Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger).

Two primary resources for anti-behavioral analysis behaviors are [1] and [2].

Capture Evasion M0036
Debugger Detection M0001
Debugger Evasion M0002
Dynamic Analysis Evasion M0003
Emulator Detection M0004
Emulator Evasion M0005
Executable Code Virtualization M0008
Execution Guardrails E1480
Hooking E1179
Memory Dump Evasion M0006
Sandbox Detection M0007
Software Packing E1045
Virtual Machine Detection M0009

References

[1] Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project

[2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking