# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 4 Attack Techniques Used by Malicious Code
A memory patch is a technique for inserting hidden code in an area that loads into the memory in order to conceal a program that an attacker has successfully installed on the target system. The memory patch mainly relies on code injection and DLL injection techniques. This technique does not exist as a real file, but because the code is loaded into memory, defenders directly explore and detect memory areas. Because of this, there are cases in which detection is difficult or impossible. For example, code-concealment techniques such as memory patches were used in Regin, a malicious code with the aim of leaking information [28]. Other concealment techniques include steganography [10] to hide communication, code obfuscation to hide execution code [13], execution compression techniques such as packing to prevent analysis, and anti-debugging [28]. Further, some techniques only operate when certain conditions are met [28]. In the internal search step, the internal system and the network that have been penetrated for the final purpose are searched, and techniques such as backdoor, network monitoring and analysis, and system monitoring are utilized. The backdoor allows the attacker to communicate with the victim's system from the outside. It is mainly used to install additional malicious codes or for the purposes of commands delivery and information leakage [13]. The network monitoring and analysis step involves the gathering and analysis of information on the network to penetrate into the victim's system; this is mainly performed using the port scan technique. In a port scan, information about the ports of the internal network is collected. If successful, the port scan bypasses security functions such as access control because it performs scanning on the authorized system. Therefore, this attack technique is very effective because it is not detected by the security system and is generally allowed to communicate internally [12, 13, 29]. To perform such an internal search, the above malicious codes are additionally installed, thereby collecting system and user information. The collected information includes system connection information, service usage information, pattern information, etc. Using the collected information, the attacker can approach and penetrate the victim's system, then proceed to the internal activity stage [13]. In the internal activity step, the attacker becomes active in the internal system and network to penetrate the final target system. This is carried out using attack techniques including keylogger, IRC (Internet Relay Chat), information exposure and leakage, interception of password hash values of victim accounts, and eavesdropping on conversations through the microphone. A Keylogger records information that is input using a keyboard. Here, the attacker achieves their goal by taking information input from the keyboard or information stored in the database [13]. This is because access to systems and databases is mostly based on ID-password pairs. IRC [16] is a protocol for real-time chat that also provides functions such as conversation and file transfer. However, these functions can be exploited by attackers, who can then execute malicious actions such as information retrieval by sending specific commands or downloading additional malicious codes based on the data collected through internal search [29]. The method used for information exposure and leakage is similar to that used to collect information about internal systems and networks in the internal search step. The difference from the previous step is that more information is gathered and used to penetrate the victim's system, and the attacker achieves their goal by stealing important information such as authorized certificates, system account information and configuration information [29]. The attackers can also achieve their goal by collecting information to penetrate the final target system, such as intercepting the password hash value of victim accounts and eavesdropping on conversations recording using microphones, as in the case of EMC/RSA [13].