add method

README.md

@@ -2,7 +2,7 @@
 The Malware Behavior Catalog (MBC) is a catalog of malware Objectives and Behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-markdown/blob/master/yfaq/README.md) page for answers to common questions.
 
 ### Objectives ###
-As shown below, malware Objectives are based on [ATT&CK Tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known Objectives and Behaviors. Two malware analysis-specific Objectives (Anti-Behavioral Analysis and Anti-Static Analysis) not in ATT&CK are also defined. 
+As shown below, malware Objectives are based on [ATT&CK Tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known Objectives and Behaviors. Two malware analysis-specific Objectives not in ATT&CK are also defined (Anti-Behavioral Analysis and Anti-Static Analysis). 
 
 ### Behaviors ###
 Under each Objective, MBC captures all behaviors and code characteristics discovered during malware analysis, with links to [ATT&CK Techniques](https://attack.mitre.org/techniques/enterprise/) as appropriate. Names of MBC Behaviors may or may not match related ATT&CK Techniques. Any content provided on Behavior pages is *supplemental* to ATT&CK content. In other words, ATT&CK content is not duplicated in MBC, and MBC users will want to reference ATT&CK while capturing malware Behaviors.

defense-evasion/README.md

@@ -37,7 +37,7 @@ Behaviors that evade detection or avoid other defenses.
 * **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
 * **Polymorphic Code** [M0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md)
 * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
-* **Process Hollowing** [T1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-hollow.md)
+* **Process Hollowing** [T1093](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-hollow.md)
 * **Process Injection** [T1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md)
 * **Redundant Access** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/redundant-access.md)
 * **Regsvr32** [T1117](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/regsvr32.md)

impact/remote-access.md

@@ -13,6 +13,10 @@ Malware may also provide specific commands. Given an "execute" command, the atta
 
 This behavior is related to the ATT&CK [**Remote Access Tools**](https://attack.mitre.org/techniques/T1219/) technique which is defined under the ATT&CK Command and Control tactic, but it is not equivalent (reflected by its "M" ID).
 
+Methods
+-------
+* **reverse shell**: Malware may create a reverse shell by invoking cmd.exe and creating three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary. 
+
 Malware Examples
 ----------------
 |Name|Date|Description|