mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
brightmt
6933d9e896
* Update snake.md Updated malware behaviors and descriptions. * Update snake.md Divided table to split out enhanced techniques * Update software-packing.md Added Snake * Update self-deletion.md Added Snake * Update system-information-discovery.md Added Snake * Update keylogging.md Added Snake * Update screen-capture.md * Update decode-data.md Added Snake * Update decrypt-data.md Added Snake * Update copy-file.md Added Snake * Update create-file.md Added Snake * Update delete-file.md * Update crypto-library.md Added Snake * Update crypto-library.md --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
Micro-behaviors
Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created or a string may be checked for some condition. Because such things are often noted in malware analysis, they are captured in MBC. They are called "micro-behaviors."
Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-objectives are shown below.
| Micro-objective | Description |
|---|---|
| Communication | Malware uses various protocols and components to communication. |
| Cryptography | Malware uses elements of cryptography. |
| Data | Malware manipulates data. |
| File System | Malware manipulates files or directories. |
| Hardware | Malware has hardware-related behaviors. |
| Memory | Malware manipulates memory. |
| Process | Malware uses processes. |
| Operating System | Malware makes changes to the operating system. |