mbc-markdown

KO | EN

gitlite — search

#python #hacktoberfest #react #ai #typescript #llm #golang #go #linux #nodejs #java #cli #kubernetes #ios

(★ 568)

MBC content in markdown

File Explorer

Download Latest Version (.zip)

- capture-evasion.md
- debugger-detection.md
- debugger-evasion.md
- dynamic-analysis-evasion.md
- emulator-detection.md
- emulator-evasion.md
- memory-dump-evasion.md
- README.md
- sandbox-detection.md
- virtual-machine-detection.md
- call-graph-generation-evasion.md
- data-flow-analysis-evasion.md
- disassembler-evasion.md
- executable-code-obfuscation.md
- executable-code-optimization.md
- executable-code-virtualization.md
- README.md
- software-packing.md
- archive-collected-data.md
- cryptocurrency.md
- input-capture.md
- keylogging.md
- README.md
- screen-capture.md
- c2-communication.md
- domain-name-generation.md
- ingress-tool-transfer.md
- README.md
- README.md
- alternative-installation-location.md
- bootkit.md
- bypass-data-execution-prevention.md
- covert-location.md
- disable-or-evade-security-tools.md
- hidden-files-and-directories.md
- hide-artifacts.md
- hijack-execution-flow.md
- indicator-blocking.md
- install-insecure-or-malicious-configuration.md
- modify-registry.md
- obfuscated-files-or-information.md
- polymorphic-code.md
- process-injection.md
- README.md
- rootkit.md
- self-deletion.md
- analysis-tool-discovery.md
- application-window-discovery.md
- code-discovery.md
- file-and-directory-discovery.md
- README.md
- self-discovery.md
- smtp-connection-discovery.md
- system-information-discovery.md
- taskbar-discovery.md
- command-and-scripting-interpreter.md
- conditional-execution.md
- execution-dependency.md
- exploitation-for-client-execution.md
- install-additional-program.md
- prevent-concurrent-execution.md
- README.md
- remote-commands.md
- send-email.md
- send-poisoned-text-message.md
- system-services.md
- user-execution.md
- automated-exfiltration.md
- README.md
- clipboard-modification.md
- compromise-data-integrity.md
- data-destruction.md
- data-encrypted-for-impact.md
- denial-of-service.md
- destroy-hardware.md
- disk-wipe.md
- exploit-kit.md
- generate-traffic-from-victim.md
- manipulate-network-traffic.md
- modify-hardware.md
- README.md
- remote-access.md
- resource-hijacking.md
- spamming.md
- README.md
- supply-chain-compromise.md
- - dns-communication.md
  - ftp-communication.md
  - http-communication.md
  - icmp-communication.md
  - interprocess-communication.md
  - README.md
  - smtp-communication.md
  - socket-communication.md
  - wininet.md
- - crypto-algorithm.md
  - crypto-constant.md
  - crypto-library.md
  - cryptographic-hash.md
  - decrypt-data.md
  - encrypt-data.md
  - encryption-key.md
  - generate-pseudorandom-sequence.md
  - hashed-message-authentication-code.md
  - README.md
- - check-string.md
  - checksum.md
  - compress-data.md
  - compression-library.md
  - decode-data.md
  - decompress-data.md
  - encode-data.md
  - modulo.md
  - noncryptographic-hash.md
  - README.md
  - use-constant.md
- - alter-file-extension.md
  - copy-file.md
  - create-directory.md
  - create-file.md
  - delete-directory.md
  - delete-file.md
  - get-file-attributes.md
  - move-file.md
  - read-file.md
  - read-virtual-disk.md
  - README.md
  - set-file-attributes.md
  - writes-file.md
- - install-driver.md
  - load-driver.md
  - README.md
  - simulate-hardware.md
- - allocate-memory.md
  - change-memory-protection.md
  - free-memory.md
  - heap-spray.md
  - overflow-buffer.md
  - README.md
  - stack-pivot.md
- - console.md
  - environment-variable.md
  - README.md
  - registry.md
  - wallpaper.md
- - allocate-thread-local-storage.md
  - check-mutex.md
  - create-mutex.md
  - create-process.md
  - create-thread.md
  - enumerate-threads.md
  - open-process.md
  - open-thread.md
  - README.md
  - resume-thread.md
  - set-thread-context.md
  - set-thread-local-storage-value.md
  - suspend-thread.md
  - terminate-process.md
  - terminate-thread.md
  - unmap-section-view.md
  - write-process-memory.md
- README.md
- component-firmware.md
- kernel-modules-and-extensions.md
- malicious-network-driver.md
- modify-existing-service.md
- README.md
- registry-run-keys-startup-folder.md
- shutdown-event.md
- install-certificate.md
- README.md
- - Conti_Process_Hollowing.afb
  - Conti_Process_Hollowing.json
  - Conti_Process_Hollowing.png
  - SearchAwesome_Adware.afb
  - SearchAwesome_Adware.json
  - SearchAwesome_Adware.png
  - Shamoon.afb
  - Shamoon.json
  - Shamoon.png
- adwind-jrat.md
- attor.md
- badusb.md
- bagle.md
- blackenergy.md
- chopstick.md
- clipminer.md
- conficker.md
- conti.md
- cozycar.md
- cryptolocker.md
- cryptowall.md
- dark-comet.md
- dnschanger.md
- drovorub.md
- dyepack.md
- electrorat.md
- emotet.md
- evilbunny.md
- gamut.md
- geneio.md
- gobotkr.md
- gravity-rat.md
- heriplor.md
- hupigon.md
- kovter.md
- kraken.md
- locky-bart.md
- malware-types.md
- matanbuchus.md
- mazarbot.md
- mebromi.md
- netwalker.md
- poison-ivy.md
- README.md
- redhip.md
- rombertik.md
- samsam.md
- searchawesome.md
- shamoon.md
- snake.md
- stuxnet.md
- synful-knock.md
- teardrop.md
- terminator.md
- trickbot.md
- up007.md
- ursnif.md
- vobfus.md
- wannacry.md
- webcobra.md
- yispecter.md
- mbc_matrix_with_ids.svg
- mbc_matrix_without_ids.svg
- pafish.md
- README.md
- references_to_mbc.md
- 03152023.md
- 05012024.md
- 06152023.md
- 09092022.md
- 09152023.md
- 12092024.md
- 12152022.md
- 12182023.md
- README.md
- - stix2viz.js
- README.md
capa.md
cape.md
CITATION.cff
mbc_summary.md
README.md
revoked.md
tou.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# <a name="mbc"></a>Malware Behavior Catalog v3.1 #
The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions, and read the [newsletters](./ynewsletters/README.md) for information on the most recent MBC updates and activity.

Open-source malware analysis tools map their output to MBC and ATT&CK:

* [capa](https://github.com/fireeye/capa-rules) - see the [capa rule mapping distribution](./capa.md)
* [CAPE](https://github.com/kevoreilly/community/tree/master/modules/signatures) - see the [CAPE signature mapping distribution](./cape.md)

MBC supports other community efforts:

* [CACAO](https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cacao) - a [playbook](https://github.com/oasis-tcs/cacao/tree/master/Examples/CACAO-2.0) for the MBC corpus malware [Locky Bart](./xample-malware/locky-bart.md) shows how CACAO can reference MBC behaviors.
* [Attack Flow](https://github.com/center-for-threat-informed-defense/attack-flow/tree/main/corpus) - flow diagrams for the MBC corpus malware [Shamoon](./xample-malware/shamoon.md) and [SearchAwesome](./xample-malware/searchawesome.md) illustrate how Attack Flow can reference MBC behaviors.

Check out MBC presentations:

* [Standardized Reporting with the Malware Behavior Catalog](https://youtu.be/qZef-SoREdY), VB2020 localhost (October 2020)
* [Malware Behavior Catalog](https://youtu.be/KY8Ty-0sdVU), BSides DC (October 2019)

To join the **MBC mailing list**, please send a request to mbc@mitre.org.

### Objectives ###
As shown below, malware objectives are based on [ATT&CK tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known objectives and behaviors. Two malware analysis-specific objectives not in ATT&CK are also defined (ANTI-BEHAVIORAL ANALYSIS and ANTI-STATIC ANALYSIS).

### Behaviors ###
Under each objective, MBC captures all behaviors and code characteristics discovered during malware analysis, with links to [ATT&CK techniques](https://attack.mitre.org/techniques/enterprise/) as appropriate. Names of MBC behaviors may or may not match related ATT&CK techniques. Any content provided on behavior pages is *supplemental* to ATT&CK content. In other words, ATT&CK content is not duplicated in MBC, and MBC users will reference ATT&CK while capturing malware behaviors.

### Methods ###
Methods are associated with behaviors and serve different roles, depending on the behavior. In some cases, a method further refines a behavior (i.e., sub-behavior); in other cases, a method is an implementation of a behavior. Previously, methods had no ATT&CK counterpart, but beginning in April 2020, ATT&CK defines sub-techniques, which are similar to methods.

Note that a method cannot be used without a behavior.

### Micro-objectives / Micro-behaviors ###
Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](./micro-behaviors/README.md) for details.

### <a name="ids"></a>Identifiers ###
As shown below, the letter of an identifier relays information about a behavior. Note that letters used in MBC v2 and v3 are changed from MBC v1.

|**Letter**|**Example**|**Description**|
|---|---|---|
|**B**|*B0040*|An MBC behavior.|
|**C**|*C0015*|An MBC micro-behavior.|
|**T**|*T1234*|An ATT&CK technique.|
|**E**|*E1234*|An ATT&CK technique that has been enhanced with malware-specific details. The numerical portion of the identifier will match the ATT&CK ID (e.g., E1234 enhances T1234).|
|**F**|*F0004*|An ATT&CK sub-technique that has been enhanced with malware-specific details.|

Two letters of an identifier relay information about an objective.

|**Letter**|**Example**|**Description**|
|---|---|---|
|**OB**|*OB0001*|An MBC objective.|
|**OC**|*OC0003*|An MBC micro-objective.|

Identifiers of methods are formatted in the same way as ATT&CK sub-techniques. If MBC defines a new method for an existing ATT&CK technique, the identifier is changed from "T" to "E" and an "m" identifier is added (e.g., a method added to T1234 would be denoted *E1234.m01* and is different than *T1234.001*, although both refer to the T1234 ATT&CK technique). Method identifiers of "B", "C", and "F" behaviors are defined without the "m" (e.g., *B0008.009*; *C0005.002*; *F0001.005*).

When two or more MBC behaviors refine the same ATT&CK technique, each is given an MBC identifier and each references the ATT&CK identifier. When a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier is preserved and the new ATT&CK identifier is referenced.

In cases where an MBC behavior enhances a technique/sub-technique that is defined in both ATT&CK Mobile and Enterprise, the "E" identifier used in MBC corresponds to the Enterprise identifier. For example, the Obfuscated Files or Information technique has identifier <a href="https://attack.mitre.org/techniques/T1027/">T1027</a> in Enterprise, identifier <a href="https://attack.mitre.org/techniques/T1406/">T1406</a> in Mobile, and identifier <a href="./defense-evasion/obfuscated-files-or-information.md">E1027</a> in MBC.

### Canonical Representation ###
The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**. For example, *ANTI-BEHAVIORAL ANALYSIS::Debugger Detection::Process Environment Block*.

Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.

### STIX 2.1 Representation ###
A STIX 2.1 representation for MBC v3.1 is available in the [mbc-stix2.1](https://github.com/MBCProject/mbc-stix2.1) repository. It's based on a refined STIX 2.1 [Malware Behavior Extension](https://github.com/oasis-open/cti-stix-common-objects/tree/main/extension-definition-specifications/malware-behavior-8e9) that includes new STIX domain objects for MBC objectives, behaviors, and methods.

### Navigator View ###
This visual representation of the MBC Matrix is based on the ATT&CK Navigator. Two views are available:

* <a href="https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_with_ids.svg" target="_blank">Matrix with identifiers</a>
* <a href="https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_without_ids.svg" target="_blank">Matrix without identifiers</a>

### Malware Corpus ###
The MBC contains a [malware corpus](./xample-malware/README.md) where each malware entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports. Note that some malware types are also present in the ATT&CK software page. We refer readers to the corresponding ATT&CK page for a list of identified ATT&CK techniques. However, we will list any newly identified ATT&CK techniques in the MBC malware page.

## Malware Objective Descriptions ##
Malware objectives are defined in the table below. Follow the links to view associated behaviors.

|**Objective**|**Description**|
|---|---|
|[**Anti-Behavioral Analysis**](./anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis, such as analysis done using a sandbox or debugger.|
|[**Anti-Static Analysis**](./anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult.|
|[**Collection**](./collection/README.md)|Malware aims to identify and gather information from a machine or network.|
|[**Command and Control**](./command-and-control/README.md)|Malware aims to communicate with compromised systems to control them.|
|[**Credential Access**](./credential-access/README.md)|Malware aims to steal account names and passwords.|
|[**Defense Evasion**](./defense-evasion/README.md)|Malware aims to evade detection.|
|[**Discovery**](./discovery/README.md)|Malware aims to gain knowledge about the environment.|
|[**Execution**](./execution/README.md)|Malware aims to execute code on a system.|
|[**Exfiltration**](./exfiltration/README.md)|Malware aims to steal data.|
|[**Impact**](./impact/README.md)|Malware aims to manipulate, interrupt, or destroy systems or data.|
|[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate or otherwise move through an environment. Lateral movement may be active, happening via direct machine access, or may be passive (for example, done via malicious email).|
|[**Persistence**](./persistence/README.md)|Malware aims to remain on a system.|
|[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain higher level permissions.|

## MBC Behaviors ##
The table below lists MBC behaviors and related ATT&CK techniques. In most cases, related ATT&CK techniques were defined *after* the MBC behavior was defined. Please see the [MBC Summary](./mbc_summary.md) for a listing of all MBC content.

|**ID**|**Objective(s)**|**Behavior**|**Related ATT&CK Technique**|
|---|---|---|---|
|**B0001**|ANTI-BEHAVIORAL ANALYSIS|**Debugger Detection**|*none*|
|**B0002**|ANTI-BEHAVIORAL ANALYSIS|**Debugger Evasion**|Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T1622))|
|**B0003**|ANTI-BEHAVIORAL ANALYSIS|**Dynamic Analysis Evasion**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))|
|**B0004**|ANTI-BEHAVIORAL|**Emulator Detection**|*none*|
|**B0005**|ANTI-BEHAVIORAL|**Emulator Evasion**|*none*|
|**B0006**|ANTI-BEHAVIORAL|**Memory Dump Evasion**|*none*|
|**B0007**|ANTI-BEHAVIORAL|**Sandbox Detection**|Virtualization/Sandbox Evasion: System Checks ([T1497.001](https://attack.mitre.org/techniques/T1497/001),[T1633.001](https://attack.mitre.org/techniques/T1633/001)); Virtualization/Sandbox Evasion: User Activity Based Checks ([T1497.002](https://attack.mitre.org/techniques/T1497/002))|
|**B0008**|ANTI-BEHAVIORAL ANALYSIS, ANTI-STATIC ANALYSIS|**Executable Code Virtualization**|*none*|
|**B0009**|ANTI-BEHAVIORAL ANALYSIS|**Virtual Machine Detection**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497),[T1633](https://attack.mitre.org/techniques/T1633))|
|**B0010**|ANTI-STATIC ANALYSIS|**Call Graph Generation Evasion**|*none*|
|**B0011**|EXECUTION|**Remote Commands**|*none*|
|**B0012**|ANTI-STATIC ANALYSIS|**Disassembler Evasion**|*none*|
|**B0013**|DISCOVERY|**Analysis Tool Discovery**|*none*|
|**B0014**|DISCOVERY|**SMTP Connection Discovery**|*none*|
|**B0015**|*not defined*|---|---|
|**B0016**|IMPACT|**Compromise Data Integrity**|Data Manipulation: Stored Data Manipulation ([T1565.001](https://attack.mitre.org/techniques/T1565/001))|
|**B0017**|IMPACT|**Destroy Hardware**|*none*|
|**B0018**|IMPACT|**Resource Hijacking**|Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1496))|
|**B0019**|IMPACT|**Manipulate Network Traffic**|Data Manipulation: Transmitted Data Manipulation ([T1565.002](https://attack.mitre.org/techniques/T1565/002))|
|**B0020**|EXECUTION, LATERAL MOVEMENT|**Send Email**|Phishing ([T1566](https://attack.mitre.org/techniques/T1566))|
|**B0021**|EXECUTION, LATERAL MOVEMENT|**Send Poisoned Email**|*none*|
|**B0022**|IMPACT, PERSISTENCE|**Remote Access**|*none*|
|**B0023**|EXECUTION|**Install Additional Program**|*none*|
|**B0024**|EXECUTION|**Prevent Concurrent Execution**|*none*|
|**B0025**|ANTI-BEHAVIORAL ANALYSIS//EXECUTION|**Conditional Execution**|Execution Guardrails ([T1480](https://attack.mitre.org/techniques/T1480))|
|**B0026**|LATERAL MOVEMENT, PERSISTENCE|**Malicious Network Driver**|*none*|
|**B0027**|DEFENSE EVASION|**Alternative Installation Location**|*none*|
|**B0028**|CREDENTIAL ACCESS|**Cryptocurrency**|*none*|
|**B0029**|DEFENSE EVASION|**Polymorphic Code**|*none*|
|**B0030**|COMMAND AND CONTROL|**Command and Control Communication**|*none*|
|**B0031**|COMMAND AND CONTROL|**Domain Name Generation**|Dynamic Resolution: Domain Name Generation ([T1568.002](https://attack.mitre.org/techniques/T1568/002))|
|**B0032**|ANTI-STATIC ANALYSIS|**Executable Code Obfuscation**|*none*|
|**B0033**|IMPACT|**Denial of Service**|Network Denial of Service ([T1498](https://attack.mitre.org/techniques/T1498))|
|**B0034**|ANTI-STATIC ANALYSIS|**Executable Code Optimization**|*none*|
|**B0035**|PERSISTENCE|**Shutdown Event**|*none*|
|**B0036**|ANTI-BEHAVIORAL ANALYSIS|**Capture Evasion**|*none*|
|**B0037**|DEFENSE EVASION|**Bypass Data Execution Prevention**|*none*|
|**B0038**|DISCOVERY|**Self Discovery**|*none*|
|**B0039**|IMPACT|**Spamming**|*none*|
|**B0040**|DEFENSE EVASION|**Covert Location**|*none*|
|**B0041**|*not defined*|---|---|
|**B0042**|IMPACT|**Modify Hardware**|*none*|
|**B0043**|DISCOVERY|**Taskbar Discovery**|*none*|
|**B0044**|EXECUTION|**Execution Dependency**|*none*|
|**B0045**|ANTI-STATIC ANALYSIS|**Data Flow Analysis Evasion**|*none*|
|**B0046**|DISCOVERY|**Code Discovery**|*none*|
|**B0047**|DEFENSE EVASION, PERSISTENCE|**Install Insecure or Malicious Code**|*none*|

## Citing MBC ##
If you use MBC, please cite it as specified in the [CITATION](./CITATION.cff) file or by using GitHub's sidebar citation widget, which provides both APA and BibTeX formats.

mbc-markdown

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

mbc-markdown

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README