mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
2.9 KiB
2.9 KiB
| ID | B0047 |
| Objective(s) | Defense Evasion, Persistence |
| Related ATT&CK Techniques | None |
| Version | 3.0 |
| Created | 13 December 2019 |
| Last Modified | 4 March 2023 |
Install Insecure or Malicious Configuration
Malware may install malicious configuration settings or may modify existing configuration settings. For example, malware may change configuration settings associated with security mechanisms to make it difficult to detect or change configuration settings to maintain a foothold on the network.
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Black Energy | 2007 | -- | Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [1] |
| YiSpecter | 2015 | -- | The malware changes iOS Safari's default configuration. [2] |
Detection
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| bcdedit_command | Install Insecure or Malicious Configuration (B0047) | ShellExecuteExW, NtCreateUserProcess, CreateProcessInternalW |
| stealth_hidden_extension | Install Insecure or Malicious Configuration (B0047) | -- |
| stealth_hiddenreg | Install Insecure or Malicious Configuration (B0047) | -- |
| stealth_hide_notifications | Install Insecure or Malicious Configuration (B0047) | -- |
| disables_app_launch | Install Insecure or Malicious Configuration (B0047) | -- |
| modify_hostfile | Install Insecure or Malicious Configuration (B0047) | -- |
| antiav_srp | Install Insecure or Malicious Configuration (B0047) | -- |
| bypass_firewall | Install Insecure or Malicious Configuration (B0047) | -- |
References
[1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
[2] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/