Sebastien Kanj Bongard

Anti-analysis techniques, also known as evasive techniques, enable Windows malware to detect and evade dynamic inspection environments, undermining the effectiveness of virtual-machine and sandbox-based inspection. Despite extensive prior research, no unified classification has been paired with a large-scale empirical evaluation of static detection capabilities for these behaviors. This paper addresses this gap by presenting a comprehensive classification and detection framework. We consolidate 94 anti-analysis techniques from academic, community, and threat-intelligence sources into nine mechanistic categories and derive corresponding YARA rules for static identification. In total, 82 YARA signatures were authored or refined and evaluated on 459,508 malware and 92,508 goodware samples. After iterative refinement using precision thresholds, 42 rules achieved high accuracy (≥75%), 16 showed moderate precision (50–75%), and 24 were discarded due to unreliability. The results indicate strong static detectability for firmware- and BIOS-based checks, but limited precision for timing-based evasions, which frequently overlap with benign behavior. Although YARA provides broad coverage of observable artifacts, its static nature limits detection under obfuscation or runtime mutation; our measurements therefore represent conservative estimates of technique prevalence. All validated rules are released in an open-source repository to support reproducibility, improve incident-response workflows, and strengthen prevention and mitigation against real-world threats. Future work will explore hybrid validation, container-evasion extensions, and forensic attribution based on signature co-occurrence patterns.

The MITRE ATT&CK® framework is a globally recognized repository of adversarial Tactics, Techniques, and Procedures (TTPs) based on real-world cyber threats. It provides a model for analyzing attack behaviors and enhancing incident attribution. Business Email Compromise (BEC) frauds, a growing cyber threat, exploit email communications for financial gain. However, the MITRE framework is not widely used for BEC, as no custom matrix has been developed specifically for these attacks. This study maps the TTPs used by BEC Threat Actors (TA) within the MITRE ATT&CK framework. The methodology included a review of academic literature, Cyber Threat Intelligence (CTI) reports, and real-world incident response data from INCIDE Digital Data S.L.Atotal of 10 tactics, 34 techniques, and 46 sub-techniques were identified, with 5 new sub-techniques proposed to address gaps, particularly in mailbox manipulation and defense evasion. Additionally, Privilege Escalation, Lateral Movement, and Credential Access tactics were merged due to overlapping techniques, while the Execution tactic was excluded as it is not central to BEC attacks. To demonstrate the utility of the framework, we characterized two real-world TAs: Cosmic Lynx, a sophisticated actor targeting multinational organizations, and Chiffon Herring, a smaller-scale attacker employing simpler methods. These case studies highlight the framework’s adaptability for analyzing diverse TA profiles and its potential to support improved incident attribution, detection, and prevention strategies.