mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck c3033e4061 Staging (#162 )

* update staging (#158)

* update format/wording

* Capa 7.1 rule updates (#156)

* Update self-deletion.md

Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml)

* Update obfuscated-files-or-information.md

added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml

* Update disk-wipe.md

Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml

* Update system-information-discovery.md

Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml

* Update dns-communication.md

Removed duplication in APIs in "Resolve DNS" CAPA rule

* Update socket-communication.md

Updated APIs for "create raw socket" CAPA rule

* Update socket-communication.md

Updated APIs on CAPA rule "get socket status"

* Update socket-communication.md

Updated CAPA rule "initialize Winsock library"

* Update socket-communication.md

Updated API listing on CAPA rule "receive data on socket"

* Update socket-communication.md

Updated API listing for "send data on socket" CAPA rule

* Update socket-communication.md

Update APIs for CAPA rule "set socket configuration"

* Update socket-communication.md

Updated CAPA rule "connect tcp socket" to add APIs

* Update socket-communication.md

Added APIs to CAPA rule "create tcp socket"

* Update socket-communication.md

Added APIs to "create UDP socket" CAPA rule

* Update encrypt-data.md

Added new APIs to "encrypt data using DPAPI" CAPA rule

* Update install-driver.md

Added APIs to CAPA rule "install driver"

* Update set-file-attributes.md

Added APIs to CAPA rule "change file permissions on Linux"

* Update writes-file.md

Updated APIs for CAPA rule "write file on linux"

* Update system-information-discovery.md

Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1

* Update create-process.md

Added API to "create process on linux" CAPA rule

* Update hijack-execution-flow.md

Added API calls to CAPA rule "execute shellcode via Windows callback function"

* Update self-deletion.md

Changed link to master

* Update obfuscated-files-or-information.md

Changed rule link to release to point to master

* Update system-information-discovery.md

Removed nursery rules

* Update disk-wipe.md

Updated link to master branch

* Update socket-communication.md

Checked for correct socket listings under the APIs

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>

* New method (#159)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

* Corpus fix (#160)

* update format/wording

* fix tables

* Edits

---------

Co-authored-by: ryan <ryanxu@wustl.edu>

* New method (#161)

* update format/wording

* Update disassembler-evasion.md

* Update disassembler-evasion.md

---------

Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
Co-authored-by: ryan <ryanxu@wustl.edu>

2024-08-25 10:09:33 -04:00

allocate-thread-local-storage.md

Staging (#151 )

2024-05-01 16:09:33 -04:00

check-mutex.md

Updated MBC-CAPE signature mappings (#153 )

2024-06-30 15:08:20 -04:00

create-mutex.md

Updated MBC-CAPE signature mappings (#153 )

2024-06-30 15:08:20 -04:00

create-process.md

Staging (#162 )

2024-08-25 10:09:33 -04:00

create-thread.md

Updated MBC-CAPE signature mappings (#153 )

2024-06-30 15:08:20 -04:00

enumerate-threads.md

Staging (#151 )

2024-05-01 16:09:33 -04:00

open-process.md

Staging (#124 )

2023-09-20 15:57:32 -04:00

open-thread.md

Staging (#124 )

2023-09-20 15:57:32 -04:00

README.md

Staging (#124 )

2023-09-20 15:57:32 -04:00

resume-thread.md

Staging (#151 )

2024-05-01 16:09:33 -04:00

set-thread-context.md

Staging (#124 )

2023-09-20 15:57:32 -04:00

set-thread-local-storage-value.md

Staging (#151 )

2024-05-01 16:09:33 -04:00

suspend-thread.md

Staging (#151 )

2024-05-01 16:09:33 -04:00

synchronization.md

Staging (#124 )

2023-09-20 15:57:32 -04:00

terminate-process.md

Staging (#151 )

2024-05-01 16:09:33 -04:00

terminate-thread.md

Staging (#151 )

2024-05-01 16:09:33 -04:00

unmap-section-view.md

Staging (#124 )

2023-09-20 15:57:32 -04:00

write-process-memory.md

Staging (#124 )

2023-09-20 15:57:32 -04:00

README.md

ID	OC0003
Created	4 December 2020
Last Modified	29 November 2022

Process Micro-objective

Micro-behaviors related to processes.

Allocate Thread Local Storage C0040
Create Mutex C0042
Check Mutex C0043
Create Process C0017
Create Thread C0038
Enumerate Threads C0064
Open Process C0065
Open Thread C0066
Resume Thread C0054
Set Thread Context C0072
Set Thread Local Storage Value C0041
Suspend Thread C0055
Synchronization C0022
Terminate Process C0018
Terminate Thread C0039
Unmap Section View C0070
Write Process Memory C0071