocol [T1071] Count-35
+  - Remote Access Software [T1219] Count-39
+  - Proxy [T1090] Count-5
+  - Web Protocols [T1071.001] Count-19
+  - Multi-hop Proxy [T1188] Count-3
+  - Multi-hop Proxy [T1090.003] Count-3
+  - Standard Cryptographic Protocol [T1032] Count-15
+  - Encrypted Channel [T1573] Count-14
+  - File Transfer Protocols [T1071.002] Count-1
+  - Non-Application Layer Protocol [T1095] Count-4
+  - Custom Command and Control Protocol [T1094] Count-2
+  - DNS [T1071.004] Count-7
+  - Ingress Tool Transfer [T1105] Count-2
+  - Data Encoding [T1132] Count-1
+  - Standard Encoding [T1132.001] Count-1
+  - Domain Generation Algorithms [T1483] Count-2
+  - Dynamic Resolution [T1568] Count-3
+  - Domain Generation Algorithms [T1568.002] Count-2
+
+### Exfiltration ###
+  num: 4
+  - Exfiltration Over C2 Channel [T1041] Count-2
+  - Automated Exfiltration [T1020] Count-1
+  - Data Encrypted [T1022] Count-4
+  - Exfiltration Over Alternative Protocol [T1048] Count-2
+
+### Impact ###
+  num: 11
+  - Data Encrypted for Impact [T1486] Count-22
+  - Endpoint Denial of Service [T1499] Count-3
+  - Application or System Exploitation [T1499.004] Count-3
+  - Service Stop [T1489] Count-1
+  - Defacement [T1491] Count-1
+  - Internal Defacement [T1491.001] Count-1
+  - System Shutdown/Reboot [T1529] Count-1
+  - Inhibit System Recovery [T1490] Count-8
+  - Data Destruction [T1485] Count-4
+  - Disk Wipe [T1561] Count-1
+  - Resource Hijacking [T1496] Count-2
+
+## MBC MAPPINGS ##
+
+### Anti-behavioral Analysis ###
+  num: 36
+  - Sandbox Detection [B0007] Count-10
+  - Sandbox Detection [B0007.002] Count-5
+  - Dynamic Analysis Evasion [B0003] Count-5
+  - Dynamic Analysis Evasion [B0003.002] Count-1
+  - Dynamic Analysis Evasion [B0003.003] Count-1
+  - Virtual Machine Detection [B0009] Count-29
+  - Virtual Machine Detection [B0009.015] Count-1
+  - Software Packing [F0001] Count-19
+  - Software Packing [F0001.010] Count-1
+  - Virtual Machine Detection [B0009.001] Count-6
+  - Debugger Detection [B0001] Count-9
+  - Debugger Detection [B0001.002] Count-1
+  - Debugger Detection [B0001.012] Count-1
+  - Debugger Detection [B0001.001] Count-1
+  - Software Packing [F0001.009] Count-1
+  - Dynamic Analysis Evasion [B0003.010] Count-1
+  - Emulator Detection [B0004] Count-4
+  - Virtual Machine Detection [B0009.005] Count-13
+  - Virtual Machine Detection [B0009.024] Count-2
+  - Debugger Detection [B0001.030] Count-1
+  - Virtual Machine Detection [B0009.008] Count-3
+  - Debugger Detection [B0001.016] Count-1
+  - Sandbox Detection [B0007.003] Count-1
+  - Virtual Machine Detection [B0009.012] Count-1
+  - Debugger Detection [B0001.032] Count-1
+  - Emulator Detection [B0004.003] Count-2
+  - Software Packing [F0001.008] Count-1
+  - Debugger Detection [B0001.009] Count-1
+  - Debugger Evasion [B0002] Count-3
+  - Debugger Evasion [B0002.008] Count-1
+  - Software Packing [F0001.013] Count-1
+  - Virtual Machine Detection [B0009.006] Count-1
+  - Software Packing [F0001.011] Count-2
+  - Debugger Evasion [B0002.024] Count-1
+  - Debugger Detection [B0001.014] Count-1
+  - Virtual Machine Detection [B0009.009] Count-1
+
+### Anti-static Analysis ###
+  num: 7
+  - Software Packing [F0001] Count-19
+  - Software Packing [F0001.010] Count-1
+  - Software Packing [F0001.009] Count-1
+  - Obfuscated Files or Information [E1027] Count-6
+  - Software Packing [F0001.008] Count-1
+  - Software Packing [F0001.013] Count-1
+  - Software Packing [F0001.011] Count-2
+
+### Collection ###
+  num: 6
+  - Keylogging [F0002] Count-2
+  - Keylogging [F0002.001] Count-1
+  - Screen Capture [E1113] Count-2
+  - Cryptocurrency [B0028] Count-1
+  - Cryptocurrency [B0028.001] Count-1
+  - Input Capture [E1056] Count-3
+
+### Command And Control ###
+  num: 4
+  - C2 Communication [B0030] Count-14
+  - C2 Communication [B0030.005] Count-1
+  - Ingress Tool Transfer [E1105] Count-1
+  - Domain Name Generation [B0031] Count-2
+
+### Credential Access ###
+  num: 6
+  - Keylogging [F0002] Count-2
+  - Keylogging [F0002.001] Count-1
+  - Screen Capture [E1113] Count-2
+  - Cryptocurrency [B0028] Count-1
+  - Cryptocurrency [B0028.001] Count-1
+  - Input Capture [E1056] Count-3
+
+### Defense Evasion ###
+  num: 22
+  - Modify Registry [E1112] Count-71
+  - Disable or Evade Security Tools [F0004] Count-23
+  - Hidden Files and Directories [F0005] Count-7
+  - Hidden Files and Directories [F0005.002] Count-1
+  - Indicator Blocking [F0006] Count-7
+  - Software Packing [F0001] Count-19
+  - Software Packing [F0001.010] Count-1
+  - Rootkit [E1014] Count-4
+  - Process Injection [E1055] Count-23
+  - Software Packing [F0001.009] Count-1
+  - Hidden Files and Directories [F0005.004] Count-3
+  - Bypass Data Execution Prevention [B0037] Count-1
+  - Bootkit [F0013] Count-5
+  - Obfuscated Files or Information [E1027] Count-6
+  - Disable or Evade Security Tools [F0004.005] Count-3
+  - Polymorphic Code [B0029] Count-1
+  - Self Deletion [F0007] Count-2
+  - Disable or Evade Security Tools [F0004.007] Count-1
+  - Software Packing [F0001.008] Count-1
+  - Disable or Evade Security Tools [F0004.003] Count-1
+  - Software Packing [F0001.013] Count-1
+  - Software Packing [F0001.011] Count-2
+
+### Discovery ###
+  num: 7
+  - File and Directory Discovery [E1083] Count-17
+  - System Information Discovery [E1082] Count-24
+  - Application Window Discovery [E1010] Count-1
+  - Analysis Tool Discovery [B0013] Count-5
+  - Analysis Tool Discovery [B0013.001] Count-1
+  - Analysis Tool Discovery [B0013.009] Count-1
+  - Analysis Tool Discovery [B0013.008] Count-1
+
+### Execution ###
+  num: 3
+  - Exploitation for Client Execution [E1203] Count-26
+  - Command and Scripting Interpreter [E1059] Count-47
+  - Install Additional Program [B0023] Count-5
+
+### Exfiltration ###
+  num: 1
+  - Archive Collected Data [E1560] Count-6
+
+### Impact ###
+  num: 9
+  - Exploitation for Client Execution [E1203] Count-26
+  - Data Encrypted for Impact [E1486] Count-8
+  - Remote Access [B0022] Count-43
+  - Denial of Service [B0033] Count-4
+  - Disk Wipe [F0014] Count-2
+  - Disk Wipe [F0014.001] Count-1
+  - Data Destruction [E1485] Count-4
+  - Resource Hijacking [B0018] Count-2
+  - Resource Hijacking [B0018.002] Count-1
+
+### Lateral Movement ###
+  num: 1
+  - Ingress Tool Transfer [E1105] Count-1
+
+### Persistence ###
+  num: 11
+  - Remote Access [B0022] Count-43
+  - Modify Registry [E1112] Count-71
+  - Hidden Files and Directories [F0005] Count-7
+  - Hidden Files and Directories [F0005.002] Count-1
+  - Kernel Modules and Extensions [F0010] Count-2
+  - Kernel Modules and Extensions [F0010.001] Count-1
+  - Modify Existing Service [F0011] Count-6
+  - Hidden Files and Directories [F0005.004] Count-3
+  - Bootkit [F0013] Count-5
+  - Registry Run Keys / Startup Folder [F0012] Count-3
+  - Ingress Tool Transfer [E1105] Count-1
+
+### Privilege Escalation ###
+  num: 4
+  - Process Injection [E1055] Count-23
+  - Kernel Modules and Extensions [F0010] Count-2
+  - Kernel Modules and Extensions [F0010.001] Count-1
+  - Modify Existing Service [F0011] Count-6
+
+## MBC MICRO-BEHAVIOR MAPPINGS ##
+
+### Communication ###
+  num: 13
+  - HTTP Communication [C0002] Count-23
+  - HTTP Communication [C0002.003] Count-1
+  - HTTP Communication [C0002.005] Count-3
+  - WinINet [C0005] Count-5
+  - WinINet [C0005.002] Count-1
+  - WinINet [C0005.003] Count-1
+  - SMTP Communication [C0012] Count-1
+  - Socket Communication [C0001] Count-6
+  - WinINet [C0005.001] Count-1
+  - DNS Communication [C0011] Count-8
+  - ICMP Communication [C0014] Count-2
+  - Interprocess Communication [C0003] Count-1
+  - Interprocess Communication [C0003.001] Count-1
+
+### Cryptography ###
+  num: 3
+  - Encrypt Data [C0027] Count-10
+  - Encryption Key [C0028] Count-1
+  - Decrypt Data [C0031] Count-1
+
+### Data ###
+  num: 1
+  - Decompress Data [C0025] Count-1
+
+### File System ###
+  num: 9
+  - Create File [C0016] Count-24
+  - Writes File [C0052] Count-8
+  - Create Directory [C0046] Count-1
+  - Alter File Extension [C0015] Count-4
+  - Delete File [C0047] Count-7
+  - Read File [C0051] Count-6
+  - Create File [C0016.002] Count-1
+  - Copy File [C0045] Count-1
+  - Create File [C0016.001] Count-1
+
+### Hardware ###
+  num: 1
+  - Load Driver [C0023] Count-1
+
+### Memory ###
+  num: 3
+  - Change Memory Protection [C0008] Count-1
+  - Heap Spray [C0006] Count-1
+  - Allocate Memory [C0007] Count-1
+
+### Process ###
+  num: 5
+  - Create Mutex [C0042] Count-59
+  - Check Mutex [C0043] Count-4
+  - Create Process [C0017] Count-3
+  - Create Process [C0017.002] Count-1
+  - Create Thread [C0038] Count-4
+
+### Operating System ###
+  num: 7
+  - Registry [C0036] Count-89
+  - Registry [C0036.001] Count-9
+  - Wallpaper [C0035] Count-1
+  - Console [C0033] Count-1
+  - Registry [C0036.005] Count-16
+  - Registry [C0036.003] Count-3
+  - Registry [C0036.006] Count-1

collection/README.md

@@ -1,13 +1,24 @@
-|||
-|---|---|
-|**ID**|**OB0003**|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0003</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>29 November 2022</b></td>
+</tr>
+</table>
 
 
-# Collection #
-Behaviors that identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.
+# Collection
+
+Behaviors that enable malware to identify and gather information, such as sensitive files, from a machine or network. Sources often targeted include drives, browsers, audio/video, and email. Often the malware's next objective is to exfiltrate the information gathered.
 
 * **Cryptocurrency** [B0028](../collection/cryptocurrency.md)
-* **Hooking** [F0003](../credential-access/hooking.md)
+* **Hijack Execution Flow** [F0015](../defense-evasion/hijack-execution-flow.md)
 * **Input Capture** [E1056](../collection/input-capture.md)
 * **Keylogging** [F0002](../collection/keylogging.md)
 * **Screen Capture** [E1113](../collection/screen-capture.md)

collection/cryptocurrency.md

@@ -1,18 +1,48 @@
-|||
-|---|---|
-|**ID**|**B0028**|
-|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
-|**Related ATT&CK Technique**|None|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0028</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>14 August 2020</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
 
+# Cryptocurrency
 
-Cryptocurrency
-==============
 Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets.
 
-Methods
--------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Bitcoin**|B0028.001|Access Bitcoin data.|
 |**Ethereum**|B0028.002|Access Ethereum data.|
 |**Zcash**|B0028.003|Access Zcash data.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/

collection/input-capture.md

@@ -1,24 +1,70 @@
-|||
-|---|---|
-|**ID**|**E1056**|
-|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
-|**Related ATT&CK Technique**|[Input Capture](https://attack.mitre.org/techniques/T1056)|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1056</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Input Capture (<a href="https://attack.mitre.org/techniques/T1056">T1056</a>, <a href="https://attack.mitre.org/techniques/T1417/">T1417</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
 
 
-Input Capture
-=============
+# Input Capture
+
 Malware captures user input.
 
-**See ATT&CK:** [**Input Capture**](https://attack.mitre.org/techniques/T1056).
+See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [T1417](https://attack.mitre.org/techniques/T1417/))**.
+
+## Methods
 
-Methods
--------
 |Name|ID|Description|
 |---|---|---|
 |**Mouse Events**|E1056.m01|Mouse events are captured.|
 
-Malware Examples
-----------------
-|Name|Date|Description|
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware injects itself into a browser and captures user input data. [[1]](#1)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware injects HTML into a browser session to collect sensitive online banking information when the victim performs their online banking. [[2]](#2)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy can capture audio and video. [[4]](#4)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[5]](#5)|
+|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[6]](#6)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
 |---|---|---|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|Captures input.|
+|[use .NET library SharpClipboard](https://github.com/mandiant/capa-rules/blob/master/collection/use-dotnet-library-sharpclipboard.yml)|Input Capture (E1056)| |
+
+## References
+
+<a name="1">[1]</a> https://blogs.cisco.com/security/talos/rombertik
+
+<a name="2">[2]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279
+
+<a name="3">[3]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
+
+<a name="4">[4]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
+
+<a name="5">[5]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+
+<a name="6">[6]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
+

collection/keylogging.md

@@ -1,19 +1,87 @@
-|||
-|---|---|
-|**ID**|**F0002**|
-|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
-|**Related ATT&CK Sub-Technique**|[Input Capture: Keylogging](https://attack.mitre.org/techniques/T1056/001)|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0002</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Input Capture: Keylogging (<a href="https://attack.mitre.org/techniques/T1056/001">T1056.001</a>, <a href="https://attack.mitre.org/techniques/T1417/001/">T1417.001</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>14 August 2020</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
 
 
-Keylogging
-==========
+# Keylogging
+
 Malware captures user keyboard input.
 
-**See ATT&CK:** [**Input Capture: Keylogging**](https://attack.mitre.org/techniques/T1056/001).
+See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/techniques/T1056/001), [T1417.001](https://attack.mitre.org/techniques/T1417/001/))**
+
+## Methods
 
-Methods
--------
 |Name|ID|Description|
 |---|---|---|
 |**Application Hook**|F0002.001|Keystrokes are captured with an application hook.|
 |**Polling**|F0002.002|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Certain variants of the malware may have keylogging functionality. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware logs keystrokes to a file. [[2]](#2)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy's keylogger plugin allows for the collection of keystrokes. [[3]](#3)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet can capture keystrokes.  [[4]](#4)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy can capture keystrokes.  [[5]](#5)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects user keystrokes. [[6]](#6)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|F0002.001|Malware logs keystrokes via application hook. [[9]](#9)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[log keystrokes via polling](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-polling.yml)|Keylogging::Polling (F0002.002)|user32.GetAsyncKeyState, user32.GetKeyState, user32.GetKeyboardState, user32.VkKeyScan, user32.VkKeyScanEx, user32.GetKeyNameText|
+|[log keystrokes via application hook](https://github.com/mandiant/capa-rules/blob/master/collection/keylog/log-keystrokes-via-application-hook.yml)|Keylogging::Application Hook (F0002.001)| |
+
+## References
+
+<a name="1">[1]</a> https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml
+
+<a name="2">[2]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+
+<a name="3">[3]</a> https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/
+
+<a name="4">[4]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="5">[5]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
+
+<a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
+
+<a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="8">[8]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+
+<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+

collection/screen-capture.md

@@ -1,18 +1,72 @@
-|||
-|---|---|
-|**ID**|**E1113**|
-|**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
-|**Related ATT&CK Technique**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1113</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Screen Capture (<a href="https://attack.mitre.org/techniques/T1113/">T1113</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
 
 
-Screen Capture
-=============
+# Screen Capture
+
 Malware takes screen captures of the desktop.
 
-**See ATT&CK:** [**Screen Capture**](https://attack.mitre.org/techniques/T1113/).
+See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/))**.
+
+## Methods
 
-Methods
--------
 |Name|ID|Description|
 |---|---|---|
 |**WinAPI**|E1113.m01|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR is capable of capturing screenshots. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy's screenshot plugin allows for collection of screenshots. [[2]](#2)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|E1113.m01|DarkComet can take screenshots of the victim's computer. [[3]](#3) [[5]](#5)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK takes snapshots of deskop and window contents. [[4]](#4)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Malware captures screenshots. [[5]](#5)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[capture screenshot](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot.yml)|Screen Capture::WinAPI (E1113.m01)|user32.GetWindowDC, user32.GetDC, gdi32.CreateDC, gdi32.BitBlt, gdi32.GetDIBits, gdi32.CreateCompatibleDC, gdi32.CreateCompatibleBitmap, user32.GetSystemMetrics = fetch screen dimensions, user32.GetDesktopWindow = get entire desktop, BitBlt, System.Drawing.Graphics::CopyFromScreen|
+|[capture screenshot via keybd event](https://github.com/mandiant/capa-rules/blob/master/collection/screenshot/capture-screenshot-via-keybd-event.yml)|Screen Capture (E1113)| |
+
+## References
+
+<a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="2">[2]</a> https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/
+
+<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
+
+<a name="5">[5]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+

command-and-control/README.md

@@ -1,11 +1,21 @@
-|||
-|---|---|
-|**ID**|**OB0004**|
-
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0004</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>29 November 2022</b></td>
+</tr>
+</table>
 
 # Command and Control
-Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.
 
-* **Command and Control Communication** [B0030](../command-and-control/command-control-comm.md)
-* **Domain Name Generation** [B0031](../command-and-control/domain-name-generate.md)
-* **Remote File Copy** [E1105](../command-and-control/remote-file-copy.md)
+Behaviors that enable malware to communicate with systems such as C2 servers or bots. Malware can establish command and control with various levels of covertness, depending on system configuration and network topology. 
+
+* **Command and Control Communication** [B0030](../command-and-control/c2-communication.md)
+* **Domain Name Generation** [B0031](../command-and-control/domain-name-generation.md)
+* **Ingress Tool Transfer** [E1105](../command-and-control/ingress-tool-transfer.md)

command-and-control/c2-communication.md

@@ -0,0 +1,166 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0030</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../command-and-control">Command and Control</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# C2 Communication
+
+All command and control malware use implant/controller communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see **Ingress Tool Transfer ([E1105](../command-and-control/ingress-tool-transfer.md))**.
+
+Command and Control Communication relates to *autonomous* communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](../execution/remote-commands.md) under the Execution objective).
+
+As "server" and "client" are confusing terminology, we use the terms "controller" and "implant". The controller is the software running on adversary-controlled infrastructure and used to send commands to the implant. The implant is the software running on victim-controlled infrastructure that receives commands from the adversary, executes those commands on the victim, and optionally sends the results back to the adversary.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Authenticate**|B0030.011|Implant may authenticate itself to the controller, controller may authenticate itself to implant, or both. This is often at or near the start of communication. Examples include but are not limited to a simple shared secret (e.g. password), challenge-response with symmetric encryption, or challenge-response with asymmetric encryption.|
+|**Check for Payload**|B0030.005|An implant may check with the controller for additional payloads or instructions, sometimes at a regular interval. This is also known as beaconing.|
+|**Directory Listing**|B0030.012|Controller requests a directory listing from the implant, optionally from a given path, optionally recursive.|
+|**Execute File**|B0030.013|Execute/run/open the file using default operating system functionality, optionally with provided command-and-scripting-interpreter arguments. The file may or may not already exist on the victim.|
+|**Execute Shell Command**|B0030.014|Execute/run the given command using a built-in program (e.g. cmd.exe, PowerShell, bash). This differs from Start Interactive Shell because the shell process is started only for the received command or set of commands and then exits. There is no loop looking for additional commands while the shell process is still running.|
+|**File search**|B0030.015|Controller requests the implant to search for a given filename pattern, often a [glob](https://en.wikipedia.org/wiki/Glob_(programming)).|
+|**Implant to Controller File Transfer**|B0030.004|File is transferred from implant to controller.|
+|**Receive Data**|[B0030.002](#b0030002-snippet)|Receive data or command from a controller.|
+|**Request Command**|B0030.008|Implant requests a command.|
+|**Request Email Address List**|B0030.010|Request email address list.|
+|**Request Email Template**|B0030.009|Request email template.|
+|**Send Data**|B0030.001|Send data to a controller.|
+|**Send Heartbeat**|B0030.007|Heartbeat sent.|
+|**Send System Information**|B0030.006|Implant sends system information.|
+|**Server to Client File Transfer**|B0030.003|File is transferred from controller to implant.|
+|**Start Interactive Shell**|B0030.016|Starts an interactive shell using a built-in program (e.g. cmd.exe, PowerShell, bash). This is often implemented with polling the network connection from the controller for text commands to redirect to the shell's stdin and polling the shell's stdout and stderr to redirect over the network to the controller. This differs from Execute Shell Command because the shell process runs across multiple iterations of the recv-command(s)-send-result loop.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|B0030.001|The malware sends a hash value generated from system information. [[1]](#1)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|B0030.002|The malware receives a public key from the C2. [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.001|The malware sends a hash value generated from system information. [[14]](#14)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.002|The malware receives a public key from the C2. [[14]](#14)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.011|The malware sends a phone-home message with encryption to start. [[14]](#14)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|B0030.002|GoBotKR receives data from the C2. [[2]](#2) [[19]](#19)|
+|[**Terminator**](../xample-malware/terminator.md)|2013|B0030.001|The malware sends data to the C2. [[3]](#3)|
+|[**UP007**](../xample-malware/up007.md)|2016|B0030.001|The malware sends hardened HTTP headers disguised as Microsoft Update traffic. [[4]](#4)|
+|[**UP007**](../xample-malware/up007.md)|2016|B0030.002|The malware receives payloads. [[4]](#4)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|B0030.006|The malware connects to the C2 server using HTTP to send device information. [[5]](#5)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0030.011|Ursnif variant Dreambot authenticates and encrypts traffic to the C2 server using TOR. [[6]](#6)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0030.010|New email addresses are collected automatically from the victim's address books. [[7]](#7)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|B0030.001|CHOPSTICK sends data to the C2 server using HTTP POST requests. [[8]](#8)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar communicates with a C2 server. [[9]](#9)|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny communicates C2 via HTTP. [[10]](#10)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer communicates to a Tor Onion Service via HTTP. [[11]](#11)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0030.001|The malware sends collected data about the system to C2 server. [[12]](#12) [[13]](#13)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0030.002|The C2 server returns Base64 encoded data containing the information about the next command for the loader. [[12]](#12) [[13]](#13)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0030.013|The payload is run by explorer.exe. [[12]](#12) [[13]](#13)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0030.002|Gamut receives data from the C2. [[15]](#15)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0030.003|The malware receives files from the C2. [[15]](#15)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0030.002|GravityRAT receives data from the C2.  [[19]](#19)|
+|[**Heriplor**](../xample-malware/heriplor.md)|2012|B0030.002|Heriplor malware has a capability to connect with a C2 to download arbitrary code. [[16]](#16)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.001|The malware sends data to the C2. [[17]](#17) [[19]](#19)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.002|The malware receives data from the C2. [[19]](#19)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|BB0030.001|The malware sends data to the C2. [[19]](#19)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0030.002|The malware receives data from the C2. [[19]](#19)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.001|The malware sends data to the C2. [[19]](#19)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.002|The malware receives data from the C2. [[19]](#19)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002|The malware receives data from the C2 server. [[18]](#18)|
+|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat communicates to a Pastebin site via HTTP. [[20]](#20)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[send data](https://github.com/mandiant/capa-rules/blob/master/communication/send-data.yml)|C2 Communication::Send Data (B0030.001)| |
+|[receive data](https://github.com/mandiant/capa-rules/blob/master/communication/receive-data.yml)|C2 Communication::Receive Data (B0030.002)| |
+|[download and write a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/download-and-write-a-file.yml)|C2 Communication::Server to Client File Transfer (B0030.003)| |
+
+## Code Snippets
+
+### B0030.002 Snippet
+<details>
+<summary> C2 Communication::Receive Data </summary>
+SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e0
+<pre>
+asm
+loc_401981
+mov ecx, s
+mov edx, edi
+sub edx, esi
+push 0 ; flags
+lea eax, [esi+ebx]
+push edx ;len
+push eax ;buf
+push ecx ;s
+call recv
+jmp short loc_4019A2
+</pre>
+</details>
+
+
+## References
+
+<a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
+
+<a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="3">[3]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf
+
+<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+
+<a name="5">[5]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
+
+<a name="6">[6]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
+
+<a name="7">[7]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
+
+<a name="8">[8]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
+
+<a name="9">[9]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
+
+<a name="10">[10]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
+
+<a name="11">[11]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
+
+<a name="12">[12]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="13">[13]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="14">[14]</a> https://www.secureworks.com/research/cryptolocker-ransomware
+
+<a name="15">[15]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+
+<a name="16">[16]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_heriplor.a
+
+<a name="17">[17]</a> https://blogs.cisco.com/security/talos/rombertik
+
+<a name="18">[18]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
+
+<a name="19">[19]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="20">[20]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/

command-and-control/command-control-comm.md

@@ -1,27 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0030**|
-|**Objective(s)**|[Command and Control](../command-and-control)|
-|**Related ATT&CK Technique**|None|
-
-
-C2 Communication
-================
-All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](../command-and-control/remote-file-copy.md).
-
-Command and Control Communication relates to *autonomous* client/server communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](../execution/remote-commands.md) under the Execution objective).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Check for Payload**|B0030.005|Check for payload.|
-|**Client to Server File Transfer**|B0030.004|File is transferred from client to server.|
-|**Receive Data**|B0030.002|Receive data or command from a C2 server.|
-|**Request Command**|B0030.008|Client requests a command.|
-|**Request Email Address List**|B0030.010|Request email address list.|
-|**Request Email Template**|B0030.009|Request email template.|
-|**Send Data**|B0030.001|Send data to a C2 server.|
-|**Send Heartbeat**|B0030.007|Heartbeat sent.|
-|**Send System Information**|B0030.006|Client sends system information.|
-|**Server to Client File Transfer**|B0030.003|File is transferred from server to client.|

command-and-control/domain-name-generate.md

@@ -1,27 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0031**|
-|**Objective(s)**|[Command and Control](../command-and-control)|
-|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/)|
-
-
-Domain Name Generation
-======================
-Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
-
-The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Kraken**](../xample-malware/kraken.md)|April 2008|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
-|[**Conficker**](../xample-malware/conficker.md)|November 2008|Conficker uses a domain name generator. [[3]](#3)|
-
-References
-----------
-<a name="1">[1]</a> https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/
-
-<a name="2">[2]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
-
-<a name="3">[3]</a> https://en.wikipedia.org/wiki/Conficker

command-and-control/domain-name-generation.md

@@ -0,0 +1,58 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0031</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../command-and-control">Command and Control</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Dynamic Resolution: Domain Generation Algorithms (<a href="https://attack.mitre.org/techniques/T1568/002/">T1568.002</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>15 March 2023</b></td>
+</tr>
+</table>
+
+
+# Domain Name Generation
+
+Malware generates the domain name of the controller to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced implants; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
+
+The related **Dynamic Resolution: Domain Generation Algorithms ([T1568.002](https://attack.mitre.org/techniques/T1568/002/))** ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior.
+
+This behavior is related to Unprotect technique U0906.
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Kraken**](../xample-malware/kraken.md)|2008|--|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker uses a domain name generator seeded by the current date to ensure that every copy of the virus generates the same names on their respective days. [[3]](#3)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware uses an internal domain generation algorithm. [[4]](#4)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Previous interations of Ursnif have used a Domain Name Generation algorithm. [[5]](#5)|
+
+
+## References
+
+<a name="1">[1]</a> https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/
+
+<a name="2">[2]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
+
+<a name="3">[3]</a> https://en.wikipedia.org/wiki/Conficker
+
+<a name="4">[4]</a> https://www.secureworks.com/research/cryptolocker-ransomware
+
+<a name="5">[5]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
+

command-and-control/ingress-tool-transfer.md

@@ -0,0 +1,79 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1105</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../command-and-control">Command and Control</a>, <a href="../lateral-movement">Lateral Movement</a>, <a href="../persistence">Persistence</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Ingress Tool Transfer (<a href="https://attack.mitre.org/techniques/T1105/">T1105</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>17 August 2023</b></td>
+</tr>
+</table>
+
+
+# Ingress Tool Transfer
+
+Malware may copy files from an external system to a system on a compromised network. 
+
+Note that this behavior is separate from possible execution (installation) of the file, which is covered by the **Install Additional Program ([B0023](../execution/install-additional-program.md))** behavior. 
+
+See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques/T1105/))**.
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison Ivy implant is running on the target machine, the attacker can use a Windows GUI controller to control the target computer. [[1]](#1)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet can download files from a remote repository upon instruction. [[2]](#2)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory. [[3]](#3)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar requests a file using SSL to a C2 domain. [[4]](#4)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus downloads its latest version from a remote server. [[5]](#5)|
+|[**TEARDROP**](../xample-malware/teardrop.md)|2018|--|TEARDROP executes the decrypted, embedded code buffer, which is a Cobalt Strike RAT. [[6]](#6)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware downloads DLLs from the hardcoded URL/remote server. [[7]](#7) [[8]](#8)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can download additional files and update itself. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut receives files from the C2. [[10]](#10)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[11]](#11)|
+
+
+## References
+
+<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
+
+<a name="3">[3]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
+
+<a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="3">[3]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
+
+<a name="4">[4]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
+
+<a name="5">[5]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="6">[6]</a> https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b
+
+<a name="7">[7]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="8">[8]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="9">[9]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="10">[10]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+
+<a name="11">[11]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/

command-and-control/remote-file-copy.md

@@ -1,25 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1105**|
-|**Objective(s)**|[Command and Control](../command-and-control), [Lateral Movement](../lateral-movement), [Persistence](../persistence)|
-|**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)|
-
-
-Remote File Copy
-================
-Malware may copy files from one system to another. 
-
-Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](../execution/install-prog.md) behavior. 
-
-**See ATT&CK:** [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1105/).
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
-----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

credential-access/README.md

@@ -1,13 +1,22 @@
-|||
-|---|---|
-|**ID**|**OB0005**|
-
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0005</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>29 November 2022</b></td>
+</tr>
+</table>
 
 # Credential Access
-Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.
+
+Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account with the associated system and network permissions.
 
 * **Cryptocurrency** [B0028](../collection/cryptocurrency.md)
-* **Hooking** [F0003](../credential-access/hooking.md)
 * **Input Capture** [E1056](../collection/input-capture.md)
 * **Keylogging** [F0002](../collection/keylogging.md)
 * **Screen Capture** [E1113](../collection/screen-capture.md)

credential-access/hooking.md

@@ -1,39 +0,0 @@
-|||
-|---|---|
-|**ID**|**F0003**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Collection](../collection), [Credential Access](../credential-access), [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
-|**Related ATT&CK Sub-Technique**|[Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)|
-
-
-Hooking
-=======
-Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md).
-
-For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/). 
-
-Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Hook memory mapping APIs**|F0003.002|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
-|**Hook procedures**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)|
-|**Import Address Hooking (IAT) Hooking**|F0003.004|Uses modifications to a process's IAT where pointers to imported API functions are stored.|
-|**Inline Hooking**|F0003.005|Overwrites the first bytes in an API function to redirect code flow.|
-|**Patch MmGetPhysicalMemoryRanges**|F0003.001|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-
-References
-----------
-<a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, https://www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf
-
-<a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
-
-<a name="3">[3]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures

defense-evasion/README.md

@@ -1,26 +1,38 @@
-|||
-|---|---|
-|**ID**|**OB0006**|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0006</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>8 May 2023</b></td>
+</tr>
+</table>
 
 
-# Defense Evasion #
-Behaviors that evade detection or avoid other defenses.
+# Defense Evasion
 
-* **Alternative Installation Location** [B0027](../defense-evasion/alter-install-location.md)
-* **Bootkit** [F0013](../defense-evasion/boot-sector-mod.md)
-* **Bypass DEP** [B0037](../defense-evasion/bypass-dep.md)
+Behaviors that enable malware to evade detection.
+
+* **Alternative Installation Location** [B0027](../defense-evasion/alternative-installation-location.md)
+* **Bootkit** [F0013](../defense-evasion/bootkit.md)
+* **Bypass DEP** [B0037](../defense-evasion/bypass-data-execution-prevention.md)
 * **Component Firmware** [F0009](../persistence/component-firmware.md)
+* **Conditional Execution** [B0025](../execution/conditional-execution.md)
 * **Covert Location** [B0040](../defense-evasion/covert-location.md)
-* **Disable or Evade Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
-* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
-* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files.md)
-* **Hooking** [F0003](../credential-access/hooking.md)
+* **Disable or Evade Security Tools** [F0004](../defense-evasion/disable-or-evade-security-tools.md)
+* **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md)
+* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md)
+* **Hijack Execution Flow** [F0015](../defense-evasion/hijack-execution-flow.md)
 * **Indicator Blocking** [F0006](../defense-evasion/indicator-blocking.md)
-* **Install Insecure or Malicious Configuration** [E1478](../defense-evasion/config-mod.md)
-* **Modify Registry** [E1112](../defense-evasion/modify-reg.md)
-* **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscate-files.md)
+* **Install Insecure or Malicious Configuration** [B0047](../defense-evasion/install-insecure-or-malicious-configuration.md)
+* **Modify Registry** [E1112](../defense-evasion/modify-registry.md)
+* **Obfuscated Files or Information** [E1027](../defense-evasion/obfuscated-files-or-information.md)
 * **Polymorphic Code** [B0029](../defense-evasion/polymorphic-code.md)
-* **Process Injection** [E1055](../defense-evasion/process-inject.md)
-* **Rootkit** [E1014](../defense-evasion/rootkit-behavior.md)
+* **Process Injection** [E1055](../defense-evasion/process-injection.md)
+* **Rootkit** [E1014](../defense-evasion/rootkit.md)
 * **Self Deletion** [F0007](../defense-evasion/self-deletion.md)
 * **Software Packing** [F0001](../anti-static-analysis/software-packing.md)

defense-evasion/alter-install-location.md

@@ -1,27 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0027**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|None|
-
-
-Alternative Installation Location
-=================================
-Malware may install itself not as a file on the hard drive. [[1]](#1)
-
-Methods
-------- 
-|Name|ID|Description|
-|---|---|---|
-|**Fileless Malware**|B0027.001|Stores itself in memory.|
-|**Registry Install**|B0027.002|Stores itself in the Windows registry.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Kovter**](../xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
-
-References
-----------
-<a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan

defense-evasion/alternative-installation-location.md

@@ -0,0 +1,64 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0027</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>17 August 2023</b></td>
+</tr>
+</table>
+
+
+# Alternative Installation Location
+
+Malware may install itself in areas other than the hard drive [[1]](#1). Other possible locations include the BIOS/Unified Extensible Firmware Interface (UEFI) firmware, which is embedded on a chip on the motherboard, and the graphics processor unit (GPU), where malware is stored in its memory buffer (also known as VRAM) [[2]](#2)[[3]](#3). Volatile memory is a third possibility and when installation occurs here, malware is known as “fileless.” 
+
+While the definition of fileless malware can be ambiguous, here it represents malware that lives in memory only, not on disk, and it does not preclude fileless malware from using files on the system. Microsoft and Zeltser have addressed  this ambiguity by providing more context in [[4]](#4) and [[5]](#5), respectively.
+
+
+## Methods
+ 
+|Name|ID|Description|
+|---|---|---|
+|**Fileless Malware**|B0027.001|Stores itself in memory. This method is related to Unprotect technique U1205 and ATT&CK sub-technique Obfuscated Files or Information: Fileless Storage [T1027.011](https://attack.mitre.org/techniques/T1027/011/). |
+|**Registry Install**|B0027.002|Stores itself in the Windows registry.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Kovter**](../xample-malware/kovter.md)|2016|B0027.002|Kovter stores malware files in the Registry instead of on the hard drive. [[1]](#1)|
+|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|B0027.001|100 memory-resident modules can be installed. [[6]](#6)|
+
+
+## References
+
+<a name="1">[1]</a> https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem.
+
+<a name="2">[2]</a> J. Glazova,"CosmicStrand: A UEFI Rootkit," Kaspersky, blog, 26 Jul. 2022. [Online]. Available: https://usa.kaspersky.com/blog/cosmicstrand-uefi-rootkit/26807/.
+
+<a name="3">[3]</a> I. Ilascu,"Cybercriminal sells tool to hide malware in AMD, NVIDIA GPUs," bleepingcomputer.com, 31 Aug. 2021. [Online]. Available: https://www.bleepingcomputer.com/news/security/cybercriminal-sells-tool-to-hide-malware-in-amd-nvidia-gpus/.
+
+<a name="4">[4]</a> Contributors: D. Simpson, A. Lobo, A. Jupudi, D. Vangel, and C. Davis,"Fileless threats," learn.microsoft.com, 02 June 2023. [Online]. Available: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/fileless-threats?view=o365-worldwide.
+
+<a name="5">[5]</a> L. Zeltser,"The History of Fileless Malware – Looking Beyond the Buzzword," zeltser.com, blog, 12 Oct. 2018. [Online]. Available: https://zeltser.com/fileless-malware-beyond-buzzword/.
+
+<a name="6">[6]</a> B. HAU, T. LEE, and J. HOMAN,"SYNful Knock - A Cisco router implant - Part I," Mandiant.com, 15 Sept. 2015. [Online]. Available: https://www.mandiant.com/resources/synful-knock-acis.
+

defense-evasion/boot-sector-mod.md

@@ -1,22 +0,0 @@
-|||
-|---|---|
-|**ID**|**F0013**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
-|**Related ATT&CK Sub-Technique**|[Pre-OS Boot: Bootkit](https://attack.mitre.org/techniques/T1542/003)|
-
-
-Bootkit
-=======
-The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: [**Pre-OS Boot: Bootkit**](https://attack.mitre.org/techniques/T1067/).
-
-The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect. (As of 2020, ATT&CK also associates the technique with Persistence.) 
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
-
-References
-----------
-<a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/

defense-evasion/bootkit.md

@@ -0,0 +1,48 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0013</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Pre-OS Boot: Bootkit (<a href="https://attack.mitre.org/techniques/T1542/003">T1542.003</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
+
+
+# Bootkit
+
+The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: **Pre-OS Boot: Bootkit ([T1067](https://attack.mitre.org/techniques/T1067/))**.
+
+The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect. (As of 2020, ATT&CK also associates the technique with Persistence.) 
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|The malware is an MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [[2]](#24)|
+
+
+## References
+
+<a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
+
+<a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
+

defense-evasion/bypass-data-execution-prevention.md

@@ -0,0 +1,41 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0037</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>14 August 2020</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
+
+
+# Bypass Data Execution Prevention
+
+Malware may bypass Data Execution Prevention (DEP).
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce

defense-evasion/bypass-dep.md

@@ -1,20 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0037**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|None|
-
-
-Bypass Data Execution Prevention
-================================
-Malware may bypass Data Execution Prevention (DEP).
-
-Methods
-------- 
-|Name|ID|Description|
-|---|---|---|
-|**ROP Chains**|B0037.001|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)|
-
-References
-----------
-<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce

defense-evasion/config-mod.md

@@ -1,12 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1478**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
-|**Related ATT&CK Technique**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)|
-
-
-Install Insecure or Malicious Configuration
-===========================================
-Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective. 
-
-See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).

defense-evasion/covert-location.md

@@ -1,17 +1,38 @@
-|||
-|---|---|
-|**ID**|**B0040**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|None|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0040</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>10 August 2020</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>10 November 2022</b></td>
+</tr>
+</table>
 
 
-Covert Location
-===============
+# Covert Location
+
 Malware may hide data or binary files within other files, the registry, etc. 
 
-Methods
--------
+## Methods
+
 |Name|ID|Description|
 |---|---|---|
 |**Hide Data in Registry**|B0040.001|Malware may use a registry key to store a long sequence of bytes.|
-|**Steganography**|B0040.002|Malware may store information in an image.|
+|**Steganography**|B0040.002|Malware may store information in an image. See related ATT&CK techniques: Data Obfuscation: Steganography [T1001.002](https://attack.mitre.org/techniques/T1001/002), Obfuscated Files or Information: Steganography ([T1027.003](https://attack.mitre.org/techniques/T1027/003), [T1406.001](https://attack.mitre.org/techniques/T1406/001)).|

defense-evasion/disable-or-evade-security-tools.md

@@ -0,0 +1,84 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0004</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Impair Defenses: Disable or Modify Tools (<a href="https://attack.mitre.org/techniques/T1562/001">T1562.001</a>, <a href="https://attack.mitre.org/techniques/T1629/003/">T1629.003</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Disable or Evade Security Tools
+
+Malware may disable or evade security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities. This behavior is related to Unprotect technique U0508. 
+
+Malware-related methods extending ATT&CK's definition are below. 
+
+See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://attack.mitre.org/techniques/T1562/001), [T1629.003](https://attack.mitre.org/techniques/T1629/003/))**.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).|
+|**Disable Kernel Patch Protection**|F0004.001|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
+|**Disable System File Overwrite Protection**|F0004.002|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
+|**Force Lazy Writing**|F0004.006|Some operating systems will sometimes use a form of "lazy writing" for disk I/O, which may obscure the true provenance of the write operation. This method occurs when code intentionally forces the operating system to perform a lazy writing operation. For example, in Windows, a file may be opened, memory mapped, and closed, but the memory map will still exist and can be written to, which will cause a lazy write that looks like it is coming from the System process. [[3]](#3)|
+|**Heavens Gate**|F0004.008|Malware evades endpoint security products by invoking 64-bit code in 32-bit processes, effectively bypassing user-mode hooks. [[4]](#4)|
+|**Modify Policy**|F0004.005|Malware may modify policies to make software less effective. This is similar to ATT&CK's Subvert Trust Controls: Code Signing Policy Modification ([T1553.006](https://attack.mitre.org/techniques/T1553/006/), [T1632.001](https://attack.mitre.org/techniques/T1632/001/))|
+|**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
+|**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.|
+|**Disable Code Integrity**|F0004.009|Malware disables Code Integrity driver.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Most security products hook some APIs to monitor the behavior of malware. To avoid being identified by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[6]](#6)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger prevents the infected system from installing anti-virus software updates. [[2]](#2)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of Avast Antivirus. [[5]](#5)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[64-bit execution via heavens gate](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-disasm/64-bit-execution-via-heavens-gate.yml)|Disable or Evade Security Tools::Heavens Gate (F0004.008)| |
+|[patch Event Tracing for Windows function](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml)|Disable or Evade Security Tools (F0004)|kernel32.VirtualProtect, ntdll.NtProtectVirtualMemory, ZwProtectVirtualMemory|
+|[block operations on executable memory pages using Arbitrary Code Guard](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|SetProcessMitigationPolicy|
+|[protect spawned processes with mitigation policies](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/protect-spawned-processes-with-mitigation-policies.yml)|Disable or Evade Security Tools::Modify Policy (F0004.005)|UpdateProcThreadAttribute|
+|[bypass Windows File Protection](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml)|Disable or Evade Security Tools::Bypass Windows File Protection (F0004.007)| |
+|[disable driver code integrity](https://github.com/mandiant/capa-rules/blob/master/host-interaction/driver/disable-driver-code-integrity.yml)|Disable or Evade Security Tools::Disable Code Integrity (F0004.009)| |
+
+## References
+
+<a name="1">[1]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
+
+<a name="3">[3]</a> Alexander Adamov, Stealthy WastedLocker: eluding behavior blockers, but not only. Online:   https://vb2020.vblocalhost.com/conference/presentations/stealthy-wastedlocker-eluding-behaviour-blockers-but-not-only/
+
+<a name="4">[4]</a> Carl Petty, Red Canary, 3/3/2020. Online: https://redcanary.com/blog/heavens-gate-technique-on-linux/
+
+<a name="5">[5]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="6">[6]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
+

defense-evasion/disable-security-tools.md

@@ -1,45 +0,0 @@
-|||
-|---|---|
-|**ID**|**F0004**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|
-
-
-Disable or Evade Security Tools
-===============================
-Malware may disable or evade security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities. 
-
-Malware-related methods extending ATT&CK's definition are below. 
-
-See ATT&CK: [**Impair Defenses: Disable or Modify Tools**](https://attack.mitre.org/techniques/T1562/001).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).|
-|**Disable Kernel Patch Protection**|F0004.001|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
-|**Disable System File Overwrite Protection**|F0004.002|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
-|**Force Lazy Writing**|F0004.006|Some operating systems will sometimes use a form of "lazy writing" for disk I/O, which may obscure the true provenance of the write operation. This method occurs when code intentionally forces the operating system to perform a lazy writing operation. For example, in Windows, a file may be opened, memory mapped, and closed, but the memory map will still exist and can be written to, which will cause a lazy write that looks like it is coming from the System process. [[3]](#3)|
-|**Heavens Gate**|F0004.008|Malware evades endpoint security products by invoking 64-bit code in 32-bit processes, effectively bypassing user-mode hooks. [[4]](#4)|
-|**Modify Policy**|F0004.005|Malware may modify policies to make software less effective.|
-|**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
-|**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|
-
-References
-----------
-<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
-
-<a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
-
-<a name="3">[3]</a> Alexander Adamov, Stealthy WastedLocker: eluding behavior blockers, but not only. Online:   https://vblocalhost.com/conference/presentations/stealthy-wastedlocker-eluding-behaviour-blockers-but-not-only/
-
-<a name="4">[4]</a> Carl Petty, Red Canary, 3/3/2020. Online: https://redcanary.com/blog/heavens-gate-technique-on-linux/

defense-evasion/hidden-files-and-directories.md

@@ -0,0 +1,74 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0005</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Hide Artifacts: Hidden Files and Directories (<a href="https://attack.mitre.org/techniques/T1564/001/">T1564.001</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
+
+
+# Hidden Files and Directories
+
+Malware may hide files and folders to avoid detection and/or to persist on the system. See potential methods below. 
+
+This behavior is related to Unprotect technique U1230.
+
+See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://attack.mitre.org/techniques/T1564/001/))**.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Attribute**|F0005.003|Malware may change or choose an attribute to hide a file or directory.|
+|**Extension**|F0005.001|Malware may change or use a particular file extension to hide a file.|
+|**Location**|F0005.002|Malware may change or choose the location of itself, another file, or a directory to prevent detection.|
+|**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0005.004|Malware modifies target files' time to August 2012 as an antiforensic trick. [[2]](#2)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK creates a hidden file for temporary storage. [[3]](#3)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|F0005.002|Vobfus is located on external drives or network shares and attaches itself to ZIP and RAR files, other removable drives, and network shares. Vobfus hides folders on the external drive and drops an executable with the same name and a disguised folder icon. [[4]](#4)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.002|Malware looks for a specific folder on the victim. If the folder doesn't exist, the malware creates the folder on the victim by calling CreateDirectoryA and downloads the remote file into the new folder. [[5]](#5) [[6]](#6)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.001|The malware also appends the filename and extension .ocx to the ProgramData folder path. [[5]](#5) [[6]](#6)|
+|[**WannaCry**](../xample-malware/wannacry.md)|2017|F0005.003|WannaCry uses the +h attribute to hide its files. [[7]](#7)|
+
+
+## References
+
+<a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/
+
+<a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
+
+<a name="4">[4]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="5">[5]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="6">[6]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="7">[7]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile

defense-evasion/hidden-files.md

@@ -1,22 +0,0 @@
-|||
-|---|---|
-|**ID**|**F0005**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
-|**Related ATT&CK Sub-Technique**|[Hide Artifacts: Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001/)|
-
-
-Hidden Files and Directories
-============================
-Malware may hide files and folders to avoid detection and/or to persist on the system. See potential methods below. 
-
-See ATT&CK: [**Hide Artifacts: Hidden Files and Directories**](https://attack.mitre.org/techniques/T1564/001/).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Attribute**|F0005.003|Malware may change or choose an attribute to hide a file or directory.|
-|**Extension**|F0005.001|Malware may change or use a particular file extension to hide a file.|
-|**Location**|F0005.002|Malware may change or choose the location of itself, another file, or a directory to prevent detection.|
-|**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.|
-

defense-evasion/hide-artifacts.md

@@ -0,0 +1,58 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1564</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Hide Artifacts (<a href="https://attack.mitre.org/techniques/T1564/">T1564</a>, <a href="https://attack.mitre.org/techniques/T1628/">T1628</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>8 November 2021</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>4 March 2023</b></td>
+</tr>
+</table>
+
+
+# Hide Artifacts
+
+Malware may hide artifacts to evade detection and/or to persist on the system. See potential methods related to malware below. 
+
+See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/), [T1628](https://attack.mitre.org/techniques/T1628/))**.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Hidden Userspace Libraries**|E1564.m01|Hides userspace libraries used by the malware instance. Technique refers to hiding libraries loaded in memory (not disk). For example, a userspace library may be injected into a system process such that memory scanning tools may be prevented from finding them. This technique is different than DLL injection, in which the DLL will continue to show up in process metadata that tracks what is stored in memory. This technique involves clearing that metadata or making it inaccessible to security and inspection tools.|
+|**Direct Kernel Object Manipulation**|E1564.m02|Direct Kernel Object Manipulation (DKOM) can be used instead of loading a new driver. It leverages an undocumented function exported by ntdll.dll (NtSystemDebugControl()) that provides debugging functionalities at the kernel level.|
+|**Hidden Kernel Modules**|E1564.m05|Hides the use of kernel modules by the malware instance (e.g. rootkit). Techniques include kernel module list unlinking.|
+|**Hidden Processes**|E1564.m03|Hides processes used by the adversary or malware instance. This can involve techniques such as process list unlinking.|
+|**Hidden Services**|E1564.m04|Hides any system services that the malware instance creates or injects itself into. Services can be hidden by hiding associated registry keys.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications, such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removable drives.  [[2]](#2)|
+
+## References
+
+<a name="1">[1]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
+
+<a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+

defense-evasion/hijack-execution-flow.md

@@ -0,0 +1,100 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0015</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../collection">Collection</a>, <a href="../credential-access">Credential Access</a>, <a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a>, <a href="../privilege-escalation">Privilege Escalation</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Hijack Execution Flow (<a href="https://attack.mitre.org/techniques/T1574">T1574</a>, <a href="https://attack.mitre.org/techniques/T1625">T1625</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>8 November 2021</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Hijack Execution Flow
+
+Malware may execute by hijacking the way operating systems run programs. Malware (e.g. rootkit) alters API behavior or redirects execution (i.e., hooking) to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Different types of hooking are defined as methods below.
+
+Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives.
+
+For discussion related to the Credential Access and Collection objectives, see **Input Capture: Credential API Hooking ([T1056.004](https://attack.mitre.org/techniques/T1056/004/))**.
+
+For hooking related to memory dump evasion, see **Memory Dump Evasion ([B0006](../anti-behavioral-analysis/memory-dump-evasion.md))**.
+
+See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques/T1574), [T1625](https://attack.mitre.org/techniques/T1625))**.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Abuse Windows Function Calls**|F0015.006|Malware abuses native Windows function calls to transfer execution to shellcode that it loads into memory. A pointer to the callback function is used to supply the memory address of the shellcode. Functions that can be abused include EnumResourceTypesA and EnumUILanguagesW. [[4]](#4)|
+|**Export Address Table Hooking**|F0015.001|Malware (e.g. rootkit) hooks the export address table (EAT).|
+|**Import Address Table Hooking**|F0015.003|Malware (e.g. rootkit) modifies a process's import address table (IAT), which stores pointers to imported API functions.[[1]](#1) This method is related to Unprotect technique U1217.|
+|**Inline Patching**|F0015.002|Inline patching (inline hooking) is done by modifying the beginning of a function (e.g., first bytes) in order to redirect the execution flow to custom code (i.e. redirecting code flow) before jumping back to the original function.[[2]](#2) This method is related to Unprotect technique U1205.|
+|**Procedure Hooking**|F0015.007|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[5]](#5)|
+|**Shadow System Service Dispatch Table Hooking**|F0015.004|The Shadow System Service Dispatch Table (SSDT) can be hooked similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).[[3]](#3)|
+|**System Service Dispatch Table Hooking**|F0015.005|Malware (e.g. rootkit, malicious drivers) may hook the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.[[3]](#3)|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|**Kronos**|2014|--|Kronos hooks the API of processes to prevent detection. [[6]](#6)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware hooks various DLL exported functions when the DLL component is loaded into their respective browser application to monitor network traffic. [[7]](#7)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|F0015.006|GravityRAT abuses Microsoft's Dynamic Data Exchange (DDE) protocol. [[8]](#8)|
+|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|--|SYNful Knock hooks iOS functions to call and initialize the malware. [[9]](#9)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0015.006|Malware escalates privileges by impersonating the token through using LogonUser and ImpersonateLoggedOnUser then ImpersonateNamedPipeClient. [[10]](#10)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.003|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[11]](#11)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.007|WTR4141.tmp hooks APIs from kernel32.dll and ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[11]](#11)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[create new application domain in .NET](https://github.com/mandiant/capa-rules/blob/master/host-interaction/memory/create-new-application-domain-in-dotnet.yml)|Hijack Execution Flow (F0015)| |
+|[execute shellcode via Windows callback function](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-callback-function.yml)|Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)|EnumDateFormats, GrayString, LineDDA, EnumChildWindows, EnumDesktops, EnumDesktopWindows, EnumSystemCodePages, EnumSystemGeoID, EnumSystemLanguageGroups, EnumSystemLocales, EnumThreadWindows, EnumUILanguages, EnumWindows, EnumChildWindows, EnumTimeFormats|
+|[rebuild import table](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/rebuild-import-table.yml)|Hijack Execution Flow::Import Address Table Hooking (F0015.003)|LoadLibraryA, GetProcAddress|
+
+## References
+
+<a name="1">[1]</a> https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf
+
+<a name="2">[2]</a> https://www.oreilly.com/library/view/learning-malware-analysis/9781788392501/a0a506d6-d062-48c1-a0a8-57d6acb77785.xhtml
+
+<a name="3">[3]</a> https://www.mdpi.com/1999-5903/4/4/971/html
+
+<a name="4">[4]</a> http://ropgadget.com/posts/abusing_win_functions.html
+
+<a name="5">[5]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
+
+<a name="6">[6]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
+
+<a name="7">[7]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_URSNIF.A2?_ga=2.131425807.1462021705.1559742358-1202584019.1549394279
+
+<a name="8">[8]</a> https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html
+
+<a name="9">[9]</a> https://www.mandiant.com/resources/synful-knock-acis
+
+<a name="10">[10]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/
+
+<a name="11">[11]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+

defense-evasion/indicator-blocking.md

@@ -1,18 +1,61 @@
-|||
-|---|---|
-|**ID**|**F0006**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Impair Defenses: Indicator Blocking](https://attack.mitre.org/techniques/T1562/006/)|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0006</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Impair Defenses: Indicator Blocking (<a href="https://attack.mitre.org/techniques/T1562/006/">T1562.006</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>1 March 2023</b></td>
+</tr>
+</table>
 
 
-Indicator Blocking
-==================
+# Indicator Blocking
+
 Malware blocks indicators or events that would indicate malicious activity. Methods relevant to the malware domain are below. 
 
-See ATT&CK: [**Impair Defenses: Indicator Blocking**](https://attack.mitre.org/techniques/T1562/006/).
+See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mitre.org/techniques/T1562/006/))**.
+
+## Methods
 
-Methods
--------
 |Name|ID|Description|
 |---|---|---|
 |**Remove SMS Warning Messages**|F0006.001|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|The malware clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system. [[1]](#1)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|The malware terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software. [[2]](#2)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|The malware can disable security center functions like anti-virus and firewall. [[3]](#3)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[4]](#4)|
+
+
+## References
+
+<a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
+
+<a name="2">[2]</a> https://en.wikipedia.org/wiki/Conficker
+
+<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="4">[4]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
+

defense-evasion/install-insecure-or-malicious-configuration.md

@@ -0,0 +1,45 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0047</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>3.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>13 December 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>4 March 2023</b></td>
+</tr>
+</table>
+
+
+# Install Insecure or Malicious Configuration
+
+Malware may install malicious configuration settings or may modify existing configuration settings. For example, malware may change configuration settings associated with security mechanisms to make it difficult to detect or change configuration settings to maintain a foothold on the network.
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Black Energy**](../xample-malware/blackenergy.md)|2007|--|Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [[1]](#1)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware changes iOS Safari's default configuration. [[2]](#2)|
+
+
+## References
+
+<a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
+
+<a name="2">[2]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

defense-evasion/modify-reg.md

@@ -1,23 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1112**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
-|**Related ATT&CK Technique**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|
-
-
-Modify Registry
-===============
-Malware may make changes to the Windows Registry to hide execution or to persist on the system (note that ATT&CK does not extend this behavior to the Persistence objective). 
-
-See ATT&CK: [**Modify Registry**](https://attack.mitre.org/techniques/T1112).
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
-----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

defense-evasion/modify-registry.md

@@ -0,0 +1,66 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1112</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../persistence">Persistence</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Modify Registry (<a href="https://attack.mitre.org/techniques/T1112">T1112</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>2 August 2022</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>19 September 2023</b></td>
+</tr>
+</table>
+
+
+# Modify Registry
+
+Malware may make changes to the Windows Registry to hide execution or to persist on the system (note that ATT&CK does not extend this behavior to the Persistence objective). 
+
+
+See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112/))**.
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[2]](#2)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware adds many entries to the registry. [[3]](#3)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware adds a registry key. [[4]](#4)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware modifies the registry during execution. [[5]](#5)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy. [[6]](#6)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK may encrypt and store configuration data inside a registry key. [[7]](#7)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer edits the registry. [[8]](#8)|
+
+
+## References
+
+<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
+
+<a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="3">[3]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HUPIGON
+
+<a name="4">[4]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+
+<a name="5">[5]</a> https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem.
+
+<a name="6">[6]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/
+
+<a name="7">[7]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
+
+<a name="8">[8]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
+

defense-evasion/obfuscate-files.md

@@ -1,40 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1027**|
-|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)|
-
-
-Obfuscated Files or Information
-===============================
-Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself can be encoded or encrypted (i.e., encoding/encryption is a code characteristic).
-
-A related MBC behavior (code characteristic), associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](../anti-static-analysis/exe-code-obfuscate.md).
-
-Another related MBC behavior (code characteristic), is [Software Packing](../anti-static-analysis/software-packing.md) which has methods capturing specific packers and types of compression.
-
-See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
-
-Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
-|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
-|**Encoding-Standard Algorithm**|E1027.m02|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
-|**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted.|
-|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
-|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information.|
-|**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
-|**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
-
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|Obfuscates files.|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|Obfuscates files.|

defense-evasion/obfuscated-files-or-information.md

@@ -0,0 +1,141 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1027</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../anti-static-analysis">Anti-Static Analysis</a>, <a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Obfuscated Files or Information (<a href="https://attack.mitre.org/techniques/T1027/">T1027</a>, <a href="https://attack.mitre.org/techniques/T1406/">T1406</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Obfuscated Files or Information
+
+Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself can be encoded or encrypted (i.e., encoding/encryption is a code characteristic).
+
+A related MBC behavior (code characteristic), associated explicitly with executable code and making its analysis more difficult, is **Executable Code Obfuscation ([B0032](../anti-static-analysis/executable-code-obfuscation.md))**.
+
+Another related MBC behavior (code characteristic), is **Software Packing ([F0001](../anti-static-analysis/software-packing.md))** which has methods capturing specific packers and types of compression.
+
+See ATT&CK: **Obfuscated Files or Information ([T1027](https://attack.mitre.org/techniques/T1027/), [T1406](https://attack.mitre.org/techniques/T1406/))**.
+
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
+|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information. This method is related to Unprotect technique U0702.|
+|**Encoding-Standard Algorithm**|[E1027.m02](#e1027m02-snippet)|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information. This method is related to Unprotect technique U0701 and U0706.|
+|**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted. This method is related to Unprotect technique U0703.|
+|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
+|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information. This method is related to Unprotect technique U0701.|
+|**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
+|**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Malware obfuscates files.[[8]](#8)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The dropped file is password-protected. Once unzipped, the file contains a DLL file to decrypt the second file (a bin file with an encrypted malicious payload). [[7]](#7)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware will use a key to decrypt text from a URL to create more malicious code. [[2]](#2)|
+|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as Base64, hexademcimal, and XOR. [[3]](#3)|
+|[**TEARDROP**](../xample-malware/teardrop.md)|2018|E1027.m05|TEARDROP decrypts an embedded code buffer using an XOR-based stream cipher. [[4]](#4)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m01|The configuration data block is encoded with a NOT XOR 0xFF operation. [[5]](#5)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m02|Stuxnet encodes data using XOR. [[9]](#9)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware creates an encrypted Registry key called TorClient to store its data. [[6]](#6)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|E1027.m02|TrickBot encodes data using XOR. [[9]](#9)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1027.m05|BlackEnergy encrypts data using RC4 via WinAPI. [[9]](#9)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|E1027.m02|CryptoLocker encodes data using XOR. [[9]](#9)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1027.m02|Dark Comet encodes data using XOR. [[9]](#9)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|E1027.m02|DNSChanger encodes data using XOR. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|E1027.m02|Gamut encodes data using XOR. [[9]](#9)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1027.m02|Hupigon encodes data using XOR. [[9]](#9)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1027.m05|Hupigon encrypts data using DES. [[9]](#9)|
+|[**Kraken**](../xample-malware/kraken.md)|2008|E1027.m02|Kraken encodes data using XOR. [[9]](#9)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|E1027.m02|Locky Bart encodes data using XOR. [[9]](#9)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|E1027.m02|Mebromi encodes data using XOR. [[9]](#9)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|E1027.m02|Redhip encodes data using XOR. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1027.m02|Rombertik encodes data using XOR. [[9]](#9)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|E1027.m07|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[10]](#10)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Shamoon encodes data using XOR. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|E1027.m02|The malware encodes data using XOR. [[9]](#9)|
+
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[encrypt data using memfrob from glibc](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-data-using-memfrob-from-glibc.yml)|Obfuscated Files or Information::Encryption (E1027.m04)|memfrob|
+|[encrypt data using XXTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xxtea/encrypt-data-using-xxtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using HC-128](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using HC-128 via WolfSSL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using RC6](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc6/encrypt-data-using-rc6.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using twofish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/twofish/encrypt-data-using-twofish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using AES MixColumns step](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-mixcolumns-step.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using AES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
+|[encrypt data using AES via .NET](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/encrypt-data-using-aes-via-dotnet.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[manually build AES constants](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/manually-build-aes-constants.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using Sosemanuk](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/sosemanuk/encrypt-data-using-sosemanuk.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using XTEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/xtea/encrypt-data-using-xtea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using Camellia](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using vest](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/vest/encrypt-data-using-vest.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using DES](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using DES via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/des/encrypt-data-using-des-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
+|[encrypt data using RC4 with custom key via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-with-custom-key-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptImportKey, CryptAcquireContext, CryptEncrypt|
+|[encrypt data using RC4 via WinAPI](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-winapi.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)|CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt|
+|[encrypt data using skipjack](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/skipjack/encrypt-data-using-skipjack.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using blowfish](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/blowfish/encrypt-data-using-blowfish.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[decrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/decrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encrypt data using TEA](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/tea/encrypt-data-using-tea.yml)|Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)| |
+|[encode data using XOR](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/xor/encode-data-using-xor.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| |
+|[encode data using Base64](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/encode-data-using-base64.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)|System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars|
+|[decode data using Base64 via dword translation table](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encoding/base64/decode-data-using-base64-via-dword-translation-table.yml)|Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)| |
+|[resolve function by Brute Ratel Badger hash](https://github.com/mandiant/capa-rules/blob/master/linking/runtime-linking/resolve-function-by-brute-ratel-badger-hash.yml)|Obfuscated Files or Information (E1027)| |
+
+## References
+
+<a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="2">[2]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
+
+<a name="3">[3]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
+
+<a name="4">[4]</a> https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b
+
+<a name="5">[5]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+
+<a name="6">[6]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
+
+<a name="7">[7]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="8">[8]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+
+<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="10">[10]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html

defense-evasion/polymorphic-code.md

@@ -1,22 +1,52 @@
-|||
-|---|---|
-|**ID**|**B0029**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|None|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0029</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>1 March 2023</b></td>
+</tr>
+</table>
 
 
-Polymorphic Code
-================
-Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic Code behavior is typically identified through analysis of related samples.
+# Polymorphic Code
+
+Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic code behavior is typically identified through analysis of related samples.
+
+## Methods
 
-Methods
--------
 |Name|ID|Description|
 |---|---|---|
 |**Call Indirections**|B0029.002|[[1]](#1)|
 |**Code Reordering**|B0029.003|[[1]](#1)|
 |**Packer Stub**|B0029.001|A packer stub can generate polymorphic code.|
 
-References
-----------
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny utilizes Lua scripts to exhibit polymorphism. [[2]](#2)|
+
+## References
+
 <a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
+
+<a name="2">[2]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
+

defense-evasion/process-inject.md

@@ -1,50 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1055**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion), [Privilege Escalation](../privilege-escalation)|
-|**Related ATT&CK Technique**|[Process Injection](https://attack.mitre.org/techniques/T1055)|
-
-
-Process Injection
-=================
-Malware may execute code in the address space of a separate process. 
-
-See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on sub-techniques in the context of [[1]](#1) are in as follows:
-
-|ID|ATT&CK Sub-Technique|Notes|
-|---|---|---|
-|T1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
-|T1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
-|T1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
-|T1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread); also called AtomBombing [[3]](#3). Called *APC Injection and AtomBombing* in [[1]](#1).|
-|T1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
-|T1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|
-
-Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hooking](../credential-access/hooking.md) behavior.
-
-Methods
-------- 
-|Name|ID|Description|
-|---|---|---|
-|**Hook Injection via SetWindowsHooksEx**|E1055.m01|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)|
-|**Injection and Persistence via Registry Modification**|E1055.m02|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
-|**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**UP007**](../xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|Injects minor code into a running process.|
-
-References
-----------
-<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
-
-<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
-
-<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
-
-<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/

defense-evasion/process-injection.md

@@ -0,0 +1,109 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1055</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a>, <a href="../privilege-escalation">Privilege Escalation</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Process Injection (<a href="https://attack.mitre.org/techniques/T1055">T1055</a>, <a href="https://attack.mitre.org/techniques/T1631/">T1631</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Process Injection
+
+Malware may execute code in the address space of a separate process. 
+
+See ATT&CK: **Process Injection ([T1055](https://attack.mitre.org/techniques/T1055/), [T1631](https://attack.mitre.org/techniques/T1631/))**.
+
+The methods table includes existing ATT&CK sub-techniques, which have been enhanced with malware-specific details, as well as new methods. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md) behavior. 
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Dynamic-link Library Injection**|E1055.001|(Enhanced ATT&CK sub-technique) Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods, called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1). This method is related to Unprotect technique U1226.|
+|**Portable Executable Injection**|E1055.002|(Enhanced ATT&CK sub-technique) Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary), called *Portable Executable Injection* in [[1]](#1). This method is related to Unprotect technique U1216.|
+|**Thread Execution Hijacking**|E1055.003|(Enhanced ATT&CK sub-technique) Malware targets an existing thread of a process, avoiding noisy process or thread creations operations, called *Thread Execution Hijacking* in [[1]](#1). This method is related to Unprotect technique U1223.|
+|**Asynchronous Procedure Call**|E1055.004|(Enhanced ATT&CK sub-technique) Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread). AtomBombing [[1]](#1)[[3]](#3), a variant of APC injection, occurs when the attacker stores malicious code in the global atom table. The APC gets the targeted process to retrieve the code that will be injected to the memory of the targeted process. This method is related to Unprotect technique U1221 and U1220.|
+|**Extra Window Memory Injection**|E1055.011|(Enhanced ATT&CK sub-technique) Malware may inject into Explorer tray window’s extra window memory, called *Extra Window Memory Injection* in [[1]](#1). This method is related to Unprotect technique U1219.|
+|**Process Hollowing**|E1055.012|(Enhanced ATT&CK sub-technique) Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable, called *Process Hollowing* in [[1]](#1). This method is related to Unprotect technique U1225.|
+|**Hook Injection via SetWindowsHooksEx**|E1055.m01|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1) This method is related to Unprotect technique 1227.|
+|**Injection and Persistence via Registry Modification**|E1055.m02|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
+|**Injection via Windows Fibers**|E1055.m05|Malware executes shellcode via Windows fibers by converting a thread to a fiber. [[5]](#5)|
+|**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1) This method is related to Unprotect technique U1218.|
+|**Patch Process Command Line**|E1055.m04|Malware patches the PEB of a process to spoof the arguments.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**UP007**](../xample-malware/up007.md)|2016|E1055.001|The malware loads multiple DLLs into memory. [[4]](#4)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware injects itself into svchost.exe. [[11]](#11)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy code is injected into explorer.exe. [[2]](#2)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware injects miner code into a running process. [[12]](#12)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware injects code into a new svchost process. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware injects itself into processes such as cmd.exe and notepad.exe [[7]](#7)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1055.012|The malware uses process replacement. [[13]](#13)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1055.m05|BlackEnergy bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution. [[8]](#8)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy injects its dll component into svchost.exe. [[8]](#8)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.001|Stuxnet injects the entire DLL into another process and then just calls the particular export. [[9]](#9)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.m02|Stuxnet uses Mrxcls.sys driver for persistence. It is registered as a boot start service by creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys". [[9]](#9)|
+|[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory. [[10]](#10)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|The malware can attach user process memory. [[13]](#13)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)|
+|[**Conti**](../xample-malware/conti.md)|2019|E1055.012|Conti creates a process in a suspended state and unmaps or removes the PE image layout from a given process space.|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[patch process command line](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/patch-process-command-line.yml)|Process Injection::Patch Process Command Line (E1055.m04)|VirtualProtect, GetProcAddress, ReadProcessMemory|
+|[attach user process memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/attach-user-process-memory.yml)|Process Injection (E1055)|ntoskrnl.KeStackAttachProcess, ntoskrnl.KeUnstackDetachProcess|
+|[inject shellcode using extra window memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-extra-window-memory.yml)|Process Injection (E1055)|SetWindowLong, SetWindowLongPtr, PostMessage, SendNotifyMessage|
+|[inject shellcode using a file mapping object](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-a-file-mapping-object.yml)|Process Injection (E1055)|CreateFileMapping, MapViewOfFile, MapViewOfFileNuma2|
+|[inject shellcode using window subclass procedure](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/inject-shellcode-using-window-subclass-procedure.yml)|Process Injection (E1055)|user32.SetProp, PostMessage, SendNotifyMessage|
+|[execute shellcode via Windows fibers](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/execute-shellcode-via-windows-fibers.yml)|Process Injection::Injection via Windows Fibers (E1055.m05)|ConvertThreadToFiber, CreateFiber, SwitchToFiber|
+
+## References
+<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
+
+<a name="2">[2]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+
+<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
+
+<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+
+<a name="5">[5]</a> https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber
+
+<a name="6">[6]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
+
+<a name="7">[7]</a> https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml
+
+<a name="8">[8]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
+
+<a name="9">[9]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+
+<a name="10">[10]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
+
+<a name="11">[11]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
+
+<a name="12">[12]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="13">[13]</a> capa v4.0, analyzed at MITRE on 10/12/2022

defense-evasion/rootkit-behavior.md

@@ -1,40 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1014**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|[Rootkit](https://attack.mitre.org/techniques/T1014)|
-
-
-Rootkit
-=======
-Behaviors of a rootkit: "A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that is not otherwise allowed and often masks its existence or the existence of other software." [[1]](#1)
-
-See ATT&CK: [**Rootkit**](https://attack.mitre.org/techniques/T1014).
-
-Methods
-------- 
-|Name|ID|Description|
-|---|---|---|
-|**Hide Kernel Modules**|E1014.m01|Hides the usage of any kernel modules by the malware instance.|
-|**Hide Services**|E1014.m02|Hides any system services that the malware instance creates or injects itself into.|
-|**Hide Threads**|E1014.m04|Hides one or more threads that belong to the malware instance.|
-|**Hide Userspace Libraries**|E1014.m05|Hides the usage of userspace libraries by the malware instance.|
-|**Prevent API Unhooking**|E1014.m06|Prevents the API hooks installed by the malware instance from being removed.|
-|**Prevent File Access**|E1014.m09|Prevents access to the file system, including to specific files and/or directories associated with the malware instance.|
-|**Prevent File Deletion**|E1014.m10|Prevents files and/or directories associated with the malware instance from being deleted from a system.|
-|**Prevent Memory Access**|E1014.m11|Prevents access to system memory where the malware instance may be storing code or data.|
-|**Prevent Native API Hooking**|E1014.m12|Prevents other software from hooking native system APIs.|
-|**Prevent Registry Access**|E1014.m07|Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.|
-|**Prevent Registry Deletion**|E1014.m08|Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
-
-References
-----------
-<a name="1">[1]</a> https://en.wikipedia.org/wiki/Rootkit
-
-<a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

defense-evasion/rootkit.md

@@ -0,0 +1,73 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1014</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Rootkit (<a href="https://attack.mitre.org/techniques/T1014">T1014</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>3.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
+
+
+# Rootkit
+
+Behaviors of a rootkit: "A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that is not otherwise allowed and often masks its existence or the existence of other software." [[1]](#1)
+
+
+See ATT&CK: **Rootkit ([T1014](https://attack.mitre.org/techniques/T1014/))**.
+
+Rootkits may hide artifacts (kernel modules, services, threads, userspace libraries), prevent actions, API unhooking (prevents API hooks installed by the malware instance from being removed), file access (prevents access to the file system, including specific files and/or directories associated with the malware instance), file deletion (prevents files and/or directories associated with the malware instance from being deleted), memory access (prevents access to system memory where the malware instance stores code or data), native API hooking (prevents other software from hooking native system APIs), registry access (prevents access to the Windows registry, either entire registry or particular registry keys/values), and registry deletion (prevents deletion of registry keys and/or values associated with the malware instance).
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Application Rootkit**|E1014.m12|Application rootkits operate by exchanging standard application files with rootkit files, or changing applications by injecting code or patching.|
+|**Bootloader**|E1014.m13|A bootloader rootkit modifies the bootloader, enabling activation before the operating system is started, also known as a Bootkit. See ATT&CK: [Bootkit](https://attack.mitre.org/techniques/T1542/003/).|
+|**Hardware/Firmware Rootkit**|E1014.m14|A firmware rootkit compromises hardware (e.g. network card, hard drive), system BIOS, UEFI firmware. LoJack is the first in-the-wild UEFI rootkit. See ATT&CK: [System Firmware](https://attack.mitre.org/techniques/T1542/001/).|
+|**Hypervisor/Virtualized Rootkit**|E1014.m15|A hypervisor (virtualized) rootkit hosts the target operating system as a virtual machine, enabling interception of all hardware calls, also called a virtual-machine-based rootkit (VMBR).|
+|**Kernel Mode Rootkit**|E1014.m16|Rootkit operates by adding or replacing code in OS, device drivers, loadable kernel modules (LKM). Related to ATT&CK: [Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006/)|
+|**Memory Rootkit**|E1014.m17|A memory rootkit hids in RAM. Behaviors may include methods to prevent memory access. The lifespan of a memory rootkit is short because it disappears after a system reboot.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon has certain variants that may have rootkit functionality. [[3]](#3)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1014.m16|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate. [[4]](#4)|
+
+
+## Detection
+
+Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Impair Defenses, and Highjack Execution Flow. Hidden artifacts include kernel modules (hides use of kernel modules used by the malware instance), services (hides any system services that the malware instance creates or injects itself into), threads (hides one or more threads that belong to the malware instance), and userspace libraries (hides use of userspace libraries used by the malware instance). 
+
+Rootkits can also be detected via memory dump analysis or virtual machine introspection.
+
+
+## References
+
+<a name="1">[1]</a> https://en.wikipedia.org/wiki/Rootkit
+
+<a name="2">[2]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
+
+<a name="3">[3]</a> https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml
+
+<a name="4">[4]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+

defense-evasion/self-deletion.md

@@ -1,18 +1,68 @@
-|||
-|---|---|
-|**ID**|**F0007**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>F0007</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Indicator Removal on Host: Uninstall Malicious Application (<a href="https://attack.mitre.org/techniques/T1630/001/">T1630.001</a>), Indicator Removal on Host: File Deletion (<a href="https://attack.mitre.org/techniques/T1070/004/">T1070.004</a>)</b></td>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>14 August 2020</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+</tr>
+</table>
 
 
-Self Deletion
-=============
+# Self Deletion
+
 Malware may uninstall itself to avoid detection. 
 
-See ATT&CK: [**Indicator Removal on Host: File Deletion**](https://attack.mitre.org/techniques/T1070/004/).
+See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630.001](https://attack.mitre.org/techniques/T1630/001/)), Indicator Removal on Host: File Deletion ([T1070.004](https://attack.mitre.org/techniques/T1070/004/))**.
+
+## Methods
 
-Methods
--------
 |Name|ID|Description|
 |---|---|---|
 |**COMSPEC Environment Variable**|F0007.001|Uninstalls self via COMSPEC environment variable.|
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Terminator**](../xample-malware/terminator.md)|2013|F0007.001|The RAT evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)|
+|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[self delete](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-forensic/self-deletion/self-delete.yml)|Self Deletion::COMSPEC Environment Variable (F0007.001)| |
+
+
+## References
+
+<a name="1">[1]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf
+
+<a name="2">[2]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
+
+<a name="3">[3]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
+
+<a name="4">[4]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile

discovery/README.md

@@ -1,15 +1,27 @@
-|||
-|---|---|
-|**ID**|**OB0007**|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0007</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
 
 
-# Discovery #
-Behaviors that aim to gain knowledge about the system and internal network.
+# Discovery
 
-* **Analysis Tool Discovery** [B0013](../discovery/analysis-tool-discover.md)
-* **Application Window Discovery** [E1010](../discovery/app-window-discover.md)
-* **File and Directory Discovery** [E1083](../discovery/file-discover.md)
-* **Self Discovery** [B0038](../discovery/self-discover.md)
-* **SMTP Connection Discovery** [B0014](../discovery/smtp-connect-discover.md)
-* **System Information Discovery** [E1082](../discovery/system-info-discover.md)
-* **Taskbar Discovery** [B0043](../discovery/taskbar-discover.md)
+Behaviors that enable malware to gain knowledge about the system and network.
+
+* **Analysis Tool Discovery** [B0013](../discovery/analysis-tool-discovery.md)
+* **Application Window Discovery** [E1010](../discovery/application-window-discovery.md)
+* **Code Discovery** [B0046](../discovery/code-discovery.md)
+* **File and Directory Discovery** [E1083](../discovery/file-and-directory-discovery.md)
+* **Self Discovery** [B0038](../discovery/self-discovery.md)
+* **SMTP Connection Discovery** [B0014](../discovery/smtp-connection-discovery.md)
+* **System Information Discovery** [E1082](../discovery/system-information-discovery.md)
+* **Taskbar Discovery** [B0043](../discovery/taskbar-discovery.md)

discovery/analysis-tool-discover.md

@@ -1,26 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0013**|
-|**Objective(s)**|[Discovery](../discovery)|
-|**Related ATT&CK Technique**|None|
-
-
-Analysis Tool Discovery
-=======================
-Malware can employ various means to detect whether analysis tools are present or running on the system on which it is executing. Note that analysis tools are used to *analyze* malware whereas security software (see [Software Discovery: Security Software Discovery](https://attack.mitre.org/techniques/T1518/001/)) aims to *detect/mitigate* malware on a system or network.
-
-This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](../anti-behavioral-analysis) objective.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Known File Location**|B0013.008|Malware may detect an analysis tool by the presence of a file in a known location.|
-|**Known Window**|B0013.009|Malware may detect an analysis tool via the presence of a known window.|
-|**Process detection**|B0013.001|Malware can scan for the process name associated with common analysis tools.|
-|**Process detection - Debuggers**|B0013.002|Malware can scan for the process name associated with common analysis tools. OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
-|**Process detection - PCAP Utilities**|B0013.004|Malware can scan for the process name associated with common analysis tools. Wireshark / Dumpcap|
-|**Process detection - PE Utilities**|B0013.006|Malware can scan for the process name associated with common analysis tools. ImportREC / PETools / LordPE|
-|**Process detection - Process Utilities**|B0013.005|Malware can scan for the process name associated with common analysis tools. ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
-|**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.|
-|**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|

discovery/analysis-tool-discovery.md

@@ -0,0 +1,75 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0013</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Analysis Tool Discovery
+
+Malware can employ various means to detect whether analysis tools are present or running on the system on which it is executing.S uch tools include Wireshark, Process Hacker, and IDA. 
+
+Note that analysis tools are used to *analyze* malware whereas security software (see **Software Discovery: Security Software Discovery ([T1518](https://attack.mitre.org/techniques/T1518/001/))** aims to *detect/mitigate* malware on a system or network.
+
+This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](../anti-behavioral-analysis) objective.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Known File Location**|B0013.008|Malware may detect an analysis tool by the presence of a file in a known location.|
+|**Known Window**|B0013.009|Malware may detect an analysis tool via the presence of a known window.|
+|**Known Windows Class Name**|B0013.010|Running program windows are checked to see if any windows class name contains a string indicating that an analysis tool is running. For example, 'WinDbgFrameClass' is Windbg main window’s class name. [2]|
+|**Process detection**|B0013.001|Malware can scan for the process name associated with common analysis tools.|
+|**Process detection - Debuggers**|B0013.002|Malware can scan for the process name associated with common analysis tools - OllyDBG / ImmunityDebugger / WinDbg / IDA Pro.|
+|**Process detection - PCAP Utilities**|B0013.004|Malware can scan for the process name associated with common analysis tools - Wireshark / Dumpcap.|
+|**Process detection - PE Utilities**|B0013.006|Malware can scan for the process name associated with common analysis tools - ImportREC / PETools / LordPE.|
+|**Process detection - Process Utilities**|B0013.005|Malware can scan for the process name associated with common analysis tools - ProcessHacker / SysAnalyzer / HookExplorer / SysInspector.|
+|**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools - Joe Sandbox, etc.|
+|**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools - Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If Emotet receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it receives an "upgrade" command which calls the ShellExecuteW function and exits. [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one of the analysis tools is running. [[2]](#2) [[3]](#3)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0013.010|Poison Ivy goes through all the running program windows to check if any Windows class name contains a special string to determine if an analysis tool is running. [[2]](#2) [[3]](#3)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0013.004|When infecting a x64 architecture system, the malware terminates if Wireshark is running on the system. [[4]](#4)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[reference analysis tools strings](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/reference-analysis-tools-strings.yml)|Analysis Tool Discovery::Process detection (B0013.001)| |
+
+## References
+
+<a name="1">[1]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
+
+<a name="2">[2]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+
+<a name="3">[3]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
+
+<a name="4">[4]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

discovery/app-window-discover.md

@@ -1,16 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1010**|
-|**Objective(s)**|[Discovery](../discovery)|
-|**Related ATT&CK Technique**|[Application Window Discovery](https://attack.mitre.org/techniques/T1010/) |
-
-
-Application Window Discovery
-============================
-Malware may attempt to get a listing of open application windows.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.|

discovery/application-window-discovery.md

@@ -0,0 +1,59 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1010</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Application Window Discovery (<a href="https://attack.mitre.org/techniques/T1010/">T1010</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>4 December 2020</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Application Window Discovery
+
+Malware may attempt to get a listing of open application windows.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1010.m01|DarkComet gets graphical window texts. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|E1010.m01|Gamut gets graphical window texts. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1010.m01|Hupigon gets graphical window texts. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|E1010.m01|Kovter gets graphical window texts. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1010.m01|Rombertik gets graphical window texts. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|E1010.m01|UP007 gets graphical window text. [[1]](#1)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[get graphical window text](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/window/get-text/get-graphical-window-text.yml)|Application Window Discovery (E1010)|user32.IsWindowVisible, user32.SendMessage, user32.GetForegroundWindow, user32.GetWindowText|
+
+## References
+
+<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+

discovery/code-discovery.md

@@ -0,0 +1,67 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0046</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>10 November 2021</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Code Discovery
+
+Malware may inspect code or enumerate aspects.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Enumerate PE Sections**|B0046.001|Malware enumerates virtual offsets of code sections.|
+|**Inspect Section Memory Permissions**|B0046.002|Malware identifies section memory permissions from image section header.|
+|**Parse PE Header**|B0046.003|Malware parses the PE header.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0046.001|BlackEnergy enumerates PE sections. [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0046.001|CryptoLocker enumerates PE sections. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0046.001|DarkComet enumerates PE sections. [[1]](#1)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0046.001|Emotet enumerates PE sections. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0046.001|Gamut enumerates PE sections. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0046.001|Hupigon enumerates PE sections. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|B0046.001|Locky Bart enumerates PE sections. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|B0046.002|Redhip inspects section memory permissions. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0046.001|Stuxnet enumerates PE sections. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|TrickBot inspects section memory permissions. [[1]](#1)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Ursnif enumerates PE sections. [[1]](#1)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[enumerate PE sections](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/enumerate-pe-sections.yml)|Code Discovery::Enumerate PE Sections (B0046.001)| |
+|[inspect section memory permissions](https://github.com/mandiant/capa-rules/blob/master/load-code/pe/inspect-section-memory-permissions.yml)|Code Discovery::Inspect Section Memory Permissions (B0046.002)| |
+
+## References
+
+<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+

discovery/file-and-directory-discovery.md

@@ -0,0 +1,94 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1083</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>File and Directory Discovery (<a href="https://attack.mitre.org/techniques/T1083/">T1083</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>2 August 2022</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# File and Directory Discovery
+
+Malware may enumerate files and directories or may search for specific files or in specific locations.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Log File**|E1083.m01|Malware may look for system log files.|
+|**Filter by Extension**|E1083.m02|Malware may filter by extension (common in ransomware).|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware searches for user files before encrypting them. [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware searches for user files before encrypting them. [[2]](#2)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware collects machine information and local files with specified file extensions. [[3]](#3)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware verifies that the folder from the first stage loader exists on the system. The malware also checks for the path for the Opera web browser. If it exists, the malware exits. [[4]](#4) [[5]](#5)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT enumerates files on Windows. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon enumerates files recursively. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1083.m01|Hupigon accesses the Windows event log. [[6]](#6)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter gets file version info. [[6]](#6)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|E1083.m01|Kovter accesses the Windows event log. [[6]](#6)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam enumerates files on Windows. [[6]](#6)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware enumerates files on Windows. [[6]](#6)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|The malware gets the common file path. [[6]](#6)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware gets file version info. [[6]](#6)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut gets the common file path. [[6]](#6)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR checks if a file exists. [[6]](#6)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|The malware gets a file size. [[6]](#6)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi gets a file size. [[6]](#6)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets a file size. [[6]](#6)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware gets the file version info. [[6]](#6)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)|
+|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[7]](#7)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[get common file path](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/get-common-file-path.yml)|File and Directory Discovery (E1083)|kernel32.GetTempPath, kernel32.GetTempFileName, kernel32.GetSystemDirectory, kernel32.GetWindowsDirectory, kernel32.GetSystemWow64Directory, GetAllUsersProfileDirectory, GetAppContainerFolderPath, GetCurrentDirectory, GetDefaultUserProfileDirectory, GetProfilesDirectory, GetUserProfileDirectory, SHGetFolderPathAndSubDir, shell32.SHGetFolderPath, shell32.SHGetFolderLocation, shell32.SHGetKnownFolderPath, shell32.SHGetSpecialFolderPath, shell32.SHGetSpecialFolderLocation, System.IO.Directory::GetCurrentDirectory, System.Environment::GetFolderPath|
+|[get file version info](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-version-info.yml)|File and Directory Discovery (E1083)|version.GetFileVersionInfo, version.GetFileVersionInfoEx, System.Diagnostics.FileVersionInfo::GetVersionInfo, version.VerQueryValue, version.GetFileVersionInfoSize, version.GetFileVersionInfoSizeEx|
+|[get file size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/meta/get-file-size.yml)|File and Directory Discovery (E1083)|kernel32.GetFileSize, kernel32.GetFileSizeEx|
+|[check if file exists](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/exists/check-if-file-exists.yml)|File and Directory Discovery (E1083)|kernel32.GetFileAttributes, kernel32.GetLastError, shlwapi.PathFileExists, System.IO.File::Exists|
+|[enumerate files on Linux](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-linux.yml)|File and Directory Discovery (E1083)|getdents, getdents64, opendir, readdir|
+|[enumerate files on Windows](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-on-windows.yml)|File and Directory Discovery (E1083)|kernel32.FindFirstFile, kernel32.FindFirstFileEx, kernel32.FindFirstFileTransacted, kernel32.FindFirstFileName, kernel32.FindFirstFileNameTransacted, kernel32.FindNextFile, kernel32.FindNextFileName, kernel32.FindClose, ntdll.NtOpenDirectoryObject, ntdll.NtQueryDirectoryObject, RtlAllocateHeap, System.IO.DirectoryInfo::GetFiles, System.IO.DirectoryInfo::EnumerateFiles, System.IO.Directory::GetFiles, System.IO.Directory::EnumerateFiles, System.IO.Directory::EnumerateFileSystemEntries, System.IO.DirectoryInfo::GetDirectories, System.IO.DirectoryInfo::EnumerateDirectories, System.IO.Directory::GetDirectories, System.IO.Directory::EnumerateDirectories|
+|[enumerate files recursively](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/files/list/enumerate-files-recursively.yml)|File and Directory Discovery (E1083)| |
+|[read data from CLFS log container](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/clfs/read-data-from-clfs-log-container.yml)|File and Directory Discovery::Log File (E1083.m01)|clfsw32.CreateLogFile, clfsw32.CreateLogMarshallingArea, clfsw32.ReadLogRecord, clfsw32.ReadNextLogRecord|
+|[access the Windows event log](https://github.com/mandiant/capa-rules/blob/master/host-interaction/log/winevt/access/access-the-windows-event-log.yml)|File and Directory Discovery::Log File (E1083.m01)|OpenEventLog, ClearEventLog, OpenBackupEventLog, ReportEvent|
+
+## References
+
+<a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
+
+<a name="2">[2]</a> https://www.secureworks.com/research/cryptolocker-ransomware
+
+<a name="3">[3]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
+
+<a name="4">[4]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="5">[5]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="7">[7]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/

discovery/file-discover.md

@@ -1,16 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1083**|
-|**Objective(s)**|[Discovery](../discovery)|
-|**Related ATT&CK Technique**|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/) |
-
-
-File and Directory Discovery
-============================
-Malware may enumerate files and directories or may search for specific files or in specific locations.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Log File**|E1083.m01|Malware may look for system log files.|

discovery/self-discover.md

@@ -1,10 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0038**|
-|**Objective(s)**|[Discovery](../discovery)|
-|**Related ATT&CK Technique**|None|
-
-
-Self Discovery
-==============
-Malware may gather information about itself, such as its filename or size on disk. 

discovery/self-discovery.md

@@ -0,0 +1,54 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0038</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>7 October 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>17 August 2023</b></td>
+</tr>
+</table>
+
+
+# Self Discovery
+
+Malware may gather information about itself, such as its filename or size on disk. 
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Use Hashquine**|B0038.001|Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [[1]](#1)|
+|**Check Magic String**|B0038.002|Malware checks a static value (i.e., magic string or number) to verify integrity. [[2]](#2)|
+|**Check Section Length**|B0038.003|Malware checks the length of a section to verify integrity. [[2]](#2)|
+
+## Use in Malware
+
+Name|Date|Method|Description|
+|---|---|---|---|
+|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry checks the size of the file it loads into memory. [[1]](#1)|
+|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.002|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[2]](#2)|
+|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.003|WannaCry checks the data lengh of a section before decypting a dll. [[2]](#2)|
+
+
+## References
+
+<a name="1">[1]</a> https://github.com/Rogdham/gif-md5-hashquine
+
+<a name="2">[2]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile

discovery/smtp-connect-discover.md

@@ -1,10 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0014**|
-|**Objective(s)**|[Discovery](../discovery)|
-|**Related ATT&CK Technique**|None|
-
-
-SMTP Connection Discovery
-=========================
-Malware may test whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction. 

discovery/smtp-connection-discovery.md

@@ -0,0 +1,41 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0014</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
+
+
+# SMTP Connection Discovery
+
+Malware may test whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction. 
+
+## Use in Malware
+
+Name|Date|Method|Description|
+|---|---|---|---|
+|[**Snake**](../xample-malware/snake.md)|2004|--|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware

discovery/system-info-discover.md

@@ -1,25 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1082**|
-|**Objective(s)**|[Discovery](../discovery)|
-|**Related ATT&CK Technique**|[System Information Discovery](https://attack.mitre.org/techniques/T1082)|
-
-
-System Information Discovery
-============================
-Malware may attempt to get detailed information about the system. 
-
-See ATT&CK: [**System Information Discovery**](https://attack.mitre.org/techniques/T1082).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|Learns about the system so it can drop compatible miner software.|

discovery/system-information-discovery.md

@@ -0,0 +1,95 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1082</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>System Information Discovery (<a href="https://attack.mitre.org/techniques/T1082">T1082</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>2 August 2022</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# System Information Discovery
+
+Malware may attempt to get detailed information about the system. 
+
+See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/techniques/T1082/))**.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Generate Windows Exception**|E1082.m01|Malware may trigger an exception as a way of gathering system details.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware can collect information about the computer, resources, services, installed programs, firmware, and operating system versions. [[7]](#7)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Malware learns about the system so it can drop compatible miner software. [[8]](#8)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Malware uses Window's command prompt commands to gather system info, task list, installed drivers, and installed programs.  [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Malware uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor. [[2]](#2)|
+|[**DarkComet**](../xample-malware/darkcomet.md)|2008|--|Malware can collect information about the computer, resources, and operating system version.  [[3]](#3)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet collects information related to OS, processes, and sometimes mail client information and sends it to C2. [[4]](#4)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Malware gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the network to spread itself. [[5]](#5)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks OS version. [[5]](#5)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings. [[6]](#6)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware queries environment variables. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware queries environment variables. [[9]](#9)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software and queries environment variables. [[9]](#9) [[10]](#10)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon queries environment variables. [[9]](#9)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter gets disk information. [[9]](#9)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi checks OS version. [[9]](#9)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip checks the OS version. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[query environment variable](https://github.com/mandiant/capa-rules/blob/master/host-interaction/environment-variable/query-environment-variable.yml)|System Information Discovery (E1082)|kernel32.GetEnvironmentVariable, kernel32.GetEnvironmentStrings, kernel32.ExpandEnvironmentStrings, msvcr90.getenv, msvcrt.getenv, System.Environment::GetEnvironmentVariable, System.Environment::GetEnvironmentVariables, System.Environment::ExpandEnvironmentVariables|
+|[get disk information](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-information.yml)|System Information Discovery (E1082)|kernel32.GetDriveType, kernel32.GetLogicalDrives, kernel32.GetVolumeInformation, kernel32.GetVolumeNameForVolumeMountPoint, kernel32.GetVolumePathNamesForVolumeName, kernel32.GetLogicalDriveStrings, kernel32.QueryDosDevice|
+|[get disk size](https://github.com/mandiant/capa-rules/blob/master/host-interaction/hardware/storage/get-disk-size.yml)|System Information Discovery (E1082)|kernel32.GetDiskFreeSpace, kernel32.GetDiskFreeSpaceEx, DeviceIoControl|
+|[check OS version](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/version/check-os-version.yml)|System Information Discovery (E1082)| |
+|[get hostname](https://github.com/mandiant/capa-rules/blob/master/host-interaction/os/hostname/get-hostname.yml)|System Information Discovery (E1082)|kernel32.GetComputerName, kernel32.GetComputerNameEx, GetComputerObjectName, ws2_32.gethostname, gethostname|
+
+## References
+
+<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_URSNIF.A2?_ga=2.131425807.1462021705.1559742358-1202584019.1549394279
+
+<a name="2">[2]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
+
+<a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+
+<a name="4">[4]</a> https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf
+
+<a name="5">[5]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+
+<a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
+
+<a name="7">[7]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
+
+<a name="8">[8]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="10">[10]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

discovery/taskbar-discover.md

@@ -1,10 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0043**|
-|**Objective(s)**|[Discovery](../discovery)|
-|**Related ATT&CK Technique**|None|
-
-
-Taskbar Discovery
-=================
-Malware may find the taskbar.

discovery/taskbar-discovery.md

@@ -0,0 +1,47 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0043</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../discovery">Discovery</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>4 December 2020</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Taskbar Discovery
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[find taskbar](https://github.com/mandiant/capa-rules/blob/master/host-interaction/gui/taskbar/find/find-taskbar.yml)|Taskbar Discovery (B0043)| |
+
+## References
+
+<a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+

execution/README.md

@@ -1,16 +1,29 @@
-|||
-|---|---|
-|**ID**|**OB0009**|
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>OB0009</b></td>
+</tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>29 November 2022</b></td>
+</tr>
+</table>
 
-# Execution #
-Behaviors that execute code on a system to achieve a variety of goals.
+# Execution
 
-* **Command and Scripting Interpreter** [E1059](../execution/command-line.md)
-* **Conditional Execution** [B0025](../execution/conditional-execute.md)
-* **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
-* **Install Additional Program** [B0023](../execution/install-prog.md)
-* **Prevent Concurrent Execution** [B0024](../execution/prevent-concurrent-exe.md)
+Behaviors that enable malware to execute code on a system to achieve a variety of goals.
+
+* **Command and Scripting Interpreter** [E1059](../execution/command-and-scripting-interpreter.md)
+* **Conditional Execution** [B0025](../execution/conditional-execution.md)
+* **Execution Dependency** [B0044](../execution/execution-dependency.md)
+* **Exploitation for Client Execution** [E1203](../execution/exploitation-for-client-execution.md)
+* **Install Additional Program** [B0023](../execution/install-additional-program.md)
+* **Prevent Concurrent Execution** [B0024](../execution/prevent-concurrent-execution.md)
 * **Remote Commands** [B0011](../execution/remote-commands.md)
 * **Send Email** [B0020](../execution/send-email.md)
-* **Send Poisoned Text Message** [B0021](../execution/send-poison-text-msg.md)
-* **User Execution** [E1204](../execution/user-interaction.md)
+* **Send Poisoned Text Message** [B0021](../execution/send-poisoned-text-message.md)
+* **System Services** [E1569](../execution/system-services.md)
+* **User Execution** [E1204](../execution/user-execution.md)

execution/command-and-scripting-interpreter.md

@@ -0,0 +1,93 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1059</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../execution">Execution</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Command and Scripting Interpreter (<a href="https://attack.mitre.org/techniques/T1059">T1059</a>, <a href="https://attack.mitre.org/techniques/T1623">T1623</a>)</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>2 August 2022</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Command and Scripting Interpreter
+
+Malware may abuse command and script interpreters to execute commands, scripts, or binaries.
+
+See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))**.
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|From the command line, the malware drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses cmd.exe to execute commands. [[2]](#2)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware executes malicious javascript and powershell. [[3]](#3)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam uses a batch file for executing the malware and deleting certain components. [[4]](#4)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion. Shamoon also accepts command line arguments.[[5]](#5)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell. [[6]](#6)|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny executes Lua scripts. [[7]](#7)|
+|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is written and executed in Powershell. [[8]](#8)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware accepts command line arguments. [[9]](#9)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware accepts command line arguments. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut accepts command line arguments. [[9]](#9)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon accepts command line arguments. [[9]](#9)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi accepts command line arguments. [[9]](#9)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip accepts command line arguments. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware accepts command line arguments. [[9]](#9)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs a script to inject a JavaScript script and modify web traffic. [[10]](#10)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot accepts command line arguments. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware accepts command line arguments. [[9]](#9)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[accept command line arguments](https://github.com/mandiant/capa-rules/blob/master/host-interaction/cli/accept-command-line-arguments.yml)|Command and Scripting Interpreter (E1059)|GetCommandLine, CommandLineToArgv, System.Environment::GetCommandLineArgs|
+|[run PowerShell expression](https://github.com/mandiant/capa-rules/blob/master/load-code/powershell/run-powershell-expression.yml)|Command and Scripting Interpreter (E1059)|System.Management.Automation.PowerShell::Create, System.Management.Automation.PowerShell::AddScript, System.Management.Automation.PowerShell::Invoke|
+
+## References
+
+<a name="1">[1]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
+
+<a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="3">[3]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
+
+<a name="4">[4]</a> https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-ransomware-chooses-Its-targets-carefully-wpna.pdf
+
+<a name="5">[5]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/
+
+<a name="6">[6]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+
+<a name="7">[7]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
+
+<a name="8">[8]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
+
+<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="10">[10]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
+
+<a name="11">[11]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="12">[12]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
+
+<a name="13">[13]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
+

execution/command-line.md

@@ -1,23 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1059**|
-|**Objective(s)**|[Execution](../execution)|
-|**Related ATT&CK Technique**|[Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)|
-
-
-Command and Scripting Interpreter
-=================================
-Malware may abuse command and script interpreters to execute commands, scripts, or binaries.
-
-**See ATT&CK Technique:** [**Command and Scripting Interpreter**](https://attack.mitre.org/techniques/T1059).
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
-
-References
-----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

execution/conditional-execute.md

@@ -1,27 +0,0 @@
-|||
-|---|---|
-|**ID**|**B0025**|
-|**Objective(s)**|[Execution](../execution)|
-|**Related ATT&CK Technique**|None|
-
-
-Conditional Execution
-=====================
-Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution happens autonomously, not because of an attacker's command.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
-|[**Conficker**](../xample-malware/conficker.md)|2008|A routine causes the process to suicide exit if the keyboard language is set to Ukranian.|
-
-References
-----------
-<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

execution/conditional-execution.md

@@ -0,0 +1,89 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0025</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../execution">Execution</a>, <a href="../anti-behavioral-analysis">Anti-Behavioral Analysis</a>, <a href="../defense-evasion">Defense Evasion</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Execution Guardrails  (<a href="https://attack.mitre.org/techniques/T1480">T1480</a>)</b></td>
+</tr>
+<tr>
+<td><b>Anti-Analysis Type</b></td>
+<td><b>Evasion</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>3.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>19 September 2023</b></td>
+</tr>
+</table>
+
+
+# Conditional Execution
+
+Malware checks system environment conditions or characteristics to determine its execution path. For example, malware may not run or may be dormant unless system conditions are favorable, or a file that is dropped may vary its behavior according to the execution environment. Conditional execution in malware happens autonomously, not because of an attacker's command. Such execution is realized when control flow of the malicious program changes with branching instructions in the code, e.g., conditional/unconditional jumps or ‘if’ statements.
+
+This behavior is related to the **Dynamic Analysis Evasion ([B0003](../anti-behavioral-analysis/dynamic-analysis-evasion.md))** behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
+
+Some aspects of this Conditional Execution behavior are related to the [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480) ATT&CK technique; however, the ATT&CK technique is not focused on anti-behavioral analysis behaviors.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
+|**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method. The subsequently defined ATT&CK sub-technique [Execution Guardrails: Environmental Keying (T1480.001)](https://attack.mitre.org/techniques/T1480/001/) is related to this MBC method. |
+|**GetVolumeInformation**|B0025.003|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
+|**Host Fingerprint Check**|B0025.004|Compare a previously computed host fingerprint (e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
+|**Runs as Service**|B0025.007|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[2]](#2)|
+|**Secure Triggers**|B0025.005|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
+|**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
+|**Token Check**|B0025.006|A token's presence is checked to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language is set to Ukranian. [[8]](#8)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|B0025.001|Conficker B variant has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts. [[5]](#5)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0025.004|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.). [[3]](#3)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware only proceeds if it detects the BIOS ROM is Award BIOS. [[4]](#4)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0025.004|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0025.007|Hupigon can run as a service. [[7]](#7)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|B0025.007|Shamoon can run as a service. [[7]](#7)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[run as service](https://github.com/mandiant/capa-rules/blob/master/host-interaction/service/run-as-service.yml)|Conditional Execution::Runs as Service (B0025.007)|RegisterServiceCtrlHandler, RegisterServiceCtrlHandlerEx, StartServiceCtrlDispatcher, System.ServiceProcess.ServiceBase::Run|
+
+## References
+
+<a name="1">[1]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="2">[2]</a> https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
+
+<a name="3">[3]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
+
+<a name="4">[4]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
+
+<a name="5">[5]</a> http://www.csl.sri.com/users/vinod/papers/Conficker/
+
+<a name="6">[6]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+
+<a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="8">[8]</a> https://en.wikipedia.org/wiki/Conficker

execution/execution-dependency.md

@@ -0,0 +1,43 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0044</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../execution">Execution</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>20 April 2021</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>12 June 2023</b></td>
+</tr>
+</table>
+
+
+# Execution Dependency
+
+Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in **Conditional Execution ([B0025](../execution/conditional-execution.md))**, this dependency is not because of an explicit check coded into the malware by the author.
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Adwind jRAT**](../xample-malware/adwindjrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)|
+
+
+## References
+
+<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/

execution/exploit-software.md

@@ -1,33 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1203**|
-|**Objective(s)**|[Execution](../execution), [Impact](../impact)|
-|**Related ATT&CK Technique**|[Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|
-
-
-Exploitation for Client Execution
-=================================
-Software is exploited - either because of a vulnerability or through its designed features - to gain access for malware. In general, exploitation may be done by a human attacker, but MBC focuses on software exploits implemented in code. Malware-specific details are below.
-
-**See related ATT&CK Technique:** [**Exploitation for Client Execution**](https://attack.mitre.org/techniques/T1203).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**File Transfer Protocol (FTP) Servers**|E1203.m03|Malware leverages an FTP server.|
-|**Java-based Web Servers**|E1203.m02||
-|**Red Hat JBoss Enterprise Products**|E1203.m04||
-|**Remote Desktop Protocols (RDP)**|E1203.m01|RDP is used by malware.|
-|**Sysinternals**|E1203.m05|Sysinternals tools are used for additional command line functionality.|
-|**Windows Utilities**|E1203.m06|One or more Windows utilities are used.|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|[**SamSam**](../xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
-
-References
-----------
-<a name="1">[1]</a> https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/

execution/exploitation-for-client-execution.md

@@ -0,0 +1,59 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>E1203</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../execution">Execution</a>, <a href="../impact">Impact</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>Exploitation for Client Execution (<a href="https://attack.mitre.org/techniques/T1203">T1203</a>)</b></td>
+</tr>
+<tr>
+<td><b>Impact Type</b></td>
+<td><b>Breach</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>3.0</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>1 March 2023</b></td>
+</tr>
+</table>
+
+
+# Exploitation for Client Execution
+
+Software is exploited - either because of a vulnerability or through its designed features - to gain access for malware. In general, exploitation may be done by a human attacker, but MBC focuses on software exploits implemented in code. Malware-specific details are below.
+
+See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.org/techniques/T1203))**.
+
+## Methods
+
+|Name|ID|Description|
+|---|---|---|
+|**File Transfer Protocol (FTP) Servers**|E1203.m03|Malware leverages an FTP server.|
+|**Java-based Web Servers**|E1203.m02|Malware leverages a Java-based web server.|
+|**Red Hat JBoss Enterprise Products**|E1203.m04|Malware leverages JBoss Enterprise products.|
+|**Remote Desktop Protocols**|E1203.m01|RDP is used by malware.|
+|**Sysinternals**|E1203.m05|Sysinternals tools are used for additional command line functionality.|
+|**Windows Utilities**|E1203.m06|One or more Windows utilities are used.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**SamSam**](../xample-malware/samsam.md)|2015|E1203.m01|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
+
+## References
+
+<a name="1">[1]</a> https://blog.malwarebytes.com/cybercrime/2018/05/samsam-ransomware-need-know/
+

execution/install-additional-program.md

@@ -0,0 +1,111 @@
+<table>
+<tr>
+<td><b>ID</b></td>
+<td><b>B0023</b></td>
+</tr>
+<tr>
+<td><b>Objective(s)</b></td>
+<td><b><a href="../execution">Execution</a></b></td>
+</tr>
+<tr>
+<td><b>Related ATT&CK Techniques</b></td>
+<td><b>None</b></td>
+</tr>
+<tr>
+<td><b>Version</b></td>
+<td><b>2.1</b></td>
+</tr>
+<tr>
+<td><b>Created</b></td>
+<td><b>1 August 2019</b></td>
+</tr>
+<tr>
+<td><b>Last Modified</b></td>
+<td><b>13 September 2023</b></td>
+</tr>
+</table>
+
+
+# Install Additional Program
+
+Malware installs another, different program on the system. The additional program can be any secondary module as exemplified by backdoors, malicious drivers, kernel modules, and OS X Apps.
+
+There are various ways to accomplish the installation. For example, malicious code can beacon to a C2 node for download of an additional program including updates (see **Ingress Tool Transfer ([E1105](../command-and-control/ingress-tool-transfer.md))**), which is then executed and installed [[1]](#1). A threat actor can achieve the same goal using a dropper embedded in the binary files of the original executable or using API calls to extract resource files that are in fact hidden executables. Extracted files are then dropped to the disk.
+
+Examples of droppers include malicious
+•	Microsoft Excel files
+•	ISO image files 
+•	self-extracting zip or archives files, which in turn may contain a second stage dropper as part of the payload [[2]](#2) [[3]](#3). 
+
+Droppers may be described as “single stage” or “two stage.” While the former embeds the malicious code internally, the latter installs itself before downloading additional code from a remote location [[4]](#4).  
+
+
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware downloads and executes Claymore's Zcash miner from a remote server. [[5]](#5)|
+|[**Geneio**](../xample-malware/geneio.md)|2015|--|Malware tricks OS X keychain to create application files. Malware also installs the browser extension Omnibar.safariextz. [[14]](#14)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR reinstalls its running instance if it is removed. [[7]](#7)|
+|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot installs a backdoor. [[18]](#18)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware contains a dropper that installs additional programs like Cbrom.exe. [[15]](#15)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware can download and install arbitrary iOS apps. [[17]](#17)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware is a dropper that creates multiple files. [[8]](#8)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|Upon execution, CozyCar drops a decoy file and a secondary dropper. [[9]](#9)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer drops a file masquerading as a Control Panel (CPL) file. [[10]](#10)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus downloads malware from other malware families. [[11]](#11)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware drops the first loader which is responsible for loading the main loader into memory. [[12]](#12) [[13]](#13)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs an open-source program called mitmproxy. [[16]](#16)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware contains an embedded PE file. [[19]](#19)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut contains an embedded PE file. [[19]](#19)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)|
+|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[20]](#20)|
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[contain an embedded PE file](https://github.com/mandiant/capa-rules/blob/master/executable/subfile/pe/contain-an-embedded-pe-file.yml)|Install Additional Program (B0023)| |
+|[write and execute a file](https://github.com/mandiant/capa-rules/blob/master/communication/c2/file-transfer/write-and-execute-a-file.yml)|Install Additional Program (B0023)| |
+
+## References
+<a name="1">"Cyclops Blink: Malware Analysis Report, Version 1.0," National Cyber Security Centre/GCHQ, 23 Feb. 2022. [Online]. Available: https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf.
+
+<a name="2"> Threat Hunter Team,"Shuckworm: Espionage Group Continues Intense Campaign Against Ukraine," Symantec, Enterprise Blogs/Threat Intelligence, 20 Apr. 2022. [Online]. Available: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-intense-campaign-ukraine.
+
+<a name="3">"What's behind APT29? | How they attack: the story of our hunt for the CozyDuke cybercriminal group," Kaspersky.com, [Online]. Available: https://www.kaspersky.com/enterprise-security/mitre/apt29.
+
+<a name="4">"Dropper," Computersecurity.fandom.com, wiki, [Online]. Available: https://computersecurity.fandom.com/wiki/Dropper.
+
+<a name="5">[5]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="6">[6]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-driver-based-mitm-malware-itranslator.html
+
+<a name="7">[7]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="8">[8]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+
+<a name="9">[9]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
+
+<a name="10">[10]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
+
+<a name="11">[11]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="12">[12]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="13">[13]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="14">[14]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
+
+<a name="15">[15]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
+
+<a name="16">[16]</a> https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection
+
+<a name="17">[17]</a> https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
+
+<a name="18">[18]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
+
+<a name="19">[19]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
+<a name="20">[20]</a> https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/