{ "namespace": "maec-malware-behavior", "description": "Malware behaviours based on MAEC 5.0", "version": 1, "predicates": [ { "value": "maec-malware-behavior", "expanded": "MAEC Malware behavior", "uuid": "8cb67136-d312-5aa4-a411-5ad43f400dc5" } ], "values": [ { "predicate": "maec-malware-behavior", "entry": [ { "value": "access-premium-service", "expanded": "access-premium-service", "uuid": "25be82cd-d0ed-5b34-b907-ab5ac87bce5a" }, { "value": "autonomous-remote-infection", "expanded": "autonomous-remote-infection", "uuid": "e394e622-2b20-573b-bcb0-55e7237e03b3" }, { "value": "block-security-websites", "expanded": "block-security-websites", "uuid": "cd5cfc3d-6d35-5fe4-a9a0-faa8678157fe" }, { "value": "capture-camera-input", "expanded": "capture-camera-input", "uuid": "91b6165a-7836-50d2-bd6a-a7154e57ccf9" }, { "value": "capture-file-system-data", "expanded": "capture-file-system-data", "uuid": "2c962c70-6f8b-596e-9681-9b078774616d" }, { "value": "capture-gps-data", "expanded": "capture-gps-data", "uuid": "d5e88dad-b65a-526e-a1c9-a8af95b52fcc" }, { "value": "capture-keyboard-input", "expanded": "capture-keyboard-input", "uuid": "62a946e1-3abf-5de9-bc64-4386d4c3e560" }, { "value": "capture-microphone-input", "expanded": "capture-microphone-input", "uuid": "5664286a-56f3-5e42-96fd-702c307af6c6" }, { "value": "capture-mouse-input", "expanded": "capture-mouse-input", "uuid": "ff7aeac0-ee7b-59ae-947e-a5853717f488" }, { "value": "capture-printer-output", "expanded": "capture-printer-output", "uuid": "42e1afa8-bdb9-5d4e-87da-bf49f60ba6b3" }, { "value": "capture-system-memory", "expanded": "capture-system-memory", "uuid": "924e1977-8b09-5b02-8e49-1d941a74703a" }, { "value": "capture-system-network-traffic", "expanded": "capture-system-network-traffic", "uuid": "7bf6d472-832d-5738-9514-3fe3214415c4" }, { "value": "capture-system-screenshot", "expanded": "capture-system-screenshot", "uuid": "10ee4118-500a-598e-a518-08e13fab587c" }, { "value": "capture-touchscreen-input", "expanded": "capture-touchscreen-input", "uuid": "a941b43e-1c31-5be7-92bb-22e182d4c7cf" }, { "value": "check-for-payload", "expanded": "check-for-payload", "uuid": "f67b2bab-e4f2-5991-875f-3ebaf97a63a7" }, { "value": "click-fraud", "expanded": "click-fraud", "uuid": "8579f29c-4433-5fe2-970f-d77d1a98c913" }, { "value": "compare-host-fingerprints", "expanded": "compare-host-fingerprints", "uuid": "3928caf0-a942-5314-9e0a-3c0ee7a89910" }, { "value": "compromise-remote-machine", "expanded": "compromise-remote-machinen", "uuid": "74f4f083-b2c8-5079-bd81-9acfbafce6d1" }, { "value": "control-local-machine-via-remote-command", "expanded": "control-local-machine-via-remote-command", "uuid": "f3391dfb-99eb-57da-9dd2-719ae65032c3" }, { "value": "control-malware-via-remote-command", "expanded": "control-malware-via-remote-command", "uuid": "0dcb7966-f830-52c4-be28-04a99aae7bba" }, { "value": "crack-passwords", "expanded": "crack-passwords", "uuid": "0b9f79b6-fc4b-5b09-90e8-220e0d9b15e2" }, { "value": "defeat-call-graph-generation", "expanded": "defeat-call-graph-generation", "uuid": "8e19a480-0106-5582-beed-ccc8f880fbd8" }, { "value": "defeat-emulator", "expanded": "defeat-emulator", "uuid": "3388cbd9-3de9-54d6-8f78-ef326ce30021" }, { "value": "defeat-flow-oriented-disassembler", "expanded": "defeat-flow-oriented-disassembler", "uuid": "9297120a-4bf3-5d8a-a970-f9b15af9b2fc" }, { "value": "defeat-linear-disassembler", "expanded": "defeat-linear-disassembler", "uuid": "e176078f-7788-5149-9be6-2b9ca7d39e9a" }, { "value": "degrade-security-program", "expanded": "degrade-security-program", "uuid": "a1e5a91e-18aa-5f4d-ae03-1914faa3eeec" }, { "value": "denial-of-service", "expanded": "denial-of-service", "uuid": "5eb8dd65-de01-59dc-90e0-bdffffd61472" }, { "value": "destroy-hardware", "expanded": "destroy-hardware", "uuid": "e9302db8-c213-5de6-81ed-a86d0fa472df" }, { "value": "detect-debugging", "expanded": "detect-debugging", "uuid": "3b2fd531-05f7-529d-88d2-7234c0d8676b" }, { "value": "detect-emulator", "expanded": "detect-emulator", "uuid": "de2db94f-a496-5af5-815d-9ed2b67a5c86" }, { "value": "detect-installed-analysis-tools", "expanded": "detect-installed-analysis-tools", "uuid": "42db9b98-991f-5833-9a15-508fbeb5f9ec" }, { "value": "detect-installed-av-tools", "expanded": "detect-installed-av-tools", "uuid": "81d6040a-6b82-5a3a-a8aa-e6215ef28c04" }, { "value": "detect-sandbox-environment", "expanded": "detect-sandbox-environment", "uuid": "6c735b2a-eecb-5695-bfef-984d1b85abb3" }, { "value": "detect-vm-environment", "expanded": "detect-vm-environment", "uuid": "4f506828-0c10-515b-a4d0-67344bab2bf0" }, { "value": "determine-host-ip-address", "expanded": "determine-host-ip-address", "uuid": "e094e512-b9a5-5f84-9091-ef57d2ea9930" }, { "value": "disable-access-rights-checking", "expanded": "disable-access-rights-checking", "uuid": "ce77bd4d-7006-5611-a345-56844112d856" }, { "value": "disable-firewall", "expanded": "disable-firewall", "uuid": "3bdb2b7e-e9b0-547d-bbcb-8a4b42ff1759" }, { "value": "disable-kernel-patch-protection", "expanded": "disable-kernel-patch-protection", "uuid": "b617b8ea-5db3-5b82-b560-8ded0847a6a3" }, { "value": "disable-os-security-alerts", "expanded": "disable-os-security-alerts", "uuid": "4107f630-e51a-5556-94af-8527802bfad7" }, { "value": "disable-privilege-limiting", "expanded": "disable-privilege-limiting", "uuid": "3aacc488-f29a-5499-ad6e-91d4bc9d7e7c" }, { "value": "disable-service-pack-patch-installation", "expanded": "disable-service-pack-patch-installation", "uuid": "cef82a8e-0736-5d66-a674-41d98625427e" }, { "value": "disable-system-file-overwrite-protection", "expanded": "disable-system-file-overwrite-protection", "uuid": "d542b504-f640-5f9e-8997-393a0730c999" }, { "value": "disable-update-services-daemons", "expanded": "disable-update-services-daemons", "uuid": "890a37f8-c5e1-59db-a329-969b640c37c5" }, { "value": "disable-user-account-control", "expanded": "disable-user-account-control", "uuid": "ae7befbf-7970-53bc-82e5-f17f34f8760e" }, { "value": "drop-retrieve-debug-log-file", "expanded": "drop-retrieve-debug-log-file", "uuid": "f96c6ba8-d006-5da9-b8b7-44005fce6735" }, { "value": "elevate-privilege", "expanded": "elevate-privilege", "uuid": "14ff92b8-7e6d-55f2-9169-c436791584a4" }, { "value": "encrypt-data", "expanded": "encrypt-data", "uuid": "832a8a47-1295-564f-a523-f2cd75a1873d" }, { "value": "encrypt-files", "expanded": "encrypt-files", "uuid": "967b7ed0-8e2a-5b70-9de3-2c8395972df0" }, { "value": "encrypt-self", "expanded": "encrypt-self", "uuid": "5eb393dd-7e15-5701-bace-0da4c751281c" }, { "value": "erase-data", "expanded": "erase-data", "uuid": "0c609b84-b79d-58e7-b5d2-dcd1208107d3" }, { "value": "evade-static-heuristic", "expanded": "evade-static-heuristic", "uuid": "0df24778-e828-55b7-8078-a349e8da7a4e" }, { "value": "execute-before-external-to-kernel-hypervisor", "expanded": "execute-before-external-to-kernel-hypervisor", "uuid": "3f3f6912-9faa-52c5-9922-b2e417b4e180" }, { "value": "execute-non-main-cpu-code", "expanded": "execute-non-main-cpu-code", "uuid": "f7352717-bd59-5723-9eb7-939085ec1f51" }, { "value": "execute-stealthy-code", "expanded": "execute-stealthy-code", "uuid": "a0b66ebe-511f-5aca-9ca3-c01c2bddf4b2" }, { "value": "exfiltrate-data-via-covert channel", "expanded": "exfiltrate-data-via-covert channel", "uuid": "92b1636d-d852-5ea2-8151-b7825e46f02d" }, { "value": "exfiltrate-data-via--dumpster-dive", "expanded": "exfiltrate-data-via-dumpster-dives", "uuid": "c241d2eb-6894-500d-99fc-151afb350f16" }, { "value": "exfiltrate-data-via-fax", "expanded": "exfiltrate-data-via-fax", "uuid": "df61430f-cf6a-50cd-9bcb-273ab7765218" }, { "value": "exfiltrate-data-via-network", "expanded": "exfiltrate-data-via-network", "uuid": "a45ee092-fcb5-52ef-9261-3770b8a9d7df" }, { "value": "exfiltrate-data-via-physical-media", "expanded": "exfiltrate-data-via-physical-media", "uuid": "3f2348f8-5587-534b-8dee-cc004977691f" }, { "value": "exfiltrate-data-via-voip-phone", "expanded": "exfiltrate-data-via-voip-phone", "uuid": "974a8641-5fbd-5dc9-83ec-7fd9ccf45817" }, { "value": "feed-misinformation-during-physical-memory-acquisition", "expanded": "feed-misinformation-during-physical-memory-acquisition", "uuid": "95b87d61-75a4-55a5-96ab-2dc6e0110718" }, { "value": "file-system-instantiation", "expanded": "file-system-instantiation", "uuid": "9b26f41d-b94b-5d9e-afad-a3b820df5bff" }, { "value": "fingerprint-host", "expanded": "fingerprint-host", "uuid": "ddf8ea6f-047a-5635-aa22-3d5e981eea3a" }, { "value": "generate-c2-domain-names", "expanded": "generate-c2-domain-names", "uuid": "ad42e755-bfea-5591-8f16-672d6dd212d4" }, { "value": "hide-arbitrary-virtual-memory", "expanded": "hide-arbitrary-virtual-memory", "uuid": "f5f466cd-088b-5c99-8f8e-b48c275a0fcb" }, { "value": "hide-data-in-other-formats", "expanded": "hide-data-in-other-formats", "uuid": "a99c246c-8210-5288-8698-dff2079ac499" }, { "value": "hide-file-system-artifacts", "expanded": "hide-file-system-artifacts", "uuid": "80564f6c-c88b-5452-acfa-32aada92116f" }, { "value": "hide-kernel-modules", "expanded": "hide-kernel-modules", "uuid": "46067c88-8047-5efa-b5f4-879c5c5acc29" }, { "value": "hide-network-traffic", "expanded": "hide-network-traffic", "uuid": "9e96bce2-6433-59d0-a35f-a4b5f96ac0a2" }, { "value": "hide-open-network-ports", "expanded": "hide-open-network-ports", "uuid": "d5e12fe8-7cfc-5e84-a501-d6b2612421b3" }, { "value": "hide-processes", "expanded": "hide-processes", "uuid": "d826f596-2d4e-578f-8e47-629c535276fc" }, { "value": "hide-services", "expanded": "hide-services", "uuid": "06ca22c6-bc41-5790-bc7b-63de642cf0d8" }, { "value": "hide-threads", "expanded": "hide-threads", "uuid": "4778448f-9082-5acc-8f00-b3979cbb4669" }, { "value": "hide-userspace-libraries", "expanded": "hide-userspace-libraries", "uuid": "0cb0c26a-b465-5d6e-805d-9485f4cb7629" }, { "value": "identify-file", "expanded": "identify-file", "uuid": "e6989427-3dfe-5e6d-be62-905bdf4d2f58" }, { "value": "identify-os", "expanded": "identify-os", "uuid": "18d20db5-5126-5ff0-bbb8-962abef84236" }, { "value": "identify-target-machines", "expanded": "identify-target-machines", "uuid": "d01bf781-bd51-5c0b-a954-64dd3f5d6bd5" }, { "value": "impersonate-user", "expanded": "impersonate-user", "uuid": "a05c71fb-ff1b-555d-a4c4-13b80f7e7f3d" }, { "value": "install-backdoor", "expanded": "install-backdoor", "uuid": "9fd03366-2c3a-52c9-84d2-d43d49cd1a17" }, { "value": "install-legitimate-software", "expanded": "install-legitimate-software", "uuid": "4662a202-fd89-5c23-970c-697819fc814f" }, { "value": "install-secondary-malware", "expanded": "install-secondary-malware", "uuid": "16177c2a-8abc-53d8-9e13-4719249119d7" }, { "value": "install-secondary-module", "expanded": "install-secondary-module", "uuid": "de4daa4f-8cd5-5d2a-95fc-4ccad18f6226" }, { "value": "intercept-manipulate-network-traffic", "expanded": "intercept-manipulate-network-traffic", "uuid": "d5d0c06c-c460-5411-a048-6ea516dd5710" }, { "value": "inventory-security-products", "expanded": "inventory-security-products", "uuid": "aa87c692-b08f-5b8e-9030-2d04f746f836" }, { "value": "inventory-system-applications", "expanded": "inventory-system-applications", "uuid": "5b8aff87-31d8-5b28-928f-8b170e7341d8" }, { "value": "inventory-victims", "expanded": "inventory-victims", "uuid": "19f325c1-3a88-596d-b454-14393d5003d9" }, { "value": "limit-application-type-version", "expanded": "limit-application-type-version", "uuid": "9aa97ef4-577e-5112-97ab-7d4bad306ed5" }, { "value": "log-activity", "expanded": "log-activity", "uuid": "37880ee3-fe62-53f1-9abe-76503ced0c7d" }, { "value": "manipulate-file-system-data", "expanded": "manipulate-file-system-data", "uuid": "fb5aa5cb-de69-59b7-8780-e79a218711f0" }, { "value": "map-local-network", "expanded": "map-local-network", "uuid": "f1ca8db0-8c59-5986-aa2c-fd2ecbfc0bd0" }, { "value": "mine-for-cryptocurrency", "expanded": "mine-for-cryptocurrency", "uuid": "e10d0dc0-d590-5d1c-8521-c6174c3ec3cc" }, { "value": "modify-file", "expanded": "modify-file", "uuid": "407bdbd8-a588-5d52-bc2d-24ae2e8a2c41" }, { "value": "modify-security-software-configuration", "expanded": "modify-security-software-configuration", "uuid": "28c1234d-46e9-5bbf-92b3-1c372110aeec" }, { "value": "move-data-to-staging-server", "expanded": "move-data-to-staging-server", "uuid": "d526f241-8f8b-588e-9521-a67b0a907a35" }, { "value": "obfuscate-artifact-properties", "expanded": "obfuscate-artifact-properties", "uuid": "bfdeead2-896d-5268-a419-5ba0d20ef1f3" }, { "value": "overload-sandbox", "expanded": "overload-sandbox", "uuid": "5254678b-c046-524b-accc-1fbbb3d609c6" }, { "value": "package-data", "expanded": "package-data", "uuid": "e453f4df-38cf-578e-9a8f-c635de249603" }, { "value": "persist-after-hardware-changes", "expanded": "persist-after-hardware-changes", "uuid": "187edadb-4500-5e83-8aaf-9a8e90eb7074" }, { "value": "persist-after-os-changes", "expanded": "persist-after-os-changes", "uuid": "b2837fb5-91c5-5e8d-89bc-328e49434284" }, { "value": "persist-after-system-reboot", "expanded": "persist-after-system-reboot", "uuid": "95a74b89-2442-5da1-b9f1-c1218323f4b2" }, { "value": "prevent-api-unhooking", "expanded": "prevent-api-unhooking", "uuid": "c250a25f-c616-5ed4-abb9-f1cd2ba0204a" }, { "value": "prevent-concurrent-execution", "expanded": "prevent-concurrent-execution", "uuid": "8ef488a3-2d5b-5461-9135-14d9c4b667a7" }, { "value": "prevent-debugging", "expanded": "prevent-debugging", "uuid": "8389e030-83ff-5a7a-89d3-8861ac2f592c" }, { "value": "prevent-file-access", "expanded": "prevent-file-access", "uuid": "395f2cac-ad3b-558e-80bd-d158cbfbcc58" }, { "value": "prevent-file-deletion", "expanded": "prevent-file-deletion", "uuid": "9dc2ee3f-e93c-5b54-a396-702383f58205" }, { "value": "prevent-memory-access", "expanded": "prevent-memory-access", "uuid": "c0ad3251-5ab6-5578-819f-87b68e73712e" }, { "value": "prevent-native-api-hooking", "expanded": "prevent-native-api-hooking", "uuid": "629efba9-25bf-5d65-bb3e-c51e88ef594b" }, { "value": "prevent-physical-memory-acquisition", "expanded": "prevent-physical-memory-acquisition", "uuid": "12c231db-b019-5a04-a53c-528ea2589860" }, { "value": "prevent-registry-access", "expanded": "prevent-registry-access", "uuid": "54d020ec-fc0b-5aa9-a1af-748327d83eca" }, { "value": "prevent-registry-deletion", "expanded": "prevent-registry-deletion", "uuid": "2bb5785e-cea8-5eeb-a2b9-9f595f8c6bd4" }, { "value": "prevent-security-software-from-executing", "expanded": "prevent-security-software-from-executing", "uuid": "42e56f0d-9b28-5fa9-9b5a-f1fce112367b" }, { "value": "re-instantiate-self", "expanded": "re-instantiate-self", "uuid": "9854dd9a-2c6a-5143-9a69-fa654780246c" }, { "value": "remove-self", "expanded": "remove-self", "uuid": "2cfb0312-a204-5c78-a027-6e00fa48ea2a" }, { "value": "remove-sms-warning-messages", "expanded": "remove-sms-warning-messages", "uuid": "c5c3fac7-186d-58e1-aa20-9b181770db82" }, { "value": "remove-system-artifacts", "expanded": "remove-system-artifacts", "uuid": "b08db6e5-2544-5f93-b8a8-ce90d534abb8" }, { "value": "request-email-address-list", "expanded": "request-email-address-list", "uuid": "c61ede94-935e-58a4-9239-2b7a28c94d4a" }, { "value": "request-email-template", "expanded": "request-email-template", "uuid": "23ba2f99-60fc-59da-bd66-3c546a26af0a" }, { "value": "search-for-remote-machines", "expanded": "search-for-remote-machines", "uuid": "c149798d-bf8d-5417-af15-aa3a60bbdde6" }, { "value": "send-beacon", "expanded": "send-beacon", "uuid": "12eaf354-158e-5774-84a7-b522db8c3f1d" }, { "value": "send-email-message", "expanded": "send-email-message", "uuid": "6f76c03c-1e21-5e9f-9621-a8b86946bb0c" }, { "value": "social-engineering-based-remote-infection", "expanded": "social-engineering-based-remote-infection", "uuid": "7af380a5-cdee-5b03-bdbf-c3f7433688ed" }, { "value": "steal-browser-cache", "expanded": "steal-browser-cache", "uuid": "a066e256-65c0-5cd9-b1ac-c3e55ab466d5" }, { "value": "steal-browser-cookies", "expanded": "steal-browser-cookies", "uuid": "89d51496-bbf3-5d4f-b6ec-57409605d833" }, { "value": "steal-browser-history", "expanded": "steal-browser-history", "uuid": "4a5051c1-e31d-5ff1-af92-e302dd2e939d" }, { "value": "steal-contact-list-data", "expanded": "steal-contact-list-data", "uuid": "b7970f3f-dd49-5fc1-845f-d7e2880b6ba1" }, { "value": "steal-cryptocurrency-data", "expanded": "steal-cryptocurrency-data", "uuid": "5b9a230c-96b1-5347-871f-d55803565645" }, { "value": "steal-database-content", "expanded": "steal-database-content", "uuid": "8a85978a-d8fd-588a-9cec-2dfe577fd9ae" }, { "value": "steal-dialed-phone-numbers", "expanded": "steal-dialed-phone-numbers", "uuid": "1c258621-158a-580d-9cb1-c64f25d7fe15" }, { "value": "steal-digital-certificates", "expanded": "steal-digital-certificates", "uuid": "4ab33de5-7c35-582c-9487-7e48fcc9703d" }, { "value": "steal-documents", "expanded": "steal-documents", "uuid": "3a37bedf-6b6c-5c81-8314-fb5cd5bc1cc3" }, { "value": "steal-email-data", "expanded": "steal-email-data", "uuid": "180d4fe7-1369-53a0-8070-21c57e263820" }, { "value": "steal-images", "expanded": "steal-images", "uuid": "a647bbcc-c1c0-5976-b445-cf18aa1584d8" }, { "value": "steal-password-hashes", "expanded": "steal-password-hashes", "uuid": "9e003fe6-a873-5f03-9c5b-4eead3d82217" }, { "value": "steal-pki-key", "expanded": "steal-pki-key", "uuid": "78a11a02-d4a8-53de-9204-edb43d720355" }, { "value": "steal-referrer-urls", "expanded": "steal-referrer-urls", "uuid": "714ebb54-69e1-595d-a4e8-38d4902ee7a2" }, { "value": "steal-serial-numbers", "expanded": "steal-serial-numbers", "uuid": "7ace6ea5-4e1d-5576-aa5e-fe92e7354a21" }, { "value": "steal-sms-database", "expanded": "steal-sms-database", "uuid": "52449b3d-460a-598f-b3af-9ff5c2a64316" }, { "value": "steal-web-network-credential", "expanded": "steal-web-network-credential", "uuid": "80247d50-eef4-55f6-bb9a-4d3c9d6c221c" }, { "value": "stop-execution-of-security-software", "expanded": "stop-execution-of-security-software", "uuid": "dc7d35ed-0ba2-56d3-a7e5-7f4224dd44c4" }, { "value": "suicide-exit", "expanded": "suicide-exit", "uuid": "329bd663-ac6b-583e-9efd-2396e2c218d9" }, { "value": "test-for-firewall", "expanded": "test-for-firewall", "uuid": "9eafe92c-33e4-5518-8505-4c2dbf2ab79b" }, { "value": "test-for-internet-connectivity", "expanded": "test-for-internet-connectivity", "uuid": "db1b99ee-c7c2-5f60-a37e-f47885b7b37e" }, { "value": "test-for-network-drives", "expanded": "test-for-network-drives", "uuid": "4feb6a75-59b8-5eaf-b19d-49a33cd62175" }, { "value": "test-for-proxy", "expanded": "test-for-proxy", "uuid": "dc02559a-4217-579f-bef3-59962aea95cc" }, { "value": "test-smtp-connection", "expanded": "test-smtp-connection", "uuid": "98c8d97c-acdf-5ab1-aba0-83d5aba06763" }, { "value": "update-configuration", "expanded": "update-configuration", "uuid": "d4d4a19a-ed2f-5620-887e-79aad3c787ed" }, { "value": "validate-data", "expanded": "validate-data", "uuid": "1972aef8-aac5-5dec-9373-30e0af5f6361" }, { "value": "write-code-into-file", "expanded": "write-code-into-file", "uuid": "e4702ddb-0e7a-5b0c-a5f2-b381a00f54f0" } ] } ], "uuid": "75135f33-bfcb-5606-b7b3-6aea0679d597" }