恶意行为分类与ATT&CK映射

---
name: behavioral-analysis
description: Classify observed malware behaviors into categories (persistence, C2, lateral movement, evasion, data theft) and map them to MITRE ATT&CK techniques for structured threat characterization.
---

# Behavioral Analysis

Analyze observed malware behaviors from dynamic analysis results, classify them into tactical categories, and map to the MITRE ATT&CK framework for standardized reporting and threat correlation.

## Prerequisites

- Behavioral logs from dynamic analysis (JSON format from sandbox or monitoring tools)
- Python 3.8+ with standard library
- Familiarity with MITRE ATT&CK framework (see `references/behavioral-indicators.md`)

## Steps

### 1. Collect Behavioral Data

Gather behavioral logs from dynamic analysis. Expected input is JSON with events covering:
- Process creation and injection
- File system modifications
- Registry changes
- Network connections and DNS queries
- API call sequences

### 2. Classify Behaviors

Run the behavior classifier on collected logs:

```bash
python scripts/behavior_classifier.py --input /analysis/results/events.json --output /analysis/results/classification.json
```

The classifier identifies and categorizes behaviors into:
- **Persistence** - Mechanisms to survive reboot (see `references/persistence-mechanisms.md`)
- **Command & Control** - C2 communication patterns (see `references/c2-patterns.md`)
- **Defense Evasion** - Anti-analysis, anti-AV, obfuscation techniques
- **Discovery** - System and network reconnaissance
- **Lateral Movement** - Techniques to spread through the network
- **Collection** - Data gathering and staging
- **Exfiltration** - Data theft mechanisms
- **Impact** - Destructive actions (ransomware, wipers)
- **Execution** - Code execution methods
- **Credential Access** - Credential harvesting

### 3. Review ATT&CK Mapping

The classifier maps each detected behavior to MITRE ATT&CK technique IDs:

```bash
python scripts/behavior_classifier.py --input /analysis/results/events.json --format attack-matrix
```

This produces a structured mapping showing:
- Tactic (why) - The adversary's goal
- Technique ID (how) - The specific method used
- Confidence level - How certain the classification is
- Supporting evidence - The specific events that triggered the classification

### 4. Analyze Persistence Mechanisms

Review detected persistence with the persistence reference:

```bash
python scripts/behavior_classifier.py --input /analysis/results/events.json --filter persistence
```

Cross-reference findings with `references/persistence-mechanisms.md` for detection and remediation guidance.

### 5. Analyze C2 Communication

Review network-based behaviors for C2 patterns:

```bash
python scripts/behavior_classifier.py --input /analysis/results/events.json --filter c2
```

Compare with known patterns in `references/c2-patterns.md`.

### 6. Generate Behavioral Profile

Create a comprehensive behavioral profile:

```bash
python scripts/behavior_classifier.py --input /analysis/results/events.json --format report --output /analysis/results/behavioral_profile.json
```

The profile includes:
- Malware type classification (trojan, ransomware, worm, etc.)
- Full ATT&CK technique mapping
- Behavioral severity assessment
- Recommended response actions

### 7. Cross-Reference with Threat Intelligence

Use the behavioral profile to:
1. Search for known malware families with similar behavior patterns
2. Correlate ATT&CK techniques with known threat groups
3. Identify campaign-level patterns across multiple samples

## Tips

- Run multiple behavioral analysis passes with different sandbox configurations
- Some behaviors only manifest under specific conditions (time, locale, domain membership)
- Weight network-based indicators higher for attribution
- Consider behavioral overlap - many techniques are shared across threat groups
- Use the ATT&CK Navigator to visualize technique coverage

## References

- `references/persistence-mechanisms.md` - Persistence techniques and detection
- `references/c2-patterns.md` - C2 communication patterns
- `references/behavioral-indicators.md` - Behavioral indicators by malware type