Use on a server or central application of administrator rights illicitly granted by an administrator@@ -9457,7 +9509,7 @@ information-security-indicators namespace available in JSON format at -
information-security-indicators:IDB="RGH.4"
+information-security-indicators:IDB="RGH.4"
Use on a server or central application of time-limited granted rights after the planned period
information-security-indicators:IDB="RGH.5"
+information-security-indicators:IDB="RGH.5"
Abuse of privileges by an administrator on a server or central application
information-security-indicators:IDB="RGH.6"
+information-security-indicators:IDB="RGH.6"
Abuse of privileges by an operator or a plain user on a server or central application
information-security-indicators:IDB="RGH.7"
+information-security-indicators:IDB="RGH.7"
Illicit use on a server or central application of rights not removed after departure or position change within the organization
information-security-indicators:IDB="MIS.1"
+information-security-indicators:IDB="MIS.1"
Server resources misappropriation by an internal source
information-security-indicators:IDB="IAC.1"
+information-security-indicators:IDB="IAC.1"
Access to hacking Website
information-security-indicators:IDB="LOG.1"
+information-security-indicators:IDB="LOG.1"
Deactivating of logs recording by an administrator
information-security-indicators:IWH="VNP.1"
+information-security-indicators:IWH="VNP.1"
Exploitation of a software vulnerability without available patch
information-security-indicators:IWH="VNP.2"
+information-security-indicators:IWH="VNP.2"
Exploitation of a non-patched software vulnerability
information-security-indicators:IWH="VNP.3"
+information-security-indicators:IWH="VNP.3"
Exploitation of a poorly-patched software vulnerability
information-security-indicators:IWH="VCN.1"
+information-security-indicators:IWH="VCN.1"
Exploitation of a configuration flaw
information-security-indicators:IWH="UKN.1"
+information-security-indicators:IWH="UKN.1"
Not categorized security incidents
information-security-indicators:IWH="UNA.1"
+information-security-indicators:IWH="UNA.1"
Security incidents on non-inventoried and/or not managed assets
information-security-indicators:VBH="PRC.1"
+information-security-indicators:VBH="PRC.1"
Server accessed by an administrator with unsecure protocols
information-security-indicators:VBH="PRC.2"
+information-security-indicators:VBH="PRC.2"
P2P client in a workstation
information-security-indicators:VBH="PRC.3"
+information-security-indicators:VBH="PRC.3"
VoIP clients in a workstation
information-security-indicators:VBH="PRC.4"
+information-security-indicators:VBH="PRC.4"
Outbound connection dangerously set up
information-security-indicators:VBH="PRC.5"
+information-security-indicators:VBH="PRC.5"
Not compliant laptop computer used to establish a connection
information-security-indicators:VBH="PRC.6"
+information-security-indicators:VBH="PRC.6"
Other unsecure protocols used
information-security-indicators:VBH="IAC.1"
+information-security-indicators:VBH="IAC.1"
Outbound controls bypassed to access Internet
information-security-indicators:VBH="IAC.2"
+information-security-indicators:VBH="IAC.2"
Anonymization site used to access Internet
information-security-indicators:VBH="FTR.1"
+information-security-indicators:VBH="FTR.1"
Files recklessly downloaded
information-security-indicators:VBH="FTR.2"
+information-security-indicators:VBH="FTR.2"
Personal public instant messaging account used for business file exchanges
information-security-indicators:VBH="FTR.3"
+information-security-indicators:VBH="FTR.3"
Personal public messaging account used for business file exchanges
information-security-indicators:VBH="WTI.1"
+information-security-indicators:VBH="WTI.1"
Workstations accessed in administrator mode
information-security-indicators:VBH="WTI.2"
+information-security-indicators:VBH="WTI.2"
Personal storage devices used
information-security-indicators:VBH="WTI.3"
+information-security-indicators:VBH="WTI.3"
Personal devices used without compartmentalization (BYOD)
information-security-indicators:VBH="WTI.4"
+information-security-indicators:VBH="WTI.4"
Not encrypted sensitive files exported
information-security-indicators:VBH="WTI.5"
+information-security-indicators:VBH="WTI.5"
Personal software used
information-security-indicators:VBH="WTI.6"
+information-security-indicators:VBH="WTI.6"
Mailbox or Internet access with admin mode
information-security-indicators:VBH="PSW.1"
+information-security-indicators:VBH="PSW.1"
Weak passwords used
information-security-indicators:VBH="PSW.2"
+information-security-indicators:VBH="PSW.2"
Passwords not changed
information-security-indicators:VBH="PSW.3"
+information-security-indicators:VBH="PSW.3"
Administrator passwords not changed
information-security-indicators:VBH="RGH.1"
+information-security-indicators:VBH="RGH.1"
Not compliant user rights granted illicitly by an administrator
information-security-indicators:VBH="HUW.1"
+information-security-indicators:VBH="HUW.1"
Human weakness exploited by a spear phishing message meant to entice or appeal to do something possibly harmful to the organization
information-security-indicators:VBH="HUW.2"
+information-security-indicators:VBH="HUW.2"
Human weakness exploited by exchanges meant to entice or appeal to tell some secrets to be used later@@ -9801,7 +9853,7 @@ information-security-indicators namespace available in JSON format at -
information-security-indicators:VSW="WSR.1"
+information-security-indicators:VSW="WSR.1"
Web applications software vulnerabilities
information-security-indicators:VSW="OSW.1"
+information-security-indicators:VSW="OSW.1"
OS software vulnerabilities regarding servers
information-security-indicators:VSW="WBR.1"
+information-security-indicators:VSW="WBR.1"
Web browsers software vulnerabilities
information-security-indicators:VCF="DIS.1"
+information-security-indicators:VCF="DIS.1"
Dangerous or illicit services on externally accessible servers
information-security-indicators:VCF="LOG.1"
+information-security-indicators:VCF="LOG.1"
Insufficient size of the space allocated for logs
information-security-indicators:VCF="FWR.1"
+information-security-indicators:VCF="FWR.1"
Weak firewall filtering rules
information-security-indicators:VCF="WTI.1"
+information-security-indicators:VCF="WTI.1"
Workstation wrongly configured
information-security-indicators:VCF="WTI.2"
+information-security-indicators:VCF="WTI.2"
Autorun feature enabled on workstations
information-security-indicators:VCF="UAC.1"
+information-security-indicators:VCF="UAC.1"
Access rights configuration not compliant with the security policy
information-security-indicators:VCF="UAC.2"
+information-security-indicators:VCF="UAC.2"
Not compliant access rights on logs
information-security-indicators:VCF="UAC.3"
+information-security-indicators:VCF="UAC.3"
Generic and shared administrator accounts
information-security-indicators:VCF="UAC.4"
+information-security-indicators:VCF="UAC.4"
Accounts without owners
information-security-indicators:VCF="UAC.5"
+information-security-indicators:VCF="UAC.5"
Inactive accounts
information-security-indicators:VTC="BKP.1"
+information-security-indicators:VTC="BKP.1"
Malfunction of server-hosted sensitive data safeguards
information-security-indicators:VTC="IDS.1"
+information-security-indicators:VTC="IDS.1"
Full unavailability of IDS/IPS
information-security-indicators:VTC="WFI.1"
+information-security-indicators:VTC="WFI.1"
Wi-Fi devices installed on the network without any official authorization
information-security-indicators:VTC="RAP.1"
+information-security-indicators:VTC="RAP.1"
Remote access points used to gain unauthorized access
information-security-indicators:VTC="NRG.1"
+information-security-indicators:VTC="NRG.1"
Devices or servers connected to the organization’s network without being registered and managed
information-security-indicators:VTC="PHY.1"
+information-security-indicators:VTC="PHY.1"
Not operational physical access control means
information-security-indicators:VOR="DSC.1"
+information-security-indicators:VOR="DSC.1"
Discovery of attacks
information-security-indicators:VOR="VNP.1"
+information-security-indicators:VOR="VNP.1"
Excessive time of window of risk exposure
information-security-indicators:VOR="VNP.2"
+information-security-indicators:VOR="VNP.2"
Rate of not patched systems
information-security-indicators:VOR="VNR.1"
+information-security-indicators:VOR="VNR.1"
Rate of not reconfigured systems
information-security-indicators:VOR="RCT.1"
+information-security-indicators:VOR="RCT.1"
Reaction plans launched without experience feedback
information-security-indicators:VOR="RCT.2"
+information-security-indicators:VOR="RCT.2"
Reaction plans unsuccessfully launched
information-security-indicators:VOR="PRT.1"
+information-security-indicators:VOR="PRT.1"
Launch of new IT projects without information classification
information-security-indicators:VOR="PRT.2"
+information-security-indicators:VOR="PRT.2"
Launch of new specific IT projects without risk analysis
information-security-indicators:VOR="PRT.3"
+information-security-indicators:VOR="PRT.3"
Launch of new IT projects of a standard type without identification of vulnerabilities and threats@@ -10079,7 +10131,7 @@ information-security-indicators namespace available in JSON format at -
information-security-indicators:IMP="COS.1"
+information-security-indicators:IMP="COS.1"
Average cost to tackle a critical security incident
information-security-indicators:IMP="TIM.1"
+information-security-indicators:IMP="TIM.1"
Average time of Websites downtime due to whole security incidents
information-security-indicators:IMP="TIM.2"
+information-security-indicators:IMP="TIM.2"
Average time of Websites downtime due to successful malicious attacks
information-security-indicators:IMP="TIM.3"
+information-security-indicators:IMP="TIM.3"
Average time of Websites downtime due to malfunctions or unintentional security incidents
Reconnaissance
kill-chain:Reconnaissance
+kill-chain:Reconnaissance
Research, identification and selection of targets, often represented as crawling Internet websites such as conference proceedings and mailing lists for email addresses, social relationships, or information on specific technologies.
Weaponization
kill-chain:Weaponization
+kill-chain:Weaponization
Coupling a remote access trojan with an exploit into a deliverable payload, typically by means of an automated tool (weaponizer). Increasingly, client application data files such as Adobe Portable Document Format (PDF) or Microsoft Office documents serve as the weaponized deliverable.
Delivery
kill-chain:Delivery
+kill-chain:Delivery
Transmission of the weapon to the targeted environment. The three most prevalent delivery vectors for weaponized payloads by APT actors, as observed by the Lockheed Martin Computer Incident Response Team (LM-CIRT) for the years 2004-2010, are email attachments, websites, and USB removable media.
Exploitation
kill-chain:Exploitation
+kill-chain:Exploitation
After the weapon is delivered to victim host, exploitation triggers intruders' code. Most often, exploitation targets an application or operating system vulnerability, but it could also more simply exploit the users themselves or leverage an operating system feature that auto-executes code.
Installation
kill-chain:Installation
+kill-chain:Installation
Installation of a remote access trojan or backdoor on the victim system allows the adversary to maintain persistence inside the environment.
Command and Control
kill-chain:Command and Control
+kill-chain:Command and Control
Typically, compromised hosts must beacon outbound to an Internet controller server to establish a C2 channel. APT malware especially requires manual interaction rather than conduct activity automatically. Once the C2 channel establishes, intruders have 'hands on the keyboard' access inside the target environment.
Actions on Objectives
kill-chain:Actions on Objectives
+kill-chain:Actions on Objectives
Only now, after progressing through the first six phases, can intruders take actions to achieve their original objectives. Typically, this objective is data exfiltration which involves collecting, encrypting and extracting information from the victim environment; violations of data integrity or availability are potential objectives as well. Alternatively, the intruders may only desire access to the initial victim box for use as a hop point to compromise additional systems and move laterally inside the network.
lifetime:falling
+lifetime:falling
Falling
lifetime:publishing
+lifetime:publishing
Publishing
lifetime:propagating
+lifetime:propagating
Propagating
lifetime:discovering
+lifetime:discovering
Discovering
maec-delivery-vector
maec-delivery-vectors:maec-delivery-vector="active-attacker"
+maec-delivery-vectors:maec-delivery-vector="active-attacker"
active Attacker
maec-delivery-vectors:maec-delivery-vector="auto-executing-media"
+maec-delivery-vectors:maec-delivery-vector="auto-executing-media"
auto-executing-media
maec-delivery-vectors:maec-delivery-vector="downloader"
+maec-delivery-vectors:maec-delivery-vector="downloader"
downloader
maec-delivery-vectors:maec-delivery-vector="dropper"
+maec-delivery-vectors:maec-delivery-vector="dropper"
dropper
maec-delivery-vectors:maec-delivery-vector="email-attachment"
+maec-delivery-vectors:maec-delivery-vector="email-attachment"
email-attachment
maec-delivery-vectors:maec-delivery-vector="exploit-kit-landing-page"
+maec-delivery-vectors:maec-delivery-vector="exploit-kit-landing-page"
exploit-kit-landing-page
maec-delivery-vectors:maec-delivery-vector="fake-website"
+maec-delivery-vectors:maec-delivery-vector="fake-website"
fake-website
maec-delivery-vectors:maec-delivery-vector="janitor-attack"
+maec-delivery-vectors:maec-delivery-vector="janitor-attack"
janitor-attack
maec-delivery-vectors:maec-delivery-vector="malicious-iframes"
+maec-delivery-vectors:maec-delivery-vector="malicious-iframes"
malicious-iframes
maec-delivery-vectors:maec-delivery-vector="malvertising"
+maec-delivery-vectors:maec-delivery-vector="malvertising"
malvertising
maec-delivery-vectors:maec-delivery-vector="media-baiting"
+maec-delivery-vectors:maec-delivery-vector="media-baiting"
media-baiting
maec-delivery-vectors:maec-delivery-vector="pharming"
+maec-delivery-vectors:maec-delivery-vector="pharming"
pharming
maec-delivery-vectors:maec-delivery-vector="phishing"
+maec-delivery-vectors:maec-delivery-vector="phishing"
phishing
maec-delivery-vectors:maec-delivery-vector="trojanized-link"
+maec-delivery-vectors:maec-delivery-vector="trojanized-link"
trojanized-link
maec-delivery-vectors:maec-delivery-vector="trojanized-software"
+maec-delivery-vectors:maec-delivery-vector="trojanized-software"
trojanized-software
maec-delivery-vectors:maec-delivery-vector="usb-cable-syncing"
+maec-delivery-vectors:maec-delivery-vector="usb-cable-syncing"
usb-cable-syncing
maec-delivery-vectors:maec-delivery-vector="watering-hole"
+maec-delivery-vectors:maec-delivery-vector="watering-hole"
watering-hole
maec-malware-behavior
maec-malware-behavior:maec-malware-behavior="access-premium-service"
+maec-malware-behavior:maec-malware-behavior="access-premium-service"
access-premium-service
maec-malware-behavior:maec-malware-behavior="autonomous-remote-infection"
+maec-malware-behavior:maec-malware-behavior="autonomous-remote-infection"
autonomous-remote-infection
maec-malware-behavior:maec-malware-behavior="block-security-websites"
+maec-malware-behavior:maec-malware-behavior="block-security-websites"
block-security-websites
maec-malware-behavior:maec-malware-behavior="capture-camera-input"
+maec-malware-behavior:maec-malware-behavior="capture-camera-input"
capture-camera-input
maec-malware-behavior:maec-malware-behavior="capture-file-system-data"
+maec-malware-behavior:maec-malware-behavior="capture-file-system-data"
capture-file-system-data
maec-malware-behavior:maec-malware-behavior="capture-gps-data"
+maec-malware-behavior:maec-malware-behavior="capture-gps-data"
capture-gps-data
maec-malware-behavior:maec-malware-behavior="capture-keyboard-input"
+maec-malware-behavior:maec-malware-behavior="capture-keyboard-input"
capture-keyboard-input
maec-malware-behavior:maec-malware-behavior="capture-microphone-input"
+maec-malware-behavior:maec-malware-behavior="capture-microphone-input"
capture-microphone-input
maec-malware-behavior:maec-malware-behavior="capture-mouse-input"
+maec-malware-behavior:maec-malware-behavior="capture-mouse-input"
capture-mouse-input
maec-malware-behavior:maec-malware-behavior="capture-printer-output"
+maec-malware-behavior:maec-malware-behavior="capture-printer-output"
capture-printer-output
maec-malware-behavior:maec-malware-behavior="capture-system-memory"
+maec-malware-behavior:maec-malware-behavior="capture-system-memory"
capture-system-memory
maec-malware-behavior:maec-malware-behavior="capture-system-network-traffic"
+maec-malware-behavior:maec-malware-behavior="capture-system-network-traffic"
capture-system-network-traffic
maec-malware-behavior:maec-malware-behavior="capture-system-screenshot"
+maec-malware-behavior:maec-malware-behavior="capture-system-screenshot"
capture-system-screenshot
maec-malware-behavior:maec-malware-behavior="capture-touchscreen-input"
+maec-malware-behavior:maec-malware-behavior="capture-touchscreen-input"
capture-touchscreen-input
maec-malware-behavior:maec-malware-behavior="check-for-payload"
+maec-malware-behavior:maec-malware-behavior="check-for-payload"
check-for-payload
maec-malware-behavior:maec-malware-behavior="click-fraud"
+maec-malware-behavior:maec-malware-behavior="click-fraud"
click-fraud
maec-malware-behavior:maec-malware-behavior="compare-host-fingerprints"
+maec-malware-behavior:maec-malware-behavior="compare-host-fingerprints"
compare-host-fingerprints
maec-malware-behavior:maec-malware-behavior="compromise-remote-machine"
+maec-malware-behavior:maec-malware-behavior="compromise-remote-machine"
compromise-remote-machinen
maec-malware-behavior:maec-malware-behavior="control-local-machine-via-remote-command"
+maec-malware-behavior:maec-malware-behavior="control-local-machine-via-remote-command"
control-local-machine-via-remote-command
maec-malware-behavior:maec-malware-behavior="control-malware-via-remote-command"
+maec-malware-behavior:maec-malware-behavior="control-malware-via-remote-command"
control-malware-via-remote-command
maec-malware-behavior:maec-malware-behavior="crack-passwords"
+maec-malware-behavior:maec-malware-behavior="crack-passwords"
crack-passwords
maec-malware-behavior:maec-malware-behavior="defeat-call-graph-generation"
+maec-malware-behavior:maec-malware-behavior="defeat-call-graph-generation"
defeat-call-graph-generation
maec-malware-behavior:maec-malware-behavior="defeat-emulator"
+maec-malware-behavior:maec-malware-behavior="defeat-emulator"
defeat-emulator
maec-malware-behavior:maec-malware-behavior="defeat-flow-oriented-disassembler"
+maec-malware-behavior:maec-malware-behavior="defeat-flow-oriented-disassembler"
defeat-flow-oriented-disassembler
maec-malware-behavior:maec-malware-behavior="defeat-linear-disassembler"
+maec-malware-behavior:maec-malware-behavior="defeat-linear-disassembler"
defeat-linear-disassembler
maec-malware-behavior:maec-malware-behavior="degrade-security-program"
+maec-malware-behavior:maec-malware-behavior="degrade-security-program"
degrade-security-program
maec-malware-behavior:maec-malware-behavior="denial-of-service"
+maec-malware-behavior:maec-malware-behavior="denial-of-service"
denial-of-service
maec-malware-behavior:maec-malware-behavior="destroy-hardware"
+maec-malware-behavior:maec-malware-behavior="destroy-hardware"
destroy-hardware
maec-malware-behavior:maec-malware-behavior="detect-debugging"
+maec-malware-behavior:maec-malware-behavior="detect-debugging"
detect-debugging
maec-malware-behavior:maec-malware-behavior="detect-emulator"
+maec-malware-behavior:maec-malware-behavior="detect-emulator"
detect-emulator
maec-malware-behavior:maec-malware-behavior="detect-installed-analysis-tools"
+maec-malware-behavior:maec-malware-behavior="detect-installed-analysis-tools"
detect-installed-analysis-tools
maec-malware-behavior:maec-malware-behavior="detect-installed-av-tools"
+maec-malware-behavior:maec-malware-behavior="detect-installed-av-tools"
detect-installed-av-tools
maec-malware-behavior:maec-malware-behavior="detect-sandbox-environment"
+maec-malware-behavior:maec-malware-behavior="detect-sandbox-environment"
detect-sandbox-environment
maec-malware-behavior:maec-malware-behavior="detect-vm-environment"
+maec-malware-behavior:maec-malware-behavior="detect-vm-environment"
detect-vm-environment
maec-malware-behavior:maec-malware-behavior="determine-host-ip-address"
+maec-malware-behavior:maec-malware-behavior="determine-host-ip-address"
determine-host-ip-address
maec-malware-behavior:maec-malware-behavior="disable-access-rights-checking"
+maec-malware-behavior:maec-malware-behavior="disable-access-rights-checking"
disable-access-rights-checking
maec-malware-behavior:maec-malware-behavior="disable-firewall"
+maec-malware-behavior:maec-malware-behavior="disable-firewall"
disable-firewall
maec-malware-behavior:maec-malware-behavior="disable-kernel-patch-protection"
+maec-malware-behavior:maec-malware-behavior="disable-kernel-patch-protection"
disable-kernel-patch-protection
maec-malware-behavior:maec-malware-behavior="disable-os-security-alerts"
+maec-malware-behavior:maec-malware-behavior="disable-os-security-alerts"
disable-os-security-alerts
maec-malware-behavior:maec-malware-behavior="disable-privilege-limiting"
+maec-malware-behavior:maec-malware-behavior="disable-privilege-limiting"
disable-privilege-limiting
maec-malware-behavior:maec-malware-behavior="disable-service-pack-patch-installation"
+maec-malware-behavior:maec-malware-behavior="disable-service-pack-patch-installation"
disable-service-pack-patch-installation
maec-malware-behavior:maec-malware-behavior="disable-system-file-overwrite-protection"
+maec-malware-behavior:maec-malware-behavior="disable-system-file-overwrite-protection"
disable-system-file-overwrite-protection
maec-malware-behavior:maec-malware-behavior="disable-update-services-daemons"
+maec-malware-behavior:maec-malware-behavior="disable-update-services-daemons"
disable-update-services-daemons
maec-malware-behavior:maec-malware-behavior="disable-user-account-control"
+maec-malware-behavior:maec-malware-behavior="disable-user-account-control"
disable-user-account-control
maec-malware-behavior:maec-malware-behavior="drop-retrieve-debug-log-file"
+maec-malware-behavior:maec-malware-behavior="drop-retrieve-debug-log-file"
drop-retrieve-debug-log-file
maec-malware-behavior:maec-malware-behavior="elevate-privilege"
+maec-malware-behavior:maec-malware-behavior="elevate-privilege"
elevate-privilege
maec-malware-behavior:maec-malware-behavior="encrypt-data"
+maec-malware-behavior:maec-malware-behavior="encrypt-data"
encrypt-data
maec-malware-behavior:maec-malware-behavior="encrypt-files"
+maec-malware-behavior:maec-malware-behavior="encrypt-files"
encrypt-files
maec-malware-behavior:maec-malware-behavior="encrypt-self"
+maec-malware-behavior:maec-malware-behavior="encrypt-self"
encrypt-self
maec-malware-behavior:maec-malware-behavior="erase-data"
+maec-malware-behavior:maec-malware-behavior="erase-data"
erase-data
maec-malware-behavior:maec-malware-behavior="evade-static-heuristic"
+maec-malware-behavior:maec-malware-behavior="evade-static-heuristic"
evade-static-heuristic
maec-malware-behavior:maec-malware-behavior="execute-before-external-to-kernel-hypervisor"
+maec-malware-behavior:maec-malware-behavior="execute-before-external-to-kernel-hypervisor"
execute-before-external-to-kernel-hypervisor
maec-malware-behavior:maec-malware-behavior="execute-non-main-cpu-code"
+maec-malware-behavior:maec-malware-behavior="execute-non-main-cpu-code"
execute-non-main-cpu-code
maec-malware-behavior:maec-malware-behavior="execute-stealthy-code"
+maec-malware-behavior:maec-malware-behavior="execute-stealthy-code"
execute-stealthy-code
maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-covert channel"
+maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-covert channel"
exfiltrate-data-via-covert channel
maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via—dumpster-dive"
+maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via—dumpster-dive"
exfiltrate-data-via-dumpster-dives
maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-fax"
+maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-fax"
exfiltrate-data-via-fax
maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-network"
+maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-network"
exfiltrate-data-via-network
maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-physical-media"
+maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-physical-media"
exfiltrate-data-via-physical-media
maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-voip-phone"
+maec-malware-behavior:maec-malware-behavior="exfiltrate-data-via-voip-phone"
exfiltrate-data-via-voip-phone
maec-malware-behavior:maec-malware-behavior="feed-misinformation-during-physical-memory-acquisition"
+maec-malware-behavior:maec-malware-behavior="feed-misinformation-during-physical-memory-acquisition"
feed-misinformation-during-physical-memory-acquisition
maec-malware-behavior:maec-malware-behavior="file-system-instantiation"
+maec-malware-behavior:maec-malware-behavior="file-system-instantiation"
file-system-instantiation
maec-malware-behavior:maec-malware-behavior="fingerprint-host"
+maec-malware-behavior:maec-malware-behavior="fingerprint-host"
fingerprint-host
maec-malware-behavior:maec-malware-behavior="generate-c2-domain-names"
+maec-malware-behavior:maec-malware-behavior="generate-c2-domain-names"
generate-c2-domain-names
maec-malware-behavior:maec-malware-behavior="hide-arbitrary-virtual-memory"
+maec-malware-behavior:maec-malware-behavior="hide-arbitrary-virtual-memory"
hide-arbitrary-virtual-memory
maec-malware-behavior:maec-malware-behavior="hide-data-in-other-formats"
+maec-malware-behavior:maec-malware-behavior="hide-data-in-other-formats"
hide-data-in-other-formats
maec-malware-behavior:maec-malware-behavior="hide-file-system-artifacts"
+maec-malware-behavior:maec-malware-behavior="hide-file-system-artifacts"
hide-file-system-artifacts
maec-malware-behavior:maec-malware-behavior="hide-kernel-modules"
+maec-malware-behavior:maec-malware-behavior="hide-kernel-modules"
hide-kernel-modules
maec-malware-behavior:maec-malware-behavior="hide-network-traffic"
+maec-malware-behavior:maec-malware-behavior="hide-network-traffic"
hide-network-traffic
maec-malware-behavior:maec-malware-behavior="hide-open-network-ports"
+maec-malware-behavior:maec-malware-behavior="hide-open-network-ports"
hide-open-network-ports
maec-malware-behavior:maec-malware-behavior="hide-processes"
+maec-malware-behavior:maec-malware-behavior="hide-processes"
hide-processes
maec-malware-behavior:maec-malware-behavior="hide-services"
+maec-malware-behavior:maec-malware-behavior="hide-services"
hide-services
maec-malware-behavior:maec-malware-behavior="hide-threads"
+maec-malware-behavior:maec-malware-behavior="hide-threads"
hide-threads
maec-malware-behavior:maec-malware-behavior="hide-userspace-libraries"
+maec-malware-behavior:maec-malware-behavior="hide-userspace-libraries"
hide-userspace-libraries
maec-malware-behavior:maec-malware-behavior="identify-file"
+maec-malware-behavior:maec-malware-behavior="identify-file"
identify-file
maec-malware-behavior:maec-malware-behavior="identify-os"
+maec-malware-behavior:maec-malware-behavior="identify-os"
identify-os
maec-malware-behavior:maec-malware-behavior="identify-target-machines"
+maec-malware-behavior:maec-malware-behavior="identify-target-machines"
identify-target-machines
maec-malware-behavior:maec-malware-behavior="impersonate-user"
+maec-malware-behavior:maec-malware-behavior="impersonate-user"
impersonate-user
maec-malware-behavior:maec-malware-behavior="install-backdoor"
+maec-malware-behavior:maec-malware-behavior="install-backdoor"
install-backdoor
maec-malware-behavior:maec-malware-behavior="install-legitimate-software"
+maec-malware-behavior:maec-malware-behavior="install-legitimate-software"
install-legitimate-software
maec-malware-behavior:maec-malware-behavior="install-secondary-malware"
+maec-malware-behavior:maec-malware-behavior="install-secondary-malware"
install-secondary-malware
maec-malware-behavior:maec-malware-behavior="install-secondary-module"
+maec-malware-behavior:maec-malware-behavior="install-secondary-module"
install-secondary-module
maec-malware-behavior:maec-malware-behavior="intercept-manipulate-network-traffic"
+maec-malware-behavior:maec-malware-behavior="intercept-manipulate-network-traffic"
intercept-manipulate-network-traffic
maec-malware-behavior:maec-malware-behavior="inventory-security-products"
+maec-malware-behavior:maec-malware-behavior="inventory-security-products"
inventory-security-products
maec-malware-behavior:maec-malware-behavior="inventory-system-applications"
+maec-malware-behavior:maec-malware-behavior="inventory-system-applications"
inventory-system-applications
maec-malware-behavior:maec-malware-behavior="inventory-victims"
+maec-malware-behavior:maec-malware-behavior="inventory-victims"
inventory-victims
maec-malware-behavior:maec-malware-behavior="limit-application-type-version"
+maec-malware-behavior:maec-malware-behavior="limit-application-type-version"
limit-application-type-version
maec-malware-behavior:maec-malware-behavior="log-activity"
+maec-malware-behavior:maec-malware-behavior="log-activity"
log-activity
maec-malware-behavior:maec-malware-behavior="manipulate-file-system-data"
+maec-malware-behavior:maec-malware-behavior="manipulate-file-system-data"
manipulate-file-system-data
maec-malware-behavior:maec-malware-behavior="map-local-network"
+maec-malware-behavior:maec-malware-behavior="map-local-network"
map-local-network
maec-malware-behavior:maec-malware-behavior="mine-for-cryptocurrency"
+maec-malware-behavior:maec-malware-behavior="mine-for-cryptocurrency"
mine-for-cryptocurrency
maec-malware-behavior:maec-malware-behavior="modify-file"
+maec-malware-behavior:maec-malware-behavior="modify-file"
modify-file
maec-malware-behavior:maec-malware-behavior="modify-security-software-configuration"
+maec-malware-behavior:maec-malware-behavior="modify-security-software-configuration"
modify-security-software-configuration
maec-malware-behavior:maec-malware-behavior="move-data-to-staging-server"
+maec-malware-behavior:maec-malware-behavior="move-data-to-staging-server"
move-data-to-staging-server
maec-malware-behavior:maec-malware-behavior="obfuscate-artifact-properties"
+maec-malware-behavior:maec-malware-behavior="obfuscate-artifact-properties"
obfuscate-artifact-properties
maec-malware-behavior:maec-malware-behavior="overload-sandbox"
+maec-malware-behavior:maec-malware-behavior="overload-sandbox"
overload-sandbox
maec-malware-behavior:maec-malware-behavior="package-data"
+maec-malware-behavior:maec-malware-behavior="package-data"
package-data
maec-malware-behavior:maec-malware-behavior="persist-after-hardware-changes"
+maec-malware-behavior:maec-malware-behavior="persist-after-hardware-changes"
persist-after-hardware-changes
maec-malware-behavior:maec-malware-behavior="persist-after-os-changes"
+maec-malware-behavior:maec-malware-behavior="persist-after-os-changes"
persist-after-os-changes
maec-malware-behavior:maec-malware-behavior="persist-after-system-reboot"
+maec-malware-behavior:maec-malware-behavior="persist-after-system-reboot"
persist-after-system-reboot
maec-malware-behavior:maec-malware-behavior="prevent-api-unhooking"
+maec-malware-behavior:maec-malware-behavior="prevent-api-unhooking"
prevent-api-unhooking
maec-malware-behavior:maec-malware-behavior="prevent-concurrent-execution"
+maec-malware-behavior:maec-malware-behavior="prevent-concurrent-execution"
prevent-concurrent-execution
maec-malware-behavior:maec-malware-behavior="prevent-debugging"
+maec-malware-behavior:maec-malware-behavior="prevent-debugging"
prevent-debugging
maec-malware-behavior:maec-malware-behavior="prevent-file-access"
+maec-malware-behavior:maec-malware-behavior="prevent-file-access"
prevent-file-access
maec-malware-behavior:maec-malware-behavior="prevent-file-deletion"
+maec-malware-behavior:maec-malware-behavior="prevent-file-deletion"
prevent-file-deletion
maec-malware-behavior:maec-malware-behavior="prevent-memory-access"
+maec-malware-behavior:maec-malware-behavior="prevent-memory-access"
prevent-memory-access
maec-malware-behavior:maec-malware-behavior="prevent-native-api-hooking"
+maec-malware-behavior:maec-malware-behavior="prevent-native-api-hooking"
prevent-native-api-hooking
maec-malware-behavior:maec-malware-behavior="prevent-physical-memory-acquisition"
+maec-malware-behavior:maec-malware-behavior="prevent-physical-memory-acquisition"
prevent-physical-memory-acquisition
maec-malware-behavior:maec-malware-behavior="prevent-registry-access"
+maec-malware-behavior:maec-malware-behavior="prevent-registry-access"
prevent-registry-access
maec-malware-behavior:maec-malware-behavior="prevent-registry-deletion"
+maec-malware-behavior:maec-malware-behavior="prevent-registry-deletion"
prevent-registry-deletion
maec-malware-behavior:maec-malware-behavior="prevent-security-software-from-executing"
+maec-malware-behavior:maec-malware-behavior="prevent-security-software-from-executing"
prevent-security-software-from-executing
maec-malware-behavior:maec-malware-behavior="re-instantiate-self"
+maec-malware-behavior:maec-malware-behavior="re-instantiate-self"
re-instantiate-self
maec-malware-behavior:maec-malware-behavior="remove-self"
+maec-malware-behavior:maec-malware-behavior="remove-self"
remove-self
maec-malware-behavior:maec-malware-behavior="remove-sms-warning-messages"
+maec-malware-behavior:maec-malware-behavior="remove-sms-warning-messages"
remove-sms-warning-messages
maec-malware-behavior:maec-malware-behavior="remove-system-artifacts"
+maec-malware-behavior:maec-malware-behavior="remove-system-artifacts"
remove-system-artifacts
maec-malware-behavior:maec-malware-behavior="request-email-address-list"
+maec-malware-behavior:maec-malware-behavior="request-email-address-list"
request-email-address-list
maec-malware-behavior:maec-malware-behavior="request-email-template"
+maec-malware-behavior:maec-malware-behavior="request-email-template"
request-email-template
maec-malware-behavior:maec-malware-behavior="search-for-remote-machines"
+maec-malware-behavior:maec-malware-behavior="search-for-remote-machines"
search-for-remote-machines
maec-malware-behavior:maec-malware-behavior="send-beacon"
+maec-malware-behavior:maec-malware-behavior="send-beacon"
send-beacon
maec-malware-behavior:maec-malware-behavior="send-email-message"
+maec-malware-behavior:maec-malware-behavior="send-email-message"
send-email-message
maec-malware-behavior:maec-malware-behavior="social-engineering-based-remote-infection"
+maec-malware-behavior:maec-malware-behavior="social-engineering-based-remote-infection"
social-engineering-based-remote-infection
maec-malware-behavior:maec-malware-behavior="steal-browser-cache"
+maec-malware-behavior:maec-malware-behavior="steal-browser-cache"
steal-browser-cache
maec-malware-behavior:maec-malware-behavior="steal-browser-cookies"
+maec-malware-behavior:maec-malware-behavior="steal-browser-cookies"
steal-browser-cookies
maec-malware-behavior:maec-malware-behavior="steal-browser-history"
+maec-malware-behavior:maec-malware-behavior="steal-browser-history"
steal-browser-history
maec-malware-behavior:maec-malware-behavior="steal-contact-list-data"
+maec-malware-behavior:maec-malware-behavior="steal-contact-list-data"
steal-contact-list-data
maec-malware-behavior:maec-malware-behavior="steal-cryptocurrency-data"
+maec-malware-behavior:maec-malware-behavior="steal-cryptocurrency-data"
steal-cryptocurrency-data
maec-malware-behavior:maec-malware-behavior="steal-database-content"
+maec-malware-behavior:maec-malware-behavior="steal-database-content"
steal-database-content
maec-malware-behavior:maec-malware-behavior="steal-dialed-phone-numbers"
+maec-malware-behavior:maec-malware-behavior="steal-dialed-phone-numbers"
steal-dialed-phone-numbers
maec-malware-behavior:maec-malware-behavior="steal-digital-certificates"
+maec-malware-behavior:maec-malware-behavior="steal-digital-certificates"
steal-digital-certificates
maec-malware-behavior:maec-malware-behavior="steal-documents"
+maec-malware-behavior:maec-malware-behavior="steal-documents"
steal-documents
maec-malware-behavior:maec-malware-behavior="steal-email-data"
+maec-malware-behavior:maec-malware-behavior="steal-email-data"
steal-email-data
maec-malware-behavior:maec-malware-behavior="steal-images"
+maec-malware-behavior:maec-malware-behavior="steal-images"
steal-images
maec-malware-behavior:maec-malware-behavior="steal-password-hashes"
+maec-malware-behavior:maec-malware-behavior="steal-password-hashes"
steal-password-hashes
maec-malware-behavior:maec-malware-behavior="steal-pki-key"
+maec-malware-behavior:maec-malware-behavior="steal-pki-key"
steal-pki-key
maec-malware-behavior:maec-malware-behavior="steal-referrer-urls"
+maec-malware-behavior:maec-malware-behavior="steal-referrer-urls"
steal-referrer-urls
maec-malware-behavior:maec-malware-behavior="steal-serial-numbers"
+maec-malware-behavior:maec-malware-behavior="steal-serial-numbers"
steal-serial-numbers
maec-malware-behavior:maec-malware-behavior="steal-sms-database"
+maec-malware-behavior:maec-malware-behavior="steal-sms-database"
steal-sms-database
maec-malware-behavior:maec-malware-behavior="steal-web-network-credential"
+maec-malware-behavior:maec-malware-behavior="steal-web-network-credential"
steal-web-network-credential
maec-malware-behavior:maec-malware-behavior="stop-execution-of-security-software"
+maec-malware-behavior:maec-malware-behavior="stop-execution-of-security-software"
stop-execution-of-security-software
maec-malware-behavior:maec-malware-behavior="suicide-exit"
+maec-malware-behavior:maec-malware-behavior="suicide-exit"
suicide-exit
maec-malware-behavior:maec-malware-behavior="test-for-firewall"
+maec-malware-behavior:maec-malware-behavior="test-for-firewall"
test-for-firewall
maec-malware-behavior:maec-malware-behavior="test-for-internet-connectivity"
+maec-malware-behavior:maec-malware-behavior="test-for-internet-connectivity"
test-for-internet-connectivity
maec-malware-behavior:maec-malware-behavior="test-for-network-drives"
+maec-malware-behavior:maec-malware-behavior="test-for-network-drives"
test-for-network-drives
maec-malware-behavior:maec-malware-behavior="test-for-proxy"
+maec-malware-behavior:maec-malware-behavior="test-for-proxy"
test-for-proxy
maec-malware-behavior:maec-malware-behavior="test-smtp-connection"
+maec-malware-behavior:maec-malware-behavior="test-smtp-connection"
test-smtp-connection
maec-malware-behavior:maec-malware-behavior="update-configuration"
+maec-malware-behavior:maec-malware-behavior="update-configuration"
update-configuration
maec-malware-behavior:maec-malware-behavior="validate-data"
+maec-malware-behavior:maec-malware-behavior="validate-data"
validate-data
maec-malware-behavior:maec-malware-behavior="write-code-into-file"
+maec-malware-behavior:maec-malware-behavior="write-code-into-file"
write-code-into-file
maec-malware-capability
maec-malware-capabilities:maec-malware-capability="anti-behavioral-analysis"
+maec-malware-capabilities:maec-malware-capability="anti-behavioral-analysis"
anti-behavioral-analysis
maec-malware-capabilities:maec-malware-capability="anti-code-analysis"
+maec-malware-capabilities:maec-malware-capability="anti-code-analysis"
anti-code-analysis
maec-malware-capabilities:maec-malware-capability="anti-detection"
+maec-malware-capabilities:maec-malware-capability="anti-detection"
anti-detection
maec-malware-capabilities:maec-malware-capability="anti-removal"
+maec-malware-capabilities:maec-malware-capability="anti-removal"
anti-removal
maec-malware-capabilities:maec-malware-capability="availability-violation"
+maec-malware-capabilities:maec-malware-capability="availability-violation"
availability-violation
maec-malware-capabilities:maec-malware-capability="collection"
+maec-malware-capabilities:maec-malware-capability="collection"
collection
maec-malware-capabilities:maec-malware-capability="command-and-control"
+maec-malware-capabilities:maec-malware-capability="command-and-control"
command-and-control
maec-malware-capabilities:maec-malware-capability="data-theft"
+maec-malware-capabilities:maec-malware-capability="data-theft"
data-theft
maec-malware-capabilities:maec-malware-capability="destruction"
+maec-malware-capabilities:maec-malware-capability="destruction"
destruction
maec-malware-capabilities:maec-malware-capability="discovery"
+maec-malware-capabilities:maec-malware-capability="discovery"
discovery
maec-malware-capabilities:maec-malware-capability="exfiltration"
+maec-malware-capabilities:maec-malware-capability="exfiltration"
exfiltration
maec-malware-capabilities:maec-malware-capability="fraud"
+maec-malware-capabilities:maec-malware-capability="fraud"
fraud
maec-malware-capabilities:maec-malware-capability="infection-propagation"
+maec-malware-capabilities:maec-malware-capability="infection-propagation"
infection-propagation
maec-malware-capabilities:maec-malware-capability="integrity-violation"
+maec-malware-capabilities:maec-malware-capability="integrity-violation"
integrity-violationk
maec-malware-capabilities:maec-malware-capability="machine-access-control"
+maec-malware-capabilities:maec-malware-capability="machine-access-control"
machine-access-control
maec-malware-capabilities:maec-malware-capability="persistence"
+maec-malware-capabilities:maec-malware-capability="persistence"
persistence
maec-malware-capabilities:maec-malware-capability="privilege-escalation"
+maec-malware-capabilities:maec-malware-capability="privilege-escalation"
privilege-escalation
maec-malware-capabilities:maec-malware-capability="secondary-operation"
+maec-malware-capabilities:maec-malware-capability="secondary-operation"
secondary-operation
maec-malware-capabilities:maec-malware-capability="security-degradation"
+maec-malware-capabilities:maec-malware-capability="security-degradation"
security-degradation
maec-malware-capabilities:maec-malware-capability="access-control-degradation"
+maec-malware-capabilities:maec-malware-capability="access-control-degradation"
access-control-degradation
maec-malware-capabilities:maec-malware-capability="anti-debugging"
+maec-malware-capabilities:maec-malware-capability="anti-debugging"
anti-debugging
maec-malware-capabilities:maec-malware-capability="anti-disassembly"
+maec-malware-capabilities:maec-malware-capability="anti-disassembly"
anti-disassembly
maec-malware-capabilities:maec-malware-capability="anti-emulation"
+maec-malware-capabilities:maec-malware-capability="anti-emulation"
anti-emulation
maec-malware-capabilities:maec-malware-capability="anti-memory-forensics"
+maec-malware-capabilities:maec-malware-capability="anti-memory-forensics"
anti-memory-forensics
maec-malware-capabilities:maec-malware-capability="anti-sandbox"
+maec-malware-capabilities:maec-malware-capability="anti-sandbox"
anti-sandbox
maec-malware-capabilities:maec-malware-capability="anti-virus-evasion"
+maec-malware-capabilities:maec-malware-capability="anti-virus-evasion"
anti-virus-evasion
maec-malware-capabilities:maec-malware-capability="anti-vm"
+maec-malware-capabilities:maec-malware-capability="anti-vm"
anti-vm
maec-malware-capabilities:maec-malware-capability="authentication-credentials-theft"
+maec-malware-capabilities:maec-malware-capability="authentication-credentials-theft"
authentication-credentials-theft
maec-malware-capabilities:maec-malware-capability="clean-traces-of-infection"
+maec-malware-capabilities:maec-malware-capability="clean-traces-of-infection"
clean-traces-of-infection
maec-malware-capabilities:maec-malware-capability="communicate-with-c2-server"
+maec-malware-capabilities:maec-malware-capability="communicate-with-c2-server"
communicate-with-c2-servern
maec-malware-capabilities:maec-malware-capability="compromise-data-availability"
+maec-malware-capabilities:maec-malware-capability="compromise-data-availability"
compromise-data-availability
maec-malware-capabilities:maec-malware-capability="compromise-system-availability"
+maec-malware-capabilities:maec-malware-capability="compromise-system-availability"
compromise-system-availability
maec-malware-capabilities:maec-malware-capability="consume-system-resources"
+maec-malware-capabilities:maec-malware-capability="consume-system-resources"
consume-system-resources
maec-malware-capabilities:maec-malware-capability="continuous-execution"
+maec-malware-capabilities:maec-malware-capability="continuous-execution"
continuous-execution
maec-malware-capabilities:maec-malware-capability="data-integrity-violation"
+maec-malware-capabilities:maec-malware-capability="data-integrity-violation"
data-integrity-violation
maec-malware-capabilities:maec-malware-capability="data-obfuscation"
+maec-malware-capabilities:maec-malware-capability="data-obfuscation"
data-obfuscation
maec-malware-capabilities:maec-malware-capability="data-staging"
+maec-malware-capabilities:maec-malware-capability="data-staging"
data-staging
maec-malware-capabilities:maec-malware-capability="determine-c2-server"
+maec-malware-capabilities:maec-malware-capability="determine-c2-server"
determine-c2-server
maec-malware-capabilities:maec-malware-capability="email-spam"
+maec-malware-capabilities:maec-malware-capability="email-spam"
email-spam
maec-malware-capabilities:maec-malware-capability="ensure-compatibility"
+maec-malware-capabilities:maec-malware-capability="ensure-compatibility"
ensure-compatibility
maec-malware-capabilities:maec-malware-capability="environment-awareness"
+maec-malware-capabilities:maec-malware-capability="environment-awareness"
environment-awareness
maec-malware-capabilities:maec-malware-capability="file-infection"
+maec-malware-capabilities:maec-malware-capability="file-infection"
file-infection
maec-malware-capabilities:maec-malware-capability="hide-artifacts"
+maec-malware-capabilities:maec-malware-capability="hide-artifacts"
hide-artifacts
maec-malware-capabilities:maec-malware-capability="hide-executing-code"
+maec-malware-capabilities:maec-malware-capability="hide-executing-code"
hide-executing-code
maec-malware-capabilities:maec-malware-capability="hide-non-executing-code"
+maec-malware-capabilities:maec-malware-capability="hide-non-executing-code"
hide-non-executing-code
maec-malware-capabilities:maec-malware-capability="host-configuration-probing"
+maec-malware-capabilities:maec-malware-capability="host-configuration-probing"
host-configuration-probing
maec-malware-capabilities:maec-malware-capability="information-gathering-for-improvement"
+maec-malware-capabilities:maec-malware-capability="information-gathering-for-improvement"
information-gathering-for-improvement
maec-malware-capabilities:maec-malware-capability="input-peripheral-capture"
+maec-malware-capabilities:maec-malware-capability="input-peripheral-capture"
input-peripheral-capture
maec-malware-capabilities:maec-malware-capability="install-other-components"
+maec-malware-capabilities:maec-malware-capability="install-other-components"
install-other-components
maec-malware-capabilities:maec-malware-capability="local-machine-control"
+maec-malware-capabilities:maec-malware-capability="local-machine-control"
local-machine-control
maec-malware-capabilities:maec-malware-capability="network-environment-probing"
+maec-malware-capabilities:maec-malware-capability="network-environment-probing"
network-environment-probing
maec-malware-capabilities:maec-malware-capability="os-security-feature-degradation"
+maec-malware-capabilities:maec-malware-capability="os-security-feature-degradation"
os-security-feature-degradation
maec-malware-capabilities:maec-malware-capability="output-peripheral-capture"
+maec-malware-capabilities:maec-malware-capability="output-peripheral-capture"
output-peripheral-capture
maec-malware-capabilities:maec-malware-capability="physical-entity-destruction"
+maec-malware-capabilities:maec-malware-capability="physical-entity-destruction"
physical-entity-destruction
maec-malware-capabilities:maec-malware-capability="prevent-artifact-access"
+maec-malware-capabilities:maec-malware-capability="prevent-artifact-access"
prevent-artifact-access
maec-malware-capabilities:maec-malware-capability="prevent-artifact-deletion"
+maec-malware-capabilities:maec-malware-capability="prevent-artifact-deletion"
prevent-artifact-deletion
maec-malware-capabilities:maec-malware-capability="remote-machine-access"
+maec-malware-capabilities:maec-malware-capability="remote-machine-access"
remote-machine-access
maec-malware-capabilities:maec-malware-capability="security-software-degradation"
+maec-malware-capabilities:maec-malware-capability="security-software-degradation"
security-software-degradation
maec-malware-capabilities:maec-malware-capability="security-software-evasion"
+maec-malware-capabilities:maec-malware-capability="security-software-evasion"
security-software-evasion
maec-malware-capabilities:maec-malware-capability="self-modification"
+maec-malware-capabilities:maec-malware-capability="self-modification"
self-modification
maec-malware-capabilities:maec-malware-capability="service-provider-security-feature-degradation"
+maec-malware-capabilities:maec-malware-capability="service-provider-security-feature-degradation"
service-provider-security-feature-degradation
maec-malware-capabilities:maec-malware-capability="stored-information-theft"
+maec-malware-capabilities:maec-malware-capability="stored-information-theft"
stored-information-theft
maec-malware-capabilities:maec-malware-capability="system-interface-data-capture"
+maec-malware-capabilities:maec-malware-capability="system-interface-data-capture"
system-interface-data-capture
maec-malware-capabilities:maec-malware-capability="system-operational-integrity-violation"
+maec-malware-capabilities:maec-malware-capability="system-operational-integrity-violation"
system-operational-integrity-violation
maec-malware-capabilities:maec-malware-capability="system-re-infection"
+maec-malware-capabilities:maec-malware-capability="system-re-infection"
system-re-infection
maec-malware-capabilities:maec-malware-capability="system-state-data-capture"
+maec-malware-capabilities:maec-malware-capability="system-state-data-capture"
system-state-data-capture
maec-malware-capabilities:maec-malware-capability="system-update-degradation"
+maec-malware-capabilities:maec-malware-capability="system-update-degradation"
system-update-degradation
maec-malware-capabilities:maec-malware-capability="user-data-theft"
+maec-malware-capabilities:maec-malware-capability="user-data-theft"
user-data-theft
maec-malware-capabilities:maec-malware-capability="virtual-entity-destruction"
+maec-malware-capabilities:maec-malware-capability="virtual-entity-destruction"
virtual-entity-destruction
maec-obfuscation-methods
maec-malware-obfuscation-methods:maec-obfuscation-methods="packing"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="packing"
packing
maec-malware-obfuscation-methods:maec-obfuscation-methods="code-encryption"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="code-encryption"
code-encryption
maec-malware-obfuscation-methods:maec-obfuscation-methods="dead-code-insertion"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="dead-code-insertion"
dead-code-insertion
maec-malware-obfuscation-methods:maec-obfuscation-methods="entry-point-obfuscation"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="entry-point-obfuscation"
entry-point-obfuscation
maec-malware-obfuscation-methods:maec-obfuscation-methods="import-address-table-obfuscation"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="import-address-table-obfuscation"
import-address-table-obfuscation
maec-malware-obfuscation-methods:maec-obfuscation-methods="interleaving-code"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="interleaving-code"
interleaving-code
maec-malware-obfuscation-methods:maec-obfuscation-methods="symbolic-obfuscation"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="symbolic-obfuscation"
symbolic-obfuscation
maec-malware-obfuscation-methods:maec-obfuscation-methods="string-obfuscation"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="string-obfuscation"
string-obfuscation
maec-malware-obfuscation-methods:maec-obfuscation-methods="subroutine-reordering"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="subroutine-reordering"
subroutine-reordering
maec-malware-obfuscation-methods:maec-obfuscation-methods="code-transposition"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="code-transposition"
code-transposition
maec-malware-obfuscation-methods:maec-obfuscation-methods="instruction-substitution"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="instruction-substitution"
instruction-substitution
maec-malware-obfuscation-methods:maec-obfuscation-methods="register-reassignment"
+maec-malware-obfuscation-methods:maec-obfuscation-methods="register-reassignment"
register-reassignment
malware-category
malware_classification:malware-category="Virus"
+malware_classification:malware-category="Virus"
Virus
malware_classification:malware-category="Worm"
+malware_classification:malware-category="Worm"
Worm
malware_classification:malware-category="Trojan"
+malware_classification:malware-category="Trojan"
Trojan
malware_classification:malware-category="Ransomware"
+malware_classification:malware-category="Ransomware"
Ransomware
malware_classification:malware-category="Rootkit"
+malware_classification:malware-category="Rootkit"
Rootkit
malware_classification:malware-category="Downloader"
+malware_classification:malware-category="Downloader"
Downloader
malware_classification:malware-category="Adware"
+malware_classification:malware-category="Adware"
Adware
malware_classification:malware-category="Spyware"
+malware_classification:malware-category="Spyware"
Spyware
malware_classification:malware-category="Botnet"
+malware_classification:malware-category="Botnet"
Botnet
obfuscation-technique
malware_classification:obfuscation-technique="no-obfuscation"
+malware_classification:obfuscation-technique="no-obfuscation"
No obfuscation is used
malware_classification:obfuscation-technique="encryption"
+malware_classification:obfuscation-technique="encryption"
encryption
malware_classification:obfuscation-technique="oligomorphism"
+malware_classification:obfuscation-technique="oligomorphism"
oligomorphism
malware_classification:obfuscation-technique="metamorphism"
+malware_classification:obfuscation-technique="metamorphism"
metamorphism
malware_classification:obfuscation-technique="stealth"
+malware_classification:obfuscation-technique="stealth"
stealth
malware_classification:obfuscation-technique="armouring"
+malware_classification:obfuscation-technique="armouring"
armouring
malware_classification:obfuscation-technique="tunneling"
+malware_classification:obfuscation-technique="tunneling"
tunneling
malware_classification:obfuscation-technique="XOR"
+malware_classification:obfuscation-technique="XOR"
XOR
malware_classification:obfuscation-technique="BASE64"
+malware_classification:obfuscation-technique="BASE64"
BASE64
malware_classification:obfuscation-technique="ROT13"
+malware_classification:obfuscation-technique="ROT13"
ROT13
payload-classification
malware_classification:payload-classification="no-payload"
+malware_classification:payload-classification="no-payload"
No payload
malware_classification:payload-classification="non-destructive"
+malware_classification:payload-classification="non-destructive"
Non-Destructive
malware_classification:payload-classification="destructive"
+malware_classification:payload-classification="destructive"
Destructive
malware_classification:payload-classification="dropper"
+malware_classification:payload-classification="dropper"
Dropper
memory-classification
malware_classification:memory-classification="resident"
+malware_classification:memory-classification="resident"
In memory
malware_classification:memory-classification="temporary-resident"
+malware_classification:memory-classification="temporary-resident"
In memory temporarily
malware_classification:memory-classification="swapping-mode"
+malware_classification:memory-classification="swapping-mode"
Only a part loaded in memory temporarily
malware_classification:memory-classification="non-resident"
+malware_classification:memory-classification="non-resident"
Not in memory
malware_classification:memory-classification="user-process"
+malware_classification:memory-classification="user-process"
As a user level process
malware_classification:memory-classification="kernel-process"
+malware_classification:memory-classification="kernel-process"
As a process in the kernel
ui
misp:ui="hide"
+misp:ui="hide"
tag to hide from the user-interface.
api
misp:api="hide"
+misp:api="hide"
tag to hide from the API.
misp:expansion="block"
+misp:expansion="block"
block
contributor
misp:contributor="pgpfingerprint"
+misp:contributor="pgpfingerprint"
OpenPGP Fingerprint
confidence-level
misp:confidence-level="completely-confident"
+misp:confidence-level="completely-confident"
Completely confident
misp:confidence-level="usually-confident"
+misp:confidence-level="usually-confident"
Usually confident
misp:confidence-level="fairly-confident"
+misp:confidence-level="fairly-confident"
Fairly confident
misp:confidence-level="rarely-confident"
+misp:confidence-level="rarely-confident"
Rarely confident
misp:confidence-level="unconfident"
+misp:confidence-level="unconfident"
Unconfident
misp:confidence-level="confidence-cannot-be-evalued"
+misp:confidence-level="confidence-cannot-be-evalued"
Confidence cannot be evaluated
threat-level
misp:threat-level="no-risk"
+misp:threat-level="no-risk"
No risk
misp:threat-level="low-risk"
+misp:threat-level="low-risk"
Low risk
misp:threat-level="medium-risk"
+misp:threat-level="medium-risk"
Medium risk
misp:threat-level="high-risk"
+misp:threat-level="high-risk"
High risk
misp:automation-level="unsupervised"
+misp:automation-level="unsupervised"
Generated automatically without human verification
misp:automation-level="reviewed"
+misp:automation-level="reviewed"
Generated automatically but verified by a human
misp:automation-level="manual"
+misp:automation-level="manual"
Output of human analysis
Tool associated with the information taggged
misp:tool="misp2stix"
+misp:tool="misp2stix"
misp2stix
malware-type
ms-caro-malware:malware-type="Adware"
+ms-caro-malware:malware-type="Adware"
Adware - Software that shows you extra promotions that you cannot control as you use your PC
ms-caro-malware:malware-type="Backdoor"
+ms-caro-malware:malware-type="Backdoor"
A type of trojan that gives a malicious hacker access to and control of your PC
ms-caro-malware:malware-type="Behavior"
+ms-caro-malware:malware-type="Behavior"
A type of detection based on file actions that are often associated with malicious activity
ms-caro-malware:malware-type="BroswerModifier"
+ms-caro-malware:malware-type="BroswerModifier"
A program than makes changes to your Internet browser without your permission
ms-caro-malware:malware-type="Constructor"
+ms-caro-malware:malware-type="Constructor"
A program that can be used to automatically create malware files
ms-caro-malware:malware-type="DDoS"
+ms-caro-malware:malware-type="DDoS"
When a number of PCs are made to access a website, network or server repeatedly within a given time period. The aim of the attack is to overload the target so that it crashes and can’t respond
ms-caro-malware:malware-type="Dialer"
+ms-caro-malware:malware-type="Dialer"
A program that makes unauthorized telephone calls. These calls may be charged at a premium rate and cost you a lot of money
ms-caro-malware:malware-type="DoS"
+ms-caro-malware:malware-type="DoS"
When a target PC or server is deliberately overloaded so that it doesn’t work for any visitors anymore
ms-caro-malware:malware-type="Exploit"
+ms-caro-malware:malware-type="Exploit"
A piece of code that uses software vulnerabilities to access information on your PC or install malware
ms-caro-malware:malware-type="HackTool"
+ms-caro-malware:malware-type="HackTool"
A type of tool that can be used to allow and maintain unauthorized access to your PC
ms-caro-malware:malware-type="Joke"
+ms-caro-malware:malware-type="Joke"
A program that pretends to do something malicious but actually doesn’t actually do anything harmful. For example, some joke programs pretend to delete files or format disks
ms-caro-malware:malware-type="Misleading"
+ms-caro-malware:malware-type="Misleading"
The program that makes misleading or fraudulent claims about files, registry entries or other items on your PC
ms-caro-malware:malware-type="MonitoringTool"
+ms-caro-malware:malware-type="MonitoringTool"
A commercial program that monitors what you do on your PC. This can include monitoring what keys you press; your email or instant messages; your voice or video conversations; and your banking details and passwords. It can also take screenshots as you use your PC
ms-caro-malware:malware-type="Program"
+ms-caro-malware:malware-type="Program"
Software that you may or may not want installed on your PC
ms-caro-malware:malware-type="PUA"
+ms-caro-malware:malware-type="PUA"
Potentially Unwanted Applications. Characteristics of unwanted software can include depriving users of adequate choice or control over what the software does to the computer, preventing users from removing the software, or displaying advertisements without clearly identifying their source.
ms-caro-malware:malware-type="PWS"
+ms-caro-malware:malware-type="PWS"
A type of malware that is used steal your personal information, such as user names and passwords. It often works along with a keylogger that collects and sends information about what keys you press and websites you visit to a malicious hacker
ms-caro-malware:malware-type="Ransom"
+ms-caro-malware:malware-type="Ransom"
A detection for malicious programs that seize control of the computer on which they are installed. This trojan usually locks the screen and prevents the user from using the computer. It usually displays an alert message.
ms-caro-malware:malware-type="RemoteAccess"
+ms-caro-malware:malware-type="RemoteAccess"
A program that gives someone access to your PC from a remote location. This type of program is often installed by the computer owner
ms-caro-malware:malware-type="Rogue"
+ms-caro-malware:malware-type="Rogue"
Software that pretends to be an antivirus program but doesn’t actually provide any security. This type of software usually gives you a lot of alerts about threats on your PC that don’t exist. It also tries to convince you to pay for its services
ms-caro-malware:malware-type="SettingsModifier"
+ms-caro-malware:malware-type="SettingsModifier"
A program that changes your PC settings
ms-caro-malware:malware-type="SoftwareBundler"
+ms-caro-malware:malware-type="SoftwareBundler"
A program that installs unwanted software on your PC at the same time as the software you are trying to install, without adequate consent
ms-caro-malware:malware-type="Spammer"
+ms-caro-malware:malware-type="Spammer"
A trojan that sends large numbers of spam emails. It may also describe the person or business responsible for sending spam
ms-caro-malware:malware-type="Spoofer"
+ms-caro-malware:malware-type="Spoofer"
A type of trojan that makes fake emails that look like they are from a legitimate source
ms-caro-malware:malware-type="Spyware"
+ms-caro-malware:malware-type="Spyware"
A program that collects your personal information, such as your browsing history, and uses it without adequate consent
ms-caro-malware:malware-type="Tool"
+ms-caro-malware:malware-type="Tool"
A type of software that may have a legitimate purpose, but which may also be abused by malware authors
ms-caro-malware:malware-type="Trojan"
+ms-caro-malware:malware-type="Trojan"
A trojan is a program that tries to look innocent, but is actually a malicious application. Unlike a virus or a worm , a trojan doesn’t spread by itself. Instead they try to look innocent to convince you to download and install them. Once installed, a trojan can steal your personal information, download more malware, or give a malicious hacker access to your PC
ms-caro-malware:malware-type="TrojanClicker"
+ms-caro-malware:malware-type="TrojanClicker"
A type of trojan that can use your PC to click on websites or applications. They are usually used to make money for a malicious hacker by clicking on online advertisements and making it look like the website gets more traffic than it does. They can also be used to skew online polls, install programs on your PC, or make unwanted software appear more popular than it is
ms-caro-malware:malware-type="TrojanDownloader"
+ms-caro-malware:malware-type="TrojanDownloader"
A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.
ms-caro-malware:malware-type="TrojanDropper"
+ms-caro-malware:malware-type="TrojanDropper"
A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.
ms-caro-malware:malware-type="TrojanNotifier"
+ms-caro-malware:malware-type="TrojanNotifier"
A type of trojan that sends information about your PC to a malicious hacker. It is similar to a password stealer
ms-caro-malware:malware-type="TrojanProxy"
+ms-caro-malware:malware-type="TrojanProxy"
A type of trojan that installs a proxy server on your PC. The server can be configured so that when you use the Internet, any requests you make are sent through a server controlled by a malicious hacker.
ms-caro-malware:malware-type="TrojanSpy"
+ms-caro-malware:malware-type="TrojanSpy"
A program that collects your personal information, such as your browsing history, and uses it without adequate consent.
ms-caro-malware:malware-type="VirTool"
+ms-caro-malware:malware-type="VirTool"
A detection that is used mostly for malware components, or tools used for malware-related actions, such as rootkits.
ms-caro-malware:malware-type="Virus"
+ms-caro-malware:malware-type="Virus"
A type of malware. Viruses spread on their own by attaching their code to other programs, or copying themselves across systems and networks.
ms-caro-malware:malware-type="Worm"
+ms-caro-malware:malware-type="Worm"
A type of malware that spreads to other PCs. Worms may spread using one or more of the following methods: Email programs, Instant messaging programs, File-sharing programs, Social networking sites, Network shares, Removable drives with Autorun enabled, Software vulnerabilities
malware-platform
ms-caro-malware:malware-platform="AndroidOS"
+ms-caro-malware:malware-platform="AndroidOS"
Android operating system
ms-caro-malware:malware-platform="DOS"
+ms-caro-malware:malware-platform="DOS"
MS-DOS platform
ms-caro-malware:malware-platform="EPOC"
+ms-caro-malware:malware-platform="EPOC"
Psion devices
ms-caro-malware:malware-platform="FreeBSD"
+ms-caro-malware:malware-platform="FreeBSD"
FreeBSD platform
ms-caro-malware:malware-platform="iPhoneOS"
+ms-caro-malware:malware-platform="iPhoneOS"
iPhone operating system
ms-caro-malware:malware-platform="Linux"
+ms-caro-malware:malware-platform="Linux"
Linux platform
ms-caro-malware:malware-platform="MacOS"
+ms-caro-malware:malware-platform="MacOS"
MAC 9.x platform or earlier
ms-caro-malware:malware-platform="MacOS_X"
+ms-caro-malware:malware-platform="MacOS_X"
MacOS X or later
ms-caro-malware:malware-platform="OS2"
+ms-caro-malware:malware-platform="OS2"
OS2 platform
ms-caro-malware:malware-platform="Palm"
+ms-caro-malware:malware-platform="Palm"
Palm operating system
ms-caro-malware:malware-platform="Solaris"
+ms-caro-malware:malware-platform="Solaris"
System V-based Unix platforms
ms-caro-malware:malware-platform="SunOS"
+ms-caro-malware:malware-platform="SunOS"
Unix platforms 4.1.3 or earlier
ms-caro-malware:malware-platform="SymbOS"
+ms-caro-malware:malware-platform="SymbOS"
Symbian operatings system
ms-caro-malware:malware-platform="Unix"
+ms-caro-malware:malware-platform="Unix"
General Unix platforms
ms-caro-malware:malware-platform="Win16"
+ms-caro-malware:malware-platform="Win16"
Win16 (3.1) platform
ms-caro-malware:malware-platform="Win2K"
+ms-caro-malware:malware-platform="Win2K"
Windows 2000 platform
ms-caro-malware:malware-platform="Win32"
+ms-caro-malware:malware-platform="Win32"
Windows 32-bit platform
ms-caro-malware:malware-platform="Win64"
+ms-caro-malware:malware-platform="Win64"
Windows 64-bit platform
ms-caro-malware:malware-platform="Win95"
+ms-caro-malware:malware-platform="Win95"
Windows 95, 98 and ME platforms
ms-caro-malware:malware-platform="Win98"
+ms-caro-malware:malware-platform="Win98"
Windows 98 platform only
ms-caro-malware:malware-platform="WinCE"
+ms-caro-malware:malware-platform="WinCE"
Windows CE platform
ms-caro-malware:malware-platform="WinNT"
+ms-caro-malware:malware-platform="WinNT"
WinNT
ms-caro-malware:malware-platform="ABAP"
+ms-caro-malware:malware-platform="ABAP"
Advanced Business Application Programming scripts
ms-caro-malware:malware-platform="ALisp"
+ms-caro-malware:malware-platform="ALisp"
ALisp scripts
ms-caro-malware:malware-platform="AmiPro"
+ms-caro-malware:malware-platform="AmiPro"
AmiPro script
ms-caro-malware:malware-platform="ANSI"
+ms-caro-malware:malware-platform="ANSI"
American National Standards Institute scripts
ms-caro-malware:malware-platform="AppleScript"
+ms-caro-malware:malware-platform="AppleScript"
compiled Apple scripts
ms-caro-malware:malware-platform="ASP"
+ms-caro-malware:malware-platform="ASP"
Active Server Pages scripts
ms-caro-malware:malware-platform="AutoIt"
+ms-caro-malware:malware-platform="AutoIt"
AutoIT scripts
ms-caro-malware:malware-platform="BAS"
+ms-caro-malware:malware-platform="BAS"
Basic scripts
ms-caro-malware:malware-platform="BAT"
+ms-caro-malware:malware-platform="BAT"
Basic scripts
ms-caro-malware:malware-platform="CorelScript"
+ms-caro-malware:malware-platform="CorelScript"
Corelscript scripts
ms-caro-malware:malware-platform="HTA"
+ms-caro-malware:malware-platform="HTA"
HTML Application scripts
ms-caro-malware:malware-platform="HTML"
+ms-caro-malware:malware-platform="HTML"
HTML Application scripts
ms-caro-malware:malware-platform="INF"
+ms-caro-malware:malware-platform="INF"
Install scripts
ms-caro-malware:malware-platform="IRC"
+ms-caro-malware:malware-platform="IRC"
mIRC/pIRC scripts
ms-caro-malware:malware-platform="Java"
+ms-caro-malware:malware-platform="Java"
Java binaries (classes)
ms-caro-malware:malware-platform="JS"
+ms-caro-malware:malware-platform="JS"
Javascript scripts
ms-caro-malware:malware-platform="LOGO"
+ms-caro-malware:malware-platform="LOGO"
LOGO scripts
ms-caro-malware:malware-platform="MPB"
+ms-caro-malware:malware-platform="MPB"
MapBasic scripts
ms-caro-malware:malware-platform="MSH"
+ms-caro-malware:malware-platform="MSH"
Monad shell scripts
ms-caro-malware:malware-platform="MSIL"
+ms-caro-malware:malware-platform="MSIL"
ms-caro-malware:malware-platform="Perl"
+ms-caro-malware:malware-platform="Perl"
Perl scripts
ms-caro-malware:malware-platform="PHP"
+ms-caro-malware:malware-platform="PHP"
Hypertext Preprocessor scripts
ms-caro-malware:malware-platform="Python"
+ms-caro-malware:malware-platform="Python"
Python scripts
ms-caro-malware:malware-platform="SAP"
+ms-caro-malware:malware-platform="SAP"
SAP platform scripts
ms-caro-malware:malware-platform="SH"
+ms-caro-malware:malware-platform="SH"
Shell scripts
ms-caro-malware:malware-platform="VBA"
+ms-caro-malware:malware-platform="VBA"
Visual Basic for Applications scripts
ms-caro-malware:malware-platform="VBS"
+ms-caro-malware:malware-platform="VBS"
Visual Basic scripts
ms-caro-malware:malware-platform="WinBAT"
+ms-caro-malware:malware-platform="WinBAT"
Winbatch scripts
ms-caro-malware:malware-platform="WinHlp"
+ms-caro-malware:malware-platform="WinHlp"
Windows Help scripts
ms-caro-malware:malware-platform="WinREG"
+ms-caro-malware:malware-platform="WinREG"
Windows registry scripts
ms-caro-malware:malware-platform="A97M"
+ms-caro-malware:malware-platform="A97M"
Access 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware:malware-platform="HE"
+ms-caro-malware:malware-platform="HE"
macro scripting
ms-caro-malware:malware-platform="O97M"
+ms-caro-malware:malware-platform="O97M"
Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and Powerpoint
ms-caro-malware:malware-platform="PP97M"
+ms-caro-malware:malware-platform="PP97M"
PowerPoint 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware:malware-platform="V5M"
+ms-caro-malware:malware-platform="V5M"
Visio5 macros
ms-caro-malware:malware-platform="W1M"
+ms-caro-malware:malware-platform="W1M"
Word1Macro
ms-caro-malware:malware-platform="W2M"
+ms-caro-malware:malware-platform="W2M"
Word2Macro
ms-caro-malware:malware-platform="W97M"
+ms-caro-malware:malware-platform="W97M"
Word 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware:malware-platform="WM"
+ms-caro-malware:malware-platform="WM"
Word 95 macros
ms-caro-malware:malware-platform="X97M"
+ms-caro-malware:malware-platform="X97M"
Excel 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware:malware-platform="XF"
+ms-caro-malware:malware-platform="XF"
Excel formulas
ms-caro-malware:malware-platform="XM"
+ms-caro-malware:malware-platform="XM"
Excel 95 macros
ms-caro-malware:malware-platform="ASX"
+ms-caro-malware:malware-platform="ASX"
XML metafile of Windows Media .asf files
ms-caro-malware:malware-platform="HC"
+ms-caro-malware:malware-platform="HC"
HyperCard Apple scripts
ms-caro-malware:malware-platform="MIME"
+ms-caro-malware:malware-platform="MIME"
MIME packets
ms-caro-malware:malware-platform="Netware"
+ms-caro-malware:malware-platform="Netware"
Novell Netware files
ms-caro-malware:malware-platform="QT"
+ms-caro-malware:malware-platform="QT"
Quicktime files
ms-caro-malware:malware-platform="SB"
+ms-caro-malware:malware-platform="SB"
StarBasic (Staroffice XML) files
ms-caro-malware:malware-platform="SWF"
+ms-caro-malware:malware-platform="SWF"
Shockwave Flash files
ms-caro-malware:malware-platform="TSQL"
+ms-caro-malware:malware-platform="TSQL"
MS SQL server files
ms-caro-malware:malware-platform="XML"
+ms-caro-malware:malware-platform="XML"
XML files
malware-type
ms-caro-malware-full:malware-type="Adware"
+ms-caro-malware-full:malware-type="Adware"
Adware - Software that shows you extra promotions that you cannot control as you use your PC
ms-caro-malware-full:malware-type="Backdoor"
+ms-caro-malware-full:malware-type="Backdoor"
A type of trojan that gives a malicious hacker access to and control of your PC
ms-caro-malware-full:malware-type="Behavior"
+ms-caro-malware-full:malware-type="Behavior"
A type of detection based on file actions that are often associated with malicious activity
ms-caro-malware-full:malware-type="BroswerModifier"
+ms-caro-malware-full:malware-type="BroswerModifier"
A program than makes changes to your Internet browser without your permission
ms-caro-malware-full:malware-type="Constructor"
+ms-caro-malware-full:malware-type="Constructor"
A program that can be used to automatically create malware files
ms-caro-malware-full:malware-type="DDoS"
+ms-caro-malware-full:malware-type="DDoS"
When a number of PCs are made to access a website, network or server repeatedly within a given time period. The aim of the attack is to overload the target so that it crashes and can’t respond
ms-caro-malware-full:malware-type="Dialer"
+ms-caro-malware-full:malware-type="Dialer"
A program that makes unauthorized telephone calls. These calls may be charged at a premium rate and cost you a lot of money
ms-caro-malware-full:malware-type="DoS"
+ms-caro-malware-full:malware-type="DoS"
When a target PC or server is deliberately overloaded so that it doesn’t work for any visitors anymore
ms-caro-malware-full:malware-type="Exploit"
+ms-caro-malware-full:malware-type="Exploit"
A piece of code that uses software vulnerabilities to access information on your PC or install malware
ms-caro-malware-full:malware-type="HackTool"
+ms-caro-malware-full:malware-type="HackTool"
A type of tool that can be used to allow and maintain unauthorized access to your PC
ms-caro-malware-full:malware-type="Joke"
+ms-caro-malware-full:malware-type="Joke"
A program that pretends to do something malicious but actually doesn’t actually do anything harmful. For example, some joke programs pretend to delete files or format disks
ms-caro-malware-full:malware-type="Misleading"
+ms-caro-malware-full:malware-type="Misleading"
The program that makes misleading or fraudulent claims about files, registry entries or other items on your PC
ms-caro-malware-full:malware-type="MonitoringTool"
+ms-caro-malware-full:malware-type="MonitoringTool"
A commercial program that monitors what you do on your PC. This can include monitoring what keys you press; your email or instant messages; your voice or video conversations; and your banking details and passwords. It can also take screenshots as you use your PC
ms-caro-malware-full:malware-type="Program"
+ms-caro-malware-full:malware-type="Program"
Software that you may or may not want installed on your PC
ms-caro-malware-full:malware-type="PUA"
+ms-caro-malware-full:malware-type="PUA"
Potentially Unwanted Applications. Characteristics of unwanted software can include depriving users of adequate choice or control over what the software does to the computer, preventing users from removing the software, or displaying advertisements without clearly identifying their source.
ms-caro-malware-full:malware-type="PWS"
+ms-caro-malware-full:malware-type="PWS"
A type of malware that is used steal your personal information, such as user names and passwords. It often works along with a keylogger that collects and sends information about what keys you press and websites you visit to a malicious hacker
ms-caro-malware-full:malware-type="Ransom"
+ms-caro-malware-full:malware-type="Ransom"
A detection for malicious programs that seize control of the computer on which they are installed. This trojan usually locks the screen and prevents the user from using the computer. It usually displays an alert message.
ms-caro-malware-full:malware-type="RemoteAccess"
+ms-caro-malware-full:malware-type="RemoteAccess"
A program that gives someone access to your PC from a remote location. This type of program is often installed by the computer owner
ms-caro-malware-full:malware-type="Rogue"
+ms-caro-malware-full:malware-type="Rogue"
Software that pretends to be an antivirus program but doesn’t actually provide any security. This type of software usually gives you a lot of alerts about threats on your PC that don’t exist. It also tries to convince you to pay for its services
ms-caro-malware-full:malware-type="SettingsModifier"
+ms-caro-malware-full:malware-type="SettingsModifier"
A program that changes your PC settings
ms-caro-malware-full:malware-type="SoftwareBundler"
+ms-caro-malware-full:malware-type="SoftwareBundler"
A program that installs unwanted software on your PC at the same time as the software you are trying to install, without adequate consent
ms-caro-malware-full:malware-type="Spammer"
+ms-caro-malware-full:malware-type="Spammer"
A trojan that sends large numbers of spam emails. It may also describe the person or business responsible for sending spam
ms-caro-malware-full:malware-type="Spoofer"
+ms-caro-malware-full:malware-type="Spoofer"
A type of trojan that makes fake emails that look like they are from a legitimate source
ms-caro-malware-full:malware-type="Spyware"
+ms-caro-malware-full:malware-type="Spyware"
A program that collects your personal information, such as your browsing history, and uses it without adequate consent
ms-caro-malware-full:malware-type="Tool"
+ms-caro-malware-full:malware-type="Tool"
A type of software that may have a legitimate purpose, but which may also be abused by malware authors
ms-caro-malware-full:malware-type="Trojan"
+ms-caro-malware-full:malware-type="Trojan"
A trojan is a program that tries to look innocent, but is actually a malicious application. Unlike a virus or a worm , a trojan doesn’t spread by itself. Instead they try to look innocent to convince you to download and install them. Once installed, a trojan can steal your personal information, download more malware, or give a malicious hacker access to your PC
ms-caro-malware-full:malware-type="TrojanClicker"
+ms-caro-malware-full:malware-type="TrojanClicker"
A type of trojan that can use your PC to click on websites or applications. They are usually used to make money for a malicious hacker by clicking on online advertisements and making it look like the website gets more traffic than it does. They can also be used to skew online polls, install programs on your PC, or make unwanted software appear more popular than it is
ms-caro-malware-full:malware-type="TrojanDownloader"
+ms-caro-malware-full:malware-type="TrojanDownloader"
A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.
ms-caro-malware-full:malware-type="TrojanDropper"
+ms-caro-malware-full:malware-type="TrojanDropper"
A type of trojan that installs other malicious files, including malware, onto your PC. It can download the files from a remote PC or install them directly from a copy that is included in its file.
ms-caro-malware-full:malware-type="TrojanNotifier"
+ms-caro-malware-full:malware-type="TrojanNotifier"
A type of trojan that sends information about your PC to a malicious hacker. It is similar to a password stealer
ms-caro-malware-full:malware-type="TrojanProxy"
+ms-caro-malware-full:malware-type="TrojanProxy"
A type of trojan that installs a proxy server on your PC. The server can be configured so that when you use the Internet, any requests you make are sent through a server controlled by a malicious hacker.
ms-caro-malware-full:malware-type="TrojanSpy"
+ms-caro-malware-full:malware-type="TrojanSpy"
A program that collects your personal information, such as your browsing history, and uses it without adequate consent.
ms-caro-malware-full:malware-type="VirTool"
+ms-caro-malware-full:malware-type="VirTool"
A detection that is used mostly for malware components, or tools used for malware-related actions, such as rootkits.
ms-caro-malware-full:malware-type="Virus"
+ms-caro-malware-full:malware-type="Virus"
A type of malware. Viruses spread on their own by attaching their code to other programs, or copying themselves across systems and networks.
ms-caro-malware-full:malware-type="Worm"
+ms-caro-malware-full:malware-type="Worm"
A type of malware that spreads to other PCs. Worms may spread using one or more of the following methods: Email programs, Instant messaging programs, File-sharing programs, Social networking sites, Network shares, Removable drives with Autorun enabled, Software vulnerabilities
malware-platform
ms-caro-malware-full:malware-platform="AndroidOS"
+ms-caro-malware-full:malware-platform="AndroidOS"
Android operating system
ms-caro-malware-full:malware-platform="DOS"
+ms-caro-malware-full:malware-platform="DOS"
MS-DOS platform
ms-caro-malware-full:malware-platform="EPOC"
+ms-caro-malware-full:malware-platform="EPOC"
Psion devices
ms-caro-malware-full:malware-platform="FreeBSD"
+ms-caro-malware-full:malware-platform="FreeBSD"
FreeBSD platform
ms-caro-malware-full:malware-platform="iPhoneOS"
+ms-caro-malware-full:malware-platform="iPhoneOS"
iPhone operating system
ms-caro-malware-full:malware-platform="Linux"
+ms-caro-malware-full:malware-platform="Linux"
Linux platform
ms-caro-malware-full:malware-platform="MacOS"
+ms-caro-malware-full:malware-platform="MacOS"
MAC 9.x platform or earlier
ms-caro-malware-full:malware-platform="MacOS_X"
+ms-caro-malware-full:malware-platform="MacOS_X"
MacOS X or later
ms-caro-malware-full:malware-platform="OS2"
+ms-caro-malware-full:malware-platform="OS2"
OS2 platform
ms-caro-malware-full:malware-platform="Palm"
+ms-caro-malware-full:malware-platform="Palm"
Palm operating system
ms-caro-malware-full:malware-platform="Solaris"
+ms-caro-malware-full:malware-platform="Solaris"
System V-based Unix platforms
ms-caro-malware-full:malware-platform="SunOS"
+ms-caro-malware-full:malware-platform="SunOS"
Unix platforms 4.1.3 or earlier
ms-caro-malware-full:malware-platform="SymbOS"
+ms-caro-malware-full:malware-platform="SymbOS"
Symbian operatings system
ms-caro-malware-full:malware-platform="Unix"
+ms-caro-malware-full:malware-platform="Unix"
General Unix platforms
ms-caro-malware-full:malware-platform="Win16"
+ms-caro-malware-full:malware-platform="Win16"
Win16 (3.1) platform
ms-caro-malware-full:malware-platform="Win2K"
+ms-caro-malware-full:malware-platform="Win2K"
Windows 2000 platform
ms-caro-malware-full:malware-platform="Win32"
+ms-caro-malware-full:malware-platform="Win32"
Windows 32-bit platform
ms-caro-malware-full:malware-platform="Win64"
+ms-caro-malware-full:malware-platform="Win64"
Windows 64-bit platform
ms-caro-malware-full:malware-platform="Win95"
+ms-caro-malware-full:malware-platform="Win95"
Windows 95, 98 and ME platforms
ms-caro-malware-full:malware-platform="Win98"
+ms-caro-malware-full:malware-platform="Win98"
Windows 98 platform only
ms-caro-malware-full:malware-platform="WinCE"
+ms-caro-malware-full:malware-platform="WinCE"
Windows CE platform
ms-caro-malware-full:malware-platform="WinNT"
+ms-caro-malware-full:malware-platform="WinNT"
WinNT
ms-caro-malware-full:malware-platform="ABAP"
+ms-caro-malware-full:malware-platform="ABAP"
Advanced Business Application Programming scripts
ms-caro-malware-full:malware-platform="ALisp"
+ms-caro-malware-full:malware-platform="ALisp"
ALisp scripts
ms-caro-malware-full:malware-platform="AmiPro"
+ms-caro-malware-full:malware-platform="AmiPro"
AmiPro script
ms-caro-malware-full:malware-platform="ANSI"
+ms-caro-malware-full:malware-platform="ANSI"
American National Standards Institute scripts
ms-caro-malware-full:malware-platform="AppleScript"
+ms-caro-malware-full:malware-platform="AppleScript"
compiled Apple scripts
ms-caro-malware-full:malware-platform="ASP"
+ms-caro-malware-full:malware-platform="ASP"
Active Server Pages scripts
ms-caro-malware-full:malware-platform="AutoIt"
+ms-caro-malware-full:malware-platform="AutoIt"
AutoIT scripts
ms-caro-malware-full:malware-platform="BAS"
+ms-caro-malware-full:malware-platform="BAS"
Basic scripts
ms-caro-malware-full:malware-platform="BAT"
+ms-caro-malware-full:malware-platform="BAT"
Basic scripts
ms-caro-malware-full:malware-platform="CorelScript"
+ms-caro-malware-full:malware-platform="CorelScript"
Corelscript scripts
ms-caro-malware-full:malware-platform="HTA"
+ms-caro-malware-full:malware-platform="HTA"
HTML Application scripts
ms-caro-malware-full:malware-platform="HTML"
+ms-caro-malware-full:malware-platform="HTML"
HTML Application scripts
ms-caro-malware-full:malware-platform="INF"
+ms-caro-malware-full:malware-platform="INF"
Install scripts
ms-caro-malware-full:malware-platform="IRC"
+ms-caro-malware-full:malware-platform="IRC"
mIRC/pIRC scripts
ms-caro-malware-full:malware-platform="Java"
+ms-caro-malware-full:malware-platform="Java"
Java binaries (classes)
ms-caro-malware-full:malware-platform="JS"
+ms-caro-malware-full:malware-platform="JS"
Javascript scripts
ms-caro-malware-full:malware-platform="LOGO"
+ms-caro-malware-full:malware-platform="LOGO"
LOGO scripts
ms-caro-malware-full:malware-platform="MPB"
+ms-caro-malware-full:malware-platform="MPB"
MapBasic scripts
ms-caro-malware-full:malware-platform="MSH"
+ms-caro-malware-full:malware-platform="MSH"
Monad shell scripts
ms-caro-malware-full:malware-platform="MSIL"
+ms-caro-malware-full:malware-platform="MSIL"
ms-caro-malware-full:malware-platform="Perl"
+ms-caro-malware-full:malware-platform="Perl"
Perl scripts
ms-caro-malware-full:malware-platform="PHP"
+ms-caro-malware-full:malware-platform="PHP"
Hypertext Preprocessor scripts
ms-caro-malware-full:malware-platform="Python"
+ms-caro-malware-full:malware-platform="Python"
Python scripts
ms-caro-malware-full:malware-platform="SAP"
+ms-caro-malware-full:malware-platform="SAP"
SAP platform scripts
ms-caro-malware-full:malware-platform="SH"
+ms-caro-malware-full:malware-platform="SH"
Shell scripts
ms-caro-malware-full:malware-platform="VBA"
+ms-caro-malware-full:malware-platform="VBA"
Visual Basic for Applications scripts
ms-caro-malware-full:malware-platform="VBS"
+ms-caro-malware-full:malware-platform="VBS"
Visual Basic scripts
ms-caro-malware-full:malware-platform="WinBAT"
+ms-caro-malware-full:malware-platform="WinBAT"
Winbatch scripts
ms-caro-malware-full:malware-platform="WinHlp"
+ms-caro-malware-full:malware-platform="WinHlp"
Windows Help scripts
ms-caro-malware-full:malware-platform="WinREG"
+ms-caro-malware-full:malware-platform="WinREG"
Windows registry scripts
ms-caro-malware-full:malware-platform="A97M"
+ms-caro-malware-full:malware-platform="A97M"
Access 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware-full:malware-platform="HE"
+ms-caro-malware-full:malware-platform="HE"
macro scripting
ms-caro-malware-full:malware-platform="O97M"
+ms-caro-malware-full:malware-platform="O97M"
Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and Powerpoint
ms-caro-malware-full:malware-platform="PP97M"
+ms-caro-malware-full:malware-platform="PP97M"
PowerPoint 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware-full:malware-platform="V5M"
+ms-caro-malware-full:malware-platform="V5M"
Visio5 macros
ms-caro-malware-full:malware-platform="W1M"
+ms-caro-malware-full:malware-platform="W1M"
Word1Macro
ms-caro-malware-full:malware-platform="W2M"
+ms-caro-malware-full:malware-platform="W2M"
Word2Macro
ms-caro-malware-full:malware-platform="W97M"
+ms-caro-malware-full:malware-platform="W97M"
Word 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware-full:malware-platform="WM"
+ms-caro-malware-full:malware-platform="WM"
Word 95 macros
ms-caro-malware-full:malware-platform="X97M"
+ms-caro-malware-full:malware-platform="X97M"
Excel 97, 2000, XP, 2003, 2007, and 2010 macros
ms-caro-malware-full:malware-platform="XF"
+ms-caro-malware-full:malware-platform="XF"
Excel formulas
ms-caro-malware-full:malware-platform="XM"
+ms-caro-malware-full:malware-platform="XM"
Excel 95 macros
ms-caro-malware-full:malware-platform="ASX"
+ms-caro-malware-full:malware-platform="ASX"
XML metafile of Windows Media .asf files
ms-caro-malware-full:malware-platform="HC"
+ms-caro-malware-full:malware-platform="HC"
HyperCard Apple scripts
ms-caro-malware-full:malware-platform="MIME"
+ms-caro-malware-full:malware-platform="MIME"
MIME packets
ms-caro-malware-full:malware-platform="Netware"
+ms-caro-malware-full:malware-platform="Netware"
Novell Netware files
ms-caro-malware-full:malware-platform="QT"
+ms-caro-malware-full:malware-platform="QT"
Quicktime files
ms-caro-malware-full:malware-platform="SB"
+ms-caro-malware-full:malware-platform="SB"
StarBasic (Staroffice XML) files
ms-caro-malware-full:malware-platform="SWF"
+ms-caro-malware-full:malware-platform="SWF"
Shockwave Flash files
ms-caro-malware-full:malware-platform="TSQL"
+ms-caro-malware-full:malware-platform="TSQL"
MS SQL server files
ms-caro-malware-full:malware-platform="XML"
+ms-caro-malware-full:malware-platform="XML"
XML files
malware-family
ms-caro-malware-full:malware-family="Zlob"
+ms-caro-malware-full:malware-family="Zlob"
2008 - A family of trojans that often pose as downloadable media codecs. When installed, Win32/Zlob displays frequent pop-up advertisements for rogue security software
ms-caro-malware-full:malware-family="Vundo"
+ms-caro-malware-full:malware-family="Vundo"
2008 - A multiplecomponent family of programs that deliver pop-up advertisements and may download and execute arbitrary files. Vundo is often installed as a browser helper object (BHO) without a user’s consent
ms-caro-malware-full:malware-family="Virtumonde"
+ms-caro-malware-full:malware-family="Virtumonde"
2008 - multi-component malware family that displays pop-up advertisements for rogue security software
ms-caro-malware-full:malware-family="Bancos"
+ms-caro-malware-full:malware-family="Bancos"
2008 - A data-stealing trojan that captures online banking credentials and relays them to the attacker. Most variants target customers of Brazilian banks.@@ -13654,2719 +13706,2719 @@ ms-caro-malware-full namespace available in JSON format at -
ms-caro-malware-full:malware-family="Cutwail"
+ms-caro-malware-full:malware-family="Cutwail"
2008 - A trojan that downloads and executes arbitrary files, usually to send spam. Win32/Cutwail has also been observed to transmit Win32/Newacc
ms-caro-malware-full:malware-family="Oderoor"
+ms-caro-malware-full:malware-family="Oderoor"
2008 - a backdoor trojan that allows an attacker access and control of the compromised computer. This trojan may connect with remote web sites and SMTP servers.
ms-caro-malware-full:malware-family="Newacc"
+ms-caro-malware-full:malware-family="Newacc"
2008 - An attacker tool that automatically registers new e-mail accounts on Hotmail, AOL, Gmail, Lycos and other account service providers, using a Web service to decode CAPTCHA protection.
ms-caro-malware-full:malware-family="Captiya"
+ms-caro-malware-full:malware-family="Captiya"
2008 - A trojan that transmits CAPTCHA images to a botnet, in what is believed to be an effort to improve the botnet’s ability to detect characters and break CAPTCHAs more successfully
ms-caro-malware-full:malware-family="Taterf"
+ms-caro-malware-full:malware-family="Taterf"
2008 - A family of worms that spread through mapped drives in order to steal login and account details for popular online games.
ms-caro-malware-full:malware-family="Frethog"
+ms-caro-malware-full:malware-family="Frethog"
2008 - A large family of password-stealing trojans that target confidential data, such as account information, from massively multiplayer online games
ms-caro-malware-full:malware-family="Tilcun"
+ms-caro-malware-full:malware-family="Tilcun"
2008 - A family of trojans that steals online game passwords and sends this captured data to remote sites.
ms-caro-malware-full:malware-family="Ceekat"
+ms-caro-malware-full:malware-family="Ceekat"
2008 - A collection of trojans that steal information such as passwords for online games, usually by reading information directly from running processes in memory. Different variants target different processes.
ms-caro-malware-full:malware-family="Corripio"
+ms-caro-malware-full:malware-family="Corripio"
2008 - a loosely-related family of trojans that attempt to steal passwords for popular online games. Detections containing the name Win32/Corripio are generic, and hence may be reported for a large number of different malicious password-stealing trojans that are otherwise behaviorally dissimilar.
ms-caro-malware-full:malware-family="Zuten"
+ms-caro-malware-full:malware-family="Zuten"
2008 - A family of malware that steals information from online games.
ms-caro-malware-full:malware-family="Lolyda"
+ms-caro-malware-full:malware-family="Lolyda"
2008 - A family of trojans that sends account information from popular online games to a remote server. They may also download and execute arbitrary files.
ms-caro-malware-full:malware-family="Storark"
+ms-caro-malware-full:malware-family="Storark"
2008 - A family of trojans that steals online game passwords and sends this captured data to remote sites.
ms-caro-malware-full:malware-family="Renos"
+ms-caro-malware-full:malware-family="Renos"
2008 - A family of trojan downloaders that installs rogue security software.
ms-caro-malware-full:malware-family="ZangoSearchAssistant"
+ms-caro-malware-full:malware-family="ZangoSearchAssistant"
2008 - Adware that monitors the user’s Web-browsing activity and displays pop-up advertisements related to the Internet sites the user is viewing.
ms-caro-malware-full:malware-family="ZangoShoppingReports"
+ms-caro-malware-full:malware-family="ZangoShoppingReports"
2008 - Adware that displays targeted advertising to affected users while they browse the Internet, based on search terms entered into search engines.
ms-caro-malware-full:malware-family="FakeXPA"
+ms-caro-malware-full:malware-family="FakeXPA"
2008 - A rogue security software family that claims to scan for malware and then demands that the user pay to remove nonexistent threats. Some variants unlawfully use Microsoft logos and trademarks.
ms-caro-malware-full:malware-family="FakeSecSen"
+ms-caro-malware-full:malware-family="FakeSecSen"
2008 - A rogue security software family that claims to scan for malware and then demands that the user pay to remove non-existent threats. It appears to be based on Win32/SpySheriff
ms-caro-malware-full:malware-family="Hotbar"
+ms-caro-malware-full:malware-family="Hotbar"
2008 - Adware that displays a dynamic toolbar and targeted pop-up ads based on its monitoring of Web-browsing activity.
ms-caro-malware-full:malware-family="Agent"
+ms-caro-malware-full:malware-family="Agent"
2008 - A generic detection for a number of trojans that may perform different malicious functions. The behaviors exhibited by this family are highly variable
ms-caro-malware-full:malware-family="Wimad"
+ms-caro-malware-full:malware-family="Wimad"
2008 - A detection for malicious Windows Media files that can be used to encourage users to download and execute arbitrary files on an affected machine.
ms-caro-malware-full:malware-family="BaiduSobar"
+ms-caro-malware-full:malware-family="BaiduSobar"
2008 - A Chinese language Web browser toolbar that delivers pop-up and contextual advertisements, blocks certain other advertisements, and changes the Internet Explorer search page
ms-caro-malware-full:malware-family="VB"
+ms-caro-malware-full:malware-family="VB"
2008 - A detection for various threats written in the Visual Basic programming language.
ms-caro-malware-full:malware-family="Antivirus2008"
+ms-caro-malware-full:malware-family="Antivirus2008"
2008 - A program that displays misleading security alerts in order to convince users to purchase rogue security software. It may be installed by Win32/Renos or manually by a computer user.
ms-caro-malware-full:malware-family="Playmp3z"
+ms-caro-malware-full:malware-family="Playmp3z"
2008 - An adware family that may display advertisements in connection with the use of a 'free music player' from the site 'PlayMP3z.biz.'
ms-caro-malware-full:malware-family="Tibs"
+ms-caro-malware-full:malware-family="Tibs"
2008 - a family of Trojans that may download and run other malicious software or may steal user data and send it to the attacker via HTTP POST or email. The Win32/Tibs family frequently downloads Trojans belonging to the Win32/Harnig and Win32/Passalert families, both of which are families of Trojan downloaders which may in turn download and run other malicious software
ms-caro-malware-full:malware-family="SeekmoSearchAssistant"
+ms-caro-malware-full:malware-family="SeekmoSearchAssistant"
2008 - Adware that displays targeted search results and pop-up advertisements based on terms that the user enters for Web searches. The pop-up advertisements may include adult content.
ms-caro-malware-full:malware-family="RJump"
+ms-caro-malware-full:malware-family="RJump"
2008 - a worm that attempts to spread by copying itself to newly attached media (such as USB memory devices or network drives). It also contains backdoor functionality that allows an attacker unauthorized access to an affected computer
ms-caro-malware-full:malware-family="SpywareSecure"
+ms-caro-malware-full:malware-family="SpywareSecure"
2008 - A program that displays misleading warning messages in order to convince users to purchase a product that removes spyware
ms-caro-malware-full:malware-family="Winfixer"
+ms-caro-malware-full:malware-family="Winfixer"
2008 - A program that locates various registry entries, Windows prefetch content, and other types of data, identifies them as privacy violations, and urges the user to purchase the product to fix them.
ms-caro-malware-full:malware-family="C2Lop"
+ms-caro-malware-full:malware-family="C2Lop"
2008 - a trojan that modifies Web browser settings, adds Web browser bookmarks to advertisements, updates itself and delivers pop-up and contextual advertisements.
ms-caro-malware-full:malware-family="Matcash"
+ms-caro-malware-full:malware-family="Matcash"
2008 - a multicomponent family of trojans that downloads and executes arbitrary files. Some variants of this family may install a toolbar. observed to use the Win32/Slenfbot worm as a means of distribution.
ms-caro-malware-full:malware-family="Horst"
+ms-caro-malware-full:malware-family="Horst"
2008 - CAPTCHA Breaker typically delivered through an executable application that masquerades as an illegal software crack or key generator
ms-caro-malware-full:malware-family="Slenfbot"
+ms-caro-malware-full:malware-family="Slenfbot"
2008 - A family of worms that can spread via instant messaging programs, and may spread via removable drives. They also contain backdoor functionality that allows unauthorized access to an affected machine. This worm does not spread automatically upon installation but must be ordered to spread by a remote attacker.
ms-caro-malware-full:malware-family="Rustock"
+ms-caro-malware-full:malware-family="Rustock"
2008 - A multicomponent family of rootkitenabled backdoor trojans, developed to aid in the distribution of spam. Recent variants appear to be associated with the incidence of rogue security programs.
ms-caro-malware-full:malware-family="Gimmiv"
+ms-caro-malware-full:malware-family="Gimmiv"
2008 - a family of trojans that are sometimes installed by exploits of a vulnerability documented in Microsoft Security Bulletin MS08-067.
ms-caro-malware-full:malware-family="Yektel"
+ms-caro-malware-full:malware-family="Yektel"
2008 - A family of trojans that display fake warnings of spyware or malware in an attempt to lure the user into installing or paying money to register rogue security products such as Win32/FakeXPA.
ms-caro-malware-full:malware-family="Roron"
+ms-caro-malware-full:malware-family="Roron"
2008 - This virus spreads by attaching its code to other files on your PC or network. Some of the infected programs might no longer run correctly. Attempts to send personal information to a remote address. It may spread via e-mail, network shares, or peer-to-peer file sharing.
ms-caro-malware-full:malware-family="Swif"
+ms-caro-malware-full:malware-family="Swif"
2008 - A trojan that exploits a vulnerability in Adobe Flash Player to download malicious files. Adobe has published security bulletin APSB08-11 addressing the vulnerability.
ms-caro-malware-full:malware-family="Mult"
+ms-caro-malware-full:malware-family="Mult"
2008 - A group of threats, written in JavaScript, that attempt to exploit multiple vulnerabilities on affected computers in order to download, execute or otherwise run arbitrary code. The malicious JavaScript may be hosted on compromised or malicious websites, embedded in specially crafted PDF files, or could be called by other malicious scripts.
ms-caro-malware-full:malware-family="Wukill"
+ms-caro-malware-full:malware-family="Wukill"
2008 - a family of mass-mailing e-mail and network worms. The Win32/Wukill worm spreads to root directories on certain local and mapped drives. The worm also spreads by sending a copy of itself as an attachment to e-mail addresses found on the infected computer.
ms-caro-malware-full:malware-family="Objsnapt"
+ms-caro-malware-full:malware-family="Objsnapt"
2008 - A detection for a Javascript file that exploits a known vulnerability in the Microsoft Access Snapshot Viewer ActiveX Control.
ms-caro-malware-full:malware-family="Redirector"
+ms-caro-malware-full:malware-family="Redirector"
2008 - The threat is a piece of JavaScript code that is inserted on bad or hacked websites. It can direct your browser to a website you don’t want to go to. You might see the detection for this threat if you visit a bad or hacked website, or if you open an email message.
ms-caro-malware-full:malware-family="Xilos"
+ms-caro-malware-full:malware-family="Xilos"
2008 - a detection for a proof-of-concept JavaScript obfuscation technique, which was originally published in 2002 in the sixth issue of 29A, an early online magazine for virus creators
ms-caro-malware-full:malware-family="Decdec"
+ms-caro-malware-full:malware-family="Decdec"
2008 - A detection for certain malicious JavaScript code injected in HTML pages. The virus will execute on user computers that visit compromised websites.
ms-caro-malware-full:malware-family="BearShare"
+ms-caro-malware-full:malware-family="BearShare"
2008 - A P2P file-sharing client that uses the decentralized Gnutella network. Free versions of BearShare have come bundled with advertising supported and other potentially unwanted software.
ms-caro-malware-full:malware-family="BitAccelerator"
+ms-caro-malware-full:malware-family="BitAccelerator"
2008 - A program that redirects Web search results to other Web sites and may display various advertisements to users while browsing Web sites.
ms-caro-malware-full:malware-family="Blubtool"
+ms-caro-malware-full:malware-family="Blubtool"
2008 - An Internet browser search toolbar that may be installed by other third-party software, such as a peer-to-peer file sharing application. It may modify Internet explorer search settings and display unwanted advertisements.
ms-caro-malware-full:malware-family="RServer"
+ms-caro-malware-full:malware-family="RServer"
2008 - Commercial remote administration software that can be used to control a computer. These programs are typically installed by the computer owner or administrator and should only be removed if unexpected
ms-caro-malware-full:malware-family="UltraVNC"
+ms-caro-malware-full:malware-family="UltraVNC"
2008 - A remote access program that can be used to control a computer. This program is typically installed by the computer owner or administrator, and should only be removed if unexpected.
ms-caro-malware-full:malware-family="GhostRadmin"
+ms-caro-malware-full:malware-family="GhostRadmin"
2008 - A remote administration tool that can be used to control a computer. These programs are typically installed by the computer owner or administrator and should only be removed if unexpected
ms-caro-malware-full:malware-family="TightVNC"
+ms-caro-malware-full:malware-family="TightVNC"
2008 - A remote control program that allows full control of the computer. These programs are typically installed by the computer owner or administrator and should only be removed if unexpected
ms-caro-malware-full:malware-family="DameWareMiniRemoteControl"
+ms-caro-malware-full:malware-family="DameWareMiniRemoteControl"
2008 - A detection for the DameWare Mini Remote Control tools. This program was detected by definitions prior to 1.147.1889.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.147.1889.0 which no longer detects this program.
ms-caro-malware-full:malware-family="SeekmoSearchAssistant_Repack"
+ms-caro-malware-full:malware-family="SeekmoSearchAssistant_Repack"
2008 - A detection that is triggered by modified (that is, edited and re-packed) remote control programs based on DameWare Mini Remote Control, a commercial software product
ms-caro-malware-full:malware-family="Nbar"
+ms-caro-malware-full:malware-family="Nbar"
2008 - A program that may display advertisements and redirect user searches to a certain website. It may also download malicious or unwanted content into the system without user consent.
ms-caro-malware-full:malware-family="Chir"
+ms-caro-malware-full:malware-family="Chir"
2008 - A family with a worm component and a virus component. The worm component spreads by email and by exploiting a vulnerability addressed by Microsoft Security Bulletin MS01-020. The virus component may infect .exe, .scr, and HTML files.
ms-caro-malware-full:malware-family="Sality"
+ms-caro-malware-full:malware-family="Sality"
2008 - A family of polymorphic file infectors that target executable files with the extensions .scr or .exe. They may execute a damaging payload that deletes files with certain extensions and terminates security-related processes and services.
ms-caro-malware-full:malware-family="Obfuscator"
+ms-caro-malware-full:malware-family="Obfuscator"
2008 - A detection for programs that use a combination of obfuscation techniques to hinder analysis or detection by antivirus scanners
ms-caro-malware-full:malware-family="ByteVerify"
+ms-caro-malware-full:malware-family="ByteVerify"
2008 - a detection of malicious code that attempts to exploit a vulnerability in the Microsoft Virtual Machine (VM). This flaw enables attackers to execute arbitrary code on a user’s machine such as writing, downloading and executing additional malware. This vulnerability is addressed by update MS03-011, released in 2003.
ms-caro-malware-full:malware-family="Autorun"
+ms-caro-malware-full:malware-family="Autorun"
2008 - A family of worms that spreads by copying itself to the mapped drives of an infected computer. The mapped drives may include network or removable drives.
ms-caro-malware-full:malware-family="Hamweq"
+ms-caro-malware-full:malware-family="Hamweq"
2008 - A worm that spreads through removable drives, such as USB memory sticks. It may contain an IRC-based backdoor enabling the computer to be controlled remotely by an attacker
ms-caro-malware-full:malware-family="Brontok"
+ms-caro-malware-full:malware-family="Brontok"
2008 - a family of mass-mailing e-mail worms. The worm spreads by sending a copy of itself as an e-mail attachment to e-mail addresses that it gathers from files on the infected computer. It can also copy itself to USB and pen drives. Win32/Brontok can disable antivirus and security software, immediately terminate certain applications, and cause Windows to restart immediately when certain applications run. The worm may also conduct denial of service (DoS) attacks against certain Web sites
ms-caro-malware-full:malware-family="SpywareProtect"
+ms-caro-malware-full:malware-family="SpywareProtect"
2008 - A rogue security software family that may falsely claim that the user’s computer is infected and encourages the user to buy a product for cleaning the alleged malware from the computer
ms-caro-malware-full:malware-family="Cbeplay"
+ms-caro-malware-full:malware-family="Cbeplay"
2008 - A trojan that may upload computer operating system details to a remote Web site, download additional malware, and terminate debugging utilities
ms-caro-malware-full:malware-family="InternetAntivirus"
+ms-caro-malware-full:malware-family="InternetAntivirus"
2008 - A program that displays false and misleading malware alerts to convince users to purchase rogue security software. This program also displays a fake Windows Security Center message
ms-caro-malware-full:malware-family="Nuwar"
+ms-caro-malware-full:malware-family="Nuwar"
2008 - A family of trojan droppers that install a distributed P2P downloader trojan. This downloader trojan in turn downloads an e-mail worm component.
ms-caro-malware-full:malware-family="Rbot"
+ms-caro-malware-full:malware-family="Rbot"
2008 - A family of backdoor trojans that allows attackers to control the computer through an IRC channel
ms-caro-malware-full:malware-family="IRCbot"
+ms-caro-malware-full:malware-family="IRCbot"
2008 - A large family of backdoor trojans that drops malicious software and connects to IRC servers via a backdoor to receive commands from attackers.
ms-caro-malware-full:malware-family="SkeemoSearchAssistant"
+ms-caro-malware-full:malware-family="SkeemoSearchAssistant"
2008 - A program that displays targeted search results and pop-up advertisements based on terms that the user enters for Web searches. The pop-up advertisements may include adult content
ms-caro-malware-full:malware-family="RealVNC"
+ms-caro-malware-full:malware-family="RealVNC"
2008 - A management tool that allows a computer to be controlled remotely. It can be installed for legitimate purposes, but can also be installed from a remote location by an attacker.
ms-caro-malware-full:malware-family="MoneyTree"
+ms-caro-malware-full:malware-family="MoneyTree"
2008 - A family of software that provides the ability to search for adult content on local disk. It may also install other potentially unwanted software, such as programs that display pop-up ads.
ms-caro-malware-full:malware-family="Tracur"
+ms-caro-malware-full:malware-family="Tracur"
2008 - A trojan that downloads and executes arbitrary files. It is sometimes distributed by ASX/Wimad.
ms-caro-malware-full:malware-family="Meredrop"
+ms-caro-malware-full:malware-family="Meredrop"
2008 - This is a generic detection for trojans that install and run malware on your PC. These trojans have been deliberately created in a complex way to hide their purpose and make them difficult to analyze.
ms-caro-malware-full:malware-family="Banker"
+ms-caro-malware-full:malware-family="Banker"
2008 - A family of data-stealing trojans that captures banking credentials such as account numbers and passwords from computer users and relays them to the attacker. Most variants target customers of Brazilian banks; some variants target customers of other banks.
ms-caro-malware-full:malware-family="Ldpinch"
+ms-caro-malware-full:malware-family="Ldpinch"
2008 - a family of password-stealing trojans. This trojan gathers private user data such as passwords from the host computer and sends the data to the attacker at a preset e-mail address. The Win32/Ldpinch trojans use their own Simple Mail Transfer Protocol (SMTP) engine or a web-based proxy for sending the e-mail, thus copies of the sent e-mail will not appear in the affected user’s e-mail client.
ms-caro-malware-full:malware-family="Advantage"
+ms-caro-malware-full:malware-family="Advantage"
2008 - a family of adware that displays pop-up advertisements and contacts a remote server to download updates
ms-caro-malware-full:malware-family="Parite"
+ms-caro-malware-full:malware-family="Parite"
2008 - a family of polymorphic file infectors that targets computers running Microsoft Windows. The virus infects .exe and .scr executable files on the local file system and on writeable network shares. In turn, the infected executable files perform operations that cause other .exe and .scr files to become infected.
ms-caro-malware-full:malware-family="PossibleHostsFileHijack"
+ms-caro-malware-full:malware-family="PossibleHostsFileHijack"
2008 - an indicator that the computer’s HOSTS file may have been modified by malicious or potentially unwanted software
ms-caro-malware-full:malware-family="Alureon"
+ms-caro-malware-full:malware-family="Alureon"
2008 - A data-stealing trojan that gathers confidential information such as user names, passwords, and credit card data from incoming and outgoing Internet traffic. It may also download malicious data and modify DNS settings.
ms-caro-malware-full:malware-family="PowerRegScheduler"
+ms-caro-malware-full:malware-family="PowerRegScheduler"
2008 - This program was detected by definitions prior to 1.159.567.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.159.567.0 which no longer detects this program.
ms-caro-malware-full:malware-family="APSB08-11"
+ms-caro-malware-full:malware-family="APSB08-11"
2008 - A trojan that attempts to exploit a vulnerability in Adobe Flash Player. In the wild, this trojan has been used to download and execute arbitrary files, including other malware.
ms-caro-malware-full:malware-family="ConHook"
+ms-caro-malware-full:malware-family="ConHook"
2008 - A family of Trojans that installs themselves as Browser Helper Objects (BHOs), and connects to the Internet without user consent. They also terminate specific security services, and download additional malware to the computer.
ms-caro-malware-full:malware-family="Starware"
+ms-caro-malware-full:malware-family="Starware"
2008 - This program was detected by definitions prior to 1.159.567.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.159.567.0 which no longer detects this program.
ms-caro-malware-full:malware-family="WinSpywareProtect"
+ms-caro-malware-full:malware-family="WinSpywareProtect"
2008 - A program that may falsely claim that the user’s system is infected and encourages the user to buy a promoted product for cleaning the alleged malware from the computer.
ms-caro-malware-full:malware-family="MessengerSkinner"
+ms-caro-malware-full:malware-family="MessengerSkinner"
2008 - A program, that may be distributed in the form of a freeware application, that displays advertisements, downloads additional files, and uses stealth to hide its presence
ms-caro-malware-full:malware-family="Skintrim"
+ms-caro-malware-full:malware-family="Skintrim"
2008 - A trojan that downloads and executes arbitrary files. It may be distributed by as a Microsoft Office Outlook addon used to display emoticons or other animated icons within e-mail messages.
ms-caro-malware-full:malware-family="AdRotator"
+ms-caro-malware-full:malware-family="AdRotator"
2008 - delivers advertisements, and as the name suggests, rotates advertisements among sponsors. AdRotator contacts remote Web sites in order to deliver updated content. This application also displays fake error messages that encourage users to download and install additional applications.
ms-caro-malware-full:malware-family="Wintrim"
+ms-caro-malware-full:malware-family="Wintrim"
2008 - A family of trojans that display pop-up advertisements depending on the user’s keywords and browsing history. Its variants can monitor the user’s activities, download applications, and send system information back to a remote server.
ms-caro-malware-full:malware-family="Busky"
+ms-caro-malware-full:malware-family="Busky"
2008 - A family of Trojans that monitor and redirect Internet traffic, gather system information and download unwanted software such as Win32/Renos and Win32/SpySheriff. Win32/Busky may be installed by a Web browser exploit or other vulnerability when visiting a malicious Web site.
ms-caro-malware-full:malware-family="WhenU"
+ms-caro-malware-full:malware-family="WhenU"
2008 - This program was detected by definitions prior to 1.173.303.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Mobis"
+ms-caro-malware-full:malware-family="Mobis"
2008 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Sogou"
+ms-caro-malware-full:malware-family="Sogou"
2008 - Detected by definitions prior to 1.155.995.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.155.995.0 which no longer detects this program.
ms-caro-malware-full:malware-family="Sdbot"
+ms-caro-malware-full:malware-family="Sdbot"
2008 - A family of backdoor trojans that allows attackers to control infected computers. After a computer is infected, the trojan connects to an internet relay chat (IRC) server and joins a channel to receive commands from attackers.
ms-caro-malware-full:malware-family="DelfInject"
+ms-caro-malware-full:malware-family="DelfInject"
2008 - This threat can download and run files on your PC.
ms-caro-malware-full:malware-family="Vapsup"
+ms-caro-malware-full:malware-family="Vapsup"
2008 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="BrowsingEnhancer"
+ms-caro-malware-full:malware-family="BrowsingEnhancer"
2008 - This program was detected by definitions prior to 1.175.1834.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Jeefo"
+ms-caro-malware-full:malware-family="Jeefo"
2008 - virus infects executable files, such as files with a .exe extension. When an infected file runs, the virus tries to run the original content of the file while it infects other executable files on your PC. This threat might have got on your PC if you inserted a removable disk or accessed a network connection that was infected.
ms-caro-malware-full:malware-family="Sezon"
+ms-caro-malware-full:malware-family="Sezon"
2008 - An adware that redirects web browsing to advertising or search sites.
ms-caro-malware-full:malware-family="RuPass"
+ms-caro-malware-full:malware-family="RuPass"
2008 - a DLL component which may be utilized by adware or malicious programs in order to monitor an affected user’s Internet usage and to capture sensitive information. Win32/RuPass has been distributed as a 420,352 byte DLL file, with the file name 'ConnectionServices.dll'.
ms-caro-malware-full:malware-family="OneStepSearch"
+ms-caro-malware-full:malware-family="OneStepSearch"
2008 - Modifies the user’s browser to deliver targeted advertisements when the user enters search keywords. It may also replace or override web browser error pages that would otherwise be displayed when unresolvable web addresses are entered into the browser’s address bar.
ms-caro-malware-full:malware-family="GameVance"
+ms-caro-malware-full:malware-family="GameVance"
2008 - Software that displays advertisements and tracks anonymous usage information in exchange for a free online gaming experience at the Web address 'gamevance.com.'
ms-caro-malware-full:malware-family="E404"
+ms-caro-malware-full:malware-family="E404"
2008 - is a browser helper object (BHO) that takes advantage of invalid or mistyped URLs entered in the address bar by redirecting the browser to Web sites containing adware
ms-caro-malware-full:malware-family="Mirar"
+ms-caro-malware-full:malware-family="Mirar"
2008 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Fotomoto"
+ms-caro-malware-full:malware-family="Fotomoto"
2008 - A Trojan that lowers security settings, delivers advertisements, and sends system and network configuration details to a remote Web site.
ms-caro-malware-full:malware-family="Ardamax"
+ms-caro-malware-full:malware-family="Ardamax"
2008 - The tool can capture your activity on your PC (such as the keys you press when typing in passwords) and might send this information to a hacker.
ms-caro-malware-full:malware-family="Hupigon"
+ms-caro-malware-full:malware-family="Hupigon"
2008 - A family of trojans that uses a dropper to install one or more backdoor files and sometimes installs a password stealer or other malicious programs.
ms-caro-malware-full:malware-family="CNNIC"
+ms-caro-malware-full:malware-family="CNNIC"
2008 - enables Chinese keyword searching in Internet Explorer and adds support for other applications to use Chinese domain names that registered with CNNIC. Also contains a kernel driver that protects its files and registry settings from being modified or deleted
ms-caro-malware-full:malware-family="MotePro"
+ms-caro-malware-full:malware-family="MotePro"
2008 - May display advertisement pop-ups, and download programs from predefined Web sites. When installed, Win32/MotePro runs as a Web Browser Helper Object (BHO).
ms-caro-malware-full:malware-family="CnsMin"
+ms-caro-malware-full:malware-family="CnsMin"
2008 - Installs a browser helper object (BHO) that redirects Internet Explorer searches to a Chinese search portal. CnsMin may be installed without adequate user consent. It may prevent its files from being removed or restore files that have been previously removed.
ms-caro-malware-full:malware-family="BaiduIebar"
+ms-caro-malware-full:malware-family="BaiduIebar"
2008 - A detection for an address line search tool. This program was detected by definitions prior to 1.153.956.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors. Microsoft has released definition 1.153.956.0 which no longer detects this program.
ms-caro-malware-full:malware-family="Ejik"
+ms-caro-malware-full:malware-family="Ejik"
2008 - This program was detected by definitions prior to 1.175.1915.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="AlibabaIEToolBar"
+ms-caro-malware-full:malware-family="AlibabaIEToolBar"
2008 - This program was detected by definitions prior to 1.175.1834.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="BDPlugin"
+ms-caro-malware-full:malware-family="BDPlugin"
2008 - a DLL file which is usually introduced to an affected system as a component of BrowserModifier:Win32/BaiduSobar. It may display unwanted pop-ups and advertisements on the affected system.
ms-caro-malware-full:malware-family="Adialer"
+ms-caro-malware-full:malware-family="Adialer"
2008 - A trojan dialer program that connects to a premium number, or attempts to connect to adult websites via particular phone numbers without your permission, connects to remote hosts without user consent.
ms-caro-malware-full:malware-family="EGroupSexDial"
+ms-caro-malware-full:malware-family="EGroupSexDial"
2008 - A dialer program that may attempt to dial a premium number, thus possibly resulting in international phone charges for the user.
ms-caro-malware-full:malware-family="Zonebac"
+ms-caro-malware-full:malware-family="Zonebac"
2008 - A family of backdoor Trojans that allows a remote attacker to download and run arbitrary programs, and which may upload computer configuration information and other potentially sensitive data to remote Web sites.
ms-caro-malware-full:malware-family="Antinny"
+ms-caro-malware-full:malware-family="Antinny"
2008 - A family of worms that targets certain versions of Microsoft Windows. The worm spreads using a Japanese peer-to-peer file-sharing application named Winny. The worm creates a copy of itself with a deceptive file name in the Winny upload folder so that it can be downloaded by other Winny users.
ms-caro-malware-full:malware-family="RewardNetwork"
+ms-caro-malware-full:malware-family="RewardNetwork"
2008 - A program that monitors an affected user’s Internet usage and reports this usage to a remote server. Win32/RewardNetwork may be visible as an Internet Explorer toolbar.
ms-caro-malware-full:malware-family="Virut"
+ms-caro-malware-full:malware-family="Virut"
2008 - A family of file infecting viruses that target and infect .exe and .scr files accessed on infected systems. Win32/Virut also opens a backdoor by connecting to an IRC server
ms-caro-malware-full:malware-family="Allaple"
+ms-caro-malware-full:malware-family="Allaple"
2008 - A multi-threaded, polymorphic network worm capable of spreading to other computers connected to a local area network (LAN) and performing denial-of-service (DoS) attacks against targeted remote Web sites.
ms-caro-malware-full:malware-family="VKit_DA"
+ms-caro-malware-full:malware-family="VKit_DA"
2008 - This virus spreads by attaching its code to other files on your PC or network. Some of the infected programs might no longer run correctly.
ms-caro-malware-full:malware-family="Small"
+ms-caro-malware-full:malware-family="Small"
2008 - A generic detection for a variety of threats.
ms-caro-malware-full:malware-family="Netsky"
+ms-caro-malware-full:malware-family="Netsky"
2008 - A mass-mailing worm that spreads by e-mailing itself to addresses found on an infected computer. Some variants contain a backdoor component and perform DoS attacks.
ms-caro-malware-full:malware-family="Luder"
+ms-caro-malware-full:malware-family="Luder"
2008 - A virus that spreads by infecting executable files, by inserting itself into .RAR archive files, and by sending a copy of itself as an attachment to e-mail addresses found on the infected computer. This virus has a date-activated, file damaging payload, and may connect to a remote server and accept commands from an attacker.
ms-caro-malware-full:malware-family="IframeRef"
+ms-caro-malware-full:malware-family="IframeRef"
2008 - A generic detection for specially formed IFrame tags that point to remote websites that contain malicious content.
ms-caro-malware-full:malware-family="Lovelorn"
+ms-caro-malware-full:malware-family="Lovelorn"
2008 - This threat is classified as a mass-mailing worm. A mass mailing email worm is self-contained malicious code that propagates by sending itself through e-mail. Typically, a mass mailing email worm uses its own SMTP engine to send itself, thus copies of the sent worm will not appear in the infected user’s outgoing or sent email folders. Technical details are currently not available.
ms-caro-malware-full:malware-family="Cekar"
+ms-caro-malware-full:malware-family="Cekar"
2008 - This threat downloads and installs other programs, including other malware, onto your PC without your consent.
ms-caro-malware-full:malware-family="Dialsnif"
+ms-caro-malware-full:malware-family="Dialsnif"
2008 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="Conficker"
+ms-caro-malware-full:malware-family="Conficker"
2008 - A worm that spreads by exploiting a vulnerability addressed by Security Bulletin MS08-067. Some variants also spread via removable drives and by exploiting weak passwords. It disables several important system services and security products and downloads arbitrary files.
ms-caro-malware-full:malware-family="LoveLetter"
+ms-caro-malware-full:malware-family="LoveLetter"
2009 - A family of mass-mailing worms that targets computers running certain versions of Windows. It can spread as an e-mail attachment and through an Internet Relay Chat (IRC) channel. The worm can download, overwrite, delete, infect, and run files on the infected computer.
ms-caro-malware-full:malware-family="VBSWGbased"
+ms-caro-malware-full:malware-family="VBSWGbased"
2009 - A generic detection for VBScript code that is known to be automatically generated by a particular malware tool.
ms-caro-malware-full:malware-family="Slammer"
+ms-caro-malware-full:malware-family="Slammer"
2009 - A memory resident worm that spreads through a vulnerability present in computers running either MSDE 2000 or SQL Server that have not applied Microsoft Security Bulletin MS02-039.
ms-caro-malware-full:malware-family="Msblast"
+ms-caro-malware-full:malware-family="Msblast"
2009 - A family of network worms that exploit a vulnerability addressed by security bulletin MS03-039. The worm may attempt Denial of Service (DoS) attacks on some server sites or create a backdoor on the infected system
ms-caro-malware-full:malware-family="Sasser"
+ms-caro-malware-full:malware-family="Sasser"
2009 - A family of network worms that exploit a vulnerability fixed by security bulletin MS04-011. The worm spreads by randomly scanning IP addresses for vulnerable machines and infecting any that are found
ms-caro-malware-full:malware-family="Nimda"
+ms-caro-malware-full:malware-family="Nimda"
2009 - A family of worms that spread by exploiting a vulnerability addressed by Microsoft Security Bulletin MS01-020. The worm compromises security by sharing the C drive and creating a Guest account with administrator permissions.
ms-caro-malware-full:malware-family="Mydoom"
+ms-caro-malware-full:malware-family="Mydoom"
2009 - A family of massmailing worms that spread through e-mail. Some variants also spread through P2P networks. It acts as a backdoor trojan and can sometimes be used to launch DoS attacks against specific Web sites
ms-caro-malware-full:malware-family="Bagle"
+ms-caro-malware-full:malware-family="Bagle"
2009 - A worm that spreads by e-mailing itself to addresses found on an infected computer. Some variants also spread through peer-to-peer (P2P) networks. Bagle acts as a backdoor trojan and can be used to distribute other malicious software.
ms-caro-malware-full:malware-family="Winwebsec"
+ms-caro-malware-full:malware-family="Winwebsec"
2009 - A family of rogue security software programs that have been distributed with several different names. The user interface varies to reflect each variant’s individual branding
ms-caro-malware-full:malware-family="Koobface"
+ms-caro-malware-full:malware-family="Koobface"
2009 - A multicomponent family of malware used to compromise computers and use them to perform various malicious tasks. It spreads through the internal messaging systems of popular social networking sites
ms-caro-malware-full:malware-family="Pdfjsc"
+ms-caro-malware-full:malware-family="Pdfjsc"
2009 - a family of specially crafted PDF files that exploits vulnerabilities in Adobe Acrobat and Adobe Reader. The files contain malicious JavaScript that executes when opened with a vulnerable program.
ms-caro-malware-full:malware-family="Pointfree"
+ms-caro-malware-full:malware-family="Pointfree"
2009 - a browser modifier that redirects users when invalid Web site addresses or search terms are entered in the Windows Internet Explorer address bar
ms-caro-malware-full:malware-family="Chadem"
+ms-caro-malware-full:malware-family="Chadem"
2009 - A trojan that steals password details from an infected computer by monitoring network traffic associated with FTP connections.
ms-caro-malware-full:malware-family="FakeIA"
+ms-caro-malware-full:malware-family="FakeIA"
2009 - A rogue security software family that impersonates the Windows Security Center. It may display product names or logos in an apparently unlawful attempt to impersonate Microsoft products
ms-caro-malware-full:malware-family="Waledac"
+ms-caro-malware-full:malware-family="Waledac"
2009 - A trojan that is used to send spam. It also has the ability to download and execute arbitrary files, harvest e-mail addresses from the local machine, perform denial-of-service attacks, proxy network traffic, and sniff passwords
ms-caro-malware-full:malware-family="Provis"
+ms-caro-malware-full:malware-family="Provis"
2009 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="Prolaco"
+ms-caro-malware-full:malware-family="Prolaco"
2009 - A family of worms that spreads via email, removable drives, Peer-to-Peer (P2P) and network shares. This worm may also drop and execute other malware.
ms-caro-malware-full:malware-family="Mywife"
+ms-caro-malware-full:malware-family="Mywife"
2009 - A mass-mailing network worm that targets certain versions of Microsoft Windows. The worm spreads through e-mail attachments and writeable network shares. It is designed to corrupt the content of specific files on the third day of every month.
ms-caro-malware-full:malware-family="Melissa"
+ms-caro-malware-full:malware-family="Melissa"
2009 - A macro worm that spreads via e-mail and by infecting Word documents and templates. It is designed to work in Word 97 and Word 2000, and it uses Outlook to reach new targets through e-mail
ms-caro-malware-full:malware-family="Rochap"
+ms-caro-malware-full:malware-family="Rochap"
2009 - A family of multicomponent trojans that download and execute additional malicious files. While downloading, some variants display a video from the Web site 'youtube.com' presumably to distract the user
ms-caro-malware-full:malware-family="Gamania"
+ms-caro-malware-full:malware-family="Gamania"
2009 - A family of trojans that steals online game passwords and sends them to remote sites.
ms-caro-malware-full:malware-family="Mabezat"
+ms-caro-malware-full:malware-family="Mabezat"
2009 - a polymorphic virus that infects Windows executable files. Apart from spreading through file infection, it also attempts to spread through e-mail attachments, network shares, removable drives and by CD-burning. It also contains a date-based payload that encrypts files with particular extensions.
ms-caro-malware-full:malware-family="Helpud"
+ms-caro-malware-full:malware-family="Helpud"
2009 - A family of trojans that steals login information for popular online games. The gathered information is then sent to remote websites.
ms-caro-malware-full:malware-family="PrivacyCenter"
+ms-caro-malware-full:malware-family="PrivacyCenter"
2009 - a family of programs that claims to scan for malware and displays fake warnings of 'malicious programs and viruses'. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
ms-caro-malware-full:malware-family="FakeRean"
+ms-caro-malware-full:malware-family="FakeRean"
2009 - This family of rogue security programs pretend to scan your PC for malware, and often report lots of infections. The program will say you have to pay for it before it can fully clean your PC. However, the program hasn’t really detected any malware at all and isn’t really an antivirus or antimalware scanner. It just looks like one so you’ll send money to the people who made the program. Some of these programs use product names or logos that unlawfully impersonate Microsoft products.
ms-caro-malware-full:malware-family="Bredolab"
+ms-caro-malware-full:malware-family="Bredolab"
2009 - A downloader that can access and execute arbitrary files from a remote host. Bredolab has been observed to download several other malware families to infected computers
ms-caro-malware-full:malware-family="Rugzip"
+ms-caro-malware-full:malware-family="Rugzip"
2009 - A trojan that downloads other malware from predefined Web sites. Rugzip may itself be installed by other malware. Once it has performed its malicious routines, it deletes itself to avoid detection.
ms-caro-malware-full:malware-family="Fakespypro"
+ms-caro-malware-full:malware-family="Fakespypro"
2009 - A rogue security family that falsely claims that the affected computer is infected with malware and encourages the user to buy a promoted product it claims will clean the computer.
ms-caro-malware-full:malware-family="Buzuz"
+ms-caro-malware-full:malware-family="Buzuz"
2009 - A trojan that downloads malware known as 'SpywareIsolator' a rogue security software program.
ms-caro-malware-full:malware-family="PoisonIvy"
+ms-caro-malware-full:malware-family="PoisonIvy"
2009 - A family of backdoor trojans that allow unauthorized access to and control of an affected machine. Poisonivy attempts to hide by injecting itself into other processes
ms-caro-malware-full:malware-family="AgentBypass"
+ms-caro-malware-full:malware-family="AgentBypass"
2009 - A detection for files that attempt to inject possibly malicious code into the explorer.exe process.
ms-caro-malware-full:malware-family="Enfal"
+ms-caro-malware-full:malware-family="Enfal"
2009 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="SystemHijack"
+ms-caro-malware-full:malware-family="SystemHijack"
2009 - A generic detection that uses advanced heuristics in the Microsoft Antivirus engine to detect malware that displays particular types of malicious behavior.
ms-caro-malware-full:malware-family="ProcInject"
+ms-caro-malware-full:malware-family="ProcInject"
2009 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="Malres"
+ms-caro-malware-full:malware-family="Malres"
2009 - A trojan that drops another malware, detected as Virtool:WinNT/Malres.A, into the system.
ms-caro-malware-full:malware-family="Kirpich"
+ms-caro-malware-full:malware-family="Kirpich"
2009 - a trojan that drops malicious code into the system. It also infects two system files; the infected files are detected as Virus:Win32/Kirpich.A, in the system. This does not constitute virus behavior for the trojan as it does not infect any other files and therefore does not have any conventional replication routines. TrojanDropper:Win32/Kirpich.A also disables Data Execution Protection and steals specific system information.
ms-caro-malware-full:malware-family="Malagent"
+ms-caro-malware-full:malware-family="Malagent"
2009 - A generic detection for a variety of threats.
ms-caro-malware-full:malware-family="Bumat"
+ms-caro-malware-full:malware-family="Bumat"
2009 - A generic detection for a variety of threats.
ms-caro-malware-full:malware-family="Bifrose"
+ms-caro-malware-full:malware-family="Bifrose"
2009 - A backdoor trojan that allows a remote attacker to access the compromised computer and injects its processes into the Windows shell and Internet Explorer.
ms-caro-malware-full:malware-family="Ripinip"
+ms-caro-malware-full:malware-family="Ripinip"
2009 - This threat can give a hacker unauthorized access and control of your PC.
ms-caro-malware-full:malware-family="Riler"
+ms-caro-malware-full:malware-family="Riler"
2009 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="Farfli"
+ms-caro-malware-full:malware-family="Farfli"
2009 - A trojan that drops various files detected as malware into a system. It also has backdoor capabilities that allow it to contact a remote attacker and wait for instructions.
ms-caro-malware-full:malware-family="PcClient"
+ms-caro-malware-full:malware-family="PcClient"
2009 - A backdoor trojan family with several components including a key logger, backdoor, and a rootkit.
ms-caro-malware-full:malware-family="Veden"
+ms-caro-malware-full:malware-family="Veden"
2009 - A name used for backdoor trojan detections that have been added to Microsoft signatures after advanced automated analysis.
ms-caro-malware-full:malware-family="Banload"
+ms-caro-malware-full:malware-family="Banload"
2009 - A family of trojans that download other malware. Banload usually downloads Win32/Banker, which steals banking credentials and other sensitive data and sends it back to a remote attacker.
ms-caro-malware-full:malware-family="Microjoin"
+ms-caro-malware-full:malware-family="Microjoin"
2009 - a tool that is used to deploy malware without being detected. It is used to bundle multiple files, consisting of a clean file and malware files, into a single executable.
ms-caro-malware-full:malware-family="Killav"
+ms-caro-malware-full:malware-family="Killav"
2009 - a trojan that terminates a large number of security-related processes, including those for antivirus, monitoring, or debugging tools, and may install certain exploits for the vulnerability addressed by Microsoft Security Bulletin MS08-067
ms-caro-malware-full:malware-family="Cinmus"
+ms-caro-malware-full:malware-family="Cinmus"
2009 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="MessengerPlus"
+ms-caro-malware-full:malware-family="MessengerPlus"
2009 - A non-Microsoft add-on for Microsoft’s Windows Live Messenger, called Messenger Plus!. It comes with an optional sponsor program installation, detected as Spyware:Win32/C2Lop.
ms-caro-malware-full:malware-family="Haxdoor"
+ms-caro-malware-full:malware-family="Haxdoor"
2009 - a backdoor trojan that allows remote control of the machine over the Internet. The trojan is rootkit-enabled, allowing it to hide processes and files related to the threat. Haxdoor lowers security settings on the computer and gathers user and system information to send to a third party
ms-caro-malware-full:malware-family="Nieguide"
+ms-caro-malware-full:malware-family="Nieguide"
2009 - a detection for a DLL file that connects to a Web site and may display advertisements or download other programs
ms-caro-malware-full:malware-family="Ithink"
+ms-caro-malware-full:malware-family="Ithink"
2009 - displays pop-up advertisements; it is usually bundled with other applications
ms-caro-malware-full:malware-family="Pointad"
+ms-caro-malware-full:malware-family="Pointad"
2009 - This program was detected by definitions prior to 1.175.2145.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Webdir"
+ms-caro-malware-full:malware-family="Webdir"
2009 - A Web Browser Helper Object (BHO) used to collect user information and display targeted advertisings using Internet Explorer browser. Webdir attempts to modify certain visited urls to include affiliate IDs.
ms-caro-malware-full:malware-family="Microbillsys"
+ms-caro-malware-full:malware-family="Microbillsys"
2009 - a program that processes payments made to a billing Web site. It is considered potentially unwanted software because it cannot be removed from the Add/Remove Programs list in Control Panel; rather, a user requires an 'uninstall code' before the program can be removed.
ms-caro-malware-full:malware-family="Kerlofost"
+ms-caro-malware-full:malware-family="Kerlofost"
2009 - a browser helper object (BHO) that may modify browsing behavior; redirect searches; report user statistics, behavior, and searches back to a remote server; and display pop-up advertisements.
ms-caro-malware-full:malware-family="Zwangi"
+ms-caro-malware-full:malware-family="Zwangi"
2009 - A program that runs as a service in the background and modifies Web browser settings to visit a particular Web site
ms-caro-malware-full:malware-family="DoubleD"
+ms-caro-malware-full:malware-family="DoubleD"
2009 - an adware program that displays pop-up advertising, runs at each system start and is installed as an Internet Explorer toolbar.
ms-caro-malware-full:malware-family="ShopAtHome"
+ms-caro-malware-full:malware-family="ShopAtHome"
2009 - A browser redirector that monitors Web-browsing behavior and online purchases. It claims to track points for ShopAtHome rebates when the user buys products directly from affiliated merchant Web sites.
ms-caro-malware-full:malware-family="FakeVimes"
+ms-caro-malware-full:malware-family="FakeVimes"
2009 - a downloading component of Win32/FakeVimes - a family of programs that claims to scan for malware and displays fake warnings of 'malicious programs and viruses'. They then inform the user that they need to pay money to register the software in order to remove these non-existent threats.
ms-caro-malware-full:malware-family="FakeCog"
+ms-caro-malware-full:malware-family="FakeCog"
2009 - This threat claims to scan your PC for malware and then shows you fake warnings. They try to convince you to pay to register the software to remove the non-existent threats.
ms-caro-malware-full:malware-family="FakeAdPro"
+ms-caro-malware-full:malware-family="FakeAdPro"
2009 - a program that may display false and misleading alerts regarding errors and malware to entice users to purchase it.
ms-caro-malware-full:malware-family="FakeSmoke"
+ms-caro-malware-full:malware-family="FakeSmoke"
2009 - a family of trojans consisting of a fake Security Center interface and a fake antivirus program.
ms-caro-malware-full:malware-family="FakeBye"
+ms-caro-malware-full:malware-family="FakeBye"
2009 - A rogue security software family that uses a Korean-language user interface.
ms-caro-malware-full:malware-family="Hiloti"
+ms-caro-malware-full:malware-family="Hiloti"
2009 - a generic detection for a trojan that interferes with an affected user’s browsing habits and downloads and executes arbitrary files.
ms-caro-malware-full:malware-family="Tikayb"
+ms-caro-malware-full:malware-family="Tikayb"
2009 - A trojan that attempts to establish a secure network connection to various Web sites without the user’s consent.
ms-caro-malware-full:malware-family="Ursnif"
+ms-caro-malware-full:malware-family="Ursnif"
2009 - A family of trojans that steals sensitive information from an affected computer
ms-caro-malware-full:malware-family="Rimecud"
+ms-caro-malware-full:malware-family="Rimecud"
2009 - A family of worms with multiple components that spreads via fixed and removable drives and via instant messaging. It also contains backdoor functionality that allows unauthorized access to an affected system
ms-caro-malware-full:malware-family="Lethic"
+ms-caro-malware-full:malware-family="Lethic"
2009 - A trojan that connects to remote servers, which may lead to unauthorized access to an affected system.
ms-caro-malware-full:malware-family="CeeInject"
+ms-caro-malware-full:malware-family="CeeInject"
2009 - This threat has been 'obfuscated', which means it has tried to hide its purpose so your security software doesn’t detect it. The malware that lies underneath this obfuscation can have almost any purpose.
ms-caro-malware-full:malware-family="Cmdow"
+ms-caro-malware-full:malware-family="Cmdow"
2009 - a detection for a command-line tool and violated the guidelines by which Microsoft identified unwanted software.
ms-caro-malware-full:malware-family="Yabector"
+ms-caro-malware-full:malware-family="Yabector"
2009 - This trojan can use your PC to click on online advertisements without your permission or knowledge. This can earn money for a malicious hacker by making a website or application appear more popular than it is.
ms-caro-malware-full:malware-family="Renocide"
+ms-caro-malware-full:malware-family="Renocide"
2009 - a family of worms that spread via local, removable, and network drives and also using file sharing applications. They have IRC-based backdoor functionality, which may allow a remote attacker to execute commands on the affected computer.
ms-caro-malware-full:malware-family="Liften"
+ms-caro-malware-full:malware-family="Liften"
2009 - a trojan that is used to stop affected users from downloading security updates. It is downloaded by Trojan:Win32/FakeXPA.
ms-caro-malware-full:malware-family="ShellCode"
+ms-caro-malware-full:malware-family="ShellCode"
2009 - A generic detection for JavaScript-enabled objects that contain exploit code and may exhibit suspicious behavior. Malicious websites and malformed PDF documents may contain JavaScript that attempts to execute code without the affected user’s consent.
ms-caro-malware-full:malware-family="FlyAgent"
+ms-caro-malware-full:malware-family="FlyAgent"
2009 - A backdoor trojan program that is capable of performing several actions depending on the commands of a remote attacker.
ms-caro-malware-full:malware-family="Psyme"
+ms-caro-malware-full:malware-family="Psyme"
2009 - This threat downloads and installs other programs, including other malware, onto your PC without your consent.
ms-caro-malware-full:malware-family="Orsam"
+ms-caro-malware-full:malware-family="Orsam"
2009 - A generic detection for a variety of threats. A name used for trojans that have been added to MS signatures after advanced automated analysis.
ms-caro-malware-full:malware-family="AgentOff"
+ms-caro-malware-full:malware-family="AgentOff"
2009 - This threat can perform a number of actions of a malicious hacker’s choice on your PC.
ms-caro-malware-full:malware-family="Nuj"
+ms-caro-malware-full:malware-family="Nuj"
2009 - a worm that copies itself to fixed, removable or network drives. Some variants of this worm may also terminate antivirus-related processes.
ms-caro-malware-full:malware-family="Sohanad"
+ms-caro-malware-full:malware-family="Sohanad"
2009 - Worms automatically spread to other PCs. They can do this in a number of ways, including by copying themselves to removable drives, network folders, or spreading through email.
ms-caro-malware-full:malware-family="I2ISolutions"
+ms-caro-malware-full:malware-family="I2ISolutions"
2009 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Dpoint"
+ms-caro-malware-full:malware-family="Dpoint"
2009 - This program was detected by definitions prior to 1.175.1915.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Silly_P2P"
+ms-caro-malware-full:malware-family="Silly_P2P"
2009 - Worms automatically spread to other PCs. They can do this in a number of ways, including by copying themselves to removable drives, network folders, or spreading through email.
ms-caro-malware-full:malware-family="Vobfus"
+ms-caro-malware-full:malware-family="Vobfus"
2009 - This family of worms can download other malware onto your PC, including: Win32/Beebone, Win32/Fareit, Win32/Zbot. Vobfus worms can be downloaded by other malware or spread via removable drives, such as USB flash drives.
ms-caro-malware-full:malware-family="Daurso"
+ms-caro-malware-full:malware-family="Daurso"
2009 - a family of trojans that attempts to steal sensitive information, including passwords and FTP authentication details from affected computers. This family targets particular FTP applications and also attempts to steal data from Protected Storage.
ms-caro-malware-full:malware-family="MyDealAssistant"
+ms-caro-malware-full:malware-family="MyDealAssistant"
2009 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Adsubscribe"
+ms-caro-malware-full:malware-family="Adsubscribe"
2009 - This program was detected by definitions prior to 1.175.1834.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="MyCentria"
+ms-caro-malware-full:malware-family="MyCentria"
2009 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="Fierads"
+ms-caro-malware-full:malware-family="Fierads"
2009 - This program was detected by definitions prior to 1.175.2037.0 as it violated the guidelines by which Microsoft identified unwanted software. Based on analysis using current guidelines, the program does not have unwanted behaviors.
ms-caro-malware-full:malware-family="VBInject"
+ms-caro-malware-full:malware-family="VBInject"
2009 - This is a generic detection for malicious files that are obfuscated using particular techniques to prevent their detection or analysis.
ms-caro-malware-full:malware-family="PerfectKeylogger"
+ms-caro-malware-full:malware-family="PerfectKeylogger"
2009 - a commercial monitoring program that monitors user activity, such as keystrokes typed. MonitoringTool:Win32/PerfectKeylogger is available for purchase at the company’s website. It may also have been installed without user consent by a Trojan or other malware.
ms-caro-malware-full:malware-family="AgoBot"
+ms-caro-malware-full:malware-family="AgoBot"
2010 VOL09 - A backdoor that communicates with a central server using IRC.
ms-caro-malware-full:malware-family="Bubnix"
+ms-caro-malware-full:malware-family="Bubnix"
2010 VOL09 - A generic detection for a kernel-mode driver installed by other malware that hides its presence on an affected computer by blocking registry and file access to itself. The trojan may report its installation to a remote server and download and distribute spam email messages and could download and execute arbitrary files.
ms-caro-malware-full:malware-family="Citeary"
+ms-caro-malware-full:malware-family="Citeary"
2010 VOL09 - A kernel mode driver installed by Win32/Citeary, a worm that spreads to all available drives including the local drive, installs device drivers and attempts to download other malware from a predefined website.
ms-caro-malware-full:malware-family="Fakeinit"
+ms-caro-malware-full:malware-family="Fakeinit"
2010 VOL09 - A rogue security software family distributed under the names Internet Security 2010, Security Essentials 2010, and others.
ms-caro-malware-full:malware-family="Oficla"
+ms-caro-malware-full:malware-family="Oficla"
2010 VOL09 - A family of trojans that attempt to inject code into running processes in order to download and execute arbitrary files. It may download rogue security programs.
ms-caro-malware-full:malware-family="Pasur"
+ms-caro-malware-full:malware-family="Pasur"
2010 VOL09 - a name used for backdoor trojan detections that have been added to Microsoft signatures after advanced automated analysis.
ms-caro-malware-full:malware-family="PrettyPark"
+ms-caro-malware-full:malware-family="PrettyPark"
2010 VOL09 - A worm that spreads via email attachments. It allows backdoor access and control of an infected computer.
ms-caro-malware-full:malware-family="Prorat"
+ms-caro-malware-full:malware-family="Prorat"
2010 VOL09 - A trojan that opens random ports that allow remote access from an attacker to the affected computer. This backdoor may download and execute other malware from predefined websites and may terminate several security applications or services.
ms-caro-malware-full:malware-family="Pushbot"
+ms-caro-malware-full:malware-family="Pushbot"
2010 VOL09 - A detection for a family of malware that spreads via MSN Messenger, Yahoo! Messenger, and AIM when commanded by a remote attacker. It contains backdoor functionality that allows unauthorized access and control of an affected machine.
ms-caro-malware-full:malware-family="Randex"
+ms-caro-malware-full:malware-family="Randex"
2010 VOL09 - A worm that scans randomly generated IP addresses to attempt to spread to network shares with weak passwords. After the worm infects a computer, it connects to an IRC server to receive commands from the attacker.
ms-caro-malware-full:malware-family="SDBot"
+ms-caro-malware-full:malware-family="SDBot"
2010 VOL09 - A family of backdoor trojans that allows attackers to control infected computers over an IRC channel.
ms-caro-malware-full:malware-family="Trenk"
+ms-caro-malware-full:malware-family="Trenk"
2010 VOL09 - a name used for backdoor trojan detections that have been added to Microsoft signatures after advanced automated analysis.
ms-caro-malware-full:malware-family="Tofsee"
+ms-caro-malware-full:malware-family="Tofsee"
2010 VOL09 - A multi-component family of backdoor trojans that act as a spam and traffic relay.
ms-caro-malware-full:malware-family="Ursap"
+ms-caro-malware-full:malware-family="Ursap"
2010 VOL09 - a name used for backdoor trojan detections that have been added to Microsoft signatures after advanced automated analysis.
ms-caro-malware-full:malware-family="Zbot"
+ms-caro-malware-full:malware-family="Zbot"
2010 VOL09 - A family of password stealing trojans that also contains backdoor functionality allowing unauthorized access and control of an affected machine.
ms-caro-malware-full:malware-family="Ciucio"
+ms-caro-malware-full:malware-family="Ciucio"
2010 VOL10 - A family of trojans that connect to certain websites in order to download arbitrary files.
ms-caro-malware-full:malware-family="ClickPotato"
+ms-caro-malware-full:malware-family="ClickPotato"
2010 VOL10 - A program that displays popup and notification-style advertisements based on the user’s browsing habits.
ms-caro-malware-full:malware-family="CVE-2010-0806"
+ms-caro-malware-full:malware-family="CVE-2010-0806"
2010 VOL10 - A detection for malicious JavaScript that attempts to exploit the vulnerability addressed by Microsoft Security Bulletin MS10-018.
ms-caro-malware-full:malware-family="Delf"
+ms-caro-malware-full:malware-family="Delf"
2010 VOL10 - A detection for various threats written in the Delphi programming language. The behaviors displayed by this malware family are highly variable.
ms-caro-malware-full:malware-family="FakePAV"
+ms-caro-malware-full:malware-family="FakePAV"
2010 VOL10 - A rogue security software family that masquerades as Microsoft Security Essentials.
ms-caro-malware-full:malware-family="Keygen"
+ms-caro-malware-full:malware-family="Keygen"
2010 VOL10 - A generic detection for tools that generate product keys for illegally obtained versions of various software products.
ms-caro-malware-full:malware-family="Onescan"
+ms-caro-malware-full:malware-family="Onescan"
2010 VOL10 - A Korean-language rogue security software family distributed under the names One Scan, Siren114, EnPrivacy, PC Trouble, My Vaccine, and others.
ms-caro-malware-full:malware-family="Pornpop"
+ms-caro-malware-full:malware-family="Pornpop"
2010 VOL10 - A generic detection for specially-crafted JavaScript-enabled objects that attempt to display pop-under advertisements, usually with adult content.
ms-caro-malware-full:malware-family="Startpage"
+ms-caro-malware-full:malware-family="Startpage"
2010 VOL10 - A detection for various threats that change the configured start page of the affected user’s web browser, and may also perform other malicious actions.
ms-caro-malware-full:malware-family="Begseabug"
+ms-caro-malware-full:malware-family="Begseabug"
2011 VOL11 - A trojan that downloads and executes arbitrary files on an affected computer.
ms-caro-malware-full:malware-family="CVE-2010-0840"
+ms-caro-malware-full:malware-family="CVE-2010-0840"
2011 VOL11 - A detection for a malicious and obfuscated Java class that exploits a vulnerability described in CVE-2010-0840. Oracle Corporation addressed the vulnerability with a security update in March 2010.
ms-caro-malware-full:malware-family="Cycbot"
+ms-caro-malware-full:malware-family="Cycbot"
2011 VOL11 - A backdoor trojan that allows attackers unauthorized access and control of an affected computer. After a computer is infected, the trojan connects to a specific remote server to receive commands from attackers.
ms-caro-malware-full:malware-family="DroidDream"
+ms-caro-malware-full:malware-family="DroidDream"
2011 VOL11 - A malicious program that affects mobile devices running the Android operating system. It may be bundled with clean applications, and is capable of allowing a remote attacker to gain access to the mobile device.
ms-caro-malware-full:malware-family="FakeMacdef"
+ms-caro-malware-full:malware-family="FakeMacdef"
2011 VOL11 - A rogue security software family that affects Apple Mac OS X. It has been distributed under the names MacDefender, MacSecurity, MacProtector, and possibly others.
ms-caro-malware-full:malware-family="GameHack"
+ms-caro-malware-full:malware-family="GameHack"
2011 VOL11 - Malware that is often bundled with game applications. It commonly displays unwanted pop-up advertisements and may be installed as a web browser helper object.
ms-caro-malware-full:malware-family="Loic"
+ms-caro-malware-full:malware-family="Loic"
2011 VOL11 - An open-source network attack tool designed to perform denial-ofservice (DoS) attacks.
ms-caro-malware-full:malware-family="Lotoor"
+ms-caro-malware-full:malware-family="Lotoor"
2011 VOL11 - A detection for specially crafted Android programs that attempt to exploit vulnerabilities in the Android operating system to gain root privilege.
ms-caro-malware-full:malware-family="Nuqel"
+ms-caro-malware-full:malware-family="Nuqel"
2011 VOL11 - A worm that spreads via mapped drives and certain instant messaging applications. It may modify system settings, connect to certain websites, download arbitrary files, or take other malicious actions.
ms-caro-malware-full:malware-family="OfferBox"
+ms-caro-malware-full:malware-family="OfferBox"
2011 VOL11 - A program that displays offers based on the user’s web browsing habits. Some versions may display advertisements in a pop-under window. Win32/OfferBox may be installed without adequate user consent by malware.
ms-caro-malware-full:malware-family="OpenCandy"
+ms-caro-malware-full:malware-family="OpenCandy"
2011 VOL11 - An adware program that may be bundled with certain thirdparty software installation programs. Some versions may send user-specific information, including a unique machine code, operating system information, locale, and certain other information to a remote server without obtaining adequate user consent.
ms-caro-malware-full:malware-family="Pameseg"
+ms-caro-malware-full:malware-family="Pameseg"
2011 VOL11 - A fake program installer that requires the user to send SMS messages to a premium number to successfully install certain programs.
ms-caro-malware-full:malware-family="Pramro"
+ms-caro-malware-full:malware-family="Pramro"
2011 VOL11 - A trojan that creates a proxy on the infected computer for email and HTTP traffic, and is used to send spam email.
ms-caro-malware-full:malware-family="Ramnit"
+ms-caro-malware-full:malware-family="Ramnit"
2011 VOL11 - A family of multi-component malware that infects executable files, Microsoft Office files, and HTML files. Win32/Ramnit spreads to removable drives and steals sensitive information such as saved FTP credentials and browser cookies. It may also open a backdoor to await instructions from a remote attacker.
ms-caro-malware-full:malware-family="Rlsloup"
+ms-caro-malware-full:malware-family="Rlsloup"
2011 VOL11 - A family of trojans that are used to send spam email. Rlsloup consists of several components, including an installation trojan component and a spamming payload component.
ms-caro-malware-full:malware-family="ShopperReports"
+ms-caro-malware-full:malware-family="ShopperReports"
2011 VOL11 - Adware that displays targeted advertising to affected users while browsing the Internet, based on search terms entered into search engines.
ms-caro-malware-full:malware-family="Sinowal"
+ms-caro-malware-full:malware-family="Sinowal"
2011 VOL11 - A family of password-stealing and backdoor trojans. It may try to install a fraudulent SSL certificate on the computer. Sinowal may also capture user data such as banking credentials from various user accounts and send the data to Web sites specified by the attacker.
ms-caro-malware-full:malware-family="Stuxnet"
+ms-caro-malware-full:malware-family="Stuxnet"
2011 VOL11 - A multi-component family that spreads via removable volumes by exploiting the vulnerability addressed by Microsoft Security Bulletin MS10-046.
ms-caro-malware-full:malware-family="Swimnag"
+ms-caro-malware-full:malware-family="Swimnag"
2011 VOL11 - A worm that spreads via removable drives and drops a randomly-named DLL in the Windows system folder.
ms-caro-malware-full:malware-family="Tedroo"
+ms-caro-malware-full:malware-family="Tedroo"
2011 VOL11 - A trojan that sends spam email messages. Some variants may disable certain Windows services or allow backdoor access by a remote attacker.
ms-caro-malware-full:malware-family="Yimfoca"
+ms-caro-malware-full:malware-family="Yimfoca"
2011 VOL11 - A worm family that spreads via common instant messaging applications and social networking sites. It is capable of connecting to a remote HTTP or IRC server to receive updated configuration data. It also modifies certain system and security settings.
ms-caro-malware-full:malware-family="Bamital"
+ms-caro-malware-full:malware-family="Bamital"
2011 VOL12 - A family of malware that intercepts web browser traffic and prevents access to specific security-related websites by modifying the Hosts file. Bamital variants may also modify specific legitimate Windows files in order to execute their payload.
ms-caro-malware-full:malware-family="Blacole"
+ms-caro-malware-full:malware-family="Blacole"
2011 VOL12 - An exploit pack, also known as Blackhole, that is installed on a compromised web server by an attacker and includes a number of exploits that target browser software. If a vulnerable computer browses a compromised website containing the exploit pack, various malware may be downloaded and run.
ms-caro-malware-full:malware-family="Bulilit"
+ms-caro-malware-full:malware-family="Bulilit"
2011 VOL12 - A trojan that silently downloads and installs other programs without consent. Infection could involve the installation of additional malware or malware components to an affected computer.
ms-caro-malware-full:malware-family="Dorkbot"
+ms-caro-malware-full:malware-family="Dorkbot"
2011 VOL12 - A worm that spreads via instant messaging and removable drives. It also contains backdoor functionality that allows unauthorized access and control of the affected computer. Win32/Dorkbot may be distributed from compromised or malicious websites using PDF or browser exploits.
ms-caro-malware-full:malware-family="EyeStye"
+ms-caro-malware-full:malware-family="EyeStye"
2011 VOL12 - A trojan that attempts to steal sensitive data using a method known as form grabbing, and sends it to a remote attacker. It may also download and execute arbitary files and use a rootkit component to hide its activities.
ms-caro-malware-full:malware-family="FakeSysdef"
+ms-caro-malware-full:malware-family="FakeSysdef"
2011 VOL12 - A rogue security software family that claims to discover nonexistent hardware defects related to system memory, hard drives, and overall system performance, and charges a fee to fix the supposed problems.
ms-caro-malware-full:malware-family="Helompy"
+ms-caro-malware-full:malware-family="Helompy"
2011 VOL12 - A worm that spreads via removable drives and attempts to capture and steal authentication details for a number of different websites or online services, including Facebook and Gmail.
ms-caro-malware-full:malware-family="Malf"
+ms-caro-malware-full:malware-family="Malf"
2011 VOL12 - A generic detection for malware that drops additional malicious files.
ms-caro-malware-full:malware-family="Rugo"
+ms-caro-malware-full:malware-family="Rugo"
2011 VOL12 - A program that installs silently on the user’s computer and displays advertisements.
ms-caro-malware-full:malware-family="Sirefef"
+ms-caro-malware-full:malware-family="Sirefef"
2011 VOL12 - A rogue security software family distributed under the name Antivirus 2010 and others.
ms-caro-malware-full:malware-family="Sisproc"
+ms-caro-malware-full:malware-family="Sisproc"
2011 VOL12 - A generic detection for a group of trojans that have been observed to perform a number of various and common malware behaviors.
ms-caro-malware-full:malware-family="Swisyn"
+ms-caro-malware-full:malware-family="Swisyn"
2011 VOL12 - A trojan that drops and executes arbitrary files on an infected computer. The dropped files may be potentially unwanted or malicious programs.
ms-caro-malware-full:malware-family="BlacoleRef"
+ms-caro-malware-full:malware-family="BlacoleRef"
2012 VOL13 - An obfuscated script, often found inserted into compromised websites, that uses a hidden inline frame to redirect the browser to a Blacole exploit server.
ms-caro-malware-full:malware-family="CVE-2012-0507"
+ms-caro-malware-full:malware-family="CVE-2012-0507"
2012 VOL13 - A detection for a malicious Java applet that exploits the Java Runtime Environment (JRE) vulnerability described in CVE-2012-0507, addressed by an Oracle security update in February 2012.
ms-caro-malware-full:malware-family="Flashback"
+ms-caro-malware-full:malware-family="Flashback"
2012 VOL13 - A trojan that targets Java JRE vulnerability CVE-2012-0507 on Mac OS X to enroll the infected computer in a botnet.
ms-caro-malware-full:malware-family="Gendows"
+ms-caro-malware-full:malware-family="Gendows"
2012 VOL13 - A tool that attempts to activate Windows 7 and Windows Vista operating system installations.
ms-caro-malware-full:malware-family="GingerBreak"
+ms-caro-malware-full:malware-family="GingerBreak"
2012 VOL13 - A program that affects mobile devices running the Android operating system. It drops and executes an exploit that, if run successfully, gains administrator privileges on the device.
ms-caro-malware-full:malware-family="GingerMaster"
+ms-caro-malware-full:malware-family="GingerMaster"
2012 VOL13 - A malicious program that affects mobile devices running the Android operating system. It may be bundled with clean applications, and is capable of allowing a remote attacker to gain access to the mobile device.
ms-caro-malware-full:malware-family="Mult_JS"
+ms-caro-malware-full:malware-family="Mult_JS"
2012 VOL13 - A generic detection for various exploits written in the JavaScript language.
ms-caro-malware-full:malware-family="Patch"
+ms-caro-malware-full:malware-family="Patch"
2012 VOL13 - A family of tools intended to modify, or 'patch' programs that may be evaluation copies, or unregistered versions with limited features for the purpose of removing the limitations.
ms-caro-malware-full:malware-family="Phoex"
+ms-caro-malware-full:malware-family="Phoex"
2012 VOL13 - A malicious script that exploits the Java Runtime Environment (JRE) vulnerability discussed in CVE-2010-4452. If run in a computer running a vulnerable version of Java, it downloads and executes arbitrary files.
ms-caro-malware-full:malware-family="Pluzoks"
+ms-caro-malware-full:malware-family="Pluzoks"
2012 VOL13 - A trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components.
ms-caro-malware-full:malware-family="Popupper"
+ms-caro-malware-full:malware-family="Popupper"
2012 VOL13 - A detection for a particular JavaScript script that attempts to display pop-under advertisements.
ms-caro-malware-full:malware-family="Wizpop"
+ms-caro-malware-full:malware-family="Wizpop"
2012 VOL13 - Adware that may track user search habits and download executable programs without user consent.
ms-caro-malware-full:malware-family="Wpakill"
+ms-caro-malware-full:malware-family="Wpakill"
2012 VOL13 - A family of tools that attempt to disable or bypass WPA (Windows Product Activation), WGA (Windows Genuine Advantage) checks, or WAT (Windows Activation Technologies), by altering Windows operating system files, terminating processes, or stopping services.
ms-caro-malware-full:malware-family="Yeltminky"
+ms-caro-malware-full:malware-family="Yeltminky"
2012 VOL13 - A family of worms that spreads by making copies of itself on all available drives and creating an autorun.inf file to execute that copy.
ms-caro-malware-full:malware-family="Aimesu"
+ms-caro-malware-full:malware-family="Aimesu"
2013 VOL15 - A threat that exploits vulnerabilities in unpatched versions of Java, Adobe Reader, or Flash Player. It then installs other malare on the computer, including components of the Blackhole and Cool exploit kits.
ms-caro-malware-full:malware-family="Bdaejec"
+ms-caro-malware-full:malware-family="Bdaejec"
2013 VOL15 - A trojan that allows unauthorized access and control of an affected computer, and that may download and install other programs without consent.
ms-caro-malware-full:malware-family="Bursted"
+ms-caro-malware-full:malware-family="Bursted"
2013 VOL15 - A virus written in the AutoLISP scripting language used by the AutoCAD computer-aided design program. It infects other AutoLISP files with the extension .lsp.
ms-caro-malware-full:malware-family="Colkit"
+ms-caro-malware-full:malware-family="Colkit"
2013 VOL15 - A detection for obfuscated, malicious JavaScript code that redirects to or loads files that may exploit a vulnerable version of Java, Adobe Reader, or Adobe Flash, possibly in an attempt to load malware onto the computer.
ms-caro-malware-full:malware-family="Coolex"
+ms-caro-malware-full:malware-family="Coolex"
2013 VOL15 - A detection for scripts from an exploit pack known as the Cool Exploit Kit. These scripts are often used in ransomware schemes in which an attacker locks a victim’s computer or encrypts the user’s data and demands money to make it available again.
ms-caro-malware-full:malware-family="CplLnk"
+ms-caro-malware-full:malware-family="CplLnk"
2013 VOL15 - A generic detection for specially crafted malicious shortcut files that attempt to exploit the vulnerability addressed by Microsoft Security Bulletin MS10-046, CVE-2010-2568.
ms-caro-malware-full:malware-family="CVE-2011-1823"
+ms-caro-malware-full:malware-family="CVE-2011-1823"
2013 VOL15 - A detection for specially crafted Android programs that attempt to exploit a vulnerability in the Android operating system to gain root privilege.
ms-caro-malware-full:malware-family="CVE-2012-1723"
+ms-caro-malware-full:malware-family="CVE-2012-1723"
2013 VOL15 - A family of malicious Java applets that attempt to exploit vulnerability CVE-2012-1723 in the Java Runtime Environment (JRE) to download and install files of an attacker’s choice onto the computer.
ms-caro-malware-full:malware-family="DealPly"
+ms-caro-malware-full:malware-family="DealPly"
2013 VOL15 - Adware that displays offers related to the user’s web browsing habits. It may be bundled with certain third-party software installation programs.
ms-caro-malware-full:malware-family="Fareit"
+ms-caro-malware-full:malware-family="Fareit"
2013 VOL15 - A malware family that has multiple components: a password stealing component that steals sensitive information and sends it to an attacker, and a DDoS component that could be used against other computers.
ms-caro-malware-full:malware-family="FastSaveApp"
+ms-caro-malware-full:malware-family="FastSaveApp"
2013 VOL15 - An adware program that displays offers related to the user’s web browsing habits. It may use the name 'SaveAs' or 'SaveByClick'.
ms-caro-malware-full:malware-family="FindLyrics"
+ms-caro-malware-full:malware-family="FindLyrics"
2013 VOL15 - An adware program that displays ads related to the user’s web browsing habits.
ms-caro-malware-full:malware-family="Gamarue"
+ms-caro-malware-full:malware-family="Gamarue"
2013 VOL15 - A worm that is commonly distributed via exploit kits and social engineering. Variants have been observed stealing information from the local computer and communicating with command-and-control (C&C) servers managed by attackers.
ms-caro-malware-full:malware-family="Gisav"
+ms-caro-malware-full:malware-family="Gisav"
2013 VOL15 - An adware program that displays offers related to the user’s web browsing habits. It can be downloaded from the program’s website, and can be bundled with some third-party software installation programs.
ms-caro-malware-full:malware-family="InfoAtoms"
+ms-caro-malware-full:malware-family="InfoAtoms"
2013 VOL15 - An adware program that displays advertisements related to the user’s web browsing habits and inserts advertisements into websites.
ms-caro-malware-full:malware-family="Perl/IRCbot.E"
+ms-caro-malware-full:malware-family="Perl/IRCbot.E"
2013 VOL15 - A backdoor trojan that drops other malicious software and connects to IRC servers to receive commands from attackers.
ms-caro-malware-full:malware-family="Javrobat"
+ms-caro-malware-full:malware-family="Javrobat"
2013 VOL15 - An exploit that tries to check whether certain versions of Adobe Acrobat or Adobe Reader are installed on the computer. If so, it tries to install malware.
ms-caro-malware-full:malware-family="Kraddare"
+ms-caro-malware-full:malware-family="Kraddare"
2013 VOL15 - Adware that displays Korean-language advertisements.
ms-caro-malware-full:malware-family="PriceGong"
+ms-caro-malware-full:malware-family="PriceGong"
2013 VOL15 - An adware program that shows certain deals related to the search terms entered on any web page.
ms-caro-malware-full:malware-family="Protlerdob"
+ms-caro-malware-full:malware-family="Protlerdob"
2013 VOL15 - A software installer with a Portuguese language user interface. It presents itself as a free movie download but bundles with it a number of programs that may charge for services.
ms-caro-malware-full:malware-family="Qhost"
+ms-caro-malware-full:malware-family="Qhost"
2013 VOL15 - A generic detection for trojans that modify the HOSTS file on the computer to redirect or limit Internet traffic to certain sites.
ms-caro-malware-full:malware-family="Reveton"
+ms-caro-malware-full:malware-family="Reveton"
2013 VOL15 - A ransomware family that targets users from certain countries or regions. It locks the computer and displays a location-specific webpage that covers the desktop and demands that the user pay a fine for the supposed possession of illicit material.
ms-caro-malware-full:malware-family="Rongvhin"
+ms-caro-malware-full:malware-family="Rongvhin"
2013 VOL15 - A family of malware that perpetrates click fraud. It might be delivered to the computer via hack tools for the game CrossFire.
ms-caro-malware-full:malware-family="Seedabutor"
+ms-caro-malware-full:malware-family="Seedabutor"
2013 VOL15 - A JavaScript trojan that attempts to redirect the browser to another website.
ms-caro-malware-full:malware-family="SMSer"
+ms-caro-malware-full:malware-family="SMSer"
2013 VOL15 - A ransomware trojan that locks an affected user’s computer and requests that the user send a text message to a premium-charge number to unlock it.
ms-caro-malware-full:malware-family="Tobfy"
+ms-caro-malware-full:malware-family="Tobfy"
2013 VOL15 - A family of ransomware trojans that targets users from certain countries. It locks the computer and displays a localized message demanding the payment of a fine for the supposed possession of illicit material. Some variants may also take webcam screenshots, play audio messages, or affect certain processes or drivers.
ms-caro-malware-full:malware-family="Truado"
+ms-caro-malware-full:malware-family="Truado"
2013 VOL15 - A trojan that poses as an update for certain Adobe software.
ms-caro-malware-full:malware-family="Urausy"
+ms-caro-malware-full:malware-family="Urausy"
2013 VOL15 - A family of ransomware trojans that locks the computer and displays a localized message, supposedly from police authorities, demanding the payment of a fine for alleged criminal activity.
ms-caro-malware-full:malware-family="Wecykler"
+ms-caro-malware-full:malware-family="Wecykler"
2013 VOL15 - A family of worms that spread via removable drives, such as USB drives, that may stop security processes and other processes on the computer, and log keystrokes that are later sent to a remote attacker.
ms-caro-malware-full:malware-family="Weelsof"
+ms-caro-malware-full:malware-family="Weelsof"
2013 VOL15 - A family of ransomware trojans that targets users from certain countries. It locks the computer and displays a localized message demanding the payment of a fine for the alleged possession of illicit material. Some variants may take steps that make it difficult to run or update virus protection.
ms-caro-malware-full:malware-family="Yakdowpe"
+ms-caro-malware-full:malware-family="Yakdowpe"
2013 VOL15 - A family of trojans that connect to certain websites to silently download and install other programs without consent.
ms-caro-malware-full:malware-family="Anogre"
+ms-caro-malware-full:malware-family="Anogre"
2013 VOL16 - A threat that exploits a vulnerability addressed by Microsoft Security Bulletin MS11-087. This vulnerability can allow a hacker to install programs, view, change, or delete data or create new accounts with full administrative privileges.
ms-caro-malware-full:malware-family="Brantall"
+ms-caro-malware-full:malware-family="Brantall"
2013 VOL16 - A family of trojans that download and install other programs, including Win32/Sefnit and Win32/Rotbrow. Brantall often pretends to be an installer for other, legitimate programs.
ms-caro-malware-full:malware-family="Comame"
+ms-caro-malware-full:malware-family="Comame"
2013 VOL16 - A generic detection for a variety of threats.
ms-caro-malware-full:malware-family="Crilock"
+ms-caro-malware-full:malware-family="Crilock"
2013 VOL16 - A ransomware family that encrypts the computer’s files and displays a webpage that demands a fee to unlock them.
ms-caro-malware-full:malware-family="CVE-2011-3874"
+ms-caro-malware-full:malware-family="CVE-2011-3874"
2013 VOL16 - A threat that attempts to exploit a vulnerability in the Android operating system to gain access to and control of the device Java/CVE-2012-1723. A family of malicious Java applets that attempt to exploit vulnerability CVE-2012-1723 in the Java Runtime Environment (JRE) in order to download and install files of an attacker’s choice onto the computer.
ms-caro-malware-full:malware-family="Deminnix"
+ms-caro-malware-full:malware-family="Deminnix"
2013 VOL16 - A trojan that uses the computer for Bitcoin mining and changes the home page of the web browser. It can accidentally be downloaded along with other files from torrent sites.
ms-caro-malware-full:malware-family="Detplock"
+ms-caro-malware-full:malware-family="Detplock"
2013 VOL16 - A generic detection for a variety of threats.
ms-caro-malware-full:malware-family="Dircrypt"
+ms-caro-malware-full:malware-family="Dircrypt"
2013 VOL16 - Ransomware that encrypts the user’s files and demands payment to release them. It is distributed through spam email messages and can be downloaded by other malware.
ms-caro-malware-full:malware-family="DonxRef"
+ms-caro-malware-full:malware-family="DonxRef"
2013 VOL16 - A generic detection for malicious JavaScript objects that construct shellcode. The scripts may try to exploit vulnerabilities in Java, Adobe Flash Player, and Windows.
ms-caro-malware-full:malware-family="Faceliker"
+ms-caro-malware-full:malware-family="Faceliker"
2013 VOL16 - A malicious script that likes content on Facebook without the user’s knowledge or consent.
ms-caro-malware-full:malware-family="FakeAlert"
+ms-caro-malware-full:malware-family="FakeAlert"
2013 VOL16 - A malicious script that falsely claims that the computer is infected with viruses and that additional software is needed to disinfect it.
ms-caro-malware-full:malware-family="Jenxcus"
+ms-caro-malware-full:malware-family="Jenxcus"
2013 VOL16 - A worm that gives an attacker control of the computer. It is spread by infected removable drives, like USB flash drives. It can also be downloaded within a torrent file.
ms-caro-malware-full:malware-family="Loktrom"
+ms-caro-malware-full:malware-family="Loktrom"
2013 VOL16 - Ransomware that locks the computer and displays a full-screen message pretending to be from a national police force, demanding payment to unlock the computer.
ms-caro-malware-full:malware-family="Miposa"
+ms-caro-malware-full:malware-family="Miposa"
2013 VOL16 - A trojan that downloads and runs malicious Windows Scripting Host (.wsh) files.
ms-caro-malware-full:malware-family="Nitol"
+ms-caro-malware-full:malware-family="Nitol"
2013 VOL16 - A family of trojans that perform DDoS (distributed denial of service) attacks, allow backdoor access and control, download and run files, and perform a number of other malicious activities on the computer.
ms-caro-malware-full:malware-family="Oceanmug"
+ms-caro-malware-full:malware-family="Oceanmug"
2013 VOL16 - A trojan that silently downloads and installs other programs without consent.
ms-caro-malware-full:malware-family="Proslikefan"
+ms-caro-malware-full:malware-family="Proslikefan"
2013 VOL16 - A worm that spreads through removable drives, network shares, and P2P programs. It can lower the computer’s security settings and disable antivirus products.
ms-caro-malware-full:malware-family="Rotbrow"
+ms-caro-malware-full:malware-family="Rotbrow"
2013 VOL16 - A trojan that installs browser add-ons that claim to offer protection from other add-ons. Rotbrow can change the browser’s home page, and can install the trojan Win32/Sefnit. It is commonly installed by Win32/Brantall.
ms-caro-malware-full:malware-family="Sefnit"
+ms-caro-malware-full:malware-family="Sefnit"
2013 VOL16 - A family of trojans that can allow backdoor access, download files, and use the computer and Internet connection for click fraud. Some variants can monitor web browsers and hijack search results.
ms-caro-malware-full:malware-family="Urntone"
+ms-caro-malware-full:malware-family="Urntone"
2013 VOL16 - A webpage component of the Neutrino exploit kit. It checks the version numbers of popular applications installed on the computer, and attempts to install malware that targets vulnerabilities in the software.
ms-caro-malware-full:malware-family="Wysotot"
+ms-caro-malware-full:malware-family="Wysotot"
2013 VOL16 - A threat that can change the start page of the user’s web browser, and may download and install other files to the computer. It is installed by software bundlers that advertise free software or games.
ms-caro-malware-full:malware-family="AddLyrics"
+ms-caro-malware-full:malware-family="AddLyrics"
2014 VOL17 - A browser add-on that displays lyrics for songs on YouTube, and displays advertisements in the browser window.
ms-caro-malware-full:malware-family="Adpeak"
+ms-caro-malware-full:malware-family="Adpeak"
2014 VOL17 - Adware that displays extra ads as the user browses the Internet, without revealing where the ads are coming from. It may be bundled with some third-party software installation programs.
ms-caro-malware-full:malware-family="Axpergle"
+ms-caro-malware-full:malware-family="Axpergle"
2014 VOL17 - A detection for the Angler exploit kit, which exploits vulnerabilities in recent versions of Internet Explorer, Silverlight, Adobe Flash Player, and Java to install malware.
ms-caro-malware-full:malware-family="Bepush"
+ms-caro-malware-full:malware-family="Bepush"
2014 VOL17 - A family of trojans that download and install add-ons for the Firefox and Chrome browsers that post malicious links to social networking sites, track browser usage, and redirect the browser to specific websites.
ms-caro-malware-full:malware-family="BetterSurf"
+ms-caro-malware-full:malware-family="BetterSurf"
2014 VOL17 - Adware that displays unwanted ads on search engine results pages and other websites. It may be included with software bundles that offer free applications or games.
ms-caro-malware-full:malware-family="Bladabindi"
+ms-caro-malware-full:malware-family="Bladabindi"
2014 VOL17 - A family of backdoors created by a malicious hacker tool called NJ Rat. They can steal sensitive information, download other malware, and allow backdoor access to an infected computer.
ms-caro-malware-full:malware-family="Caphaw"
+ms-caro-malware-full:malware-family="Caphaw"
2014 VOL17 - A family of backdoors that spread via Facebook, YouTube, Skype, removable drives, and drive-by download. They can make Facebook posts via the user’s account, and may steal online banking details.
ms-caro-malware-full:malware-family="Clikug"
+ms-caro-malware-full:malware-family="Clikug"
2014 VOL17 - A threat that uses a computer for click fraud. It has been observed using as much as a gigabyte of bandwidth per hour.
ms-caro-malware-full:malware-family="CVE-2014-0322"
+ms-caro-malware-full:malware-family="CVE-2014-0322"
This threat uses a vulnerability MS14-012, CVE-2014-0322 in Internet Explorer 9 and 10 to download and run files on your PC, including other malware.
ms-caro-malware-full:malware-family="CVE-2013-0422"
+ms-caro-malware-full:malware-family="CVE-2013-0422"
2014 VOL17 - A detection for a malicious Java applet that exploits the Java Runtime Environment (JRE) vulnerability described in CVE-2013-0422, addressed by an Oracle security update in January 2013.
ms-caro-malware-full:malware-family="Dowque"
+ms-caro-malware-full:malware-family="Dowque"
2014 VOL17 - A generic detection for malicious files that are capable of installing other malware.
ms-caro-malware-full:malware-family="Fashack"
+ms-caro-malware-full:malware-family="Fashack"
2014 VOL17 - A detection for the Safehack exploit kit, also known as Flashpack. It uses vulnerabilities in Adobe Flash Player, Java, and Silverlight to install malware on a computer.
ms-caro-malware-full:malware-family="Feven"
+ms-caro-malware-full:malware-family="Feven"
2014 VOL17 - A browser add-on for Internet Explorer, Firefox, or Chrome that displays ads on search engine results pages and other websites, and redirects the browser to specific websites.
ms-caro-malware-full:malware-family="Fiexp"
+ms-caro-malware-full:malware-family="Fiexp"
2014 VOL17 - A detection for the Fiesta exploit kit, which attempts to exploit Java, Adobe Flash Player, Adobe Reader, Silverlight, and Internet Explorer to install malware.
ms-caro-malware-full:malware-family="Filcout"
+ms-caro-malware-full:malware-family="Filcout"
2014 VOL17 - An application that offers to locate and download programs to run unknown files. It has been observed installing variants in the Win32/Sefnit family.
ms-caro-malware-full:malware-family="Genasom"
+ms-caro-malware-full:malware-family="Genasom"
2014 VOL17 - A ransomware family that locks a computer and demands money to unlock it. It usually targets Russian-language users, and may open pornographic websites.
ms-caro-malware-full:malware-family="Kegotip"
+ms-caro-malware-full:malware-family="Kegotip"
2014 VOL17 - A password-stealing trojan that can steal email addresses, personal information, or user account information for certain programs.
ms-caro-malware-full:malware-family="Krypterade"
+ms-caro-malware-full:malware-family="Krypterade"
2014 VOL17 - Ransomware that fraudulently claims a computer has been used for unlawful activity, locks it, and demands that the user pay to unlock it.
ms-caro-malware-full:malware-family="Lecpetex"
+ms-caro-malware-full:malware-family="Lecpetex"
2014 VOL17 - A family of trojans that steal sensitive information, such as user names and passwords. It can also use a computer for Litecoin mining, install other malware, and post malicious content via the user’s Facebook account.
ms-caro-malware-full:malware-family="Lollipop"
+ms-caro-malware-full:malware-family="Lollipop"
2014 VOL17 - Adware that may be installed by third-party software bundlers. It displays ads based on search engine searches, which can differ by geographic location and may be pornographic.
ms-caro-malware-full:malware-family="Meadgive"
+ms-caro-malware-full:malware-family="Meadgive"
2014 VOL17 - A detection for the Redkit exploit kit, also known as Infinity and Goon. It attempts to exploit vulnerabilities in programs such as Java and Silverlight to install other malware.
ms-caro-malware-full:malware-family="Neclu"
+ms-caro-malware-full:malware-family="Neclu"
2014 VOL17 - A detection for the Nuclear exploit kit, which attempts to exploit vulnerabilities in programs such as Java and Adobe Reader to install other malware.
ms-caro-malware-full:malware-family="Ogimant"
+ms-caro-malware-full:malware-family="Ogimant"
2014 VOL17 - A threat that claims to help download items from the Internet, but actually downloads and runs files that are specified by a remote attacker.
ms-caro-malware-full:malware-family="OptimizerElite"
+ms-caro-malware-full:malware-family="OptimizerElite"
2014 VOL17 - A misleading program that uses legitimate files in the Prefetch folder to claim that the computer is damaged, and offers to fix the damage for a price.
ms-caro-malware-full:malware-family="Pangimop"
+ms-caro-malware-full:malware-family="Pangimop"
2014 VOL17 - A detection for the Magnitude exploit kit, also known as Popads. It attempts to exploit vulnerabilities in programs such as Java and Adobe Flash Player to install other malware.
ms-caro-malware-full:malware-family="Phish"
+ms-caro-malware-full:malware-family="Phish"
2014 VOL17 - A password-stealing malicious webpage, known as a phishing page, that disguises itself as a page from a legitimate website.
ms-caro-malware-full:malware-family="Prast"
+ms-caro-malware-full:malware-family="Prast"
2014 VOL17 - A generic detection for various password stealing trojans.
ms-caro-malware-full:malware-family="Slugin"
+ms-caro-malware-full:malware-family="Slugin"
2014 VOL17 - A file infector that infects .exe and .dll files. It may also perform backdoor actions.
ms-caro-malware-full:malware-family="Spacekito"
+ms-caro-malware-full:malware-family="Spacekito"
2014 VOL17 - A threat that steals information about the computer and installs browser add-ons that display ads.
ms-caro-malware-full:malware-family="Tranikpik"
+ms-caro-malware-full:malware-family="Tranikpik"
This threat is a backdoor that can give a hacker unauthorized access and control of your PC
ms-caro-malware-full:malware-family="Wordinvop"
+ms-caro-malware-full:malware-family="Wordinvop"
2014 VOL17 - A detection for a specially-crafted Microsoft Word file that attempts to exploit the vulnerability CVE-2006-6456, addressed by Microsoft Security Bulletin MS07-014.
ms-caro-malware-full:malware-family="Zegost"
+ms-caro-malware-full:malware-family="Zegost"
2014 VOL17 - A backdoor that allows an attacker to remotely access and control a computer.
ms-caro-malware-full:malware-family="Archost"
+ms-caro-malware-full:malware-family="Archost"
2014 VOL18 - A downloader that installs other programs on the computer without the user’s consent, including other malware.
ms-caro-malware-full:malware-family="Balamid"
+ms-caro-malware-full:malware-family="Balamid"
2014 VOL18 - A trojan that can use the computer to click on online advertisements without the user’s permission or knowledge. This can earn money for a malicious hacker by making a website or application appear more popular than it is.
ms-caro-malware-full:malware-family="BeeVry"
+ms-caro-malware-full:malware-family="BeeVry"
2014 VOL18 - A trojan that modifies a number of settings to prevent the computer from accessing security-related websites, and lower the computer’s security.
ms-caro-malware-full:malware-family="Bondat"
+ms-caro-malware-full:malware-family="Bondat"
2014 VOL18 - A family of threats that collects information about the computer, infects removable drives, and tries to stop the user from accessing files. It spreads by infecting removable drives, such as USB thumb drives and flash drives.
ms-caro-malware-full:malware-family="Bregent"
+ms-caro-malware-full:malware-family="Bregent"
2014 VOL18 - A downloader that injects malicious code into legitimate processes such as explorer.exe and svchost.exe, and downloads other malware onto the computer.
ms-caro-malware-full:malware-family="Brolo"
+ms-caro-malware-full:malware-family="Brolo"
2014 VOL18 - A ransomware family that locks the web browser and displays a message, often pretending to be from a law enforcement agency, demanding money to unlock the browser.
ms-caro-malware-full:malware-family="CostMin"
+ms-caro-malware-full:malware-family="CostMin"
2014 VOL18 - An adware family that installs itself as a browser extension for Internet Explorer, Mozilla Firefox, and Google Chrome, and displays advertisements as the user browses the Internet.
ms-caro-malware-full:malware-family="CouponRuc"
+ms-caro-malware-full:malware-family="CouponRuc"
2014 VOL18 - A browser modifier that changes browser settings and may also modify some computer and Internet settings.
ms-caro-malware-full:malware-family="Crastic"
+ms-caro-malware-full:malware-family="Crastic"
2014 VOL18 - A trojan that sends sensitive information to a remote attacker, such as user names, passwords and information about the computer. It can also delete System Restore points, making it harder to recover the computer to a pre-infected state.
ms-caro-malware-full:malware-family="Crowti"
+ms-caro-malware-full:malware-family="Crowti"
2014 VOL18 - A ransomware family that encrypts files on the computer and demands that the user pay a fee to decrypt them, using Bitcoins.
ms-caro-malware-full:malware-family="CVE-2013-1488"
+ms-caro-malware-full:malware-family="CVE-2013-1488"
2014 VOL18 - A detection for threats that use a Java vulnerability to download and run files on your PC, including other malware. Oracle addressed the vulnerability with a security update in April 2013.
ms-caro-malware-full:malware-family="DefaultTab"
+ms-caro-malware-full:malware-family="DefaultTab"
2014 VOL18 - A browser modifier that redirects web browser searches and prevents the user from changing browser settings.
ms-caro-malware-full:malware-family="Ippedo"
+ms-caro-malware-full:malware-family="Ippedo"
2014 VOL18 - A worm that can send sensitive information to a malicious hacker. It spreads through infected removable drives, such as USB flash drives.
ms-caro-malware-full:malware-family="Kilim"
+ms-caro-malware-full:malware-family="Kilim"
2014 VOL18 - A trojan that hijacks the user’s Facebook, Twitter, or YouTube account to promote pages. It may post hyperlinks or like pages on Facebook, post comments on YouTube videos, or follow profiles and send direct messages on Twitter without permission.
ms-caro-malware-full:malware-family="Mofin"
+ms-caro-malware-full:malware-family="Mofin"
2014 VOL18 - A worm that can steal files from your PC and send them to a malicious hacker. It spreads via infected removable drives, such as USB flash drives.
ms-caro-malware-full:malware-family="MpTamperSrp"
+ms-caro-malware-full:malware-family="MpTamperSrp"
2014 VOL18 - A generic detection for an attempt to add software restriction policies to restrict Microsoft antimalware products, such as Microsoft Security Essentials and Windows Defender, from functioning properly.
ms-caro-malware-full:malware-family="Mujormel"
+ms-caro-malware-full:malware-family="Mujormel"
2014 VOL18 - A password stealer that can steal personal information, such as user names and passwords, and send the stolen information to a malicious hacker.
ms-caro-malware-full:malware-family="PennyBee"
+ms-caro-malware-full:malware-family="PennyBee"
2014 VOL18 - Adware that shows ads as the user browses the web. It can be installed from the program’s website or bundled with some third-party software installation programs.
ms-caro-malware-full:malware-family="Phdet"
+ms-caro-malware-full:malware-family="Phdet"
2014 VOL18 - A family of backdoor trojans that is used to perform distributed denial-of service (DDoS) attacks against specified targets.
ms-caro-malware-full:malware-family="Rimod"
+ms-caro-malware-full:malware-family="Rimod"
2014 VOL18 - A generic detection for files that change various security settings in the computer Win32/Rotbrow. A trojan that installs browser add-ons that claim to offer protection from other add-ons. Rotbrow can change the browser’s home page, and can install the trojan Win32/Sefnit. It is commonly installed by Win32/Brantall.
ms-caro-malware-full:malware-family="Sigru"
+ms-caro-malware-full:malware-family="Sigru"
2014 VOL18 - A virus that can stop some files from working correctly in Windows XP and earlier operating systems. It spreads by infecting the master boot record (MBR) on connected hard disks and floppy disks.
ms-caro-malware-full:malware-family="SimpleShell"
+ms-caro-malware-full:malware-family="SimpleShell"
2014 VOL18 - A backdoor that can give a malicious hacker unauthorized access to and control of the computer.
ms-caro-malware-full:malware-family="Softpulse"
+ms-caro-malware-full:malware-family="Softpulse"
2014 VOL18 - A software bundler that no longer meets Microsoft detection criteria for unwanted software following a program update in September of 2014.
ms-caro-malware-full:malware-family="SquareNet"
+ms-caro-malware-full:malware-family="SquareNet"
2014 VOL18 - A software bundler that installs other unwanted software, including adware and click-fraud malware.
ms-caro-malware-full:malware-family="Tugspay"
+ms-caro-malware-full:malware-family="Tugspay"
2014 VOL18 - A downloader that spreads by posing as an installer for legitimate software, such as a Java update, or through other malware. When installed, it downloads unwanted software to the computer.
ms-caro-malware-full:malware-family="Tupym"
+ms-caro-malware-full:malware-family="Tupym"
2014 VOL18 - A worm that copies itself to the system folder of the affected computer, and attempts to contact remote hosts.
ms-caro-malware-full:malware-family="Vercuser"
+ms-caro-malware-full:malware-family="Vercuser"
2014 VOL18 - A worm that typically spreads via drive-by download. It also receives commands from a remote server, and has been observed dropping other malware on the infected computer.
ms-caro-malware-full:malware-family="Adnel"
+ms-caro-malware-full:malware-family="Adnel"
2015 VOL19 - A family of macro malware that can download other threats to the computer, including TrojanDownloader:Win32/Drixed.
ms-caro-malware-full:malware-family="Adodb"
+ms-caro-malware-full:malware-family="Adodb"
2015 VOL19 - A generic detection for script trojans that exploit a vulnerability in Microsoft Data Access Components (MDAC) that allows remote code execution. Microsoft released Security Bulletin MS06-014 in April 2006 to address the vulnerability.
ms-caro-malware-full:malware-family="AlterbookSP"
+ms-caro-malware-full:malware-family="AlterbookSP"
2015 VOL19 - A browser add-on that formerly displayed behaviors of unwanted software. Recent versions of the add-on no longer meet Microsoft detection criteria, and are no longer considered unwanted software.
ms-caro-malware-full:malware-family="BrobanDel"
+ms-caro-malware-full:malware-family="BrobanDel"
2015 VOL19 - A family of trojans that can modify boletos bancários, a common payment method in Brazil. They can be installed on the computer when a user opens a malicious spam email attachment.
ms-caro-malware-full:malware-family="CompromisedCert"
+ms-caro-malware-full:malware-family="CompromisedCert"
2015 VOL19 - A detection for the Superfish VisualDiscovery advertising program that was preinstalled on some Lenovo laptops sold in 2014 and 2015. It installs a compromised trusted root certificate on the computer, which can be used to conduct man-in-the-middle attacks on the computer.
ms-caro-malware-full:malware-family="CouponRuc_new"
+ms-caro-malware-full:malware-family="CouponRuc_new"
2015 VOL19 - A browser modifier that changes browser settings and may also modify some computer and Internet settings.
ms-caro-malware-full:malware-family="CVE-2014-6332"
+ms-caro-malware-full:malware-family="CVE-2014-6332"
2015 VOL19 - This threat uses a Microsoft vulnerability MS14-064 to download and run files on your PC, including other malware.
ms-caro-malware-full:malware-family="Dyzap"
+ms-caro-malware-full:malware-family="Dyzap"
2015 VOL19 - A threat that steals login credentials for a long list of banking websites using man-in-the-browser (MITB) attacks. It is usually installed on the infected computer by TrojanDownloader:Win32/Upatre.
ms-caro-malware-full:malware-family="EoRezo"
+ms-caro-malware-full:malware-family="EoRezo"
2015 VOL19 - Adware that displays targeted advertising to affected users while browsing the Internet, based on downloaded pre-configured information.
ms-caro-malware-full:malware-family="FakeCall"
+ms-caro-malware-full:malware-family="FakeCall"
2015 VOL19 - This threat is a webpage that claims your PC is infected with malware. It asks you to phone a number to receive technical support to help remove the malware.
ms-caro-malware-full:malware-family="Foosace"
+ms-caro-malware-full:malware-family="Foosace"
2015 VOL19 - A threat that creates files on the compromised computer and contacts a remote host. Observed in the STRONTIUM APT.
ms-caro-malware-full:malware-family="IeEnablerCby"
+ms-caro-malware-full:malware-family="IeEnablerCby"
2015 VOL19 - A browser modifier that installs additional browser addons without the user’s consent. It bypasses the normal prompts or dialogs that ask for consent to install add-ons.
ms-caro-malware-full:malware-family="InstalleRex"
+ms-caro-malware-full:malware-family="InstalleRex"
2015 VOL19 - A software bundler that installs unwanted software, including Win32/CouponRuc and Win32/SaverExtension. It alters its own 'Installed On' date in Programs and Features to make it more difficult for a user to locate it and remove it.
ms-caro-malware-full:malware-family="JackTheRipper"
+ms-caro-malware-full:malware-family="JackTheRipper"
2015 VOL19 - A virus that can stop some files from working correctly in Windows XP and earlier operating systems. It spreads by infecting the master boot record (MBR) on connected hard disks and floppy disks.
ms-caro-malware-full:malware-family="Kenilfe"
+ms-caro-malware-full:malware-family="Kenilfe"
2015 VOL19 - A worm written in AutoCAD Lisp that only runs if AutoCAD is installed on the computer or network. It renames and deletes certain AutoCAD files, and may download and execute arbitrary files from a remote host.
ms-caro-malware-full:malware-family="KipodToolsCby"
+ms-caro-malware-full:malware-family="KipodToolsCby"
2015 VOL19 - A browser modifier that installs additional browser addons without the user’s consent. It bypasses the normal prompts or dialogs that ask for consent to install add-ons.
ms-caro-malware-full:malware-family="Macoute"
+ms-caro-malware-full:malware-family="Macoute"
2015 VOL19 - A worm that can spread itself to removable USB drives, and may communicate with a remote host.
ms-caro-malware-full:malware-family="NeutrinoEK"
+ms-caro-malware-full:malware-family="NeutrinoEK"
2015 VOL19 - This threat is a webpage that spreads the exploit kit known as Neutrino.
ms-caro-malware-full:malware-family="Peaac"
+ms-caro-malware-full:malware-family="Peaac"
2015 VOL19 - A generic detection for various threats that display trojan characteristics.
ms-caro-malware-full:malware-family="Peals"
+ms-caro-malware-full:malware-family="Peals"
2015 VOL19 - A generic detection for various threats that display trojan characteristics.
ms-caro-malware-full:malware-family="Radonskra"
+ms-caro-malware-full:malware-family="Radonskra"
2015 VOL19 - A family of threats that perform a variety of malicious acts, including stealing information about the computer, showing extra advertisements as the user browses the web, performing click fraud, and downloading other programs without consent.
ms-caro-malware-full:malware-family="SaverExtension"
+ms-caro-malware-full:malware-family="SaverExtension"
2015 VOL19 - A browser add-on that shows ads in the browser without revealing their source, and prevents itself from being removed normally.
ms-caro-malware-full:malware-family="Sdbby"
+ms-caro-malware-full:malware-family="Sdbby"
2015 VOL19 - A threat that exploits a bypass to gain administrative privileges on a machine without going through a User Access Control prompt.
ms-caro-malware-full:malware-family="Simda"
+ms-caro-malware-full:malware-family="Simda"
2015 VOL19 - A threat that can give an attacker backdoor access and control of an infected computer. It can then steal passwords and gather information about the computer to send to the attacker.
ms-caro-malware-full:malware-family="Skeeyah"
+ms-caro-malware-full:malware-family="Skeeyah"
2015 VOL19 - A generic detection for various threats that display trojan characteristics.
ms-caro-malware-full:malware-family="Wordjmp"
+ms-caro-malware-full:malware-family="Wordjmp"
2015 VOL19 - An exploit that targets a vulnerability in Word 2002 and 2003 that could allow an attacker to remotely execute arbitrary code. Microsoft released Security Bulletin MS06-027 in June 2006 to address the vulnerability.
ms-caro-malware-full:malware-family="Bayads"
+ms-caro-malware-full:malware-family="Bayads"
2015 VOL20 - A program that displays ads as the user browses the web. It can be bundled with other software. It may call itself bdraw, delta, dlclient, Pay-ByAds, or pricehorse in Programs and Features.
ms-caro-malware-full:malware-family="CandyOpen"
+ms-caro-malware-full:malware-family="CandyOpen"
2015 VOL20 - This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs: Adds files that run at startup, Modifies boot configuration data, Modifies file associations, Injects into other processes on your system, Changes browser settings, Adds a local proxy, Modifies your system DNS settings, Stops Windows Update, Disables User Access Control (UAC), These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.
ms-caro-malware-full:malware-family="Colisi"
+ms-caro-malware-full:malware-family="Colisi"
2015 VOL20 - Behavioral detection of certain files acting in a malicious way.
ms-caro-malware-full:malware-family="Creprote"
+ms-caro-malware-full:malware-family="Creprote"
2015 VOL20 - These programs are most commonly software bundlers or installers for software such as toolbars, adware, or system optimizers. The software might modify your homepage, your search provider, or perform other actions that you might not have intended.
ms-caro-malware-full:malware-family="Diplugem"
+ms-caro-malware-full:malware-family="Diplugem"
2015 VOL20 - A browser modifier that installs browser add-ons without obtaining the user’s consent. The add-ons show extra advertisements as the user browses the web, and can inject additional ads into web search results pages.
ms-caro-malware-full:malware-family="Dipsind"
+ms-caro-malware-full:malware-family="Dipsind"
2015 VOL20 - A threat that is often used in targeted attacks. It can give an attacker access to the computer to download and run files, steal domain credentials, and perform other malicious actions.
ms-caro-malware-full:malware-family="Donoff"
+ms-caro-malware-full:malware-family="Donoff"
2015 VOL20 - A threat that uses an infected Microsoft Office file to download other malware onto the computer. It can arrive as a spam email attachment, usually as a Word file (.doc).
ms-caro-malware-full:malware-family="Dorv"
+ms-caro-malware-full:malware-family="Dorv"
2015 VOL20 - A trojan is a type of malware that can’t spread on its own. It relies on you to run them on your PC by mistake, or visit a hacked or malicious webpage. They can steal your personal information, download more malware, or give a malicious hacker access to your PC.
ms-caro-malware-full:malware-family="Dowadmin"
+ms-caro-malware-full:malware-family="Dowadmin"
2015 VOL20 - A software bundler that does not provide the user with the option to decline installation of unwanted software.
ms-caro-malware-full:malware-family="Fourthrem"
+ms-caro-malware-full:malware-family="Fourthrem"
2015 VOL20 - A program that installs unwanted software without adequate consent on the computer at the same time as the software the user is trying to install.
ms-caro-malware-full:malware-family="Hao123"
+ms-caro-malware-full:malware-family="Hao123"
2015 VOL20 - This threat is a modified Internet Explorer shortcut that changes your Internet Explorer homepage. It might arrive on your PC through bundlers that offer free software. The threat will run a separate threat-related file that changes the Internet Explorer.
ms-caro-malware-full:malware-family="Mizenota"
+ms-caro-malware-full:malware-family="Mizenota"
2015 VOL20 - This program is a software bundler that installs unwanted software on your PC at the same time as the software you are trying to install. It may install one of the following: BrowserModifier:Win32/SupTab, BrowserModifier:Win32/Sasquor, BrowserModifier:Win32/Smudplu, SoftwareBundler:Win32/Pokavampo, BrowserModifier:Win32/Shopperz, Adware:Win32/EoRezo
ms-caro-malware-full:malware-family="Mytonel"
+ms-caro-malware-full:malware-family="Mytonel"
2015 VOL20 - A program that downloads and installs other programs onto the computer without the user’s consent, including other malware.
ms-caro-malware-full:malware-family="OutBrowse"
+ms-caro-malware-full:malware-family="OutBrowse"
2015 VOL20 - A software bundler that installs additional unwanted programs alongside software that the user wishes to install. It can remove or hide the installer’s close button, leaving no way to decline the additional applications.
ms-caro-malware-full:malware-family="Peapoon"
+ms-caro-malware-full:malware-family="Peapoon"
2015 VOL20 - An adware program that shows users ads that they cannot control as they browse the web. It may identify itself as Coupon in Programs and Features.
ms-caro-malware-full:malware-family="Pokki"
+ms-caro-malware-full:malware-family="Pokki"
2015 VOL20 - A browser add-on that formerly displayed behaviors of unwanted software. Recent versions of the add-on no longer meet Microsoft detection criteria, and are no longer considered unwanted software.
ms-caro-malware-full:malware-family="Putalol"
+ms-caro-malware-full:malware-family="Putalol"
2015 VOL20 - An adware program that shows users ads that they cannot control as they browse the web. It may identify itself as Lolliscan in Programs and Features.
ms-caro-malware-full:malware-family="SpigotSearch"
+ms-caro-malware-full:malware-family="SpigotSearch"
2015 VOL20 - This application can affect the quality of your computing experience. For example, some potentially unwanted applications can: Install additional bundled software, Modify your homepage, Modify your search provider. These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.
ms-caro-malware-full:malware-family="Spursint"
+ms-caro-malware-full:malware-family="Spursint"
2015 VOL20 - This threat has been detected as one of the executable malware that are distributed through URLs.
ms-caro-malware-full:malware-family="Sulunch"
+ms-caro-malware-full:malware-family="Sulunch"
2015 VOL20 - A generic detection for a group of trojans that perform a number of common malware behaviors.
ms-caro-malware-full:malware-family="SupTab"
+ms-caro-malware-full:malware-family="SupTab"
2015 VOL20 - A browser modifier that installs itself and changes the browser’s default search provider, without obtaining the user’s consent for either action.
ms-caro-malware-full:malware-family="Sventore"
+ms-caro-malware-full:malware-family="Sventore"
2015 VOL20 - This trojan can install other malware or unwanted software onto your PC.
ms-caro-malware-full:malware-family="Tillail"
+ms-caro-malware-full:malware-family="Tillail"
2015 VOL20 - A software bundler that installs unwanted software alongside the software the user is trying to install. It has been observed to install the browser modifier Win32/SupTab.
ms-caro-malware-full:malware-family="VOPackage"
+ms-caro-malware-full:malware-family="VOPackage"
2015 VOL20 - This application can also affect the quality of your computing experience. We have seen this leading to the following potentially unwanted behaviors on PCs: Adds files that run at startup, Installs a driver, Injects into other processes on your system, Injects into browsers, Changes browser settings, Changes browser shortcuts, Installs browser extensions, Adds a local proxy, Tampers with root certificate trust, Modifies the system hosts file, Modifies your system DNS settings, Disables anti-virus products, Tampers with system Group Policy settings, These applications are most commonly software bundlers or installers for applications such as toolbars, adware, or system optimizers. We have observed this application installing software that you might not have intended on your PC.
ms-caro-malware-full:malware-family="Xiazai"
+ms-caro-malware-full:malware-family="Xiazai"
2015 VOL20 - A program that installs unwanted software on the computer at the same time as the software the user is trying to install, without adequate consent.
classification
nato:classification="CTS"
+nato:classification="CTS"
COSMIC TOP SECRET
nato:classification="CTS-B"
+nato:classification="CTS-B"
COSMIC TOP SECRET BOHEMIA
nato:classification="NS"
+nato:classification="NS"
NATO SECRET
nato:classification="NC"
+nato:classification="NC"
NATO CONFIDENTIAL
nato:classification="NR"
+nato:classification="NR"
NATO RESTRICTED
nato:classification="NU"
+nato:classification="NU"
NATO UNCLASSIFIED
nato:classification="CTS-A"
+nato:classification="CTS-A"
COSMIC TOP SECRET ATOMAL
nato:classification="NS-A"
+nato:classification="NS-A"
SECRET ATOMAL
nato:classification="NC-A"
+nato:classification="NC-A"
CONFIDENTIAL ATOMAL
threat-category
open_threat:threat-category="Physical"
+open_threat:threat-category="Physical"
Threats to the confidentiality, integrity, or availability of information systems that are physical in nature. These threats generally describe actions that could lead to the theft, harm, or destruction of information systems.
open_threat:threat-category="Resource"
+open_threat:threat-category="Resource"
Threats to the confidentiality, integrity, or availability of information systems that are the result of a lack of resources required by the information system. These threats often cause failures of information systems through a disruption of resources required for operations.
open_threat:threat-category="Personal"
+open_threat:threat-category="Personal"
Threats to the confidentiality, integrity, or availability of information systems that are the result of failures or actions performed by an organization’s personnel. These threats can be the result of deliberate or accidental actions that cause harm to information systems.
open_threat:threat-category="Technical"
+open_threat:threat-category="Technical"
Threats to the confidentiality, integrity, or availability of information systems that are technical in nature. These threats are most often considered when identifying threats and constitute the technical actions performed by a threat actor that can cause harm to an information system.
threat-name
open_threat:threat-name="PHY-001"
+open_threat:threat-name="PHY-001"
Loss of Property - Rating: 5.0
open_threat:threat-name="PHY-002"
+open_threat:threat-name="PHY-002"
Theft of Property - Rating: 5.0
open_threat:threat-name="PHY-003"
+open_threat:threat-name="PHY-003"
Accidental Destruction of Property - Rating: 3.0
open_threat:threat-name="PHY-004"
+open_threat:threat-name="PHY-004"
Natural Destruction of Property - Rating: 3.0
open_threat:threat-name="PHY-005"
+open_threat:threat-name="PHY-005"
Intentional Destruction of Property - Rating: 2.0
open_threat:threat-name="PHY-006"
+open_threat:threat-name="PHY-006"
Intentional Sabotage of Property - Rating: 2.0
open_threat:threat-name="PHY-007"
+open_threat:threat-name="PHY-007"
Intentional Vandalism of Property - Rating: 2.0
open_threat:threat-name="PHY-008"
+open_threat:threat-name="PHY-008"
Electrical System Failure - Rating: 4.0
open_threat:threat-name="PHY-009"
+open_threat:threat-name="PHY-009"
Heating, Ventilation, Air Conditioning (HVAC) Failure - Rating: 3.0
open_threat:threat-name="PHY-010"
+open_threat:threat-name="PHY-010"
Structural Facility Failure - Rating: 2.0
open_threat:threat-name="PHY-011"
+open_threat:threat-name="PHY-011"
Water Distribution System Failure - Rating: 2.0
open_threat:threat-name="PHY-012"
+open_threat:threat-name="PHY-012"
Sanitation System Failure - Rating: 1.0
open_threat:threat-name="PHY-013"
+open_threat:threat-name="PHY-013"
Natural Gas Distribution Failure - Rating: 1.0
open_threat:threat-name="PHY-014"
+open_threat:threat-name="PHY-014"
Electronic Media Failure - Rating: 3.0
open_threat:threat-name="RES-001"
+open_threat:threat-name="RES-001"
Disruption of Water Resources - Rating: 2.0
open_threat:threat-name="RES-002"
+open_threat:threat-name="RES-002"
Disruption of Fuel Resources - Rating: 2.0
open_threat:threat-name="RES-003"
+open_threat:threat-name="RES-003"
Disruption of Materials Resources - Rating: 2.0
open_threat:threat-name="RES-004"
+open_threat:threat-name="RES-004"
Disruption of Electrical Resources - Rating: 4.0
open_threat:threat-name="RES-005"
+open_threat:threat-name="RES-005"
Disruption of Transportation Services - Rating: 1.0
open_threat:threat-name="RES-006"
+open_threat:threat-name="RES-006"
Disruption of Communications Services - Rating: 4.0
open_threat:threat-name="RES-007"
+open_threat:threat-name="RES-007"
Disruption of Emergency Services - Rating: 1.0
open_threat:threat-name="RES-008"
+open_threat:threat-name="RES-008"
Disruption of Governmental Services - Rating: 1.0
open_threat:threat-name="RES-009"
+open_threat:threat-name="RES-009"
Supplier Viability - Rating: 2.0
open_threat:threat-name="RES-010"
+open_threat:threat-name="RES-010"
Supplier Supply Chain Failure - Rating: 2.0
open_threat:threat-name="RES-011"
+open_threat:threat-name="RES-011"
Logistics Provider Failures - Rating: 1.0
open_threat:threat-name="RES-012"
+open_threat:threat-name="RES-012"
Logistics Route Disruptions - Rating: 1.0
open_threat:threat-name="RES-013"
+open_threat:threat-name="RES-013"
Technology Services Manipulation - Rating: 3.0
open_threat:threat-name="PER-001"
+open_threat:threat-name="PER-001"
Personnel Labor / Skills Shortage - Rating: 5.0
open_threat:threat-name="PER-002"
+open_threat:threat-name="PER-002"
Loss of Personnel Resources - Rating: 3.0
open_threat:threat-name="PER-003"
+open_threat:threat-name="PER-003"
Disruption of Personnel Resources - Rating: 3.0
open_threat:threat-name="PER-004"
+open_threat:threat-name="PER-004"
Social Engineering of Personnel Resources - Rating: 4.0
open_threat:threat-name="PER-005"
+open_threat:threat-name="PER-005"
Negligent Personnel Resources - Rating: 4.0
open_threat:threat-name="PER-006"
+open_threat:threat-name="PER-006"
Personnel Mistakes / Errors - Rating: 4.0
open_threat:threat-name="PER-007"
+open_threat:threat-name="PER-007"
Personnel Inaction - Rating: 3.0
open_threat:threat-name="TEC-001"
+open_threat:threat-name="TEC-001"
Organizational Fingerprinting via Open Sources - Rating:
open_threat:threat-name="TEC-002"
+open_threat:threat-name="TEC-002"
System Fingerprinting via Open Sources - Rating: 2.0
open_threat:threat-name="TEC-003"
+open_threat:threat-name="TEC-003"
System Fingerprinting via Scanning - Rating: 2.0
open_threat:threat-name="TEC-004"
+open_threat:threat-name="TEC-004"
System Fingerprinting via Sniffing - Rating: 2.0
open_threat:threat-name="TEC-005"
+open_threat:threat-name="TEC-005"
Credential Discovery via Open Sources - Rating: 4.0
open_threat:threat-name="TEC-006"
+open_threat:threat-name="TEC-006"
Credential Discovery via Scanning - Rating: 3.0
open_threat:threat-name="TEC-007"
+open_threat:threat-name="TEC-007"
Credential Discovery via Sniffing - Rating: 4.0
open_threat:threat-name="TEC-008"
+open_threat:threat-name="TEC-008"
Credential Discovery via Brute Force - Rating: 4.0
open_threat:threat-name="TEC-009"
+open_threat:threat-name="TEC-009"
Credential Discovery via Cracking - Rating: 4.0
open_threat:threat-name="TEC-010"
+open_threat:threat-name="TEC-010"
Credential Discovery via Guessing - Rating: 2.0
open_threat:threat-name="TEC-011"
+open_threat:threat-name="TEC-011"
Credential Discovery via Pre-Computational Attacks - Rating: 3.0
open_threat:threat-name="TEC-012"
+open_threat:threat-name="TEC-012"
Misuse of System Credentials - Rating: 3.0
open_threat:threat-name="TEC-013"
+open_threat:threat-name="TEC-013"
Escalation of Privilege - Rating: 5.0
open_threat:threat-name="TEC-014"
+open_threat:threat-name="TEC-014"
Abuse of System Privileges - Rating: 4.0
open_threat:threat-name="TEC-015"
+open_threat:threat-name="TEC-015"
Memory Manipulation - Rating: 4.0
open_threat:threat-name="TEC-016"
+open_threat:threat-name="TEC-016"
Cache Poisoning - Rating: 3.0
open_threat:threat-name="TEC-017"
+open_threat:threat-name="TEC-017"
Physical Manipulation of Technical Device - Rating: 2.0
open_threat:threat-name="TEC-018"
+open_threat:threat-name="TEC-018"
Manipulation of Trusted System - Rating: 4.0
open_threat:threat-name="TEC-019"
+open_threat:threat-name="TEC-019"
Cryptanalysis - Rating: 1.0
open_threat:threat-name="TEC-020"
+open_threat:threat-name="TEC-020"
Data Leakage / Theft - Rating: 3.0
open_threat:threat-name="TEC-021"
+open_threat:threat-name="TEC-021"
Denial of Service - Rating: 2.0
open_threat:threat-name="TEC-022"
+open_threat:threat-name="TEC-022"
Maintaining System Persistence - Rating: 5.0
open_threat:threat-name="TEC-023"
+open_threat:threat-name="TEC-023"
Manipulation of Data in Transit / Use - Rating: 2.0
open_threat:threat-name="TEC-024"
+open_threat:threat-name="TEC-024"
Capture of Data in Transit / Use via Sniffing - Rating: 3.0
open_threat:threat-name="TEC-025"
+open_threat:threat-name="TEC-025"
Capture of Data in Transit / Use via Debugging - Rating: 2.0
open_threat:threat-name="TEC-026"
+open_threat:threat-name="TEC-026"
Capture of Data in Transit / Use via Keystroke Logging - Rating: 3.0
open_threat:threat-name="TEC-027"
+open_threat:threat-name="TEC-027"
Replay of Data in Transit / Use - Rating: 2.0
open_threat:threat-name="TEC-028"
+open_threat:threat-name="TEC-028"
Misdelivery of Data - Rating: 2.0
open_threat:threat-name="TEC-029"
+open_threat:threat-name="TEC-029"
Capture of Stored Data - Rating: 3.0
open_threat:threat-name="TEC-030"
+open_threat:threat-name="TEC-030"
Manipulation of Stored Data - Rating: 3.0
open_threat:threat-name="TEC-031"
+open_threat:threat-name="TEC-031"
Application Exploitation via Input Manipulation - Rating: 5.0
open_threat:threat-name="TEC-032"
+open_threat:threat-name="TEC-032"
Application Exploitation via Parameter Injection - Rating: 4.0
open_threat:threat-name="TEC-033"
+open_threat:threat-name="TEC-033"
Application Exploitation via Code Injection - Rating: 4.0
open_threat:threat-name="TEC-034"
+open_threat:threat-name="TEC-034"
Application Exploitation via Command Injection - Rating: 4.0
open_threat:threat-name="TEC-035"
+open_threat:threat-name="TEC-035"
Application Exploitation via Path Traversal - Rating: 3.0
open_threat:threat-name="TEC-036"
+open_threat:threat-name="TEC-036"
Application Exploitation via API Abuse - Rating: 3.0
open_threat:threat-name="TEC-037"
+open_threat:threat-name="TEC-037"
Application Exploitation via Fuzzing - Rating: 3.0
open_threat:threat-name="TEC-038"
+open_threat:threat-name="TEC-038"
Application Exploitation via Reverse Engineering - Rating: 3.0
open_threat:threat-name="TEC-039"
+open_threat:threat-name="TEC-039"
Application Exploitation via Resource Location Guessing - Rating: 2.0
open_threat:threat-name="TEC-040"
+open_threat:threat-name="TEC-040"
Application Exploitation via Source Code Manipulation - Rating: 3.0
open_threat:threat-name="TEC-041"
+open_threat:threat-name="TEC-041"
Application Exploitation via Authentication Bypass - Rating: 2.0
source-type
osint:source-type="blog-post"
+osint:source-type="blog-post"
Blog post
osint:source-type="microblog-post"
+osint:source-type="microblog-post"
Microblog post like Twitter
osint:source-type="technical-report"
+osint:source-type="technical-report"
Technical or analysis report
osint:source-type="presentation"
+osint:source-type="presentation"
Presentation or slidedeck
osint:source-type="news-report"
+osint:source-type="news-report"
News report
osint:source-type="pastie-website"
+osint:source-type="pastie-website"
Pastie-like website
osint:source-type="electronic-forum"
+osint:source-type="electronic-forum"
Electronic forum
osint:source-type="mailing-list"
+osint:source-type="mailing-list"
Mailing-list
osint:source-type="block-or-filter-list"
+osint:source-type="block-or-filter-list"
Block or Filter List
osint:source-type="source-code-repository"
+osint:source-type="source-code-repository"
Source code repository
osint:source-type="expansion"
+osint:source-type="expansion"
Expansion
osint:source-type="automatic-analysis"
+osint:source-type="automatic-analysis"
Automatic analysis including dynamic analysis or sandboxes output
osint:source-type="automatic-collection"
+osint:source-type="automatic-collection"
Automatic collection including honeypots, spamtramps or equivalent technologies
osint:source-type="manual-analysis"
+osint:source-type="manual-analysis"
Manual analysis or investigation
osint:source-type="unknown"
+osint:source-type="unknown"
Unknown
osint:source-type="other"
+osint:source-type="other"
Other source not specified in this list
lifetime
osint:lifetime="perpetual"
+osint:lifetime="perpetual"
Perpetual
osint:lifetime="ephemeral"
+osint:lifetime="ephemeral"
Ephemeral
certainty
osint:certainty="100"
+osint:certainty="100"
Certainty (probability equals 1 - 100%)
osint:certainty="93"
+osint:certainty="93"
Almost certain (probability equals 0.93 - 93%)
osint:certainty="75"
+osint:certainty="75"
Probable (probability equals 0.75 - 75%)
osint:certainty="50"
+osint:certainty="50"
Chances about even (probability equals 0.50 - 50%)
osint:certainty="30"
+osint:certainty="30"
Probably not (probability equals 0.30 - 30%)
osint:certainty="7"
+osint:certainty="7"
Almost certainly not (probability equals 0.07 - 7%)
osint:certainty="0"
+osint:certainty="0"
Impossibility (probability equals 0 - 0%)
sinkholed
passivetotal:sinkholed="yes"
+passivetotal:sinkholed="yes"
Yes
passivetotal:sinkholed="no"
+passivetotal:sinkholed="no"
No
ever-comprimised
passivetotal:ever-comprimised="yes"
+passivetotal:ever-comprimised="yes"
Yes
passivetotal:ever-comprimised="no"
+passivetotal:ever-comprimised="no"
No
dynamic-dns
passivetotal:dynamic-dns="yes"
+passivetotal:dynamic-dns="yes"
Yes
passivetotal:dynamic-dns="no"
+passivetotal:dynamic-dns="no"
No
class
passivetotal:class="malicious"
+passivetotal:class="malicious"
Malicious
passivetotal:class="suspicious"
+passivetotal:class="suspicious"
Suspicious
passivetotal:class="non-malicious"
+passivetotal:class="non-malicious"
Non Malicious
passivetotal:class="unknown"
+passivetotal:class="unknown"
Unknown
pentest:approach="blackbox"
+pentest:approach="blackbox"
Blackbox penetration test requires no prior information about the target network or application and is actually performed keeping it as a real world hacker attack scenario. (https://www.evolution-sec.com/en/products/blackbox-penetration-testing)
pentest:approach="greybox"
+pentest:approach="greybox"
Gray box testing lies between black and white. Testers will have knowledge of some areas but not others. These areas are defined at the start of an engagement.(https://www.intelisecure.com/security-assessments-pen-testing/approaches/)
pentest:approach="whitebox"
+pentest:approach="whitebox"
White box, or authenticated tests, target the security of your underlying technology with full knowledge of your IT department. Information typically shared with the tester includes: network diagrams, IP addresses, system configurations and access credentials.(https://www.intelisecure.com/security-assessments-pen-testing/approaches/)
pentest:approach="vulnerability_scanning"
+pentest:approach="vulnerability_scanning"
Vulnerability scanning is a security technique used to identify security weaknesses in a computer system. (https://www.techopedia.com/definition/4160/vulnerability-scanning)
pentest:approach="redteam"
+pentest:approach="redteam"
A red team is an group that challenges an organization to improve its effectiveness by assuming an adversarial role or point of view without any predefined scope. (https://en.wikipedia.org/wiki/Red_team)
pentest:scan="vertical"
+pentest:scan="vertical"
A scan against multiple ports of a single IP.
pentest:scan="horizontal"
+pentest:scan="horizontal"
A scan against a group of IPs for a single port.
pentest:scan="network_scan"
+pentest:scan="network_scan"
It is the discovery of networks and machines with services.
pentest:scan="vulnerability"
+pentest:scan="vulnerability"
Vulnerability scanning is a security technique used to identify security weaknesses in a computer system. (https://www.techopedia.com/definition/4160/vulnerability-scanning)
pentest:exploit="type confusion"
+pentest:exploit="type confusion"
When a piece of code doesn’t verify the type of object that is passed to it, and uses it blindly without type-checking, it leads to type confusion. (https://cloudblogs.microsoft.com/microsoftsecure/2015/06/17/understanding-type-confusion-vulnerabilities-cve-2015-0336/)
pentest:exploit="format_strings"
+pentest:exploit="format_strings"
The format string exploit occurs when the submitted data of an input string leads to arbitrary read or write in the memory. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application, causing new behaviors that could compromise the security or the stability of the system. (https://www.owasp.org/index.php/Format_string_attack)
pentest:exploit="stack_overflow"
+pentest:exploit="stack_overflow"
In software, a stack overflow is type of buffer overflow that occurs if the call stack pointer exceeds the stack bound. (https://en.wikipedia.org/wiki/Stack_overflow)
pentest:exploit="heap_overflow"
+pentest:exploit="heap_overflow"
A heap overflow is a type of buffer overflow that occurs in the heap data area. (https://en.wikipedia.org/wiki/Heap_overflow)
pentest:exploit="heap_spraying"
+pentest:exploit="heap_spraying"
Heap spraying is a technique used in exploits to facilitate arbitrary code execution. In general, code that sprays the heap attempts to put a certain sequence of bytes at a predetermined location in the memory of a target process by having it allocate (large) blocks on the process’s heap and fill the bytes in these blocks with the right values. (https://en.wikipedia.org/wiki/Heap_spraying)
pentest:exploit="fuzzing"
+pentest:exploit="fuzzing"
Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. (https://en.wikipedia.org/wiki/Fuzzing)
pentest:exploit="ROP"
+pentest:exploit="ROP"
The Return-Oriented Programming (ROP) is a computer security exploit technique in which the attacker uses control of the call stack to indirectly execute cherry-picked machine instructions or groups of machine instructions immediately prior to the return instruction in subroutines within the existing program code, in a way similar to the execution of a threaded code interpreter. (https://en.wikipedia.org/wiki/Return-oriented_programming)
pentest:exploit="null_pointer_dereference"
+pentest:exploit="null_pointer_dereference"
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. (https://cwe.mitre.org/data/definitions/476.html)
pentest:post_exploitation="privilege_escalation"
+pentest:post_exploitation="privilege_escalation"
Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. (https://en.wikipedia.org/wiki/Privilege_escalation)
pentest:post_exploitation="pivoting"
+pentest:post_exploitation="pivoting"
Pivoting refers to a method used by penetration testers that uses the compromised system to attack other systems on the same network to avoid restrictions such as firewall configurations, which may prohibit direct access to all machines. (https://en.wikipedia.org/wiki/Exploit_(computer_security)#Pivoting)
pentest:post_exploitation="password_cracking"
+pentest:post_exploitation="password_cracking"
Password cracking is the process of recovering passwords from data that have been stored in or transmitted by a computer system. (https://en.wikipedia.org/wiki/Password_cracking)
pentest:post_exploitation="persistence"
+pentest:post_exploitation="persistence"
The persistence is when a penetration tester let him a way to keep its exploitation on a machine or a domain even if the system is rebooted.
pentest:post_exploitation="data_exfiltration"
+pentest:post_exploitation="data_exfiltration"
After an exploitation of a machine, a penetration tester will try to exfiltrate sensitive data.
pentest:web="injection"
+pentest:web="injection"
Code injection is the exploitation of a computer bug that is caused by processing invalid data. Injection is used by an attacker to introduce (or "inject") code into a vulnerable computer program and change the course of execution. (https://en.wikipedia.org/wiki/Code_injection)
pentest:web="SQLi"
+pentest:web="SQLi"
An SQL injection is a computer attack in which malicious code is embedded in a poorly-designed application and then passed to the SQL backend database. The malicious data then produces database query results or actions that should never have been executed.(https://www.techopedia.com/definition/4126/sql-injection)
pentest:web="NoSQLi"
+pentest:web="NoSQLi"
An NoSQL injection is a computer attack in which malicious code is embedded in a poorly-designed application and then passed to the NoSQL backend database. The malicious data then produces database query results or actions that should never have been executed.
pentest:web="XML injection"
+pentest:web="XML injection"
XML Injection is an attack technique used to manipulate or compromise the logic of an XML application or service. The injection of unintended XML content and/or structures into an XML message can alter the intend logic of the application. Further, XML injection can cause the insertion of malicious content into the resulting message/document.(http://projects.webappsec.org/w/page/13247004/XML%20Injection)
pentest:web="CSRF"
+pentest:web="CSRF"
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request.(https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF))
pentest:web="SSRF"
+pentest:web="SSRF"
Server Side Request Forgery (SSRF) refers to an attack where in an attacker is able to send a crafted request from a vulnerable web application. SSRF is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network. (https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/)
pentest:web="XSS"
+pentest:web="XSS"
Cross-site scripting (XSS) is a security breach that takes advantage of dynamically generated Web pages. In an XSS attack, a Web application is sent with a script that activates when it is read by an unsuspecting user’s browser or by an application that has not protected itself against cross-site scripting. (https://www.webopedia.com/TERM/X/XSS.html)
pentest:web="file_inclusion"
+pentest:web="file_inclusion"
The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation. (https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion)
pentest:web="web_tree_discovery"
+pentest:web="web_tree_discovery"
A web tree discovery is a brute force directories and files names on web/application server
pentest:web="bruteforce"
+pentest:web="bruteforce"
A brute-force attack consists of an attacker trying many passwords or passphrases with the hope of eventually guessing correctly. (https://en.wikipedia.org/wiki/Brute-force_attack)
pentest:web="fuzzing"
+pentest:web="fuzzing"
Fuzzing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. (https://en.wikipedia.org/wiki/Fuzzing)
pentest:network="sniffing"
+pentest:network="sniffing"
Sniffing involves capturing, decoding, inspecting and interpreting the information inside a network packet on a TCP/IP network. (http://www.valencynetworks.com/articles/cyber-security-attacks-network-sniffing.html)
pentest:network="spoofing"
+pentest:network="spoofing"
Spoofing, in general, is a fraudulent or malicious practice in which communication is sent from an unknown source disguised as a source known to the receiver. Spoofing is most prevalent in communication mechanisms that lack a high level of security. (https://www.techopedia.com/definition/5398/spoofing)
pentest:network="man_in_the_middle"
+pentest:network="man_in_the_middle"
man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. (https://en.wikipedia.org/wiki/Man-in-the-middle_attack)
pentest:network="network_discovery"
+pentest:network="network_discovery"
It is the discovery of networks and machines with services.
pentest:social_engineering="phishing"
+pentest:social_engineering="phishing"
Phishing is the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication. (https://en.wikipedia.org/wiki/Phishing)
pentest:social_engineering="malware"
+pentest:social_engineering="malware"
Malware, short for malicious software, is an umbrella term used to refer to a variety of forms of harmful or intrusive software, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. (https://en.wikipedia.org/wiki/Malware)
pentest:vulnerability="CWE"
+pentest:vulnerability="CWE"
Targeted to developers and security practitioners, the Common Weakness Enumeration (CWE) is a formal list of software weakness types. (https://cwe.mitre.org/about/)
pentest:vulnerability="CVE"
+pentest:vulnerability="CVE"
Common Vulnerabilities and Exposures (CVE) is a dictionary-type list of standardized names for vulnerabilities and other information related to security exposures. (https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)
An Emergency priority incident poses an imminent threat to the provision of wide-scale critical infrastructure services, national government stability, or the lives of U.S. persons.
priority-level:emergency
+priority-level:emergency
Emergency
A Severe priority incident is likely to result in a significant impact to public health or safety, national security, economic security, foreign relations, or civil liberties.
priority-level:severe
+priority-level:severe
Severe
A High priority incident is likely to result in a demonstrable impact to public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence.
priority-level:high
+priority-level:high
High
A Medium priority incident may affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence.
priority-level:medium
+priority-level:medium
Medium
A Low priority incident is unlikely to affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence.
priority-level:low
+priority-level:low
Low
A Baseline–Minor priority incident is an incident that is highly unlikely to affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence. The potential for impact, however, exists and warrants additional scrutiny.
priority-level:baseline-minor
+priority-level:baseline-minor
Baseline - Minor
A Baseline–Negligible priority incident is an incident that is highly unlikely to affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence.
priority-level:baseline-negligible
+priority-level:baseline-negligible
Baseline - Negligible
event-status
rt_event_status:event-status="new"
+rt_event_status:event-status="new"
New
rt_event_status:event-status="open"
+rt_event_status:event-status="open"
Open
rt_event_status:event-status="stalled"
+rt_event_status:event-status="stalled"
Stalled
rt_event_status:event-status="rejected"
+rt_event_status:event-status="rejected"
rejected
rt_event_status:event-status="resolved"
+rt_event_status:event-status="resolved"
Resolved
rt_event_status:event-status="deleted"
+rt_event_status:event-status="deleted"
Deleted
portable-executable
runtime-packer:portable-executable=".netshrink"
+runtime-packer:portable-executable=".netshrink"
runtime-packer:portable-executable="armadillo"
+runtime-packer:portable-executable="armadillo"
Armadillo
runtime-packer:portable-executable="aspack"
+runtime-packer:portable-executable="aspack"
ASPack
runtime-packer:portable-executable="aspr-asprotect"
+runtime-packer:portable-executable="aspr-asprotect"
ASPR (ASProtect)
runtime-packer:portable-executable="boxedapp-packer"
+runtime-packer:portable-executable="boxedapp-packer"
BoxedApp Packer
runtime-packer:portable-executable="cexe"
+runtime-packer:portable-executable="cexe"
CExe
runtime-packer:portable-executable="dotbundle"
+runtime-packer:portable-executable="dotbundle"
dotBundle
runtime-packer:portable-executable="enigma-protector"
+runtime-packer:portable-executable="enigma-protector"
Enigma Protector
runtime-packer:portable-executable="exe-bundle"
+runtime-packer:portable-executable="exe-bundle"
EXE Bundle
runtime-packer:portable-executable="exe-stealth"
+runtime-packer:portable-executable="exe-stealth"
EXE Stealth
runtime-packer:portable-executable="expressor"
+runtime-packer:portable-executable="expressor"
eXPressor
runtime-packer:portable-executable="fsg"
+runtime-packer:portable-executable="fsg"
FSG
runtime-packer:portable-executable="kkrunchy-src"
+runtime-packer:portable-executable="kkrunchy-src"
kkrunchy src
runtime-packer:portable-executable="mew"
+runtime-packer:portable-executable="mew"
MEW
runtime-packer:portable-executable="mpress"
+runtime-packer:portable-executable="mpress"
MPRESS
runtime-packer:portable-executable="obsidium"
+runtime-packer:portable-executable="obsidium"
Obsidium
runtime-packer:portable-executable="pelock"
+runtime-packer:portable-executable="pelock"
PELock
runtime-packer:portable-executable="pespin"
+runtime-packer:portable-executable="pespin"
PESpin
runtime-packer:portable-executable="petite"
+runtime-packer:portable-executable="petite"
Petite
runtime-packer:portable-executable="rlpack-basic"
+runtime-packer:portable-executable="rlpack-basic"
RLPack Basic
runtime-packer:portable-executable="smart-packer-pro"
+runtime-packer:portable-executable="smart-packer-pro"
Smart Packer Pro
runtime-packer:portable-executable="themida"
+runtime-packer:portable-executable="themida"
Themida
runtime-packer:portable-executable="upx"
+runtime-packer:portable-executable="upx"
UPX
runtime-packer:portable-executable="vmprotect"
+runtime-packer:portable-executable="vmprotect"
VMProtect
runtime-packer:portable-executable="xcomp-xpack"
+runtime-packer:portable-executable="xcomp-xpack"
XComp/XPack