INTRODUCTION.

( Intelligent malware isessentially invisible and entirely monolithic, although its behavior involves multiple modules, fragments, segments, seeds, etc., and its operation has the ability to dynamically increase or decrease the number of fragments, modules, etc.). intelligent malware never stops; after one target, it goes after others or even positions itself as a dormant entity in multiple locations. Likewise, it is a powerful cyber-weapon that cyber-attacks everything (it is software, firmware, and hardware in nature; for example, a hard drive has firmware, software, and hardware) and can be either offensive (i.e., designed to perform malicious activities (offensive malware)) or defensive (i.e., designed to execute actions to protect, neutralize, mitigate, inactivate, sterilize, etc., the offensive malware (defensive malware)). Currently, the keys to designing, synthesizing, and implementing intelligent defensive or protective malware (antagonistic and divergent to offensive malware) are being refined using a set of disruptive elements and approaches based on a large and ongoing body of accumulated knowledge, intelligence, and inferences about the offensive (or malicious) malware to be defeated. These elements empowerdefensive malware with capabilities against offensive malware that were previously unimaginable. The basic idea is to transform, transport, and amplify all the functionalities of offensive malware, including predictions based on data intelligence (using Big Data and Data Analytics), AI (Artificial Intelligence; with mechanisms such as machine learning, deep and convolutional neural networks, expert systems, neuromorphic algorithm-chips, deep learning, replicated inference engines, NLP, etc.), VI (Vulnerabilities Intelligence), CTI (Cyber-Threat Intelligence), CTH (Cyber-Threat Hunting), reverse engineering, and so on. The payload of intelligent malware includes a large number of functionalities and capabilities (intelligently dispersed and hidden in the form of seeds, fragments, modules, etc.). It also communicates (over short, medium, and long distances) using subliminal channels with steganography to dynamically add many more (dynamic feature gain as needed). The result is defensive (or protective) malware that neutralizes, inactivates, eliminates, isolates, sterilizes, mitigates, degrades, phagocytizes, nullifies, disables, hunts, blocks, etc., all offensive malware and retrospectively repairs all malicious operations that the offensive malware may have performed. The synthesis and manufacture of intelligent defensive malware is based on a set of approaches, tactics, techniques, procedures, actions, and automated operations guided by playbooks(which allow for the execution of pre-studied and repetitive tasks for robotic performance). Currently, it is not necessary to plan all the moves for inactivating and neutralizing offensive malware. Defensive malware utilizes countless paradigms, architectures, frameworks, tools, and activities, such as game theory, Zero Trust (ZT; thoroughly verify before trusting), (; here, the secret must never leave its owner/sender; the recipient will only work with a public key to that secret), and knowledge bases (dynamic, real-time, expanding databases of TTPs used by offensive malware based on years of continuous observation, which defensive malware uses to neutralize offensive malware). It operates with digital signatures, hashes, nested ciphers, advance inferences, clues, indicators (such as IoCs, etc.), anomalies, suspicious signals, and dissonant manifestations. harmony, etc. Vulnerability scanners only offer a view at a single point in time (vulnerabilities detected at one moment in time will not be those later since others will emerge) and lack the capabilities to predict the future and differentiate between a potential cyber risk and an actual exposure. 

IDENTIFICATION AND NEUTRALIZATION OF TTPs USED BY OFFENSIVE MALWARE.

    Intelligent malware uses a set of  TTPs  ( Tactics, Techniques, and Procedures ) to carry out its operations.  Tactics  are correlated with the phases of a malware cyberattack and  represent the "whys"  of a behavior and  the "reasons"  for executing the actions. An example of a tactical objective of offensive malware is to gain  access to credentials .  Techniques , on the other hand,  represent  "how"  malware will perform a  cyberattack tactic ; for example, malware might use a  "credential dump" technique to gain access to credentials. Within techniques are  sub-techniques  that  more specifically describe  the malware's behavior to achieve a goal; for example, malware might perform a " credential dump" by accessing  the  secrets of the Local Security Authority (LSA). Procedures  , meanwhile,   are the  specific implementation  that malware uses for the techniques and sub-techniques; for example, a procedure could be using  PowerShell  to inject code into  lsass.exe  and perform a "credential dump" action. Each  tactic  uses different techniques and sub-techniques, and each technique and sub-technique employs different procedures.  Defensive malware  is designed to  neutralize  ( through all its processes of  inactivating, sterilizing, disabling, mitigating, disrupting, inhibiting, paralyzing, taking down, disrupting, nullifying, etc.) the TTPs  used by offensive malware.  Defensive malware  operates at all levels, at a high level of abstraction against the TTPs that characterize the intimate and chaotic nature of offensive malware. Below this are the lower (and highly variable) levels of abstraction where operations are performed on hash values, MAC and IP addresses, domain names and  URLs, IoCs (Indicators of Compromise ), file and folder names, etc. The main tactics of offensive malware are: 

1. Initial reconnaissance/probing. This tactic allows for the exploration of targets by analyzing their digital fingerprints and integrates techniques that enable the study, investigation, identification, and selection of targets using active and/or passive reconnaissance. Malware 
2.  This tactic involves shifting sources of compromise and encompasses all the techniques that prepare the activities used to establish the infrastructure required for access and cyber-attack by offensive malware.
3. This tactic involves injecting infectious elements and integrates techniques that enable the transmission of a weapon (of infection) to the target's environment.
4. Social engineering. This tactic encompasses all techniques used to manipulate people (entities, social robots, operational robots, etc.) to perform unsafe actions (with vulnerabilities).
5. Resource development. This tactic allows the offensive malware to attempt to establish resources that it can use to support its operations.
6. Initial Access. This tactic allows offensive malware to attempt to gain access to a victim device, system, or network. The techniques integrated into this tactic represent the vectors the malware uses to gain or achieve an initial position within a target network where it intends to act maliciously. The mission of defensive malware is to neutralize each vector that is attempted to be used. Some techniques used by this tactic are:Drive-by compromise (In this case, the malware gains access to a target system when a user of that system visits an infected website, even via a QR code or shortened URL). External remote services. Valid accounts. Supply chain compromise. Trust relationship. Hardware add-ons. Replication via removable media. Spearphishing attachment. Spearphishing link/Phishing link(Tricks the user into clicking on a link or button in an email, instant message, etc.). “Spearphishing via service” (Tricks the user into running an email attachment). “Exploit Public Facing Application”. “Spearphishing Link Domain Shadowing” are added Malicious host records to an organization's DNS records, then visitors are redirected to those malicious IP addresses). “Malvertising” (Malware is downloaded onto the user's system when they click on an infected advertisement, which can be on any site, even one that appears trustworthy). “LoT (Living off the Land) stealth techniques” (These exploit everything already present on the target devices/systems without needing to download or install any external applications. They are cyberattacks on non-executable files such as Office documents with malicious macros, scripts, and commands. They run in memory, use dual-purpose tools like PowerShell and PsExec, and utilize Windows binaries like WMI to execute malicious code (LOLBins), etc.). 
7. Exploitation. This tactic allows the triggering of infectious mechanisms and encompasses all techniques that allow the exploitation of vulnerabilities in systems, people, devices, services, networks, etc., which can, among other things, lead to the execution of malware code. 
8. Execution. This tactic allows the offensive malware to attempt to execute malicious code and integrates techniques that enable the execution of malware-controlled code on a local or remote system. This tactic is used in conjunction with the "initial access" tactic as a means of code execution once access is obtained and lateral movement to expand access to remote systems on a network. Some techniques of this tactic are: "Rundll32" (Executes DLLs (Dynamic-Link Libraries) via rundll32.exe. This also enables evasion of potential defenses and allows the launch of additional modules. This technique provides a cyberattack vector that is difficult to monitor since it is also used by benign Windows functions). "Execution via API" (The malware launches processes by calling the "CreateProcessA" of the API (Application Programming Interface Windows “PowerShell” (Uses the PowerShell command line for execution.Run PowerShell and call CreateObject to create a Shell object to download and then execute malware. A reverse shell has been observed to be created using several encrypted Shell scripts called through PowerShell.) “WMI (Windows Management Instrumentation)” (This involves accessing WMI to extract information about the operating system or installed anti-malware software. The WMI command line (WMIC) is used in malware execution. WMIC creates processes.) “Service Execution” (Another important execution vector is registering or running as a service. This involves being able to execute remote processes via PsExec.exe. When the “Service Execution” technique directly executes the service, it differs from the “New Service” technique, which is used as a persistence tactic. Some malware uses PowerShell and WMI to execute fileless malware. In the “Service Execution” technique, the malware uses WSCM (Windows Service Control Manager) as a way to execute its code. The malware can execute a binary, command, or script using a method that interacts with Windows Services such as WSCM. This can be done by creating a new service or modifying an existing one. The mission of defensive malware is to intervene to disable or neutralize this execution of malicious code. The “execution” tactic encompasses techniques that allow the execution of code controlled by the malware on a local or remote system.) “CLI (Command-Line Interface)” (Certain malware interacts with the host system using the cmd.exe command-line interface to execute modules. Certain malware invokes cmd.exe to establish a backdoor by creating a TCP reverse shell. Obfuscated command-line arguments are used with cmd.exe to evade signature-based detection measures.) “GUI (Graphical User Interface)”. “WRM (Windows Remote Management)” . “MSHTA”. “Compiled HTML file”. “CMSTP” . “DDE (Dynamic Data Exchange)” . “Space after filename”. “User Execution” (One way to mitigate “execution prevention” is to use “application whitelisting,” which can prevent the execution of executables that mask other files.)
9. Persistence. This tactic allows offensive malware to attempt to maintain its position. It manifests as any access, action, or configuration change to a system that grants the offensive malware a persistent presence on that system. Malware needs to maintain access to systems despite interruptions such as system restarts, session logons, loss of credentials, or other failures that would otherwise require a remote access tool to restart or a backdoor to regain access. There is a long list of mechanisms that malware uses to gain persistence (besides backdoors). For example, the Emotet creates Windows services; the Trickbot relies on scheduled tasks. Other malware exploits vulnerabilities or a lack of validation in the loading of DLLs (Dynamic Link Libraries) or takes advantage of the COM (Component Object Model) by manipulating keys. In the Agent Tesla , the payload is hidden in a PNG file using steganography, and the malware starts based on Windows executing registry keys. Persistent malware has the ability to survive a system reboot, disguise itself as a legitimate component of the compromised system, and so on. This tactic encompasses techniques that enable any access, action, or change to a system, giving malware a persistent presence on the system, network, etc. Some techniques used by this tactic include: "Registry Run Keys" / "Start Folder" (allowing the addition of a startup key to the Windows Registry or Start Folder). “BITS Jobs” (Windows' BITS (Background Intelligent Transfer Service) is a low-bandwidth, asynchronous file transfer mechanism exposed through COM (Component Object Model). BITS is typically used by updaters, messengers, and other applications to operate in the background (using unused bandwidth). Malware can exploit BITS to download, execute, and clean up malicious code after execution. The interface for creating and managing BITS jobs is accessible through PowerShell and the BITSAdmin tool. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.) “Dropping portable executable (PE) files” (Allows direct addition to the Start Folder; a variation of the Start Folder technique). “New Service” (Installs malware as a system service. Creates a new service to run when Windows starts. Uses the CreateServiceA and adds malicious DLLs.) “Scheduled Task” (Malware can exploit the Windows Task Scheduler to schedule tasks to initiate or repeat the execution of malicious code. The Windows Task Scheduler can be accessed, and “schtasks” can be executed directly from the command line. Malware can use a .NET wrapper for the Windows Task Scheduler. The Windows netapi32 library can be used to create a scheduled task. Using “at.exe” and “schtasks.exe” makes it possible to trigger the execution of malicious code on every reboot or every minute.) “Image File Execution Options Injection”(Allows launching a new process by attaching a debugger to a running process.) “Modify Existing Services” (Allows modifying registry keys using reg.exe in HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ or using sc.exe to modify the status of Windows services such as Windows Update.) “Hooking” (The process of intercepting a function is called hooking). “AppInitDLLs” (Allows processes that load user32.dll to also load the malicious DLL). “ASEPs (Auto-Start-Execution Points)” (ASEPs native to common operating systems to maintain access to compromised systems). “Port Knocking” (Malware can use this technique to hide open ports in persistence and C&C tactics. To enable a port, the malware sends a series of attempted connections to a predefined sequence of closed ports. After completing the sequence, the port is often opened by the host-based firewall but can also be implemented by custom software).
10. Privilege escalation. This tactic allows offensive malware to attempt to gain higher permissions and authorizations. It enables actions that allow malware to obtain a higher level of permissions/authorizations on a system or network (to increase control over the infected device, system, or network). Certain actions require a higher level of privilege to operate and are likely necessary at many points throughout an operation. Malware can enter a system with unprivileged access and must exploit system vulnerabilities to gain local administrator or root/system privileges. A user account with administrator access can also be used. User accounts with permissions to access specific systems or perform specific functions that malware needs to achieve its objectives can also be considered privilege escalation. This tactic encompasses techniques that provide offensive malware with greater permissions on a system, device, or network. Some techniques used by this tactic are: “Access Token Manipulation” (In addition to privilege escalation, it can be used to manipulate the ownership of an active Windows process. The most common implementation of this technique is using calls to the OpenProcessToken, LookupPrivilegeValueA, and AdjustTokenPrivileges). “Accessibility Features”. “AppCert DLLs”. “AppInit DLLs”. “Exploitation for Privilege Escalation” (Accessing the ShellExecute function). “Process Injection” (Several subtypes of the “Process Injection” for Windows include “DDL Injection”, “Thread Execution Hijacking”, and “TLS (Thread Local Storage)”. technique “Process Injection” is difficult to mitigate with preventative controls since it relies on abusing the operating system's design features. Mitigating Windows API calls would have unintended side effects, such as preventing legitimate software, like cybersecurity products, from functioning correctly), “APC (Asynchronous Procedure Call) Injection”, and “PE Injection”). “Scheduled Task” (Elevates privileges to SYSTEM). Create “New Service” (Launches a service with administrator privileges to run under escalated SYSTEM privileges). 
11. Evading defenses. This tactic allows offensive malware to attempt to avoid detection. It consists of the techniques that offensive malware can use to evade detection or bypass other defenses (except for those of "defense-intelligent malware" that already knows this and therefore disables them). Sometimes these actions are the same as, or variations of, techniques from other categories, which have the added benefit of bypassing a specific defense or mitigation. Evading defenses can be considered a set of attributes applied to all phases of the operation. This tactic integrates the techniques that malware specifically uses to evade its detection or bypass other defenses. Some techniques used by this tactic are: "Software Packing" (Makes offensive malware more difficult to detect or analyze. Some packets are UPX, RAR). "Obfuscating files or information" (.NET source code encoded in BSE64. .NET code that calls "CreateDecryptor" decryption functions . Inlined NOP slides that suggest obfuscated shellcode). “DLL Side-Loading”. “Masquerading” (Allows manipulation or abuse of legitimate file names and locations to evade malware defenses. Examples include creating a presence in program files, Windows, and driver directories; creating files within the System32 directory; creating executable files with names similar to existing Windows files; and using names commonly used in third-party applications). “De-obfuscated/Decoded Files or Information” (This technique hides malware to make it harder to detect. For example, using string decryption functions to recover obfuscated sections; encoding only the malicious sections of a malware file and decoding them before execution often evades heuristic malware detection). “Install root certificate”. “MSHTA”. “Run DLL32”. “XSL Script Processing”. “DCS Shadow”. “File Deletion”. “DLL Search Order Hijacking”. “Modifying file permissions.” “BITS Jobs.” “Hiding files and directories.” “Binary padding.” “cmstp.” “Scripting.” “Bypassing user account control.” “Access token manipulation.” “Disabling cybersecurity tools.” Some tactics employed by offensive malware may use the same technique; for example, “privilege escalation” and “defense evasion” tactics use “Access Token Manipulation” to increase their permission levels and avoid detection.
12. Access to credentials. This tactic allows offensive malware to attempt to steal account names and passwords, or other secrets that grant access to resources/assets. It encompasses techniques that allow access to or control of a system, domain, or service credentials used within a specific environment. Malware will likely attempt to obtain legitimate user or administrator account credentials (local system administrator or domain users with administrator access) for use within the network. This enables the malware to assume the account's identity with full account permissions on the system or network, making it more difficult for security systems to detect (unlike defensive malware, which is aware of the tactic). With sufficient network access, malware can create accounts for later use within the environment. This tactic encompasses all techniques that allow access to or control of a system, service, or domain using credentials. Some techniques used by this tactic are: “Credential dumping” (or “credential dumping”) .This technique describes all means of obtaining login and password information from the operating system and software (in the form of a hash or plaintext password) that can later be used for lateral movement on the network and access to restricted information. Techniques include collecting web browser history and passwords; requesting the location of files and registry keys from common third-party FTP tools; requesting the key for the “Login Data Registry” used by Chrome and “IntelliForms2” used by Internet Explorer to store passwords; querying the file system; and searching the Windows Registry for stored credentials. Some methods used by the “credential dumping” technique are: SAM (Security Accounts Manager), cached credentials, LSA (Local Security Authority) secrets, plaintext credentials, SPNs (Service Principal Names), GPP (Group Policy Preference) files, NTDS from the domain controller, DCSync, etc. Some procedures used by the technique “Credential-dumping” includes: gsecdump, mimikatz, pwdumpx.exe). “Brute force”. “Credentials in files”. “Credentials in the Registry”. “Capturing input”(Capturing user input via the keyboard with the “SetWindowsHookEx” function, which intercepts what is typed; using functionalities to retrieve typed information using functions such as GetAAsyncKeyState, GetKeyState, and MaoVirtualKeyA; creating a DirectInput object using the DirectDrawCreateEx function to capture the keys pressed). “Password Filter DLL”. “Forced authentication”. “Hooking” (The process of intercepting a function is called hooking. One function for performing web injections on Windows is “HttpSendRequestA”. By intercepting this function, malware can scan HTTP requests for sensitive data such as credit card numbers and send them to the malware's target. Web injections are a Malware technique that intercepts Windows API functions called by the web browser. “Account manipulation”. “Bash history”. “Keylogging”. “LLMNR/NBT-NS poisoning”. “Kerber roasting”. “Network sniffing”. “Credential access exploitation”.  
13.  This tactic allows the attacking malware to thoroughly understand its environment. It consists of techniques that enable the malware to gain knowledge about the system and its internal network. A second reconnaissance iteration is essential, employing techniques to gather information about an infected system and its place within the network. When malware gains access to a new system, it must focus on what it now controls and what operational benefits that system provides for its current or overall objectives during the cyber intrusion. The operating system provides many native tools that aid in this post-compromise information-gathering phase. Most of the techniques in the "discovery" tactic utilize native operating system features. This tactic integrates techniques that allow malware to gain knowledge about the system, device, service, etc., and its network environment. Some techniques used by this tactic are: “Security Software Discovery” (This involves detecting the presence of cybersecurity software such as anti-malware software, local firewall rules, virtualization software, debuggers, etc. To do this, the “SystemKernelDebuggerInformation” to detect a ring 0-debugger linked to the current process. Detecting a debugger by checking the time difference between two calls to the Windows APIs, “GetProcessHeap” and “CloseHandle.” Making an API call to “IsDebuggerPresent.” Checking for the presence of a debugger by setting GetLastError to a random value in the registry and checking if it has changed after calling OutDebugString. Executing an RDTSC (ReaD-Time-Stamp-Counter) to determine the speed at which the processor executes instructions; this allows inferring the presence of a debugger. Detecting virtual machines and sandbox environments is another way to prevent the analysis of offensive malware. Detecting multiple products Virtualization detection by identifying registry keys specific to guest sharing functionality, such as HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VMTools. Calling the “PhysicalDrive0” function to check for strings that may indicate the drive is virtualized. “Query Registry” (Allows querying the Windows registry to discover information about the “host system”. Ability to read software restriction policies from the Windows registry by enumeratingHKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers. The DWORD value of “AuthenticodeEnabled” indicates whether the execution of binaries is restricted by the operating system. Querying the GUID (Globally Unique Identifier) ​​from the registry, presumably the unique identifier of the infected system). “System Network Configuration Discovery” (Calling the “GetAdaptersInfo” function to retrieve information about the network adapter. Use Use ipconfig, netstat, or netsh to search for Windows network configuration. Query standard online IP and geolocation services to determine the infected system's online IP address. “Process Discovery” (This involves gathering information about active processes on the host system. Implement this technique at runtime using calls to Windows functions such as “CreateToolhelp32Snapshot”, “Process32First”, and “Process32Next”. Use tasklist.exe to discover processes running on both the local and remote systems). “System Information Discovery” (This technique supports further malware execution by querying the operating system and hardware. Query the Windows version using the “GetVersion” function. Retrieve local information such as the user interface language by querying the “GetLocaleInfoA” or “GetLocaleInfoEx” functions of the Windows API. Obtain this information using “VirtualQuery” and “VirtualAlloc” to gather information about memory contents. Check CPU instructions that may have anti-analysis purposes. Depending on the The instruction, when called, can return the CPU manufacturer identifier string, but also the hypervisor brand. Certain returned values ​​can indicate whether the malware is running on a physical or virtual machine. Processor information can be retrieved from the Windows registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor. “System time discovery.” “Password policy discovery.” “System user/owner discovery.” “System network connection discovery.” “Permission group discovery.” “Peripheral device discovery.” “Network sniffing.”
14. Lateral movement. This tactic allows offensive malware to attempt to move across its environment. It integrates techniques that enable offensive malware to access and control remote systems on a network and cloud (edge-fog-cloud-computing), but does not necessarily include the execution of tools on remote systems. This tactic can allow malware to gather information from a system without needing additional tools such as a remote access tool. This tactic allows pivoting across the network to other systems of interest. The techniques of this tactic are difficult to observe. This tactic encompasses techniques that allow malware to access and control other remote systems horizontally. Some techniques used by this tactic are: “Replication Through Removable Media” (attempting to infect USB storage devices by creating autorun.inf files with an Open or ShellExecute entry). “Remote Desktop Protocol” (Attempts to start the “Remote Desktop” service, which can be an effective stealth technique for lateral movement by blending in with the normal network protocol flow. File download attempts that constitute a case of host monitoring for unusual processes by establishing a network connection). “Remote File Copy” (This technique allows malware to download and upload within the network, as well as malware-controlled infrastructure. Additional file download attempts. Uses “HTTP GET” requests, mostly storing the result in the “Temporary Internet Files” directory. Establishes HTTPS connections). “Shared Webroot”. “Windows Remote Management”. “Logon scripts”. “Exploitation of remote services”.
15.  This tactic encompasses techniques that allow traffic to be tunneled through a controlled system to other systems that are not directly accessible.
16. Information Gathering. This tactic allows offensive malware to attempt to collect data of interest to its targets. This tactic consists of the techniques used to identify and collect information, such as sensitive files, from a target network before exfiltration. This tactic also masks locations on the system or network where the malware can search for information to exfiltrate. Most of the techniques rely on native Windows functions to acquire sensitive user information and the use of scripting. This tactic integrates all the techniques used to identify and collect data from a target network, system, or device before exfiltration. Some techniques of this tactic are: “Email Collection”(Collecting email messages by querying email locations and registry keys associated with email clients such as Outlook and Windows Mail) “Clipboard Data” (Obtaining data from the Windows clipboard by making calls to “OpenClipboard” and “GetClipboardData” and launching a window in the CLIPBRDWNDCLASS clipboard class to obtain copy-paste operations). “Screen Capture” (Capturing GUI content with calls to functions like “GetDesktopWindows”, “GetWindowsRect” to retrieve window dimensions, and “BitBlt” and “GetDIBits” to buffer the capture). “Audio Capture.” “Network Shared Drive Data.” “Removable Media Data.” “Man-in-the-Browser Attack.” “Video Capture.” “Information Repository Data.” “Keystroke Capture” (e.g., using keyloggers). “Shared Drive.” “Automated Collection.” 
17. Exfiltration. This tactic allows offensive malware to attempt to steal data. It encompasses all techniques and attributes that enable malware to extract files and information from a target network. This tactic also masks the locations within the system or network where the malware might search for information to exfiltrate. Subliminal protocols and channels are used, such as SMTP, DNS, FTP, HTTPS, etc. It includes all techniques that allow or assist malware in extracting data from a target network, device, or system. Some techniques of this tactic are: "Exfiltration over physical media." "Exfiltration over alternative protocols." "Exfiltration over C&C channels." "Exfiltration over other network media." "File downloads via FTP." "Calls to the 'FtpPutFile' function identified as EOAP (Exfiltration Over Alternative Protocol)." "Automated exfiltration." "Compressed data." "Encrypted data." "Scheduled transfer."
18. Command and Control (C&C). This tactic allows offensive malware to attempt to stealthily communicate with compromised systems, networks, and devices to control them, enabling remote access to the target network. It facilitates communication between malware and systems under its control within the target network or other networks. There are many ways for malware to establish C&C with varying levels of stealth, depending on system configuration, network topology, and other factors. Due to the wide range of variations available to malware at the network level, conventional defenses face a significant challenge (unlike intelligent defensive malware that is aware of potential network protocols and services for communication). This tactic encompasses the techniques that allow malware to communicate with controlled systems within a target network. Some techniques used in this tactic include: “Connection Proxy” (This allows redirecting network traffic between systems or acting as an intermediary for network communications. Many tools exist for redirecting traffic through proxies or port forwarding, such as ZXProxy, HTRAN, ZXPortMap, etc.). “Domain Generation Algorithms” (Malware can use Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for C&C traffic instead of using a static list of IP addresses or domains. This makes it difficult for defense tools to trace, block, or take control of the C&C channel, as there can be thousands of domains that the malware can check to exchange instructions). “Fast Flux DNS” (Allows malware to hide a C&C channel behind a set of rapidly changing IP addresses linked to a single domain resolution. This technique uses a Fully Qualified Domain Name (FQDN) with multiple IP addresses assigned to it, which are swapped frequently using a combination of circular queued IP addressing and a short Time-To-Live (TTL) for a DNS resource record.) “Junk data” (Malware can add junk data to the protocols used for C&C to hinder detection. Adding random or meaningless data to the protocols used for C&C can prevent traffic decoding and analysis. Examples of this technique include adding junk characters before or after data, or writing junk characters between meaningful characters.) “Uncommonly Used Port” (Establishes TCP or UDP traffic over non-standard ports. This technique is deployed to bypass improper proxy and firewall configurations.) “Web Service” (Performs communication with popular social media platforms such as Facebook, Tumblr, Pastebin, etc., used for C&C). “Standard cryptographic protocols”. “Multi-hop Proxy” (Tor connections are established). “Named pipes” (A method for Inter-Process Communication (IPC) with both local and remote processes. One technique to evade C&C traffic detection is to establish communication using SMB and RPC. The “named-pipes” technique can be discovered because a process is expected to call the kernel32.dll function CreateNamedPipe to create a “named pipe”). “Commonly used port”. “Communication via removable media”. “Custom cryptographic protocol”. “Custom C&C protocol”. “Data Encoding” (Allows data to be encoded, making C&C traffic more difficult to detect. C&C information can be encoded in hexadecimal, EBCDIC, ASCII, Unicode, Base64, MIME, using gzip data compression, etc., or custom encodings). “Data Obfuscation”. “Multi-hop Proxy”. “Fallback Channels” (Malware can use alternative or fallback communication channels if the primary channel is compromised or inaccessible to maintain reliable C&C and avoid data transfer thresholds). “Dead Drop Resolver” (Malware can use an existing legitimate external web service to host information that points to additional C&C infrastructure. Malware can send content called “dead-drop-resolvers” on web services with encrypted, obfuscated, and encoded domains or IP addresses. Once infected, victims are redirected through these resolvers). “Multi-band Communication”. “Multi-layer Encryption”. “Multilevel, redundant, and nested steganography” (These techniques allow C&C traffic to be hidden, significantly hindering detection. They enable the concealment of data within digital messages transferred between systems. This hidden information is used for C&C of compromised systems, function gain, etc. The passage of embedded files using steganography, such as images, document files, unused headers in protocol PDUs, etc., is used for C&C.) “Remote file copying.” “Remote access tools.” “Domain fronting.” “Multi-stage channels” (Malware can create multiple C&C stages that are used under different conditions or for specific functions. Using multiple stages can obfuscate C&C, making detection more difficult.) “Protocol Impersonation” (Malware can impersonate legitimate protocol or web service traffic to disguise C&C activity and prevent analysis. By impersonating legitimate web services or protocols, malware can mix its C&C traffic with legitimate network traffic.)
20. Network effects. This tactic allows offensive malware to attempt to intercept or manipulate network traffic to or from a device, object, system, or network.
21. Effects of remote services. This tactic allows offensive malware to attempt to control or monitor the system/device/network using remote services.
22.  The socio-technical, geo-political objectives (including false flag operations, use of decoys, etc.) of a malware cyber-attack are planned to carry out a strategic objective.
23. ICS/CPS Degradation. This tactic allows offensive malware to attempt to degrade the target ICS/CPS system, reducing the effectiveness and/or efficiency of legitimate C&C systems and information gathering methods. It uses techniques such as: (1) Degradation. This is the degradation of an element whose function is mandatory to provide a service. It can be performed at any point between the target system and its authorized users. The points of attack are the system itself or network devices (whose degradation impacts users). Typically, to maximize the impact, malware will deny service to the largest number of users. There are four sub-techniques associated with degradation: (i) Flooding. This degrades services by sending large quantities of valid service requests. (ii) Amplification. This involves sending a small number of requests to services that produce responses of very high magnitudes, so that malware can saturate a service. Examples include amplification based on DNS, NTP, ICMP, etc. (iii) Reflection. The malware sends requests, spoofing its originating address and pretending to be the victim, to a reflector server. This reflector cannot distinguish legitimate requests from forged ones, responding directly to the victim and degrading its bandwidth. (iv) Exploitation. This involves exploiting one or more vulnerabilities in a policy or in the mechanism/protocol that executes the policy, or exploiting vulnerabilities in the software that implements the target system, causing excessive consumption of the target's resources by sending a few carefully crafted requests. Malicious queries sent to a web application with a poor database structure lead to CPU degradation on the web or database server. (2) Interference. This involves introducing noise or injecting false data to degrade the target's services. There are three sub-techniques associated with interference: (i) Jamming. Using saturation or inhibition signals. Similar to RF jammers and EMP (Electromagnetic Pulse) generators. (ii) Packet dropping. The goal is for the sender and receiver to perceive a disconnection or degradation in the quality of the path. (ii) Misrouting. This is a routing cyberattack, modifying the routes that connect the sender to the receiver (for example, with poisoning, black-holing, etc.). (3) Alteration. Of system components. There are two sub-techniques associated with alteration: (i) Disabling. The malware disables one or more components and changes when the malware modifies the key functions or data of the target (any point in the service delivery, a specific infrastructure, etc.). (ii) Corruption. Of the volatile memory system, and system reboot usually recovers the lost or degraded functionality. 
24. Destruction in ICSs-CPSs. This tactic integrates a set of techniques such as: (1) Erasure. Of firmware, software, and data. It allows the deletion of files to disrupt the availability of the target system's services. It employs two sub-techniques: (i) Clearing. This is performed using system commands or methods that do not actually destroy the information. (ii) Purging. This allows the deletion of information so that it can no longer be read (for example, by overwriting the space used by the object with random patterns). If it is a hard drive, it is called disk wiping , and if it is performed on folders or files, it is called shredding. (2) Malicious encryption. This can be reversible if the decryption key is provided and irreversible otherwise. In some cases, the encrypted file can be recovered by cryptanalysis, finding vulnerabilities in the algorithm or implementation. (3) Corruption. This is a deliberate modification of information (for example, replacing the "boot-time" code in a BIOS with garbage data). One sub-technique is the “decaying” or gradual corruption of data caused by system failures motivated by the offensive malware.
25. Manipulation in ICSs-CPSs. This tactic encompasses the following groups of techniques for cyberattacking system integrity: (1) Fabrication. This involves inserting spurious data into key elements to cause a malfunction in the targeted system (a parameter in a configuration file, malware, etc.). (2) Modification. This involves replacing legitimate data with malicious data to cause a malfunction. Consider a level detector for a harmful/radioactive/toxic fluid whose display value is modified to show a very low value when it is actually very high, resulting in a dangerous leak. The "poltergeist" technique modifies the sensor data of a vehicle-based CPS so that it detects obstacles where there are none and fails to detect obstacles where there are. (3) Cancellation. This involves deleting key data in the target system to cause a malfunction. Data manipulation affects all types: metadata in photos/videos, geolocation data, runtime data, stored data, transmitted data, data structures, system resources, timing and state data, etc.

FINAL CONSIDERATIONS.

Offensive malware disrupts the functioning of everything: computing devices, performs sabotage, illegally captures sensitive information ( malware within a file, upon opening it, determines the location of the person opening it ), gains unauthorized access to all types of devices ( PCs, tablets, mobile phones like iPhone 13, PLCs, routers, etc. ), systems ( reads process data ), networks ( WiFi-6/7, 4G/5G, fiber optics, LoRaWAN, etc. ), services ( it can cause a "blackout" of services (such as social networks, instant messaging, etc.), cyberattack services for sending and receiving money like Bizum, etc. ), operating systems ( Linux, Windows 10, iOS 15, Android 12, macOS, Solaris, Unix, etc. ), people, vehicles ( ships, airplanes, trains, drones, submarines, connected/autonomous cars with ADAS/advanced driver assistance systems, etc. ), CPS ( Cyber ​​Physical Systems ), ICS ( Industrial Control Systems ), and apps. Databases, CRM, ERP, IoT/IoMT/IIoT/AIoT objects, all types of satellites [( geolocation-geopositioning such as GPS, Glonass, BeiDou, Galileo, GNSS, etc.), communications (multimedia and Internet link, such as Hispasat, Iridium, Inmarsat, Eutelsat, Globalstar, SES, Intelsat, Thuraya, Terrestar, Indium, Astra, STSAT-2C, etc.), meteorological ( Meteosat-8, GOES-12, MTSAT-1R, MSG-3, TIROS-1, GOMS, RESURS, METEOR, NOAA-18, FENGYUN/FY-2D, etc. ), observation, surveillance, reconnaissance and spy satellites ( Earth Observing EO-1 (NASA), Discover, Corona (USA), Spainsat, Yantar, Cartosat-1, Kosmos 2542 (Russia), USA-245/NROL-65, Ofeq, Paz, Helios 2B, Vela, IGS, Keyhole-KH, SAR/Lupe, etc. ), etc.], etc. According to a Juniper Research study , the global number of IIoT ( Industrial Internet of Things ) connections is projected to grow by 107% by 2025, reaching 36.8 billion ( a goldmine for malware in Industry 4.0 ). Currently, the evolution of vulnerabilities is dissonant, rapid, and disjointed; its purpose is to facilitate the advancement of intelligent malware. Cybersecurity Threshold ( CTH) is a proactive cyber-defense functionality/activity (integrated into defensive intelligent malware). It is also the automated process that iteratively scans networks, devices, applications, etc., predictively and proactively to detect, neutralize, isolate, restore, and so on. The actions of intelligent, offensive malware capable of bypassing conventional cybersecurity systems (e.g., cyber-threat management measures such as IDS, IPS, FW, SIEM, sandboxing, etc.). A Mobieltron study shows that 86% of smartphone users have scanned QR codes, and 34% are not concerned about the cybersecurity implications of using them.

Offensive malware shouldn't be endured, it must be combated (with neutralizing cyber weapons such as defensive malware, a new operational paradigm as a defensive cyber weapon). QR codes are a vector for cyberattacks and a way to access a website from a smartphone without typing the URL (and therefore without seeing which URL is being accessed). For example, they allow you to view a restaurant menu, access a malicious website unknowingly, view a malicious digital ransom note, activate and infect services connected to a multimedia system, malware can access your geolocation, download malicious firmware, spy on your phone, make payments in your name, redirect you to a fake and infected website that mimics an authorized site and impersonate you (phishing), etc. If the smartphone is linked to a vehicle, home, work, identity, health, banking/finance, etc., the potential cyber risks increase exponentially. 

REFERENCES.

- Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo. 2020.

- Areitio, J. “Controlling the growing empowerment of malware: identification and exploration of key aspects of malware”. Conectrónica Magazine. No. 240. February 2021.

- Areitio, J. “Danger of ignorance of the existence of malware contamination tending towards very serious global cyber-epidemiological situations”. Electronic Journal. No. 241. March-April 2021.

- Areitio, J. “Clarifications on malware, cyber-pandemics and critical cyber-epidemiological scenarios. Protection against malware: early defense”. Conectrónica Magazine. No. 242. May-June 2021.

- Areitio, J. “Confluences between malware, vulnerabilities and exploits: infiltration indicators, infection vector surface and malware danger”. Conectrónica Magazine. No. 243. July 2021.

- Areitio, J. “Adaptation to the variability of undetected malware infection events in all types of current scenarios, environments and ecosystems””. Conectrónica Magazine. No. 244. September 2021. 

- Areitio, J. “Duality of advanced intelligent malware (offensive and defensive), points of action and transparent expansion operation”. Conectrónica Magazine. No. 245. October 2021.

- Metcalf, L. and Spring, J. “Using Science in Cybersecurity”. World Scientific Publishing Company. 2021.

- Stamp, M., Alazab, M. and Shalaginov, A. “Malware Analysis Using Artificial Intelligence and Deep Learning”. Springer. 2021.

- Karbab, EB, Debbabi, M., Derhab, A. and Mouheb, D. “Android Malware Detection using Machine Learning: Data-Driven Fingerprinting and Threat Intelligence”. Springer. 2021.   

- Rains, T. “Cybersecurity Threats, Malware Trends, and Strategies: Learn to Mitigate Exploits, Malware, Phishing, and other social engineering Attacks.” Packt Publishing. 2020. 

- Bilge, L., Cavallaro, L., Pellegrino, G. and Neves, N. “Detection of Intrusions and Malware, and Vulnerability Assessment”. 18th International Conference, DIMVA 2021. Springer. 2021.

- Wardle, P. “The Art of Mac Malware: The Guide to Analyzing Malicious Software.” Not Starch Press. 2021.

- URLs where you can download malware samples for research: https://github.com/ytisf/theZoo; https://zeltser.com/malware-sample-sources/; https://contagiodump.blogspot.com/; http://openmalware.org/

- Sanders, C. “Intrusion Detection Honeypots: Detection through Deception”. Applied Network Defense. 2020. 

- Stanford, E. “Crypto Wars: Facked Deaths, Missing Billions and Industry Disruption.” Kogan Page. 2021.

- Di Pietro, R., Raponi, S., Caprolu, M. and Cresci, S. “New Dimensions of Information Warfare”. Springer. 2021.

- Malpedia (Malware repository): malpedia.caad.fkie.fraunhofer.de/details/

- Patterson, W. and Winston-Proctor, CE “Behavioral Cybersecurity: Fundamental Principles and Applications of Personality Psychology”. CRC Press. 2020.

- Alrabaee, S., Debbabi, M., Shirani, P., Wang, L., Youssef, A., Rahimani, A., Nouth, L., Mouheb, D., Huang, H. and Hanna, A. “Binary Code Fingerprinting for Cybersecurity: Application to Malicious Code Fingerprinting”. Springer. 2020.

- Chiroma, H., Abdulhamid, SM, Fournier-Viger, P. and García, NM “Machine Learning and Data Mining for Emerging Trend in Cyber ​​Dynamics: Theories and Applications”. Springer. 2021.