diff --git a/anti-analysis/packer/confuser/packed-with-confuser.yml b/anti-analysis/packer/confuser/packed-with-confuser.yml index 59e8323b..fd053cb6 100644 --- a/anti-analysis/packer/confuser/packed-with-confuser.yml +++ b/anti-analysis/packer/confuser/packed-with-confuser.yml @@ -7,7 +7,7 @@ rule: att&ck: - Defense Evasion::Obfuscated Files or Information::Software Packing [T1027.002] mbc: - - Anti-Static Analysis::Software Packing::Confuser [F0001.012] + - Anti-Static Analysis::Software Packing::Confuser [F0001.009] examples: - b9f5bd514485fb06da39beff051b9fdc features: diff --git a/compiler/pyarmor/compiled-with-pyarmor.yml b/compiler/pyarmor/compiled-with-pyarmor.yml index a1e76a2e..21ffb5b1 100644 --- a/compiler/pyarmor/compiled-with-pyarmor.yml +++ b/compiler/pyarmor/compiled-with-pyarmor.yml @@ -6,6 +6,7 @@ rule: scope: file att&ck: - Execution::Command and Scripting Interpreter::Python [T1059.006] + - Defense Evasion::Obfuscated Files or Information::Software Packing [1027.002] references: - https://twitter.com/stvemillertime/status/1349032548580483073 examples: diff --git a/data-manipulation/encoding/base64/encode-data-using-base64.yml b/data-manipulation/encoding/base64/encode-data-using-base64.yml index e51adbc9..ec65fa3e 100644 --- a/data-manipulation/encoding/base64/encode-data-using-base64.yml +++ b/data-manipulation/encoding/base64/encode-data-using-base64.yml @@ -8,7 +8,7 @@ rule: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02] - - Data::Encoding::Base64 [C0026.001] + - Data::Encode Data::Base64 [C0026.001] examples: - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C - 074072B261FC27B65C72671F13510C05:0x100049B2 diff --git a/data-manipulation/encoding/base64/reference-base64-string.yml b/data-manipulation/encoding/base64/reference-base64-string.yml index 46d91916..0adabca7 100644 --- a/data-manipulation/encoding/base64/reference-base64-string.yml +++ b/data-manipulation/encoding/base64/reference-base64-string.yml @@ -4,8 +4,10 @@ rule: namespace: data-manipulation/encoding/base64 author: moritz.raabe@fireeye.com scope: file + att&ck: + - Defense Evasion::Obfuscated Files or Information [T1027] mbc: - - Data::Encoding::Base64 [C0026.001] + - Data::Encode Data::Base64 [C0026.001] - Data::Check String [C0019] examples: - BFB9B5391A13D0AFD787E87AB90F14F5 diff --git a/data-manipulation/encoding/xor/encode-data-using-xor.yml b/data-manipulation/encoding/xor/encode-data-using-xor.yml index 0acfd39e..35b85790 100644 --- a/data-manipulation/encoding/xor/encode-data-using-xor.yml +++ b/data-manipulation/encoding/xor/encode-data-using-xor.yml @@ -8,7 +8,7 @@ rule: - Defense Evasion::Obfuscated Files or Information [T1027] mbc: - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02] - - Data::Encoding::XOR [C0026.002] + - Data::Encode Data::XOR [C0026.002] examples: - 2D3EDC218A90F03089CC01715A9F047F:0x403D7E features: diff --git a/host-interaction/file-system/write/write-file.yml b/host-interaction/file-system/write/write-file.yml index 48cc084f..2b3d4e3d 100644 --- a/host-interaction/file-system/write/write-file.yml +++ b/host-interaction/file-system/write/write-file.yml @@ -5,7 +5,7 @@ rule: author: william.ballenthin@fireeye.com scope: function mbc: - - File System::Write File [C0052] + - File System::Writes File [C0052] examples: - Practical Malware Analysis Lab 01-04.exe_:0x4011FC # ntdll diff --git a/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml b/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml index 7841b24f..f966e802 100644 --- a/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml +++ b/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml @@ -5,7 +5,7 @@ rule: author: michael.hunhoff@fireeye.com scope: function mbc: - - Impact::Modify Hardware::CDROM [C0042.001] + - Impact::Modify Hardware::CDROM [B0042.001] examples: - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x10007250 features: diff --git a/host-interaction/registry/create-registry-key-via-offline-registry-library.yml b/host-interaction/registry/create-registry-key-via-offline-registry-library.yml index 8adc4880..c7e1e9fe 100644 --- a/host-interaction/registry/create-registry-key-via-offline-registry-library.yml +++ b/host-interaction/registry/create-registry-key-via-offline-registry-library.yml @@ -4,6 +4,8 @@ rule: namespace: host-interaction/registry author: johnk3r scope: function + att&ck: + - Defense Evasion::Modify Registry [T1112] mbc: - Operating System::Registry::Create Registry Key [C0036.004] examples: diff --git a/host-interaction/registry/delete/delete-registry-key.yml b/host-interaction/registry/delete/delete-registry-key.yml index d9bde6f4..a58dea0f 100644 --- a/host-interaction/registry/delete/delete-registry-key.yml +++ b/host-interaction/registry/delete/delete-registry-key.yml @@ -7,6 +7,8 @@ rule: - michael.hunhoff@fireeye.com - johnk3r scope: function + att&ck: + - Defense Evasion::Modify Registry [T1112] mbc: - Operating System::Registry::Delete Registry Key [C0036.002] examples: diff --git a/host-interaction/registry/delete/delete-registry-value.yml b/host-interaction/registry/delete/delete-registry-value.yml index be97c9a5..be78292a 100644 --- a/host-interaction/registry/delete/delete-registry-value.yml +++ b/host-interaction/registry/delete/delete-registry-value.yml @@ -4,6 +4,8 @@ rule: namespace: host-interaction/registry/delete author: michael.hunhoff@fireeye.com scope: function + att&ck: + - Defense Evasion::Modify Registry [T1112] mbc: - Operating System::Registry::Delete Registry Value [C0036.007] examples: diff --git a/host-interaction/registry/set-registry-key-via-offline-registry-library.yml b/host-interaction/registry/set-registry-key-via-offline-registry-library.yml index c00072d3..3a5fdaf6 100644 --- a/host-interaction/registry/set-registry-key-via-offline-registry-library.yml +++ b/host-interaction/registry/set-registry-key-via-offline-registry-library.yml @@ -4,6 +4,8 @@ rule: namespace: host-interaction/registry author: johnk3r scope: function + att&ck: + - Defense Evasion::Modify Registry [T1112] mbc: - Operating System::Registry::Set Registry Key [C0036.001] examples: diff --git a/load-code/pe/inject-dll-reflectively.yml b/load-code/pe/inject-dll-reflectively.yml index 7d1200f8..3fca7dd5 100644 --- a/load-code/pe/inject-dll-reflectively.yml +++ b/load-code/pe/inject-dll-reflectively.yml @@ -4,6 +4,8 @@ rule: namespace: load-code/pe author: "@Ana06" scope: function + att&ck: + - Defense Evasion::Process Injection::Dynamic-link Library Injection [T1055.001] references: - https://0x00sec.org/t/reflective-dll-injection/3080 - https://www.ired.team/offensive-security/code-injection-process-injection/reflective-dll-injection diff --git a/nursery/check-for-process-debug-object.yml b/nursery/check-for-process-debug-object.yml index 7cd6b292..064cb74e 100644 --- a/nursery/check-for-process-debug-object.yml +++ b/nursery/check-for-process-debug-object.yml @@ -5,7 +5,7 @@ rule: author: michael.hunhoff@fireeye.com scope: function mbc: - - Anti-Behavioral Analysis::Detect Debugger + - Anti-Behavioral Analysis::Debugger Detection references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQueryInformationProcess_ProcessDebugObject.cpp features: diff --git a/nursery/check-processdebugflags.yml b/nursery/check-processdebugflags.yml index 4d812674..3126fdec 100644 --- a/nursery/check-processdebugflags.yml +++ b/nursery/check-processdebugflags.yml @@ -5,7 +5,7 @@ rule: author: michael.hunhoff@fireeye.com scope: basic block mbc: - - Anti-Behavioral Analysis::Detect Debugger + - Anti-Behavioral Analysis::Debugger Detection references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQueryInformationProcess_ProcessDebugFlags.cpp features: diff --git a/nursery/check-processdebugport.yml b/nursery/check-processdebugport.yml index 0a21452a..35dccc73 100644 --- a/nursery/check-processdebugport.yml +++ b/nursery/check-processdebugport.yml @@ -5,7 +5,7 @@ rule: author: michael.hunhoff@fireeye.com scope: basic block mbc: - - Anti-Behavioral Analysis::Detect Debugger + - Anti-Behavioral Analysis::Debugger Detection references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQueryInformationProcess_ProcessDebugPort.cpp features: diff --git a/nursery/check-systemkerneldebuggerinformation.yml b/nursery/check-systemkerneldebuggerinformation.yml index 731ee560..1cc9fbe8 100644 --- a/nursery/check-systemkerneldebuggerinformation.yml +++ b/nursery/check-systemkerneldebuggerinformation.yml @@ -5,7 +5,7 @@ rule: author: michael.hunhoff@fireeye.com scope: basic block mbc: - - Anti-Behavioral Analysis::Detect Debugger + - Anti-Behavioral Analysis::Debugger Detection references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtQuerySystemInformation_SystemKernelDebuggerInformation.cpp features: diff --git a/nursery/check-thread-yield-allowed.yml b/nursery/check-thread-yield-allowed.yml index 79f2bdab..ef47a4a0 100644 --- a/nursery/check-thread-yield-allowed.yml +++ b/nursery/check-thread-yield-allowed.yml @@ -5,7 +5,7 @@ rule: author: michael.hunhoff@fireeye.com scope: function mbc: - - Anti-Behavioral Analysis::Detect Debugger + - Anti-Behavioral Analysis::Debugger Detection references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/NtYieldExecution.cpp features: diff --git a/nursery/decode-data-using-base64-via-winapi.yml b/nursery/decode-data-using-base64-via-winapi.yml index f5adfb48..ded4a2ef 100644 --- a/nursery/decode-data-using-base64-via-winapi.yml +++ b/nursery/decode-data-using-base64-via-winapi.yml @@ -4,6 +4,8 @@ rule: namespace: data-manipulation/encoding/base64 author: michael.hunhoff@fireeye.com scope: basic block + att&ck: + - Defense Evasion::Deobfuscate/Decode Files or Information [T1140] features: - and: - or: diff --git a/nursery/decrypt-data-via-sspi.yml b/nursery/decrypt-data-via-sspi.yml index d4932ec2..39b30542 100644 --- a/nursery/decrypt-data-via-sspi.yml +++ b/nursery/decrypt-data-via-sspi.yml @@ -5,7 +5,7 @@ rule: author: matthew.williams@fireeye.com scope: basic block att&ck: - - Defense Evasion::Obfuscated Files or Information [T1027] + - Defense Evasion::Deobfuscate/Decode Files or Information [T1140] references: - https://docs.microsoft.com/en-us/windows/win32/api/sspi/nf-sspi-decryptmessage features: diff --git a/nursery/delete-registry-key-via-offline-registry-library.yml b/nursery/delete-registry-key-via-offline-registry-library.yml index 1d5c7a7c..f01e3691 100644 --- a/nursery/delete-registry-key-via-offline-registry-library.yml +++ b/nursery/delete-registry-key-via-offline-registry-library.yml @@ -4,6 +4,8 @@ rule: namespace: host-interaction/registry author: johnk3r scope: function + att&ck: + - Defense Evasion::Modify Registry [T1112] mbc: - Operating System::Registry::Delete Registry Key [C0036.002] - Operating System::Registry::Delete Registry Value [C0036.007] diff --git a/nursery/encode-data-using-base64-via-winapi.yml b/nursery/encode-data-using-base64-via-winapi.yml index d936cb99..b68e2a00 100644 --- a/nursery/encode-data-using-base64-via-winapi.yml +++ b/nursery/encode-data-using-base64-via-winapi.yml @@ -4,6 +4,8 @@ rule: namespace: data-manipulation/encoding/base64 author: moritz.raabe@fireeye.com scope: basic block + att&ck: + - Defense Evasion::Obfuscated Files or Information [T1027] features: - and: - number: 1 = CRYPT_STRING_BASE64 diff --git a/nursery/enumerate-network-shares.yml b/nursery/enumerate-network-shares.yml index efaa7392..18372279 100644 --- a/nursery/enumerate-network-shares.yml +++ b/nursery/enumerate-network-shares.yml @@ -4,6 +4,8 @@ rule: namespace: host-interaction/network author: michael.hunhoff@fireeye.com scope: function + att&ck: + - Discovery::Network Share Discovery [T1135] features: - and: - or: diff --git a/nursery/get-user-security-identifier.yml b/nursery/get-user-security-identifier.yml index f3d3c16b..9c1d7208 100644 --- a/nursery/get-user-security-identifier.yml +++ b/nursery/get-user-security-identifier.yml @@ -5,6 +5,8 @@ rule: namespace: host-interaction/sid author: michael.hunhoff@fireeye.com scope: basic block + att&ck: + - Discovery::Account Discovery [T1087] features: - or: - api: advapi32.LookupAccountName diff --git a/nursery/reference-processor-manufacturer-constants.yml b/nursery/reference-processor-manufacturer-constants.yml index fc513d36..d5166299 100644 --- a/nursery/reference-processor-manufacturer-constants.yml +++ b/nursery/reference-processor-manufacturer-constants.yml @@ -7,7 +7,7 @@ rule: att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] mbc: - - Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check + - Anti-Behavioral Analysis::Virtual Machine Detection::Instruction Testing - CPUID [B0009.034] references: - https://en.wikipedia.org/wiki/CPUID features: diff --git a/nursery/reference-the-vmware-io-port.yml b/nursery/reference-the-vmware-io-port.yml index de66db5f..ea100926 100644 --- a/nursery/reference-the-vmware-io-port.yml +++ b/nursery/reference-the-vmware-io-port.yml @@ -7,7 +7,7 @@ rule: att&ck: - Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001] mbc: - - Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check + - Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - I/O Communication Port [B0009.025] features: - and: - mnemonic: in