use serde::{Deserialize, Serialize};
macro_rules! string_enum {
(
$(#[$meta:meta])*
$vis:vis enum $name:ident {
$(
$(#[$variant_meta:meta])*
$variant:ident => $value:expr
),* $(,)?
}
) => {
$(#[$meta])*
#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case")]
$vis enum $name {
$(
$(#[$variant_meta])*
#[serde(rename = $value)]
$variant,
)*
}
};
}
string_enum! {
pub enum Capability {
AntiBehavioralAnalysis => "anti-behavioral-analysis",
AntiCodeAnalysis => "anti-code-analysis",
AntiDetection => "anti-detection",
AntiRemoval => "anti-removal",
AvailabilityViolation => "availability-violation",
Collection => "collection",
CommandAndControl => "command-and-control",
DataTheft => "data-theft",
Destruction => "destruction",
Discovery => "discovery",
Exfiltration => "exfiltration",
Fraud => "fraud",
InfectionPropagation => "infection-propagation",
IntegrityViolation => "integrity-violation",
MachineAccessControl => "machine-access-control",
Persistence => "persistence",
PrivelegeEscalation => "privelege-escalation",
SecondaryOperation => "secondary-operation",
SecurityDegradation => "security-degradation",
}
}
string_enum! {
pub enum CommonAttribute {
ApplicablePlatform => "applicable-platform",
ArchiveType => "archive-type",
Autonomy => "autonomy",
BackdoorType => "backdoor-type",
CryptocurrencyType => "cryptocurrency-type",
EncryptionAlgorithm => "encryption-algorithm",
ErasureScope => "erasure-scope",
FileInfectionType => "file-infection-type",
FileModificationType => "file-modification-type",
FileType => "file-type",
Frequency => "frequency",
InfectionTargeting => "infection-targeting",
NetworkProtocol => "network-protocol",
PersistenceScope => "persistence-scope",
PortNumber => "port-number",
PropagationScope => "propagation-scope",
TargetedApplication => "targeted-application",
TargetedFileArchitectureType => "targeted-file-architecture-type",
TargetedFileType => "targeted-file-type",
TargetedProgram => "targeted-program",
TargetedSandbox => "targeted-sandbox",
TargetedVm => "targeted-vm",
TargetedWebsite => "targeted-website",
Technique => "technique",
TriggerType => "trigger-type",
UserPrivilegeEscalationType => "user-privilege-escalation-type",
VulnerabilityIdCve => "vulnerability-id-cve",
VulnerabilityIdOsvdb => "vulnerability-id-osvdb",
}
}
string_enum! {
pub enum MalwareConfigurationParameter {
Filename => "filename",
GroupId => "group-id",
Id => "id",
InstallationPath => "installation-path",
MagicNumber => "magic-number",
Mutex => "mutex",
C2IpAddress => "c2-ip-address",
C2Domain => "c2-domain",
C2Url => "c2-url",
Directory => "directory",
Filepath => "filepath",
InjectionProcess => "injection-process",
Interval => "interval",
Key => "key",
Password => "password",
Useragent => "useragent",
Version => "version",
}
}
string_enum! {
pub enum OsFeature {
LoginItems => "login-items",
PlistFiles => "plist-files",
Applescript => "applescript",
LaunchAgent => "launch-agent",
LaunchDaemons => "launch-daemons",
Kext => "kext",
LoginLogoutHooks => "login-logout-hooks",
NamedPipes => "named_pipes",
BerkeleySockets => "berkeley-sockets",
Cron => "cron",
Mutexes => "mutexes",
RegistryKeys => "registry keys",
Services => "services",
Powershell => "powershell",
NtfsExtendedAttributes => "ntfs-extended-attributes",
NetworkShares => "network-shares",
Hooks => "hooks",
Wmi => "wmi",
TaskScheduler => "task-scheduler",
CriticalSections => "critical-sections",
DeviceDrivers => "device-drivers",
AdminNetworkShares => "admin-network-shares",
}
}
string_enum! {
pub enum Behavior {
AccessPremiumService => "access-premium-service",
AutonomousRemoteInfection => "autonomous-remote-infection",
BlockSecurityWebsites => "block-security-websites",
CaptureCameraInput => "capture-camera-input",
CaptureFileSystemData => "capture-file-system-data",
CaptureGpsData => "capture-gps-data",
CaptureKeyboardInput => "capture-keyboard-input",
CaptureMicrophoneInput => "capture-microphone-input",
CaptureMouseInput => "capture-mouse-input",
CapturePrinterOutput => "capture-printer-output",
CaptureSystemMemory => "capture-system-memory",
CaptureSystemNetworkTraffic => "capture-system-network-traffic",
CaptureSystemScreenshot => "capture-system-screenshot",
CaptureTouchscreenInput => "capture-touchscreen-input",
CheckForPayload => "check-for-payload",
CheckLanguage => "check-language",
ClickFraud => "click-fraud",
CompareHostFingerprints => "compare-host-fingerprints",
CompromiseRemoteMachine => "compromise-remote-machine",
ControlLocalMachineViaRemoteCommand => "control-local-machine-via-remote-command",
ControlMalwareViaRemoteCommand => "control-malware-via-remote-command",
CrackPasswords => "crack-passwords",
DefeatCallGraphGeneration => "defeat-call-graph-generation",
DefeatEmulator => "defeat-emulator",
DefeatFlowOrientedDisassembler => "defeat-flow-oriented-disassembler",
DefeatLinearDisassembler => "defeat-linear-disassembler",
DegradeSecurityProgram => "degrade-security-program",
DenialOfService => "denial-of-service",
DestroyHardware => "destroy-hardware",
DetectDebugging => "detect-debugging",
DetectEmulator => "detect-emulator",
DetectInstalledAnalysisTools => "detect-installed-analysis-tools",
DetectInstalledAvTools => "detect-installed-av-tools",
DetectSandboxEnvironment => "detect-sandbox-environment",
DetectVmEnvironment => "detect-vm-environment",
DetermineHostIpAddress => "determine-host-ip-address",
DisableAccessRightsChecking => "disable-access-rights-checking",
DisableFirewall => "disable-firewall",
DisableKernelPatchProtection => "disable-kernel-patch-protection",
DisableOsSecurityAlerts => "disable-os-security-alerts",
DisablePrivelegeLimiting => "disable-privelege-limiting",
DisableServicePackPatchInstallation => "disable-service-pack-patch-installation",
DisableSystemFileOverwriteProtection => "disable-system-file-overwrite-protection",
DisableUpdateServicesDaemons => "disable-update-services-daemons",
DisableUserAccountControl => "disable-user-account-control",
DropRetrieveDebugLogFile => "drop-retrieve-debug-log-file",
ElevatePrivelege => "elevate-privelege",
EncryptData => "encrypt-data",
EncryptFiles => "encrypt-files",
EncryptSelf => "encrypt-self",
EraseData => "erase-data",
EvadeStaticHeuristic => "evade-static-heuristic",
ExecuteBeforeExternalToKernelHypervisor => "execute-before-external-to-kernel-hypervisor",
ExecuteNonMainCpuMode => "execute-non-main-cpu-mode",
ExecuteStealthyCode => "execute-stealthy-code",
ExfiltrateDataViaCovertChannel => "exfiltrate-data-via-covert-channel",
ExfiltrateDataViaDumpsterDive => "exfiltrate-data-via-dumpster-dive",
ExfiltrateDateViaFax => "exfiltrate-date-via-fax",
ExfiltrateDataViaNetwork => "exfiltrate-data-via-network",
ExfiltrateDataViaPhysicalMedia => "exfiltrate-data-via-physical-media",
ExfiltrateDataViaVoipPhone => "exfiltrate-data-via-voip-phone",
FeedMisinformationDuringPhysicalMemoryAcquisition => "feed-misinformation-during-physical-memory-acquisition",
FileSystemInstantiation => "file-system-instantiation",
FingerprintHost => "fingerprint-host",
GenerateC2DomainNames => "generate-c2-domain-names",
HideArbitraryVirtualMemory => "hide-arbitrary-virtual-memory",
HideDataInOtherFormats => "hide-data-in-other-formats",
HideFileSystemArtifacts => "hide-file-system-artifacts",
HideKernelModules => "hide-kernel-modules",
HideNetworkTraffic => "hide-network-traffic",
HideOpenNetworkPorts => "hide-open-network-ports",
HideProcesses => "hide-processes",
HideRegistryArtifacts => "hide-registry-artifacts",
HideServices => "hide-services",
HideThreads => "hide-threads",
HideUserspaceLibraries => "hide-userspace-libraries",
IdentifyFile => "identify-file",
IdentifyOs => "identify-os",
IdentifyTargetMachines => "identify-target-machines",
ImpersonateUser => "impersonate-user",
InstallBackdoor => "install-backdoor",
InstallLegitimate => "install-legitimate",
InstallLegitimateSoftware => "install-legitimate-software",
InstallSecondaryMalware => "install-secondary-malware",
InstallSecondaryModule => "install-secondary-module",
InterceptManipulateNetworkTraffic => "intercept/manipulate-network-traffic",
InventoryVictims => "inventory-victims",
LimitApplicationTypeVersion => "limit-application-type/version",
LogActivity => "log-activity",
ManipulateFileSystemData => "manipulate-file-system-data",
MapLocalNetwork => "map-local-network",
MineForCryptocurrency => "mine-for-cryptocurrency",
ModifyFile => "modify-file",
ModifySecuritySoftwareConfiguration => "modify-security-software-configuration",
MoveDataToStagingServer => "move-data-to-staging-server",
ObfuscateArtifactProperties => "obfuscate-artifact-properties",
OverloadSandbox => "overload-sandbox",
PackageData => "package-data",
PersistAfterHardwareChanges => "persist-after-hardware-changes",
PersistAfterOsChanges => "persist-after-os-changes",
PersistAfterSystemReboot => "persist-after-system-reboot",
PreventApiUnhooking => "prevent-API-unhooking",
PreventConcurrentExecution => "prevent-concurrent-execution",
PreventDebugging => "prevent-debugging",
PreventFileAccess => "prevent-file-access",
PreventFileDeletion => "prevent-file-deletion",
PreventMemoryAccess => "prevent-memory-access",
PreventNativeApiHooking => "prevent-native-API-hooking",
PreventPhysicalMemoryAcquisition => "prevent-physical-memory-acquisition",
PreventRegistryAccess => "prevent-registry-access",
PreventRegistryDeletion => "prevent-registry-deletion",
PreventSecuritySoftwareFromExecuting => "prevent-security-software-from-executing",
ReInstantiateSelf => "re-instantiate-self",
RemoveSelf => "remove-self",
RemoveSmsWarningMessages => "remove-SMS-warning-messages",
RemoveSystemArtifacts => "remove-system-artifacts",
RequestEmailAddressList => "request-email-address-list",
RequestEmailTemplate => "request-email-template",
SearchForRemoteMachines => "search-for-remote-machines",
SendBeacon => "send-beacon",
SendEmailMessage => "send-email-message",
SendSystemInformation => "send-system-information",
SocialEngineeringBasedRemoteInfection => "social-engineering-based-remote-infection",
StealBrowserCache => "steal-browser-cache",
StealBrowserCookies => "steal-browser-cookies",
StealBrowserHistory => "steal-browser-history",
StealContactListData => "steal-contact-list-data",
StealCryptocurrencyData => "steal-cryptocurrency-data",
StealDatabaseContent => "steal-database-content",
StealDialedPhoneNumbers => "steal-dialed-phone-numbers",
StealDigitalCertificates => "steal-digital-certificates",
StealDocuments => "steal-documents",
StealEmailData => "steal-email-data",
StealImages => "steal-images",
StealPasswordHashes => "steal-password-hashes",
StealPkiKey => "steal-PKI-key",
StealReferrerUrls => "steal-referrer-URLs",
StealSerialNumbers => "steal-serial-numbers",
StealSmsDatabase => "steal-SMS-database",
StealWebNetworkCredential => "steal-web/network-credential",
StopExecutionOfSecuritySoftware => "stop-execution-of-security-software",
SuicideExit => "suicide-exit",
TestForFirewall => "test-for-firewall",
TestForInternetConnectivity => "test-for-internet-connectivity",
TestForNetworkDrives => "test-for-network-drives",
TestForProxy => "test-for-proxy",
TestForSmtpConnection => "test-for-SMTP-connection",
UpdateConfiguration => "update-configuration",
ValidateData => "validate-data",
WriteCodeIntoFile => "write-code-into-file",
}
}
string_enum! {
pub enum MalwareAction {
AcceptSocketConnection => "accept-socket-connection",
AddConnectionToNetworkShare => "add-connection-to-network-share",
AddNetworkShare => "add-network-share",
AddScheduledTask => "add-scheduled-task",
AddSystemCallHook => "add-system-call-hook",
AddUserToGroup => "add-user to group",
AddUser => "add-user",
AddWindowsHook => "add-windows-hook",
AllocateProcessVirtualMemory => "allocate-process-virtual-memory",
BindAddressToSocket => "bind-address-to-socket",
CallLibraryFunction => "call-library-function",
ChangePassword => "change-password",
CheckForKernelDebugger => "check-for-kernel-debugger",
CheckForRemoteDebugger => "check-for-remote-debugger",
CloseFile => "close-file",
ClosePort => "close-port",
CloseRegistryKey => "close-registry-key",
CloseSocket => "close-socket",
ConnectToFtpServer => "connect-to-ftp-server",
ConnectToIp => "connect-to-ip",
ConnectToIrcServer => "connect-to-irc-server",
ConnectToNamedPipe => "connect-to-named-pipe",
ConnectToNetworkShare => "connect-to-network-share",
ConnectToSocketAddress => "connect-to-socket-address",
ConnectToSocket => "connect-to-socket",
ConnectToUrl => "connect-to-url",
CopyFile => "copy-file",
CreateCriticalSection => "create-critical-section",
CreateDialogBox => "create-dialog-box",
CreateDirectory => "create-directory",
CreateEvent => "create-event",
CreateFileAlternateDataStream => "create-file-alternate-data-stream",
CreateFileMapping => "create-file-mapping",
CreateFileSymbolicLink => "create-file-symbolic-link",
CreateFile => "create-file",
CreateMailslot => "create-mailslot",
CreateMutex => "create-mutex",
CreateNamedPipe => "create-named-pipe",
CreateProcessAsUser => "create-process-as-user",
CreateProcess => "create-process",
CreateRegistryKeyValue => "create-registry-key-value",
CreateRegistryKey => "create-registry-key",
CreateRemoteThreadInProcess => "create-remote-thread-in-process",
CreateSemaphore => "create-semaphore",
CreateService => "create-service",
CreateSocket => "create-socket",
CreateThread => "create-thread",
CreateWindow => "create-window",
DeleteCriticalSection => "delete-critical-section",
DeleteDirectory => "delete-directory",
DeleteEvent => "delete-event",
DeleteFile => "delete-file",
DeleteMutex => "delete-mutex",
DeleteNamedPipe => "delete-named-pipe",
DeleteNetworkShare => "delete-network-share",
DeleteRegistryKeyValue => "delete-registry-key-value",
DeleteRegistryKey => "delete-registry-key",
DeleteSemaphore => "delete-semaphore",
DeleteService => "delete-service",
DeleteUser => "delete-user",
DisconnectFromFtpServer => "disconnect-from-ftp-server",
DisconnectFromIp => "disconnect-from-ip",
DisconnectFromIrcServer => "disconnect-from-irc-server",
DisconnectFromNamedPipe => "disconnect-from-named-pipe",
DisconnectFromNetworkShare => "disconnect-from-network-share",
DisconnectFromSocket => "disconnect-from-socket",
DownloadFile => "download-file",
EmulateDisk => "emulate-disk",
EmulateDriver => "emulate-driver",
EnumerateLibraries => "enumerate-libraries",
EnumerateNetworkShares => "enumerate-network-shares",
EnumerateProcesses => "enumerate-processes",
EnumerateRegistryKeySubkeys => "enumerate-registry-key-subkeys",
EnumerateRegistryKeyValues => "enumerate-registry-key-values",
EnumerateServices => "enumerate-services",
EnumerateSystemHandles => "enumerate-system-handles",
EnumerateThreads => "enumerate-threads",
EnumerateUsers => "enumerate-users",
EnumerateWindows => "enumerate-windows",
ExecuteFile => "execute-file",
FindFile => "find-file",
FindWindow => "find-window",
FlushProcessInstructionCache => "flush-process-instruction-cache",
FreeLibrary => "free-library",
FreeProcessVirtualMemory => "free-process-virtual-memory",
GetDiskAttributes => "get-disk-attributes",
GetDiskType => "get-disk-type",
GetElapsedSystemUpTime => "get-elapsed-system-up-time",
GetFileAttributes => "get-file-attributes",
GetFunctionAddress => "get-function-address",
GetHostByAddress => "get-host-by-address",
GetHostByName => "get-host-by-name",
GetNetbiosName => "get-netbios-name",
GetProcessCurrentDirectory => "get-process-current-directory",
GetProcessEnvironmentVariable => "get-process-environment-variable",
GetProcessStartupinfo => "get-process-startupinfo",
GetRegistryKeyAttributes => "get-registry-key-attributes",
GetSystemGlobalFlags => "get-system-global-flags",
GetSystemHostName => "get-system-host-name",
GetSystemLocalTime => "get-system-local-time",
GetSystemTime => "get-system-time",
GetThreadContext => "get-thread-context",
GetThreadUsername => "get-thread-username",
GetUserAttributes => "get-user-attributes",
GetUsername => "get-username",
GetWindowsDirectory => "get-windows-directory",
GetWindowsSystemDirectory => "get-windows-system-directory",
GetWindowsTemporaryFilesDirectory => "get-windows-temporary-files-directory",
HideDirectory => "hide-directory",
HideFile => "hide-file",
HideHook => "hide-hook",
HideWindow => "hide-window",
ImpersonateProcess => "impersonate-process",
InvokeUserPrivilege => "invoke-user-privilege",
JoinIrcChannel => "join-irc-channel",
KillProcess => "kill-process",
KillThread => "kill-thread",
KillWindow => "kill-window",
LeaveIrcChannel => "leave-irc-channel",
ListDisks => "list-disks",
ListenOnPort => "listen-on-port",
ListenOnSocket => "listen-on-socket",
LoadAndCallDriver => "load-and-call-driver",
LoadDriver => "load-driver",
LoadLibrary => "load-library",
LockFile => "lock-file",
LogoAsUser => "logo-as-user",
MapFileIntoProcess => "map-file-into-process",
MapLibraryIntoProcess => "map-library-into-process",
ModifyProcessVirtualMemoryProtection => "modify-process-virtual-memory-protection",
ModifyRegistryKeyValue => "modify-registry-key-value",
ModifyRegistryKey => "modify-registry-key",
ModifyServiceConfiguration => "modify-service-configuration",
MonitorDirectory => "monitor-directory",
MonitorDisk => "monitor-disk",
MonitorRegistryKey => "monitor-registry-key",
MountDisk => "mount-disk",
MoveFile => "move-file",
OpenCriticalSection => "open-critical-section",
OpenEvent => "open-event",
OpenFileMapping => "open-file-mapping",
OpenFile => "open-file",
OpenMutex => "open-mutex",
OpenPort => "open-port",
OpenProcess => "open-process",
OpenRegistryKey => "open-registry-key",
OpenSemaphore => "open-semaphore",
OpenService => "open-service",
QueueApcInThread => "queue-apc-in-thread",
ReadFromFile => "read-from-file",
ReadFromMailslot => "read-from-mailslot",
ReadFromNamedPipe => "read-from-named-pipe",
ReadFromProcessMemory => "read-from-process-memory",
ReadRegistryKeyValue => "read-registry-key-value",
ReceiveDataOnSocket => "receive-data-on-socket",
ReceiveHttpResponse => "receive-http-response",
ReceiveIrcPrivateMessage => "receive-irc-private-message",
ReceiveNetworkPacket => "receive-network-packet",
ReleaseCriticalSection => "release-critical-section",
ReleaseMutex => "release-mutex",
ReleaseSemaphore => "release-semaphore",
RemoveUserFromGroup => "remove-user-from-group",
RenameFile => "rename-file",
ResetEvent => "reset-event",
RevertThreadToSelf => "revert-thread-to-self",
SendControlCodeToFile => "send-control-code-to-file",
SendControlCodeToService => "send-control-code-to-service",
SendDataOnSocket => "send-data-on-socket",
SendDataToAddressOnSocket => "send-data-to-address-on-socket",
SendDnsQuery => "send-dns-query",
SendEmailMessage => "send-email-message",
SendFtpCommand => "send-ftp-command",
SendHttpConnectRequest => "send-http-connect-request",
SendHttpDeleteRequest => "send-http-delete-request",
SendHttpGetRequest => "send-http-get-request",
SendHttpHeadRequest => "send-http-head-request",
SendHttpOptionsRequest => "send-http-options-request",
SendHttpPatchRequest => "send-http-patch-request",
SendHttpPostRequest => "send-http-post-request",
SendHttpPutRequest => "send-http-put-request",
SendHttpTraceRequest => "send-http-trace-request",
SendIcmpRequest => "send-icmp-request",
SendIrcPrivateMessage => "send-irc-private-message",
SendNetworkPacket => "send-network-packet",
SendReverseDnsLookup => "send-reverse-dns-lookup",
SetFileAttributes => "set-file-attributes",
SetIrcNickname => "set-irc-nickname",
SetNetbiosName => "set-netbios-name",
SetProcessCurrentDirectory => "set-process-current-directory",
SetProcessEnvironmentVariable => "set-process-environment-variable",
SetSystemGlobalFlags => "set-system-global-flags",
SetSystemHostName => "set-system-host-name",
SetSystemLocalTime => "set-system-local-time",
SetSystemTime => "set-system-time",
SetThreadContext => "set-thread-context",
ShowWindow => "show-window",
ShutdownSystem => "shutdown-system",
SleepProcess => "sleep-process",
SleepSystem => "sleep-system",
StartService => "start-service",
StopService => "stop-service",
UnloadDriver => "unload-driver",
UnlockFile => "unlock-file",
UnmapFileFromProcess => "unmap-file-from-process",
UnmountDisk => "unmount-disk",
UploadFile => "upload-file",
WriteToFile => "write-to-file",
WriteToMailslot => "write-to-mailslot",
WriteToNamedPipe => "write-to-named-pipe",
WriteToProcessMemory => "write-to-process-memory",
}
}