changes for Mobile v11-beta techniques

anti-behavioral-analysis/detect-sandbox.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**B0007**|
 |**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Sub-techniques**|[Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/), [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/)|
+|**Related ATT&CK Sub-techniques**|Virtualization/Sandbox Evasion: System Checks ([T1497.001](https://attack.mitre.org/techniques/T1497/001/), [T1633.001](https://attack.mitre.org/techniques/T1633/001/)), Virtualization/Sandbox Evasion: User Activity Based Checks ([T1497.002](https://attack.mitre.org/techniques/T1497/002/))|
 
 
 Sandbox Detection
 =================
 Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.
 
-The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
+The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** techniques and their sub-techniques.
 
 Methods
 -------

anti-behavioral-analysis/detect-vm.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**B0009**|
 |**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
+|**Related ATT&CK Technique**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))|
 
 
 Virtual Machine Detection
 =========================
 Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)
 
-The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
+The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** techniques and their sub-techniques.
 
 Methods
 -------

anti-behavioral-analysis/evade-dynamic-analysis.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**B0003**|
 |**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
+|**Related ATT&CK Technique**|Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))|
 
 
 Dynamic Analysis Evasion
@@ -11,6 +11,8 @@ Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine
 
 See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](../anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 
 
+See ATT&CK: **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))**.
+
 Methods
 -------
 |Name|ID|Description|

anti-static-analysis/software-packing.md

@@ -2,13 +2,13 @@
 |---|---|
 |**ID**|**F0001**|
 |**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Obfuscated Files or Information: Software Packing](https://attack.mitre.org/techniques/T1027/002)|
+|**Related ATT&CK Sub-Technique**|Obfuscated Files or Information: Software Packing ([T1027.002](https://attack.mitre.org/techniques/T1027/002/), [T1406.002](https://attack.mitre.org/techniques/T1406/002/))|
 
 Software Packing
 ================
 This code characteristic - Software Packing - can make static and behavioral analysis difficult and includes packing with software protectors, such as Themida and Armadillo [[1]](#1). Methods related to anti-analysis are below. This behavior covers both characteristics of the malware (i.e., how it is packed) as well as behaviors of the malware (e.g., the malware packs another executable file).
 
-This description refines the ATT&CK [**Obfuscated Files or Information: Software Packing**](https://attack.mitre.org/techniques/T1027/002) sub-technique.
+This description refines the ATT&CK **Obfuscated Files or Information: Software Packing ([T1027.002](https://attack.mitre.org/techniques/T1027/002/), [T1406.002](https://attack.mitre.org/techniques/T1406/002/))**.
 
 Methods
 -------

collection/input-capture.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**E1056**|
 |**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
-|**Related ATT&CK Technique**|[Input Capture](https://attack.mitre.org/techniques/T1056)|
+|**Related ATT&CK Technique**|Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [T1417](https://attack.mitre.org/techniques/T1417/))|
 
 
 Input Capture
 =============
 Malware captures user input.
 
-**See ATT&CK:** [**Input Capture**](https://attack.mitre.org/techniques/T1056).
+**See ATT&CK:** **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [T1417](https://attack.mitre.org/techniques/T1417/))**.
 
 Methods
 -------

collection/keylogging.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**F0002**|
 |**Objective(s)**|[Collection](../collection), [Credential Access](../credential-access)|
-|**Related ATT&CK Sub-Technique**|[Input Capture: Keylogging](https://attack.mitre.org/techniques/T1056/001)|
+|**Related ATT&CK Sub-Technique**|Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/techniques/T1056/001), [T1417.001](https://attack.mitre.org/techniques/T1417/001/))|
 
 
 Keylogging
 ==========
 Malware captures user keyboard input.
 
-**See ATT&CK:** [**Input Capture: Keylogging**](https://attack.mitre.org/techniques/T1056/001).
+**See ATT&CK:** **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/techniques/T1056/001), [T1417.001](https://attack.mitre.org/techniques/T1417/001/))**
 
 Methods
 -------

defense-evasion/disable-security-tools.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**F0004**|
 |**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|
+|**Related ATT&CK Sub-Techniques**|Impair Defenses: Disable or Modify Tools ([T1562.001](https://attack.mitre.org/techniques/T1562/001), [T1629.003] (https://attack.mitre.org/techniques/T1629/003/))|
 
 
 Disable or Evade Security Tools
@@ -11,7 +11,7 @@ Malware may disable or evade security tools to avoid detection. Security tools i
 
 Malware-related methods extending ATT&CK's definition are below. 
 
-See ATT&CK: [**Impair Defenses: Disable or Modify Tools**](https://attack.mitre.org/techniques/T1562/001).
+See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://attack.mitre.org/techniques/T1562/001), [T1629.003] (https://attack.mitre.org/techniques/T1629/003/))**.
 
 Methods
 -------
@@ -22,7 +22,7 @@ Methods
 |**Disable System File Overwrite Protection**|F0004.002|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
 |**Force Lazy Writing**|F0004.006|Some operating systems will sometimes use a form of "lazy writing" for disk I/O, which may obscure the true provenance of the write operation. This method occurs when code intentionally forces the operating system to perform a lazy writing operation. For example, in Windows, a file may be opened, memory mapped, and closed, but the memory map will still exist and can be written to, which will cause a lazy write that looks like it is coming from the System process. [[3]](#3)|
 |**Heavens Gate**|F0004.008|Malware evades endpoint security products by invoking 64-bit code in 32-bit processes, effectively bypassing user-mode hooks. [[4]](#4)|
-|**Modify Policy**|F0004.005|Malware may modify policies to make software less effective.|
+|**Modify Policy**|F0004.005|Malware may modify policies to make software less effective. This is similar to ATT&CK's Subvert Trust Controls: Code Signing Policy Modification ([T1553.006](https://attack.mitre.org/techniques/T1553/006/), [T1632.001](https://attack.mitre.org/techniques/T1632/001/))|
 |**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
 |**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.|
 |**Disable Code Integrity**|F0004.009|Malware disables Code Integrity driver.|

defense-evasion/hide-artifacts.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**E1564**|
 |**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
-|**Related ATT&CK Technique**|Hide Artifacts [(T1564](https://attack.mitre.org/techniques/T1564/), [T1628)](https://attack.mitre.org/techniques/T1628/)|
+|**Related ATT&CK Technique**|Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/), [T1628](https://attack.mitre.org/techniques/T1628/))|
 
 
 Hide Artifacts
 ==============
 Malware may hide artifacts to evade detection and/or to persist on the system. See potential methods related to malware below. 
 
-See ATT&CK: **Hide Artifacts [(T1564](https://attack.mitre.org/techniques/T1564/), [T1628)](https://attack.mitre.org/techniques/T1628/)**.
+See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/), [T1628](https://attack.mitre.org/techniques/T1628/))**.
 
 Methods
 -------

defense-evasion/obfuscate-files.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**E1027**|
 |**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)|
+|**Related ATT&CK Technique**|Obfuscated Files or Information ([T1027](https://attack.mitre.org/techniques/T1027/)), Obfuscated Files or Information: Steganography ([T1406.001](https://attack.mitre.org/techniques/T1406/001/))|
 
 
 Obfuscated Files or Information
@@ -13,7 +13,7 @@ A related MBC behavior (code characteristic), associated explicitly with executa
 
 Another related MBC behavior (code characteristic), is [Software Packing](../anti-static-analysis/software-packing.md) which has methods capturing specific packers and types of compression.
 
-See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
+See ATT&CK: **Obfuscated Files or Information ([T1027](https://attack.mitre.org/techniques/T1027/)), Obfuscated Files or Information: Steganography ([T1406.001](https://attack.mitre.org/techniques/T1406/001/))**.
 
 Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
 

defense-evasion/process-inject.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**E1055**|
 |**Objective(s)**|[Defense Evasion](../defense-evasion), [Privilege Escalation](../privilege-escalation)|
-|**Related ATT&CK Technique**|[Process Injection](https://attack.mitre.org/techniques/T1055)|
+|**Related ATT&CK Technique**|Process Injection ([T1055](https://attack.mitre.org/techniques/T1055), [T1631](https://attack.mitre.org/techniques/T1631/))|
 
 
 Process Injection
 =================
 Malware may execute code in the address space of a separate process. 
 
-See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on ATT&CK's sub-techniques in the context of [[1]](#1) are as follows:
+See ATT&CK: **Process Injection ([T1055](https://attack.mitre.org/techniques/T1055/), [T1631](https://attack.mitre.org/techniques/T1631/))**. Notes on ATT&CK's sub-techniques in the context of [[1]](#1) are as follows:
 
 |ID|ATT&CK Sub-Technique|Notes|
 |---|---|---|

defense-evasion/self-deletion.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**F0007**|
 |**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: Uninstall Malicious Application](https://attack.mitre.org/techniques/T1630/001/), [Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)|
+|**Related ATT&CK Sub-Technique**|Indicator Removal on Host: Uninstall Malicious Application ([T1630.001](https://attack.mitre.org/techniques/T1630/001/)), Indicator Removal on Host: File Deletion ([T1070.004](https://attack.mitre.org/techniques/T1070/004/))|
 
 
 Self Deletion
 =============
 Malware may uninstall itself to avoid detection. 
 
-See ATT&CK: [**Indicator Removal on Host: Uninstall Malicious Application**](https://attack.mitre.org/techniques/T1630/001/), [**Indicator Removal on Host: File Deletion**](https://attack.mitre.org/techniques/T1070/004/).
+See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630.001](https://attack.mitre.org/techniques/T1630/001/)), Indicator Removal on Host: File Deletion ([T1070.004](https://attack.mitre.org/techniques/T1070/004/))**.
 
 Methods
 -------

execution/command-line.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**E1059**|
 |**Objective(s)**|[Execution](../execution)|
-|**Related ATT&CK Technique**|Command and Scripting Interpreter [(T1059](https://attack.mitre.org/techniques/T1059), [T1623)](https://attack.mitre.org/techniques/T1623)|
+|**Related ATT&CK Technique**|Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))|
 
 
 Command and Scripting Interpreter
 =================================
 Malware may abuse command and script interpreters to execute commands, scripts, or binaries.
 
-**See ATT&CK Technique:** **Command and Scripting Interpreter [(T1059](https://attack.mitre.org/techniques/T1059), [T1623)](https://attack.mitre.org/techniques/T1623)**.
+**See ATT&CK Technique:** **Command and Scripting Interpreter ([T1059](https://attack.mitre.org/techniques/T1059), [T1623](https://attack.mitre.org/techniques/T1623))**.
 
 Malware Examples
 ----------------

impact/README.md

@@ -16,7 +16,7 @@ Behaviors that enable malware to achieve its mission of manipulating, interrupti
 * **Disk Wipe** [F0014](../impact/disk-wipe.md)
 * **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
-* **Generate Network Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md)
+* **Generate Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md)
 * **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md)
 * **Modify Hardware** [B0042](../impact/modify-hardware.md)	
 * **Remote Access** [B0022](../impact/remote-access.md)

impact/generate-traffic-from-victim.md

@@ -7,7 +7,7 @@
 
 Generate Traffic from Victim
 =======================================
-Malware may generate traffic from the victim system such as clicks of advertising links that generate fraudulent ad revenue. The ATT&CK technique, [Generate Traffic from Victim](https://attack.mitre.org/techniques/T1643/), pertains only to mobile platform, but the behavior is applicable to other platforms as well.
+Malware may generate traffic from the victim system such as clicks of advertising links that generate fraudulent ad revenue. The ATT&CK technique, [Generate Traffic from Victim](https://attack.mitre.org/techniques/T1643/), is only associated with the mobile platform, but the behavior is applicable to other platforms as well.
 
 Methods
 -------

lateral-movement/supply-chain-compromise.md

@@ -2,12 +2,12 @@
 |---|---|
 |**ID**|**E1195**|
 |**Objective(s)**|[Lateral Movement](../lateral-movement)|
-|**Related ATT&CK Technique**|[Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)|
+|**Related ATT&CK Technique**|Supply Chain Compromise ([T1195](https://attack.mitre.org/techniques/T1195/), [T1474](https://attack.mitre.org/techniques/T1474/))|
 
 
 Supply Chain Compromise
 =======================
-The supply chain may be compromised to enable initial malware infection. Malware-related methods are listed below to supplement the information available defined in ATT&CK: [**Supply Chain Compromise**](https://attack.mitre.org/techniques/T1195/).  
+The supply chain may be compromised to enable initial malware infection. MBC objectives don't encompass initial infection, but the malware-related methods are listed below supplement the information available defined in ATT&CK and allow for lateral movement: **Supply Chain Compromise ([T1195](https://attack.mitre.org/techniques/T1195/), [T1474](https://attack.mitre.org/techniques/T1474/))**.  
 
 Methods
 -------