mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

- Updating capa detection in behaviors
- Newsletter
- Conti malware
- pafish faq

2023-09-20 15:57:32 -04:00

ID	F0006
Objective(s)	Defense Evasion
Related ATT&CK Techniques	Impair Defenses: Indicator Blocking (T1562.006)
Version	2.0
Created	1 August 2019
Last Modified	1 March 2023

Indicator Blocking

Malware blocks indicators or events that would indicate malicious activity. Methods relevant to the malware domain are below.

See ATT&CK: Impair Defenses: Indicator Blocking (T1562.006).

Methods

Name	ID	Description
Remove SMS Warning Messages	F0006.001	Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.

Name	Date	Method	Description
BlackEnergy	2007	--	The malware clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system. [1]
Conficker	2008	--	The malware terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software. [2]
DarkComet	2008	--	The malware can disable security center functions like anti-virus and firewall. [3]
TrickBot	2016	--	TrickBot terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [4]