mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
bd31003a22
* Fixing links * Code samples (#149) * Update obfuscated-files-or-information.md Added code sample with some proposed formatting incl. annotations explaining broad behavior patterns * Update obfuscated-files-or-information.md Added brief clarification to note * Update obfuscated-files-or-information.md Made requested changes to format * Update system-information-discovery.md Added code snippet from PoisonIvy RAT * Update debugger-detection.md Added code with example of PEB access * Update system-information-discovery.md Added new method based on code snippet * Update registry.md Added snippet for registry key query * Update generate-pseudorandom-sequence.md Added example of Mersenne Twister algorithm * Update keylogging.md Add Dark Comet keylogging code sample * Update dns-communication.md Added code sample from darkcomet * Update socket-communication.md Added DarkComet code snippet * Update delete-file.md Provided DarkComet sample * Update file-and-directory-discovery.md Added DarkComet snippet * Update allocate-memory.md Added DarkComet sample * Update modulo.md Added Hupigon snippet * Update get-file-attributes.md Added Hupigon sample * Update application-window-discovery.md Added Hupigon snippet * Update create-process.md Added Hupigon snippet. * Update conditional-execution.md Added Hupigon snippet * Update create-thread.md Added Hupigon snippet * Update resume-thread.md Added Hupigon snippet * Update command-and-scripting-interpreter.md Added SmokeLoader sample * Update change-memory-protection.md Added SmokeLoader snippet * Update console.md Added snippet from SmokeLoader * Update dynamic-analysis-evasion.md Added Industroyer sample * Update interprocess-communication.md Added CobaltStrike sample * Update read-file.md Added Cobalt Strike snippet * Update writes-file.md Added cobalt strike snippet * Update noncryptographic-hash.md Added emotet snippet * Update clipboard-modification.md Added emotet snippet * Update check-mutex.md Added emotet sampler * Update check-mutex.md Fixed typo * Update create-mutex.md Added Emotet snippet * Update allocate-thread-local-storage.md Added emotet snippet * Update registry-run-keys-startup-folder.md Added emotet snippet * Update wininet.md Added EnvyScout snippet * Update http-communication.md Added EnvyScout snippet * Update enumerate-threads.md Added Envyscout snippet * Update set-thread-local-storage-value.md Added Envyscout sample * Update create-directory.md Added explosive snippet * Update delete-directory.md Added explosive code snippet (note: the malware is called "explosive") * Update set-file-attributes.md Added explosive sample * Update terminate-process.md Added explosive snippet * Update terminate-thread.md Added explosive sample * Update move-file.md Added Finfisher snippet * Update screen-capture.md Added ECCENTRICBANDWAGON snippet * Fix links (#150) * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * fix link * update mod date * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * fix links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * update links * Update code-discovery.md * Update taskbar-discovery.md * Update conditional-execution.md * Update memory-dump-evasion.md * Update execution-dependency.md * Update compromise-data-integrity.md * Update dns-communication.md * Update http-communication.md * Update interprocess-communication.md * Update socket-communication.md * Update wininet.md * Update generate-pseudorandom-sequence.md * Update modulo.md * Update noncryptographic-hash.md * Update create-directory.md * Update delete-directory.md * Update delete-file.md * Update get-file-attributes.md * Update move-file.md * Update read-file.md * Update terminate-thread.md * Update set-file-attributes.md * Update writes-file.md * Update allocate-memory.md * Update change-memory-protection.md * Update console.md * Update registry.md * Update allocate-thread-local-storage.md * Update check-mutex.md * Update terminate-process.md * Update create-mutex.md * Update create-process.md * Update set-thread-local-storage-value.md * Update resume-thread.md * Update enumerate-threads.md * Update create-thread.md * update for 3.1 release * update for 3.1 release * update for 3.1 release --------- Co-authored-by: ryan <ryanxu@wustl.edu> Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
13 KiB
13 KiB
| ID | C0002 |
| Objective(s) | Communication |
| Related ATT&CK Techniques | None |
| Version | 2.2 |
| Created | 14 August 2020 |
| Last Modified | 30 April 2024 |
HTTP Communication
This micro-behavior is related to HTTP communication.
Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
Methods
| Name | ID | Description |
|---|---|---|
| Server | C0002.001 | General HTTP server behavior. |
| Client | C0002.002 | General HTTP client behavior. |
| Connect to Server | C0002.009 | HTTP client connects to HTTP server. |
| Open URL | C0002.004 | HTTP client connects to a URL. |
| Download URL | C0002.006 | HTTP client downloads URL to file. |
| Extract Body | C0002.011 | HTTP client extracts HTTP body. |
| Create Request | C0002.012 | HTTP client creates request. |
| Send Request | C0002.003 | HTTP client sends request (GET). |
| Send Data | C0002.005 | HTTP clients sends data to a server (POST/PUT). |
| Receive Request | C0002.015 | HTTP server receives request. |
| Send Response | C0002.016 | HTTP server sends response. |
| Get Response | C0002.017 | HTTP client receives response. |
| Start Server | C0002.018 | HTTP server is started. |
| Set Header | C0002.013 | HTTP header is set. |
| Read Header | C0002.014 | HTTP read header. |
| IWebBrowser | C0002.010 | The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document. |
| WinHTTP | C0002.008 | An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API). |
| WinINet | C0002.007 | A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the WinInet micro-behavior. |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| BlackEnergy | 2007 | C0002.010 | The malware initializes IWebBrowser2. [1] |
| BlackEnergy | 2007 | C0002.011 | The malware extracts the HTTP body. [1] |
| Emotet | 2018 | C0002.012 | The malware creates a HTTP request. [1] |
| Kovter | 2016 | C0002.009 | Kovter connects to a HTTP server. [1] |
| Kovter | 2016 | C0002.012 | Kovter creates a HTTP request. [1] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| read HTTP header | HTTP Communication::Read Header (C0002.014) | winhttp.WinHttpQueryHeaders |
| initialize WinHTTP library | HTTP Communication::WinHTTP (C0002.008) | winhttp.WinHttpOpen |
| initialize IWebBrowser2 | HTTP Communication::IWebBrowser (C0002.010) | ole32.CoCreateInstance |
| get HTTP content length | HTTP Communication (C0002) | wininet.HttpQueryInfo |
| set HTTP header | HTTP Communication::Set Header (C0002.013) | winhttp.WinHttpAddRequestHeaders, System.Net.WebHeaderCollection::Add |
| reference HTTP User-Agent string | HTTP Communication (C0002) | urlmon.ObtainUserAgentString |
| start HTTP server | HTTP Communication::Start Server (C0002.018) | httpapi.HttpInitialize, httpapi.HttpTerminate, System.Net.HttpListener::Start |
| receive HTTP request | HTTP Communication::Receive Request (C0002.015) | httpapi.HttpReceiveHttpRequest, httpapi.HttpReceiveRequestEntityBody |
| send HTTP response | HTTP Communication::Send Response (C0002.016) | httpapi.HttpSendHttpResponse, httpapi.HttpSendResponseEntityBody |
| receive HTTP response | HTTP Communication::Get Response (C0002.017) | System.Net.WebRequest::GetResponse, winhttp.WinHttpReceiveResponse, winhttp.WinHttpReadData, winhttp.WinHttpQueryDataAvailable |
| send HTTP request | HTTP Communication::Send Request (C0002.003) | System.Net.WebRequest::GetResponse, System.Net.WebRequest::GetResponseAsync, wininet.HttpOpenRequest, wininet.InternetConnect, wininet.HttpSendRequest, wininet.HttpSendRequestEx, winhttp.WinHttpSendRequest, winhttp.WinHttpWriteData, winhttp.WinHttpOpenRequest, winhttp.WinHttpConnect |
| read data from Internet | HTTP Communication::Get Response (C0002.017) | wininet.InternetReadFile, wininet.InternetReadFileEx, System.Net.WebClient::DownloadString, System.Net.WebClient::DownloadStringAsync, System.Net.WebClient::DownloadStringTaskAsync, System.Net.WebClient::DownloadData, System.Net.WebClient::DownloadDataAsync, System.Net.WebClient::DownloadDataTaskAsync |
| get HTTP document via IWebBrowser2 | HTTP Communication::Get Response (C0002.017) | oleaut32.SysAllocString, oleaut32.VariantInit |
| get HTTP document via IWebBrowser2 | HTTP Communication::IWebBrowser (C0002.010) | oleaut32.SysAllocString, oleaut32.VariantInit |
| download URL | HTTP Communication::Download URL (C0002.006) | urlmon.URLDownloadToFile, urlmon.URLDownloadToCacheFile, urlmon.URLOpenBlockingStream, urlmon.URLOpenPullStream, urlmon.URLOpenStream, System.Net.WebClient::DownloadFile, System.Net.WebClient::DownloadFileAsync, System.Net.WebClient::DownloadFileTaskAsync, Microsoft.VisualBasic.Devices.Network::DownloadFile |
| prepare HTTP request | HTTP Communication::Create Request (C0002.012) | winhttp.WinHttpOpenRequest |
| create HTTP request | HTTP Communication::Create Request (C0002.012) | wininet.InternetOpen, System.Net.WebRequest::Create, System.Net.WebRequest::CreateDefault, System.Net.WebRequest::CreateHttp, wininet.InternetCloseHandle |
| send file via HTTP | HTTP Communication::Send Data (C0002.005) | wininet.InternetWriteFile |
| decompress HTTP response via IEncodingFilterFactory | HTTP Communication::Get Response (C0002.017) | -- |
| check HTTP status code | HTTP Communication::Read Header (C0002.014) | atoi, wininet.HttpQueryInfo |
| get HTTP response content encoding | HTTP Communication::Get Response (C0002.017) | wininet.HttpQueryInfo |
| connect to URL | HTTP Communication::Open URL (C0002.004) | wininet.InternetOpenUrl |
| connect to HTTP server | HTTP Communication::Connect to Server (C0002.009) | wininet.InternetConnect |
| extract HTTP body | HTTP Communication::Extract Body (C0002.011) | -- |
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| internet_dropper | HTTP Communication (C0002) | HttpOpenRequestA, InternetConnectA, HttpOpenRequestW, InternetConnectW |
| bot_madness | HTTP Communication (C0002) | -- |
| bot_madness | HTTP Communication::Send Request (C0002.003) | -- |
| bot_drive | HTTP Communication (C0002) | -- |
| bot_drive | HTTP Communication::Send Data (C0002.005) | -- |
| network_cnc_http | HTTP Communication (C0002) | -- |
| recon_beacon | HTTP Communication (C0002) | HttpOpenRequestA, HttpSendRequestA |
| network_http | HTTP Communication (C0002) | -- |
| explorer_http | HTTP Communication (C0002) | WinHttpConnect, WinHttpOpenRequest |
| bot_drive2 | HTTP Communication (C0002) | -- |
| bot_drive2 | HTTP Communication::Send Data (C0002.005) | -- |
| bot_dirtjumper | HTTP Communication (C0002) | -- |
| bot_dirtjumper | HTTP Communication::Send Data (C0002.005) | -- |
| bot_athenahttp | HTTP Communication (C0002) | -- |
| koadic_network_activity | HTTP Communication (C0002) | HttpOpenRequestW, WinHttpOpenRequest |
| http_request | HTTP Communication (C0002) | HttpOpenRequestA, HttpOpenRequestW, InternetConnectW, InternetOpenUrlA, InternetConnectA, InternetOpenUrlW, WinHttpGetProxyForUrl |
| cmdline_http_link | HTTP Communication (C0002) | -- |
| cmdline_reversed_http_link | HTTP Communication (C0002) | -- |
| https_urls | HTTP Communication (C0002) | InternetOpenUrlW, InternetOpenUrlA |
| network_document_http | HTTP Communication (C0002) | URLDownloadToFileW, HttpOpenRequestW, InternetCrackUrlW, InternetCrackUrlA, WSASend, InternetReadFile |
| banker_zeus_url | HTTP Communication (C0002) | -- |
| downloads_from_filehosting | HTTP Communication (C0002) | WinHttpOpenRequest, InternetOpenUrlA |
| purplewave_network_activity | HTTP Communication (C0002) | InternetOpenW, HttpOpenRequestW, HttpSendRequestW, HttpAddRequestHeadersA |
C0002.017 Snippet
Communication::HTTP Communication::Get Response
SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641 Location: 0x180001380mov param_2, ebx lea r9, [rsp + 0x44] ; where to store the number of bytes read add param_2, r14 ; pointer to buffer to receive HTTP data mov param_3, 0x400 ; number of bytes to read (1024) mov param_1, rsi ; handle to previously opened HTTP request call qword ptr [->WININET::InternetReadFile] ; Windows API for reading data from HTTP or FTP connections
References
[1] capa v4.0, analyzed at MITRE on 10/12/2022