MBCProject-mbc-markdown/defense-evasion/install-insecure-or-malicious-configuration.md

ID	B0047
Objective(s)	Defense Evasion, Persistence
Related ATT&CK Techniques	None
Version	3.2
Created	13 December 2019
Last Modified	28 April 2024

Install Insecure or Malicious Configuration

Malware may install malicious configuration settings or may modify existing configuration settings. For example, malware may change configuration settings associated with security mechanisms to make it difficult to detect or change configuration settings to maintain a foothold on the network.

Use in Malware

Name	Date	Method	Description
Black Energy	2007	--	Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [1]
YiSpecter	2015	--	The malware changes iOS Safari's default configuration. [2]

Detection

Tool: CAPE	Mapping	APIs
bcdedit_command	Install Insecure or Malicious Configuration (B0047)	ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW
stealth_hidden_extension	Install Insecure or Malicious Configuration (B0047)	--
stealth_hiddenreg	Install Insecure or Malicious Configuration (B0047)	--
stealth_hide_notifications	Install Insecure or Malicious Configuration (B0047)	--
disables_app_launch	Install Insecure or Malicious Configuration (B0047)	--
modify_hostfile	Install Insecure or Malicious Configuration (B0047)	--
antiav_srp	Install Insecure or Malicious Configuration (B0047)	--
bypass_firewall	Install Insecure or Malicious Configuration (B0047)	--

References

[1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf

[2] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/