Technique List
| Technique Name | Technique ID's | Categories | Snippet(s) | Rules(s) | OS | Creation Date |
|---|---|---|---|---|---|---|
| WMI Event Subscriptions | U1353 | Sandbox Evasion | 4 weeks | |||
| Removing Commands from SELinux Audit Logs | U0312 | Anti-Forensic | 3 months, 2 weeks | |||
| Deleting Troubleshoot Information and Core Dumps | U0311 | Anti-Forensic | 3 months, 2 weeks | |||
| Manipulating Debug Logs | U0310 | Anti-Forensic | 3 months, 2 weeks | |||
| Clearing Kernel Message | U0309 | Anti-Forensic | 3 months, 2 weeks | |||
| XProtect Encryption Abuse | U0711 | Data Obfuscation | 3 months, 2 weeks | |||
| kernel flag inspection via sysctl | U0135 | Anti-Debugging | 3 months, 2 weeks | |||
| Exfiltration via SMTP | U0912 | Network Evasion | 3 months, 3 weeks | |||
| XBEL Recently Opened Files Check | U1352 | Sandbox Evasion | 3 months, 3 weeks | |||
| Default Windows Wallpaper Check | U1351 | Sandbox Evasion | 4 months, 3 weeks | |||
| Event Triggered Execution: Linux Inotify | U1245 T1546 | Process Manipulating | 5 months, 1 week | |||
| Replication Through Removable Media | U1012 T1091 | Defense Evasion [Mitre], Others | 6 months, 1 week | |||
| VBA Purging | U0524 | Antivirus/EDR Evasion | 7 months, 1 week | |||
| QEMU CPU brand evasion | U1350 | Sandbox Evasion | 7 months, 3 weeks | |||
| bochs CPU oversights evasion | U1349 | Sandbox Evasion | 8 months | |||
| Al-Khaser_WriteWatch | U0134 | Anti-Debugging | 8 months, 1 week | |||
| WinDefAVEmu_goatfiles | U1348 | Sandbox Evasion | 8 months, 1 week | |||
| IPV4/IPV6 Obfuscation | U0710 | Data Obfuscation | 8 months, 1 week | |||
| AppInit DLL Injection | U1244 T1546 | Process Manipulating, Defense Evasion [Mitre] | 8 months, 1 week | |||
| VboxEnumShares | U1347 | Sandbox Evasion | 8 months, 1 week | |||
| Cronos-Crypter | U1437 | Packers | 8 months, 1 week | |||
| Odd Thread Count | U1346 | Sandbox Evasion | 8 months, 1 week | |||
| Hyper-V Signature | U1345 | Sandbox Evasion | 8 months, 1 week | |||
| NtDelayExecution | U1344 U0133 | Sandbox Evasion, Anti-Debugging | 8 months, 1 week | |||
| Runtime Function Decryption | U0523 | Antivirus/EDR Evasion | 1 year, 1 month | |||
| BlockInput | U1011 | Others | 1 year, 1 month | |||
| Retrieve HDD Information | U1343 | Sandbox Evasion | 1 year, 1 month | |||
| BuildCommDCBAndTimeoutA | U1342 T1497.002 | Sandbox Evasion | 1 year, 1 month | |||
| LimeCrypter | U1436 | Packers | 1 year, 3 months | |||
| PyArmor | U1435 | Packers | 1 year, 3 months |