Expand List of Capabilities/Objectives

ikiril01 commented 10 years ago

We should consider expanding the existing list of Malware Objectives/Capabilities, including with the following (definitions are notional):

Redirection : the malware instance is capable of redirecting web traffic to a specific IP/domain/URL.
DNS Overriding: the malware instance is capable of overriding DNS resolution for a particular domain or set of domains, so that they resolve to some particular IP controlled by the attacker.
Monitor Window Titles: the malware instance is capable of monitoring GUI window names/titles for a particular title or set of titles.

ikiril01 commented 9 years ago

We should also consider including Capabilities/Objectives related to polymorphism, e.g. server-side polymorphism.

ikiril01 commented 9 years ago

Also:

Environmental keying related capabilities and objectives
Behaviors related to hiding files on NTFS via alternate data streams and extended attributes

MAECProject / schemas