214 lines
6.5 KiB
Markdown
214 lines
6.5 KiB
Markdown
# MITRE ATT&CK Detection Coverage
|
|
|
|
Ghost detection engine coverage mapped to MITRE ATT&CK framework techniques.
|
|
|
|
## Process Injection (T1055)
|
|
|
|
### T1055.001 - Dynamic-link Library Injection
|
|
|
|
- **Detection**: Hook-based injection detection (`hooks.rs`)
|
|
- **Indicators**:
|
|
- SetWindowsHookEx API monitoring
|
|
- Suspicious DLL loading patterns
|
|
- Global hook chain analysis
|
|
- **Confidence**: High (0.8-0.9)
|
|
|
|
### T1055.002 - Portable Executable Injection
|
|
|
|
- **Detection**: Shellcode pattern detection (`shellcode.rs`)
|
|
- **Indicators**:
|
|
- PE headers in private memory regions
|
|
- Meterpreter payload signatures
|
|
- High entropy executable regions
|
|
- **Confidence**: High (0.7-0.9)
|
|
|
|
### T1055.003 - Thread Execution Hijacking
|
|
|
|
- **Detection**: Thread analysis (`thread.rs`, `detection.rs`)
|
|
- **Indicators**:
|
|
- Threads with unusual start addresses
|
|
- High ratio of recently created threads
|
|
- Thread count anomalies
|
|
- **Confidence**: Medium (0.5-0.7)
|
|
|
|
### T1055.004 - Asynchronous Procedure Call
|
|
|
|
- **Detection**: Memory pattern analysis
|
|
- **Indicators**:
|
|
- Suspicious memory layout changes
|
|
- RWX region proliferation
|
|
- Thread creation spikes
|
|
- **Confidence**: Medium (0.4-0.6)
|
|
|
|
### T1055.012 - Process Hollowing
|
|
|
|
- **Detection**: Comprehensive hollowing detection (`hollowing.rs`)
|
|
- **Indicators**:
|
|
- Unmapped main executable image
|
|
- Suspicious memory gaps (>16MB)
|
|
- PE header validation (DOS/NT signatures)
|
|
- Image base mismatches
|
|
- Corrupted PE structures
|
|
- Unusual entry point locations
|
|
- Memory layout anomalies
|
|
- **Confidence**: Very High (0.8-1.0)
|
|
|
|
## Defense Evasion (TA0005)
|
|
|
|
### T1027 - Obfuscated Files or Information
|
|
|
|
- **Detection**: Entropy analysis in shellcode detector
|
|
- **Indicators**:
|
|
- High entropy regions (>7.0 Shannon entropy)
|
|
- Encrypted/packed code patterns
|
|
- **Confidence**: Medium (0.6-0.8)
|
|
|
|
### T1055 - Process Injection (General)
|
|
|
|
- **Detection**: Multi-layered approach across all modules
|
|
- **Indicators**: Combination of all injection-specific indicators
|
|
- **Confidence**: Varies by technique
|
|
|
|
### T1036 - Masquerading
|
|
|
|
- **Detection**: Process metadata analysis
|
|
- **Indicators**:
|
|
- Process name/path mismatches
|
|
- Suspicious parent-child relationships
|
|
- **Confidence**: Low-Medium (0.3-0.6)
|
|
|
|
## Execution (TA0002)
|
|
|
|
### T1106 - Native API
|
|
|
|
- **Detection**: Memory pattern analysis, syscall indicators
|
|
- **Indicators**:
|
|
- Direct syscall usage patterns
|
|
- Unusual API call sequences
|
|
- **Confidence**: Medium (0.5-0.7)
|
|
|
|
### T1055 - Process Injection
|
|
|
|
- **Detection**: Primary focus of Ghost detection engine
|
|
- **Coverage**: Comprehensive across all sub-techniques
|
|
|
|
## Detection Methodology
|
|
|
|
### Heuristic Analysis
|
|
|
|
1. **Memory Layout Analysis**
|
|
- RWX region detection
|
|
- Memory gap analysis
|
|
- Region size anomalies
|
|
|
|
2. **Behavioral Patterns**
|
|
- Thread creation patterns
|
|
- Hook installation monitoring
|
|
- Process lifecycle anomalies
|
|
|
|
3. **Signature Matching**
|
|
- Known shellcode patterns
|
|
- Malware family signatures
|
|
- API usage fingerprints
|
|
|
|
### Confidence Scoring
|
|
|
|
- **0.9-1.0**: Very High - Multiple strong indicators
|
|
- **0.7-0.8**: High - Clear malicious patterns
|
|
- **0.5-0.6**: Medium - Suspicious but may be legitimate
|
|
- **0.3-0.4**: Low - Anomalous but likely false positive
|
|
- **0.0-0.2**: Very Low - Minimal suspicious activity
|
|
|
|
## Coverage Matrix
|
|
|
|
| Technique | Detection Module | Implementation Status | Test Coverage |
|
|
|-----------|------------------|----------------------|---------------|
|
|
| T1055.001 | hooks.rs | ✅ Inline hooks + Linux LD_PRELOAD | ❌ Basic |
|
|
| T1055.002 | shellcode.rs | ⚠️ Heuristic only | ✅ Basic |
|
|
| T1055.003 | thread.rs | ✅ Thread enumeration | ✅ Unit tests |
|
|
| T1055.004 | detection.rs | ⚠️ Heuristic only | ✅ Basic |
|
|
| T1055.012 | hollowing.rs | ✅ PE header validation | ❌ Pending |
|
|
| T1027 | shellcode.rs | ⚠️ Basic patterns | ❌ Pending |
|
|
| T1036 | process.rs | ❌ Not implemented | ❌ Pending |
|
|
| T1106 | detection.rs | ❌ Not implemented | ❌ Pending |
|
|
|
|
**Implementation Status Legend**:
|
|
- ✅ Complete: Full implementation with actual API calls
|
|
- ⚠️ Partial: Heuristic-based or incomplete implementation
|
|
- ❌ Not implemented: Placeholder or missing
|
|
|
|
## Current Implementation Details
|
|
|
|
### What's Actually Implemented
|
|
|
|
1. **Memory Analysis** (memory.rs)
|
|
- Windows: VirtualQueryEx, ReadProcessMemory
|
|
- Linux: /proc/[pid]/maps parsing, /proc/[pid]/mem reading
|
|
- macOS: Not implemented
|
|
|
|
2. **Thread Analysis** (thread.rs)
|
|
- Windows: Thread32First/Next, NtQueryInformationThread, GetThreadTimes
|
|
- Linux: /proc/[pid]/task enumeration, stat parsing
|
|
- macOS: Not implemented
|
|
|
|
3. **Hook Detection** (hooks.rs)
|
|
- Windows: Inline hook detection via JMP pattern scanning
|
|
- Linux: LD_PRELOAD detection, LD_LIBRARY_PATH monitoring, ptrace detection
|
|
- Detects suspicious library loading from /tmp/, /dev/shm/, etc.
|
|
- Does NOT enumerate SetWindowsHookEx chains on Windows
|
|
- No IAT/EAT hook scanning (pattern detection only)
|
|
|
|
4. **Process Hollowing Detection** (hollowing.rs)
|
|
- Windows: Full PE header validation (DOS/NT signatures, image base)
|
|
- Detects corrupted PE structures
|
|
- Detects image base mismatches
|
|
- Memory layout anomaly detection
|
|
- Memory gap analysis
|
|
|
|
5. **Process Enumeration** (process.rs)
|
|
- Windows: CreateToolhelp32Snapshot
|
|
- Linux: /proc filesystem
|
|
- macOS: sysctl KERN_PROC_ALL
|
|
|
|
### What's NOT Implemented
|
|
|
|
- Actual shellcode signature database
|
|
- Entropy analysis for obfuscation detection
|
|
- SetWindowsHookEx chain parsing (Windows)
|
|
- APC injection detection
|
|
- MITRE ATT&CK technique attribution (framework only)
|
|
- process_vm_writev monitoring (Linux)
|
|
|
|
## Future Enhancements
|
|
|
|
### High Priority
|
|
|
|
- **T1055.008** - Ptrace System Calls (Linux) - ✅ Basic detection implemented
|
|
- **T1055.013** - Process Doppelgänging
|
|
- **T1055.014** - VDSO Hijacking (Linux)
|
|
- Shellcode signature database
|
|
|
|
### Medium Priority
|
|
|
|
- **T1134** - Access Token Manipulation
|
|
- SetWindowsHookEx chain enumeration
|
|
- IAT/EAT hook scanning
|
|
- LD_PRELOAD detection (Linux) - ✅ Implemented
|
|
|
|
### Research Areas
|
|
|
|
- Behavioral analysis over time
|
|
- Process relationship analysis
|
|
- Integration with threat intelligence feeds
|
|
|
|
## References
|
|
|
|
- [MITRE ATT&CK Framework](https://attack.mitre.org/)
|
|
- [Process Injection Techniques](https://attack.mitre.org/techniques/T1055/)
|
|
- [Windows Process Injection Research](https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process)
|
|
- [Linux Process Injection](https://blog.sektor7.net/#!res/2018/pure-in-memory-linux.md)
|
|
|
|
---
|
|
|
|
*Coverage updated: November 2024*
|
|
*Next review: December 2024* |