Emotet — Extracted TTPs
This directory will hold the recreated TTPs extracted from the Emotet analysis, following the same structure used by the other families in this repository:
Extracted_TTPs/
└── Emotet_<TechniqueName>/
├── Code/ recreated technique, buildable
└── Detection/ rule / query / detection logic
Planned
Candidate techniques from the analysis, in rough order of usefulness:
| Technique | ATT&CK | Notes |
|---|---|---|
| Dynamic API resolution & API hashing | T1027.007 | Resolve exports by hash comparison instead of by name |
| Reflective loading of an encrypted resource DLL | T1620 | Decrypt a DLL held in a bitmap resource into an RWX region |
| Run-time string decryption | T1140 | Encrypted string table decrypted on demand |
Relocation to %AppData% + Mark-of-the-Web bypass |
T1553.005 | Copy to a random path and strip the Zone.Identifier stream |
| ECDH + AES C2 key exchange | T1573.002 | BCryptSecretAgreement / BCryptDeriveKey shared-secret derivation |
Status: not yet implemented — contributions welcome, see CONTRIBUTING.md.
Disclaimer
Artifacts and code in this repository are intended for educational purposes only.