update text for v2.2

Capa2.0 changes

README.md

@@ -1,4 +1,4 @@
-# <a name="mbc"></a>Malware Behavior Catalog v2.1 #
+# <a name="mbc"></a>Malware Behavior Catalog v2.2 #
 The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions.
 
 Check out the MBC presentations:
@@ -80,3 +80,7 @@ Malware objectives are defined in the table below. Follow the links to view asso
 |[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
 |[**Persistence**](./persistence/README.md)|Malware aims to remain on a system regardless of system events.|
 |[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
+
+
+**Copyright 2021 The MITRE Corporation. [Terms of Use](./tou.md)**
+

anti-behavioral-analysis/README.md

@@ -6,16 +6,14 @@
 # Anti-Behavioral Analysis
 Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger). 
 
-Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).
-
 * **Capture Evasion** [B0036](../anti-behavioral-analysis/evade-capture.md)
+* **Conditional Execution** [B0025](../execution/conditional-execute.md)
 * **Debugger Detection** [B0001](../anti-behavioral-analysis/detect-debugger.md)
 * **Debugger Evasion** [B0002](../anti-behavioral-analysis/evade-debugger.md)
 * **Dynamic Analysis Evasion** [B0003](../anti-behavioral-analysis/evade-dynamic-analysis.md)
 * **Emulator Detection** [B0004](../anti-behavioral-analysis/detect-emulator.md)
 * **Emulator Evasion** [B0005](../anti-behavioral-analysis/evade-emulator.md)
 * **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
-* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
 * **Hooking** [F0003](../credential-access/hooking.md)
 * **Memory Dump Evasion** [B0006](../anti-behavioral-analysis/evade-memory-dump.md)
 * **Sandbox Detection** [B0007](../anti-behavioral-analysis/detect-sandbox.md)

anti-behavioral-analysis/detect-sandbox.md

@@ -37,7 +37,7 @@ Malware Examples
 Code Snippets
 -------------
 **Sandbox Detection::Product Key/ID Testing** (B0007.005) - the value 55274-640-2673064-23950 corresponds to Joe Sandbox.
-```
+```asm
 push    ebx
 add     esp, 0FFFFFEF4h
 xor     ebx, ebx

anti-behavioral-analysis/detect-vm.md

@@ -62,6 +62,44 @@ Malware Examples
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
 |[**Redhip**](../xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
 
+Code Snippets
+-------------
+**Virtual Machine Detection::Instruction Testing** (B0009.029)
+ <br/>MD5: 0e058126f26b54b3a4a950313ec5dbce
+```asm
+; ___unwind { // __except handler4
+push ebp
+mov ebp, esp
+push 0FFFFFFFEh
+push offset stru_413980
+push offset __except handler4
+mov eax, large fs:0
+push eax
+sub esp, 14h
+push ebx
+push esi
+push edi
+mov eax, ___security_cookie
+xor [epb+ms_exc.registration.ScopeTable], eax
+xor eax, ebp
+push eax
+lea eax, [ebp+ms_exc.registration]
+mov large fs:0 eax
+mov [ebp+var_19], al
+;  __try { // __except at loc_401CB8
+mov [ebp+ms_exc.registration.TryLevel], eax
+push ebx
+mov ebx, 0
+mov eax, 1
+vpcext 7, 08h
+test ebx, ebx
+setz [ebp+var_19]
+pop ebx
+jmp short loc_401CBB
+```
+
+
+
 References
 ----------
 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

anti-behavioral-analysis/evade-memory-dump.md

@@ -22,6 +22,8 @@ Methods
 |**On-the-Fly APIs**|B0006.007|Resolve API addresses before each use to prevent complete dumping.|
 |**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.|
 |**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
+|**Hook memory mapping APIs**|B0006.010|Hooking prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
+|**Patch MmGetPhysicalMemoryRanges**|B0006.011|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
 
 Malware Examples
 ----------------
@@ -29,6 +31,48 @@ Malware Examples
 |---|---|---|
 |[Kraken](../xample-malware/kraken.md)|April 2008|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
 
+Code Snippets
+-------------
+**Memory Dump::Code Encryption in Memory** (B0006.011)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+mov cl, 65h ; 'e'
+mov al, 70h ; 'p'
+mov [ebp+var_23], cl
+mov [ebp+var_1F], cl
+mov [ebp+String], bl
+mov [ebp+var_12], bl
+mov [ebp+var_2E], al
+mov [ebp+var_2D], al
+lea ecx, [ebp+String]
+mov al, 74h ; 't'
+mov bl, 2Eh ; '.'
+push ecx
+mov [ebp+var_13], 30h
+mov [ebp+var_11], 30h
+mov [ebp+var_10], 0
+mov [ebp+cp]
+mov [ebp+var_2F], 75h
+mov [ebp+var_2C], 6Fh
+mov [ebp+var_2B], 72h
+mov [ebp+var_2A], al
+mov [ebp+var_29], bl
+mov [ebp+var_28], 62h
+mov [ebp+var_27], 79h
+mov [ebp+var_26], 69h
+mov [ebp+var_25], dl
+mov [ebp+var_24], al
+mov [ebp+var_22], 72h
+mov [ebp+var_21], bl
+mov [ebp+var_20], dl
+mov [ebp+var_1E], al
+mov [ebp+var_1D], 0
+call ds:atoi
+add esp, 4
+mov dword ptr [ebp+hostshort], eax
+jmp short loc_401326
+```
+
 References
 ----------
 <a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, https://www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf

anti-behavioral-analysis/execution-guardrails.md

@@ -1,31 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1480**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
-
-
-Execution Guardrails
-====================
-Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
-
-**See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Deposited Keys**|E1480.m01|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
-|**Environmental Keys**|E1480.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
-|**GetVolumeInformation**|E1480.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
-|**Host Fingerprint Check**|E1480.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
-|**Runs as Service**|E1480.m07|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[1]](#1)|
-|**Secure Triggers**|E1480.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
-|**Token Check**|E1480.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
-
-References
-----------
-<a name="1">[1]</a> 
-https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
-
-

anti-static-analysis/README.md

@@ -6,10 +6,9 @@
 # Anti-Static Analysis
 Behaviors and code characteristics that prevent static analysis or make it more difficult. Simple static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.
 
-Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).
-
 * **Call Graph Generation Evasion** [B0010](../anti-static-analysis/evade-call-graph.md)
 * **Disassembler Evasion** [B0012](../anti-static-analysis/evade-disassembler.md)
+* **Data Flow Analysis Evasion** [B0045](../anti-static-analysis/evade-data-flow-analysis.md)
 * **Executable Code Obfuscation** [B0032](../anti-static-analysis/exe-code-obfuscate.md)
 * **Executable Code Optimization** [B0034](../anti-static-analysis/exe-code-optimize.md)
 * **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)

anti-static-analysis/evade-data-flow-analysis.md

@@ -0,0 +1,22 @@
+|||
+|---|---|
+|**ID**|**B0045**|
+|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
+|**Related ATT&CK Technique**|None|
+
+
+Data Flow Analysis Evasion
+==========================
+Malware code evades data flow analysis (also known as information flow analysis and taint-tracking).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Control Dependence**|B0045.001|Data is propagated via an if-then-else clause instead of direct assignment.[[1]](#1)|
+|**Implicit Flows**|B0045.002|Data is propagated via semantic relationships, for example one variable not changing its state could imply the state of another variable.[[1]](#1)|
+|**Arbitrary Memory Corruption**|B0045.003|Data is propagated by corrupting memory, for example overwriting a region of stack space where a file pointer is held.[[1]](#1)|
+
+References
+----------
+<a name="1">[1]</a> http://www.seclab.cs.sunysb.edu/seclab/pubs/antitaint.pdf

anti-static-analysis/exe-code-obfuscate.md

@@ -42,6 +42,60 @@ Malware Examples
 |[**Emotet**](../xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 
+Code Snippets
+-------------
+**Obfuscated Files or Information::Encoding-Standard Algorithm** (E1027.m02)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+jle short_40182F
+mov dl, byte ptr [ebp+eax+var_7CA8]
+xor dl, cl
+mov byte ptr [ebp+eax+var_7CA8], dl
+inc eax
+cmp eax, edi
+jl short loc_40181A
+```
+**Executable Code Obfuscation::Stack Strings** (B0032.017)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+mov cl, 65h ; 'e'
+mov al, 70h ; 'p'
+mov [ebp+var_23], cl
+mov [ebp_var_1f], cl
+mov [ebp_Str], bl
+mov [ebp+var_12], bl
+mov [ebp+var_2E], al
+mov [ebp+var_2D], al
+lea ecx, [ebp+Str]
+mov al, 74h ; 't'
+mov bl, 2Eh ; '.'
+mov dl. 6Eh ; 'n'
+push ecx ; STR
+mov [ebp+var_13], 30h ; '0'
+mov [ebp+var_11], 30h ; '0'
+mov [ebp+var_10], 0
+mov [ebp+cp], 73h ; 's'
+mov [ebp+var_2F], 75h ; u'
+mov [ebp+var_2C], 6Fh ; 'o'
+mov [ebp+var_2B], 72h ; 'r'
+mov [ebp+var_2A], al
+mov [ebp+var_29], bl
+mov [ebp+var_28], 62h ; 'b'
+mov [ebp+var_27], 79h ; 'y'
+mov [ebp+var_26], 69h ; 'i'
+mov [ebp+var_25], dl
+mov [ebp+var_24], al
+mov [ebp+var_22], 72h ; 'r'
+mov [ebp+var_21], bl
+mov [ebp+var_20], dl
+mov [ebp+var_1E], al
+mov [ebp+var_1D], h
+call ds:atoi
+add esp, 4
+mov dword ptr [ebp+hostshort], eax
+jmp short loc_401326
+```
+
 References
 ----------
 <a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html

command-and-control/README.md

@@ -4,7 +4,7 @@
 
 
 # Command and Control
-Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.
+Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet. As "server" and "client" are confusing terminology in this context, we use the terms **controller** and **implant**. The controller is the software running on adversary-controlled infrastructure and used to send commands to the implant. The implant is the software running on victim-controlled infrastructure that receives commands from the adversary, executes those commands on the victim, and optionally sends the results back to the adversary.
 
 * **Command and Control Communication** [B0030](../command-and-control/command-control-comm.md)
 * **Domain Name Generation** [B0031](../command-and-control/domain-name-generate.md)

command-and-control/command-control-comm.md

@@ -7,21 +7,46 @@
 
 C2 Communication
 ================
-All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](../command-and-control/remote-file-copy.md).
+All command and control malware use implant/controller communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](../command-and-control/remote-file-copy.md).
 
-Command and Control Communication relates to *autonomous* client/server communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](../execution/remote-commands.md) under the Execution objective).
+Command and Control Communication relates to *autonomous* communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](../execution/remote-commands.md) under the Execution objective).
 
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
+|**Authenticate**|B0030.011|Implant may authenticate itself to the controller, controller may authenticate itself to implant, or both. This is often at or near the start of communication. Examples include but are not limited to a simple shared secret (e.g. password), challenge-response with symmetric encryption, or challenge-response with asymmetric encryption.|
 |**Check for Payload**|B0030.005|Check for payload.|
-|**Client to Server File Transfer**|B0030.004|File is transferred from client to server.|
-|**Receive Data**|B0030.002|Receive data or command from a C2 server.|
-|**Request Command**|B0030.008|Client requests a command.|
+|**Directory Listing**|B0030.012|Controller requests a directory listing from the implant, optionally from a given path, optionally recursive.|
+|**Execute File**|B0030.013|Execute/run/open the file using default operating system functionality, optionally with provided command-line arguments. The file may or may not already exist on the victim.|
+|**Execute Shell Command**|B0030.014|Execute/run the given command using a built-in program (e.g. cmd.exe, PowerShell, bash). This differs from Start Interactive Shell because the shell process is started only for the received command or set of commands and then exits. There is no loop looking for additional commands while the shell process is still running.|
+|**File search**|B0030.015|Controller requests the implant to search for a given filename pattern, often a [glob](https://en.wikipedia.org/wiki/Glob_(programming)).|
+|**Implant to Controller File Transfer**|B0030.004|File is transferred from implant to controller.|
+|**Receive Data**|B0030.002|Receive data or command from a controller.|
+|**Request Command**|B0030.008|Implant requests a command.|
 |**Request Email Address List**|B0030.010|Request email address list.|
 |**Request Email Template**|B0030.009|Request email template.|
-|**Send Data**|B0030.001|Send data to a C2 server.|
+|**Send Data**|B0030.001|Send data to a controller.|
 |**Send Heartbeat**|B0030.007|Heartbeat sent.|
-|**Send System Information**|B0030.006|Client sends system information.|
-|**Server to Client File Transfer**|B0030.003|File is transferred from server to client.|
+|**Send System Information**|B0030.006|Implant sends system information.|
+|**Server to Client File Transfer**|B0030.003|File is transferred from controller to implant.|
+|**Start Interactive Shell**|B0030.016|Start an interactive shell using a built-in program (e.g. cmd.exe, PowerShell, bash). This is often implemented with polling the network connection from the controller for text commands to redirect to the shell's stdin and polling the shell's stdout and stderr to redirect over the network to the controller. This differs from Execute Shell Command because the shell process runs across multiple iterations of the recv-command(s)-send-result loop.|
+
+Code Snippets
+-------------
+**C2 Communication::Receive Data** (B0030.02)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+loc_401981
+mov ecx, s
+mov edx, edi
+sub edx, esi
+push 0 ; flags
+lea eax, [esi+ebx]
+push edx ;len
+push eax ;buf
+push ecx ;s
+call recv
+jmp short loc_4019A2
+```
+

command-and-control/domain-name-generate.md

@@ -7,7 +7,7 @@
 
 Domain Name Generation
 ======================
-Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
+Malware generates the domain name of the controller to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced implants; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
 
 The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.
 

command-and-control/remote-file-copy.md

@@ -18,7 +18,7 @@ Malware Examples
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
+|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy implant is running on the target machine, the attacker can use a Windows GUI controller to control the target computer. [[1]](#1)|
 
 References
 ----------

credential-access/hooking.md

@@ -13,15 +13,18 @@ For discussion related to the Credential Access and Collection objectives, see A
 
 Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives.
 
+For hooking related to memory dump evasion, see [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md).
+
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Hook memory mapping APIs**|F0003.002|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
-|**Hook procedures**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)|
-|**Import Address Hooking (IAT) Hooking**|F0003.004|Uses modifications to a process's IAT where pointers to imported API functions are stored.|
-|**Inline Hooking**|F0003.005|Overwrites the first bytes in an API function to redirect code flow.|
-|**Patch MmGetPhysicalMemoryRanges**|F0003.001|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
+|**Procedure Hooking**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[1]](#1)|
+|**Inline Patching**|F0003.002|Overwrites the first bytes in an API function to redirect code flow.|
+|**Export Address Table (EAT) Hooking**|F0003.006|Hooks the export address table (EAT).|
+|**Import Address Table (IAT) Hooking**|F0003.001|Modifies a process's import address table (IAT), which stores pointers to imported API functions.|
+|**System Service Dispatch Table Hooking**|F0003.004|Hooks the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.|
+|**Shadow SDT Hooking**|F0003.005|Hooks the Shadow SSDT similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).|
 
 Malware Examples
 ----------------
@@ -32,8 +35,8 @@ Malware Examples
 
 References
 ----------
-<a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, https://www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf
+<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
 
 <a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
 
-<a name="3">[3]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
+

defense-evasion/README.md

@@ -10,10 +10,12 @@ Behaviors that evade detection or avoid other defenses.
 * **Bootkit** [F0013](../defense-evasion/boot-sector-mod.md)
 * **Bypass DEP** [B0037](../defense-evasion/bypass-dep.md)
 * **Component Firmware** [F0009](../persistence/component-firmware.md)
+* **Conditional Execution** [B0025](../execution/conditional-execute.md)
 * **Covert Location** [B0040](../defense-evasion/covert-location.md)
 * **Disable or Evade Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
-* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
+* **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md)
 * **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files.md)
+* **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md)
 * **Hooking** [F0003](../credential-access/hooking.md)
 * **Indicator Blocking** [F0006](../defense-evasion/indicator-blocking.md)
 * **Install Insecure or Malicious Configuration** [E1478](../defense-evasion/config-mod.md)

defense-evasion/disable-security-tools.md

@@ -25,6 +25,7 @@ Methods
 |**Modify Policy**|F0004.005|Malware may modify policies to make software less effective.|
 |**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
 |**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.|
+|**Disable Code Integrity**|F0004.009|Malware disables Code Integrity driver.|
 
 Malware Examples
 ----------------

defense-evasion/hide-artifacts.md

@@ -0,0 +1,23 @@
+|||
+|---|---|
+|**ID**|**E1564**|
+|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
+|**Related ATT&CK Technique**|[Hide Artifacts](https://attack.mitre.org/techniques/T1564)|
+
+
+Hidden Artifacts
+================
+Malware may hide artifacts to evade detection and/or to persist on the system. See potential methods related to malware below. 
+
+See ATT&CK: [**Hide Artifacts**](https://attack.mitre.org/techniques/T1564/).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Hidden Userspace Libraries**|E1564.m01|Hides userspace libraries used by the malware instance. Technique refers to hiding libraries loaded in memory (not disk). For example, a userspace library may be injected into a system process such that memory scanning tools may be prevented from finding them. This technique is different than DLL injection, in which the DLL will continue to show up in process metadata that tracks what is stored in memory. This technique involves clearing that metadata or making it inaccessible to security and inspection tools.|
+|**Direct Kernel Object Manipulation**|E1564.m02|Direct Kernel Object Manipulation (DKOM) can be used instead of loading a new driver. It leverages an undocumented function exported by ntdll.dll (NtSystemDebugControl()) that provides debugging functionalities at the kernel level.|
+|**Hidden Kernel Modules**|E1564.m05|Hides the use of kernel modules by the malware instance (e.g. rootkit). Techniques include kernel module list unlinking.|
+|**Hidden Processes**|E1564.m03|Hides processes used by the adversary or malware instance. This can involve techniques such as process list unlinking.|
+|**Hidden Services**|E1564.m04|Hides any system services that the malware instance creates or injects itself into. Services can be hidden by hiding associated registry keys.|
+

defense-evasion/hijack-execution-flow.md

@@ -0,0 +1,34 @@
+|||
+|---|---|
+|**ID**|**F0015**|
+|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
+|**Related ATT&CK Technique**|[Hijack Execution Flow](https://attack.mitre.org/techniques/T1574/)|
+
+
+Hijack Execution Flow
+=====================
+Malware may execute by hijacking the way operating systems run programs. Malware (e.g. rootkit) alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Different types of hooking are defined as methods below.
+
+See ATT&CK: [**Hijack Execution Flow**](https://attack.mitre.org/techniques/T1574/).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Abuse Windows Function Calls**|F0015.006|Malware abuses native Windows function calls to transfer execution to shellcode that it loads into memory. A pointer to the callback function is used to supply the memory address of the shellcode. Functions that can be abused include EnumResourceTypesA and EnumUILanguagesW. [[4]](#4)|
+|**Export Address Table (EAT) Hooking**|F0015.001|Malware (e.g. rootkit) hooks the export address table (EAT).|
+|**Import Address Table (IAT) Hooking**|F0015.003|Malware (e.g. rootkit) modifies a process's import address table (IAT), which stores pointers to imported API functions.[[1]](#1)|
+|**Inline Patching**|F0015.002|Inline patching (inline hooking) is done by modifying the beginning of a function in order to redirect the execution flow to custom code (i.e. redirecting code flow) before jumping back to the original function.[[2]](#2)|
+|**Shadow System Service Dispatch Table Hooking**|F0015.004|The Shadow System Service Dispatch Table (SSDT) can be hooked similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).[[3]](#3)|
+|**System Service Dispatch Table Hooking**|F0015.005|Malware (e.g. rootkit, malicious drivers) may hook the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.[[3]](#3)|
+
+References
+----------
+<a name="1">[1]</a> https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf
+
+<a name="2">[2]</a> https://www.oreilly.com/library/view/learning-malware-analysis/9781788392501/a0a506d6-d062-48c1-a0a8-57d6acb77785.xhtml
+
+<a name="3">[3]</a> https://www.mdpi.com/1999-5903/4/4/971/html
+
+<a name="4">[4]</a> http://ropgadget.com/posts/abusing_win_functions.html
+

defense-evasion/process-inject.md

@@ -9,16 +9,16 @@ Process Injection
 =================
 Malware may execute code in the address space of a separate process. 
 
-See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on sub-techniques in the context of [[1]](#1) are in as follows:
+See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on ATT&CK's sub-techniques in the context of [[1]](#1) are as follows:
 
 |ID|ATT&CK Sub-Technique|Notes|
 |---|---|---|
-|T1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
-|T1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
-|T1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
-|T1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread); also called AtomBombing [[3]](#3). Called *APC Injection and AtomBombing* in [[1]](#1).|
-|T1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
-|T1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|
+|E1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
+|E1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
+|E1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
+|E1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread); also called AtomBombing [[3]](#3). Called *APC Injection and AtomBombing* in [[1]](#1).|
+|E1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
+|E1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|
 
 Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hooking](../credential-access/hooking.md) behavior.
 
@@ -28,7 +28,9 @@ Methods
 |---|---|---|
 |**Hook Injection via SetWindowsHooksEx**|E1055.m01|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)|
 |**Injection and Persistence via Registry Modification**|E1055.m02|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
+|**Injection via Windows Fibers**|E1055.m05|Malware executes shellcode via Windows fibers by converting a thread to a fiber. [[5]](#5)|
 |**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)|
+|**Patch Process Command Line**|E1055.m04|Malware patches the PEB of a process to spoof the arguments.|
 
 Malware Examples
 ----------------
@@ -48,3 +50,5 @@ References
 <a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
 
 <a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+
+<a name="5">[5]</a> https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber

defense-evasion/rootkit-behavior.md

@@ -11,21 +11,18 @@ Behaviors of a rootkit: "A rootkit is a collection of computer software, typical
 
 See ATT&CK: [**Rootkit**](https://attack.mitre.org/techniques/T1014).
 
+Rootkits may hide artifacts (kernel modules, services, threads, userspace libraries), prevent actions (API unhooking (prevents API hooks installed by the malware instance from being removed), file access (prevents access to the file system, including specific files and/or directories associated with the malware instance), file deletion (prevents files and/or directories associated with the malware instance from being deleted), memory access (prevents access to system memory where the malware instance stores code or data), native API hooking (prevents other software from hooking native system APIs), registry access (prevents access to the Windows registry, either entire registry or particular registry keys/values), registry deletion (prevents deletion of registry keys and/or values associated with the malware instance).
+
 Methods
 ------- 
 |Name|ID|Description|
 |---|---|---|
-|**Hide Kernel Modules**|E1014.m01|Hides the usage of any kernel modules by the malware instance.|
-|**Hide Services**|E1014.m02|Hides any system services that the malware instance creates or injects itself into.|
-|**Hide Threads**|E1014.m04|Hides one or more threads that belong to the malware instance.|
-|**Hide Userspace Libraries**|E1014.m05|Hides the usage of userspace libraries by the malware instance.|
-|**Prevent API Unhooking**|E1014.m06|Prevents the API hooks installed by the malware instance from being removed.|
-|**Prevent File Access**|E1014.m09|Prevents access to the file system, including to specific files and/or directories associated with the malware instance.|
-|**Prevent File Deletion**|E1014.m10|Prevents files and/or directories associated with the malware instance from being deleted from a system.|
-|**Prevent Memory Access**|E1014.m11|Prevents access to system memory where the malware instance may be storing code or data.|
-|**Prevent Native API Hooking**|E1014.m12|Prevents other software from hooking native system APIs.|
-|**Prevent Registry Access**|E1014.m07|Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.|
-|**Prevent Registry Deletion**|E1014.m08|Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.|
+|**Application Rootkit**|E1014.m12|Application rootkits operate by exchanging standard application files with rootkit files, or changing applications by injecting code or patching.|
+|**Bootloader**|E1014.m13|A bootloader rootkit modifies the bootloader, enabling activation before the operating system is started. Also known as a Bootkit. See ATT&CK: [Bootkit](https://attack.mitre.org/techniques/T1542/003/).|
+|**Hardware/Firmware Rootkit**|E1014.m14|A firmware rootkit compromises hardware (e.g. network card, hard drive), system BIOS, UEFI firmware. LoJack is the first in-the-wild UEFI rootkit. See ATT&CK: [System Firmware](https://attack.mitre.org/techniques/T1542/001/).|
+|**Hypervisor/Virtualized Rootkit**|E1014.m15|A hypervisor (virtualized) rootkit hosts the target operating system as a virtual machine, enabling interception of all hardware calls. Also called, virtual-machine-based rootkit (VMBR).|
+|**Kernel Mode Rootkit**|E1014.m16|Rootkit operates by adding or replacing code in OS, device drivers, loadable kernel modules (LKM). Related to ATT&CK: [Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006/)|
+|**Memory Rootkit**|E1014.m17|A memory rootkit hids in RAM. Behaviors may include methods to prevent memory access. The lifespan of a memory rootkit is short because it disappears after a system reboot.|
 
 Malware Examples
 ----------------
@@ -33,6 +30,12 @@ Malware Examples
 |---|---|---|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
 
+Detection
+---------
+Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Impair Defenses, Highjack Execution Flow. Hidden artifacts include kernel modules (hides use of kernel modules used by the malware instance), services (hides any system services that the malware instance creates or injects itself into), threads (hides one or more threads that belong to the malware instance), userspace libraries (hides use of userspace libraries used by the malware instance). 
+
+Rootkits can also be detected via memory dump analysis or virtual machine introspection.
+
 References
 ----------
 <a name="1">[1]</a> https://en.wikipedia.org/wiki/Rootkit

discovery/README.md

@@ -8,6 +8,7 @@ Behaviors that aim to gain knowledge about the system and internal network.
 
 * **Analysis Tool Discovery** [B0013](../discovery/analysis-tool-discover.md)
 * **Application Window Discovery** [E1010](../discovery/app-window-discover.md)
+* **Code Discovery** [B0046](../discovery/code-discover.md)
 * **File and Directory Discovery** [E1083](../discovery/file-discover.md)
 * **Self Discovery** [B0038](../discovery/self-discover.md)
 * **SMTP Connection Discovery** [B0014](../discovery/smtp-connect-discover.md)

discovery/code-discover.md

@@ -0,0 +1,18 @@
+|||
+|---|---|
+|**ID**|**B0046**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|None|
+
+
+Code Discovery
+==============
+Malware may inspect code or enumerate aspects.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Enumerate PE Sections**|B0046.001|Malware enumerates virtual offsets of code sections.|
+|**Inspect Section Memory Permissions**|B0046.002|Malware identifies section memory permissions from image section header.|
+|**Parse PE Header**|B0046.003|Malware parses the PE header.|

execution/README.md

@@ -7,10 +7,12 @@ Behaviors that execute code on a system to achieve a variety of goals.
 
 * **Command and Scripting Interpreter** [E1059](../execution/command-line.md)
 * **Conditional Execution** [B0025](../execution/conditional-execute.md)
+* **Execution Dependency** [B0044](../execution/execution-dependency.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
 * **Install Additional Program** [B0023](../execution/install-prog.md)
 * **Prevent Concurrent Execution** [B0024](../execution/prevent-concurrent-exe.md)
 * **Remote Commands** [B0011](../execution/remote-commands.md)
 * **Send Email** [B0020](../execution/send-email.md)
 * **Send Poisoned Text Message** [B0021](../execution/send-poison-text-msg.md)
+* **System Services** [E1569](../execution/system-services.md)
 * **User Execution** [E1204](../execution/user-interaction.md)

execution/conditional-execute.md

@@ -1,19 +1,30 @@
 |||
 |---|---|
 |**ID**|**B0025**|
-|**Objective(s)**|[Execution](../execution)|
-|**Related ATT&CK Technique**|None|
+|**Objective(s)**|[Execution](../execution), [Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
+|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
 
 
 Conditional Execution
 =====================
-Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution happens autonomously, not because of an attacker's command.
+Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution in malware happens autonomously, not because of an attacker's command.
+
+This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
+
+Conditional execution may also be referred to as "execution guardrails." **See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
 
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
+|**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
+|**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
+|**GetVolumeInformation**|B0025.003|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
+|**Host Fingerprint Check**|B0025.004|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
+|**Runs as Service**|B0025.007|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[2]](#2)|
+|**Secure Triggers**|B0025.005|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
 |**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
+|**Token Check**|B0025.006|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
 
 Malware Examples
 ----------------
@@ -25,3 +36,6 @@ Malware Examples
 References
 ----------
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="2">[2]</a> 
+https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service

execution/execution-dependency.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**B0044**|
+|**Objective(s)**|[Execution](../execution)|
+|**Related ATT&CK Technique**|None|
+
+
+Execution Dependency
+====================
+Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in [Conditional Execution](../execution/conditional-execute.md) this dependency is not because of an explicit check coded into the malware by the author.

execution/system-services.md

@@ -0,0 +1,23 @@
+|||
+|---|---|
+|**ID**|**E1569**|
+|**Objective(s)**|[Execution](../execution)|
+|**Related ATT&CK Technique**|[System Services](https://attack.mitre.org/techniques/T1569/)|
+
+
+System Services
+===============
+Malware may abuse system services or daemons to execute. 
+
+**See ATT&CK:** [**System Services**](https://attack.mitre.org/techniques/T1569/).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**MSDTC**|E1569.m01|The Distributed Transaction Coordinator (MSDTC) coordinates transaction across multiple resource managers (databases, message queues and file systems). This legitimate Microsoft service is part of Windows 2000 and later and can be used to import and load DLLs. Malware may abuse MSDTC to import and load DLLs.[[1]](#1)|
+
+
+References
+----------
+<a name="1">[1]</a> https://support.resolver.com/hc/en-ca/articles/207161116-Configure-Microsoft-Distributed-Transaction-Coordinator-MSDTC-

impact/README.md

@@ -13,7 +13,7 @@ Behaviors that enable malware to achieve its mission of manipulating, interrupti
 * **Data Encrypted for Impact** [E1486](../impact/encrypt-impact.md)
 * **Denial of Service** [B0033](../impact/denial-of-service.md)
 * **Destroy Hardware** [B0017](../impact/destroy-hardware.md)
-* **Disk Content Wipe** [F0014](../impact/disk-content-wipe.md)
+* **Disk Wipe** [F0014](../impact/disk-wipe.md)
 * **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
 * **Generate Fraudulent Advertising Revenue** [E1472](../impact/generate-fraud-rev.md)

impact/data-destruction.md

@@ -16,6 +16,7 @@ Methods
 |Name|ID|Description|
 |---|---|---|
 |**Delete Application/Software**|E1485.m03|An application or software is deleted.|
+|**Delete Shadow Copies**|E1485.m04|Deletes shadow drive data, which is related to ransomware.|
 |**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.|
 
 Malware Examples

impact/disk-content-wipe.md

@@ -1,17 +0,0 @@
-|||
-|---|---|
-|**ID**|**F0014**|
-|**Objective(s)**|[Impact](../impact)|
-|**Related ATT&CK Sub-Technique**|[Disk Wipe::Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001/)|
-
-Disk Content Wipe
-=================
-Malware may erase the content of storage devices.
-
-This description refines the ATT&CK [**Disk Wipe::Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001/) sub-technique.
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Delete Shadow Drive**|F0014.001|Deletes shadow drive data, which is related to ransomware.|

impact/disk-wipe.md

@@ -0,0 +1,11 @@
+|||
+|---|---|
+|**ID**|**F0014**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Sub-Technique**|[Disk Wipe](https://attack.mitre.org/techniques/T1561/)|
+
+Disk Wipe
+=========
+Malware may erase the content of storage devices. This behavior is different than [Data Destruction](../impact/data-destruction.md) because sections of the disk are erased rather than individual files.
+
+This description refines the ATT&CK [**Disk Wipe**](https://attack.mitre.org/techniques/T1561/) sub-technique.

impact/encrypt-impact.md

@@ -11,6 +11,12 @@ Malware may encrypt files stored on the system to prevent user access until a ra
 
 See ATT&CK: [**Data Encrypted for Impact**](https://attack.mitre.org/techniques/T1486/) and [**Data Encrypted for Impact (Mobile)**](https://attack.mitre.org/techniques/T1471/). 
 
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Ransom Note**|E1486.001|Ransomware displays a ransom note. Ransom notes are sometimes used to link instances of ransomware, even when the code or anti-analysis techniques change.|
+
 Malware Examples
 ----------------
 |Name|Date|Description|

micro-behaviors/cryptography/README.md

@@ -11,4 +11,5 @@ Micro-behaviors that enable malware to use crypto.
 * **Decrypt Data** [C0031](../cryptography/decrypt.md)
 * **Generate Pseudo-random Sequence** [C0021](../cryptography/gen-random.md)
 * **Cryptography Hash** [C0029](../cryptography/crypto-hash.md)
-* **Encryption Key** [C0028](../cryptography/key.md)
+* **Encryption Key** [C0028](../cryptography/key.md)
+* **Hashed Message Authentication Code** [C0061](../cryptography/hmac.md)

micro-behaviors/cryptography/hmac.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0061**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Hashed Message Authentication Code
+==================================
+Malware uses an HMAC schema.

micro-behaviors/data/decompress.md

@@ -13,5 +13,6 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
+|**aPLib**|C0025.003|Malware decompresses data using aPLib.|
 |**IEncodingFilterFactory**|C0025.002|Malware decompresses data using IEncodingFilterFactory.|
 |**QuickLZ**|C0025.001|Malware decompresses data using QuickLZ.|

micro-behaviors/file-system/README.md

@@ -13,7 +13,9 @@ Micro-behaviors related to file manipulation.
 * **Delete Directory** [C0048](../file-system/delete-dir.md)
 * **Delete File** [C0047](../file-system/delete-file.md)
 * **Get File Attributes** [C0049](../file-system/get-file-attr.md)
+* **Move File** [C0063](../file-system/move-file.md)
 * **Read File** [C0051](../file-system/read-file.md)
 * **Read Virtual Disk** [C0056](../file-system/read-virtual-disk.md)
 * **Set File Attributes** [C0050](../file-system/set-file-attr.md)
-* **Write File** [C0052](../file-system/write-file.md)
+* **Write File** [C0052](../file-system/write-file.md)
+* **Move File** [C0063](../file-system/move-file.md)

micro-behaviors/file-system/move-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0063**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Move File
+=========
+Malware moves a file. 

micro-behaviors/file-system/set-file-attr.md

@@ -7,4 +7,4 @@
 
 Set File Attributes
 ===================
-Malware sets the attributes of a file.
+Malware sets or modifies the attributes of a file.

micro-behaviors/hardware/install-driver.md

@@ -7,4 +7,10 @@
 
 Install Driver
 ==============
-Malware installs a driver.
+Malware installs a driver or minifilter.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Minifilter**|C0037.001|Malware registers a minifilter.|

micro-behaviors/hardware/load-driver.md

@@ -7,4 +7,10 @@
 
 Load Driver
 ===========
-Malware loads a device driver.
+Malware loads a device driver or minifilter.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Minifilter**|C0023.001|Malware starts a minifilter.|

micro-behaviors/operating-system/enviro-var.md

@@ -13,4 +13,5 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Set Variable**|C0034.001|Malware sets an environment variable.|
+|**Set Variable**|C0034.001|Malware sets an environment variable.|
+|**Get Variable**|C0034.002|Malware gets an environment variable.|

micro-behaviors/process/README.md

@@ -11,6 +11,9 @@ Micro-behaviors related to processes.
 * **Check Mutex** [C0043](../process/check-mutex.md)	
 * **Create Process** [C0017](../process/create-process.md)
 * **Create Thread** [C0038](../process/create-thread.md)
+* **Enumerate Threads** [C0064](../process/enumerate-threads.md)
+* **Open Process** [C0065](../process/open-process.md)
+* **Open Thread** [C0066](../process/open-thread.md)
 * **Resume Thread** [C0054](../process/resume-thread.md)
 * **Set Thread Local Storage Value** [C0041](../process/thread-storage-set-value.md)
 * **Suspend Thread** [C0055](../process/suspend-thread.md)	

micro-behaviors/process/enumerate-threads.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0064**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Enumerate Threads
+=================
+Malware enumerates threads. 

micro-behaviors/process/open-process.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0065**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Open Process
+=============
+Malware opens a process. 

micro-behaviors/process/open-thread.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0066**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Open Thread
+=============
+Malware opens a thread. 

persistence/README.md

@@ -8,7 +8,9 @@ Malware aims to remain on a system regardless of system events.
 
 * **Bootkit** [F0013](../defense-evasion/boot-sector-mod.md)
 * **Component Firmware** [F0009](../persistence/component-firmware.md)
+* **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md)
 * **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files.md)
+* **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md)
 * **Hooking** [F0003](../credential-access/hooking.md)
 * **Install Insecure or Malicious Configuration** [E1478](../defense-evasion/config-mod.md)
 * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-ext.md)

privilege-escalation/README.md

@@ -6,6 +6,7 @@
 # Privilege Escalation #
 Behaviors that aim to obtain a higher level of permission.
 
+* **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md)
 * **Hooking** [F0003](../credential-access/hooking.md)
 * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-ext.md)
 * **Modify Existing Service** [F0011](../persistence/modify-service.md)

tou.md

@@ -0,0 +1,10 @@
+# Terms of Use #
+
+## LICENSE ##
+
+**Submissions**: For all materials you submit to the Malware Behavior Catalog (MBC), you hereby grant to The MITRE Corporation (MITRE) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+**MBC Usage**: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Malware Behavior Catalog (MBC). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
+
+## DISCLAIMERS ##
+ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

xample-malware/stuxnet.md

@@ -19,7 +19,7 @@ Behaviors
 
 References
 ----------
-<a name="1">[1]</a> https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf
+<a name="1">[1]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
 
 <a name="2">[2]</a> https://www.bbc.com/timelines/zc6fbk7
 

yfaq/README.md

@@ -20,8 +20,9 @@
 * **Micro-behaviors** - Low-level malware behaviors that support other objectives and behaviors are captured as micro-behaviors in MBC 2.x.
 
 * **Version Control** - MBC v1.0 was released at the end of January 2020. Further changes are being tracked and releases will happen on an as-needed basis: 
-	- MBC v2.0 was released in September 2020 and includes micro-behaviors and changes associated with [ATT&CK sub-techniques](https://attack.mitre.org/resources/updates/updates-july-2020/index.html).
-	- MBC v2.1 was released in February 2021 and includes additional micro-behaviors and behavior methods.
+    - MBC v2.0 was released in September 2020 and includes micro-behaviors and changes associated with [ATT&CK sub-techniques](https://attack.mitre.org/resources/updates/updates-july-2020/index.html).
+    - MBC v2.1 was released in February 2021 and includes additional micro-behaviors and behavior methods.
+    - MBC v2.2 was released in February 2022 and includes additional micro-behaviors and behavior methods. Added code snippets to certain methods.
 
 * **MBC Website** - An MBC website will replace markdown documents by mid-2021.