mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
0fab38218e
* Update dns-communication.md * Update dns-communication.md * Update http-communication.md * Update icmp-communication.md * Update interprocess-communication.md * Update socket-communication.md * Update wininet.md * Update encrypt-data.md * Update encrypt-data.md * Update encryption-key.md * Update alter-file-extension.md * Update create-directory.md * Update create-file.md * Update create-file.md * Update delete-file.md * Update registry.md * Update wallpaper.md * Update create-process.md * Update check-mutex.md * Update writes-file.md * Update create-mutex.md --------- Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
Micro-behaviors
Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created or a string may be checked for some condition. Because such things are often noted in malware analysis, they are captured in MBC. They are called "micro-behaviors."
Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-objectives are shown below.
| Micro-objective | Description |
|---|---|
| Communication | Malware uses various protocols and components to communication. |
| Cryptography | Malware uses elements of cryptography. |
| Data | Malware manipulates data. |
| File System | Malware manipulates files or directories. |
| Hardware | Malware has hardware-related behaviors. |
| Memory | Malware manipulates memory. |
| Process | Malware uses processes. |
| Operating System | Malware makes changes to the operating system. |