add behs for cuckoo

defense-evasion/README.md

@@ -35,6 +35,7 @@ Behaviors that evade detection or avoid other defenses.
 * **Masquerading** [T1036](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/masquerading.md)
 * **Modify Registry** [T1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
 * **Modify Trusted Execution Environment** [T1399](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/mod-trust-exe-environ.md)
+* **NTFS File Attributes** [T1096](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/ntfs-file-attr.md)
 * **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
 * **Polymorphic Code** [M0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md)
 * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)

defense-evasion/ntfs-file-attr.md

@@ -0,0 +1,12 @@
+|||
+|---------|------------------------|
+|**ID**|**T1096**|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Related ATT&CK Technique(s)**|[NTFS File Attributes](https://attack.mitre.org/techniques/T1096/)|
+
+
+NTFS File Attributes
+====================
+Malware may store malicious data in file attribute metadata. 
+
+See ATT&CK: [**NTFS File Attributes**](https://attack.mitre.org/techniques/T1096/). 

persistence/README.md

@@ -5,6 +5,7 @@
 # Persistence #
 Malware aims to remain on a system regardless of system events.
 
+* **AppInit DLLs** [T1103](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/appinit-dlls.md)
 * **Application Shimming** [T1138](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/app-shimming.md)
 * **Backdoor** [M0037](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/backdoor.md)
 * **.bash_profile and .bashrc** [T1156](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/bash.md)
@@ -31,6 +32,7 @@ Malware aims to remain on a system regardless of system events.
 * **Registry Run Keys / Startup Folder** [E1060](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/registry-run-startup.md)
 * **Scheduled Task** [T1053](https://github.com/MBCProject/mbc-markdown/blob/master/execution/scheduled-task.md)
 * **Setuid and Setgid** [T1166](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/setuid-setgid.md)
+* **Shortcut Modification** [T1023](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/shortcut-mod.md)
 * **Shutdown Event** [M0035](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/shutdown-event.md)
 * **Startup Items** [T1165](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/startup-items.md)
 * **System Firmware** [T1109](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/system-firmware.md)

persistence/appinit-dlls.md

@@ -0,0 +1,12 @@
+|||
+|---------|------------------------|
+|**ID**|**T1103**|
+|**Objective(s)**| [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation) |
+|**Related ATT&CK Technique(s)**|[AppInit DLLs](https://attack.mitre.org/techniques/T1103/)|
+
+
+AppInit DLLs
+====================
+Malware may abuse DLLs specified in the registry AppInit_DLLs value to load and run malicious DLLs. 
+
+See ATT&CK: [**AppInit DLLs**](https://attack.mitre.org/techniques/T1103/). 

persistence/shortcut-mod.md

@@ -0,0 +1,12 @@
+|||
+|---------|------------------------|
+|**ID**|**T1023**|
+|**Objective(s)**| [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
+|**Related ATT&CK Technique(s)**|[Shortcut Modification](https://attack.mitre.org/techniques/T1023/)|
+
+
+Shortcut Modification
+=====================
+Malware may use shortcuts or symbolic links to open files or execute programs. 
+
+See ATT&CK: [**Shortcut Modification**](https://attack.mitre.org/techniques/T1023/). 

privilege-escalation/README.md

@@ -5,6 +5,7 @@
 # Privilege Escalation #
 Behaviors that aim to obtain a higher level of permission.
 
+* **AppInit DLLs** [T1103](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/appinit-dlls.md)
 * **Application Shimming** [T1138](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/app-shimming.md)
 * **Bypass User Account Control** [T1088](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-user-acct-cntl.md)
 * **DLL Search Order Hijacking** [T1038](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/dll-search-order-hijack.md)