Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger).

Two primary resources for anti-behavioral analysis behaviors are [1] and [2].

Debugger Detection M0001
Debugger Evasion M0002
Dynamic Analysis Evasion M0003
Emulator Detection M0004
Emulator Evasion M0005
Executable Code Compression T1045:M0036
Executable Code Virtualization M0008
Execution Guardrails E1480
Hooking E1179
Memory Dump Evasion M0006
Sandbox Detection M0007
Virtual Machine Detection M0009

References

[1] Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project

[2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking