From ffdb07ca8ccd315907751dc9d3b6084a38e89f10 Mon Sep 17 00:00:00 2001 From: MalwareMechanic Date: Thu, 18 Aug 2022 10:19:37 -0400 Subject: [PATCH] add additional MITRE ATT&CK and MBC mappings (#611) --- nursery/decrypt-data-using-rsa.yml | 6 ++++++ nursery/encrypt-data-using-rsa.yml | 7 +++++++ nursery/get-os-information-via-kuser_shared_data.yml | 2 ++ nursery/get-system-web-proxy.yml | 4 ++++ nursery/send-request-in-dotnet.yml | 2 ++ nursery/set-http-cookie.yml | 4 ++++ 6 files changed, 25 insertions(+) diff --git a/nursery/decrypt-data-using-rsa.yml b/nursery/decrypt-data-using-rsa.yml index ceaf9728..63e3fde9 100644 --- a/nursery/decrypt-data-using-rsa.yml +++ b/nursery/decrypt-data-using-rsa.yml @@ -5,6 +5,12 @@ rule: authors: - michael.hunhoff@mandiant.com scope: function + att&ck: + - Defense Evasion::Deobfuscate/Decode Files or Information [T1140] + mbc: + - Cryptography::Decrypt Data::RSA [C0031.010] + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider.decrypt features: - or: - api: System.Security.Cryptography.RSACryptoServiceProvider::Decrypt diff --git a/nursery/encrypt-data-using-rsa.yml b/nursery/encrypt-data-using-rsa.yml index ed52127b..39d06b37 100644 --- a/nursery/encrypt-data-using-rsa.yml +++ b/nursery/encrypt-data-using-rsa.yml @@ -5,6 +5,13 @@ rule: authors: - michael.hunhoff@mandiant.com scope: function + att&ck: + - Defense Evasion::Obfuscated Files or Information [T1027] + mbc: + - Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm [E1027.m05] + - Cryptography::Encrypt Data::RSA [C0027.011] + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider.encrypt features: - or: - api: System.Security.Cryptography.RSACryptoServiceProvider::Encrypt diff --git a/nursery/get-os-information-via-kuser_shared_data.yml b/nursery/get-os-information-via-kuser_shared_data.yml index 56646f48..c2a690e2 100644 --- a/nursery/get-os-information-via-kuser_shared_data.yml +++ b/nursery/get-os-information-via-kuser_shared_data.yml @@ -6,6 +6,8 @@ rule: authors: - "@mr-tz" scope: function + att&ck: + - Discovery::System Information Discovery [T1082] references: - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm features: diff --git a/nursery/get-system-web-proxy.yml b/nursery/get-system-web-proxy.yml index 26237969..dae32257 100644 --- a/nursery/get-system-web-proxy.yml +++ b/nursery/get-system-web-proxy.yml @@ -5,6 +5,10 @@ rule: authors: - michael.hunhoff@mandiant.com scope: function + att&ck: + - Discovery::System Network Configuration Discovery [T1016] + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.net.webrequest.getsystemwebproxy features: - and: - api: System.Net.WebRequest::GetSystemWebProxy diff --git a/nursery/send-request-in-dotnet.yml b/nursery/send-request-in-dotnet.yml index 6781a257..b186b92a 100644 --- a/nursery/send-request-in-dotnet.yml +++ b/nursery/send-request-in-dotnet.yml @@ -5,6 +5,8 @@ rule: authors: - anushka.virgaonakr@mandiant.com scope: function + att&ck: + - Command and Control::Application Layer Protocol::Web Protocols [T1071.001] mbc: - Communication::HTTP Communication::Send Request [C0002.003] features: diff --git a/nursery/set-http-cookie.yml b/nursery/set-http-cookie.yml index 4e22dc7c..2bfb249b 100644 --- a/nursery/set-http-cookie.yml +++ b/nursery/set-http-cookie.yml @@ -5,6 +5,10 @@ rule: authors: - michael.hunhoff@mandiant.com scope: function + att&ck: + - Command and Control::Application Layer Protocol::Web Protocols [T1071.001] + references: + - https://docs.microsoft.com/en-us/dotnet/api/system.net.cookiecontainer.setcookies features: - and: - api: System.Net.CookieContainer::SetCookies