// Copyright (C) 2020-2021,  0xN3utr0n

// Kanis is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.

// Kanis is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.

// You should have received a copy of the GNU General Public License
// along with Kanis. If not, see <http://www.gnu.org/licenses/>.

package threat

type information struct {
	description string
	ioc         string
}

var threats = map[string]information{
	"Execution Flow Hijacking": {
		description: "Malicious payloads can be executed by hijacking/infecting the control flow of a benign binary. Common technique among parasites, viruses and troyans.",
		ioc:         "Executable File",
	},
	"Software Packing": {
		description: "It's a method of compressing or encrypting an executable in order to conceal its code.",
		ioc:         "Packed Executable File",
	},
	"Executable Deletion": {
		description: "Malicious process may delete its own executable file in order to minimize its footprint.",
		ioc:         "Executable File",
	},
	"Kernel Thread Masquerading": {
		description: "Occurs when a malicious executable masquerades its name as a kernel thread in order to make it appear legitimate.",
		ioc:         "Executable File",
	},
	"Space After Filename Masquerading": {
		description: "An executable's true filetype can be hidden by changing its extension and appending a space at the end of the filename.",
		ioc:         "Executable File",
	},
	"Process Injection": {
		description: "It's a method of executing arbitrary code in the address space of a separate live process.",
		ioc:         "Target's PID",
	},
	"Traceme Protection": {
		description: "Commonly used as an anti-debugging technique in which a malicious process forces its parent to trace him.",
		ioc:         "Tracer's PID",
	},
	"Self-Tracing Protection": {
		description: "Anti-debugging technique in which the malicious process traces itself.",
		ioc:         "Tracer's PID",
	},
	"Two-Way-Tracing Protection": {
		description: "Anti-debugging technique in which two related processes trace each other. Usual indicator of Nanomites technique.",
		ioc:         "Tracer's PID",
	},
	"SIGTRAP-Handler Protection": {
		description: "Anti-debugging technique in which the malicious process sets up a signal handler to catch SIGTRAP signals issued by breakpoint instructions.",
		ioc:         "None",
	},
	"Malware": {
		description: "Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols.",
		ioc:         "Executable File",
	},
}
