Charissa Miller
59 lines
3.6 KiB
JSON
59 lines
3.6 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--9cf76c83-aa2d-4691-95ee-848c53bdeb8a",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"x_mitre_platforms": [
|
|
"Android",
|
|
"iOS"
|
|
],
|
|
"x_mitre_domains": [
|
|
"mobile-attack"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--60623164-ccd8-4508-a141-b5a34820b3de",
|
|
"created": "2019-09-23T13:11:43.694Z",
|
|
"x_mitre_version": "1.0",
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"external_id": "T1520",
|
|
"url": "https://attack.mitre.org/techniques/T1520"
|
|
},
|
|
{
|
|
"source_name": "Data Driven Security DGA",
|
|
"url": "https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/",
|
|
"description": "Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019."
|
|
},
|
|
{
|
|
"source_name": "securelist rotexy 2018",
|
|
"url": "https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/",
|
|
"description": "T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan \u2013 banker and ransomware. Retrieved September 23, 2019."
|
|
}
|
|
],
|
|
"x_mitre_deprecated": false,
|
|
"revoked": true,
|
|
"description": "Adversaries may use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1520) (DGAs) to procedurally generate domain names for command and control communication, and other uses such as malicious application distribution.(Citation: securelist rotexy 2018)\n\nDGAs increase the difficulty for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.",
|
|
"modified": "2022-04-05T20:03:46.788Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"name": "Domain Generation Algorithms",
|
|
"x_mitre_detection": "Detecting dynamically generated domains can be challenging due to the number of different DGA algorithms, constantly evolving malware families, and the increasing complexity of the algorithms. There is a myriad of approaches for detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) CDN domains may trigger these detections due to the format of their domain names. In addition to detecting a DGA domain based on the name, another more general approach for detecting a suspicious domain is to check for recently registered names or for rarely visited domains.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-mobile-attack",
|
|
"phase_name": "command-and-control"
|
|
}
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_tactic_type": [
|
|
"Post-Adversary Device Access"
|
|
],
|
|
"x_mitre_attack_spec_version": "2.1.0",
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
|
|
}
|
|
]
|
|
} |