search

MBCProject / mbc-markdown

MBC content in markdown
359 stars 44 forks source link

Add MBC micro-behavior for thread resume #21

Closed 0x534a closed 3 years ago

0x534a commented 3 years ago

While expanding the capa rule set, I noticed that there is currently no micro-behavior for resuming a thread. Therefore, I suggest to add this micro-behavior to MBC. Malware typically resumes a thread in order to execute previously injected code (e.g. in the course of the process hollowing technique).

This micro-behavior should fit to the Process Micro-objective where similar behavior like creating or terminating a thread is already located.

In the same turn, suspending a thread can also be added analogously as micro-behaviour.

dzbeck commented 3 years ago

@0x534a thanks for the suggestion - added!