remote file copy vs install add program text

command-and-control/README.md

@@ -18,7 +18,7 @@ Behaviors malware may use to communicate with systems under its control within a
 * **Multi-Stage Channels** [T1104](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/multi-stage-channels.md)
 * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
 * **Remote Access Tools** [T1219](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-access-tools.md)
-* **Remote File Copy** [T1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
+* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
 * **Standard Application Layer Protocol** [T1071](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-app-protocol.md)
 * **Standard Cryptographic Protocol** [T1032](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-crypto-protocol.md)
 * **Standard Non-Application Layer Protocol** [T1095](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-non-app-protocol.md)

command-and-control/remote-file-copy.md

@@ -1,12 +1,12 @@
 |||
 |---------|------------------------|
-|**ID**|**T1105**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
+|**ID**|**E1105**|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Remote File Copy](https://attack.mitre.org/techniques/T1105/)|
 
 Remote File Copy
 ================
-Malware may copy files from one system to another.
+Malware may copy files from one system to another. Note that this behavior is separate from the execution of the file, which is covered by the [Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md) behavior. 
 
 **See ATT&CK:** [**Remote File Copy**](https://attack.mitre.org/techniques/T1105/).
 

execution/install-prog.md

@@ -7,12 +7,9 @@
 
 Install Additional Program
 ==========================
-Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps. Malware that installs another component is called a "dropper."
+Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps. 
 
-Methods
--------
-* **Single Stage**: The installed code is contained within the dropper.
-* **Two Stage**: The dropper downloads the installed code to the target machine.
+Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the [Remote File Copy](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md) behavior).
 
 Malware Examples
 ----------------

lateral-movement/README.md

@@ -11,7 +11,7 @@ Behaviors that enable propagation through a compromised system or infected files
 * **Malicious Network Driver** [M0026](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/malicious-network-drv.md)
 * **Pass the Hash** [T1075](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/pass-the-hash.md)
 * **Remote Desktop Protocol** [T1076](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/remote-desktop-protocol.md)
-* **Remote File Copy** [T1105](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/remote-file-copy.md)
+* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/remote-file-copy.md)
 * **Replication Through Removable Media** [T1091](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/replicate-remove-media.md)
 * **Send Email** [M0020](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-email.md)
 * **Send Poison Text Message** [M0021](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-poison-text-msg.md)

persistence/README.md

@@ -33,6 +33,7 @@ Malware aims to remain on a system regardless of system events.
 * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
 * **Redundant Access** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/redundant-access.md)
 * **Registry Run Keys / Startup Folder** [E1060](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/registry-run-startup.md)
+* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
 * **Scheduled Task** [T1053](https://github.com/MBCProject/mbc-markdown/blob/master/execution/scheduled-task.md)
 * **Setuid and Setgid** [T1166](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/setuid-setgid.md)
 * **Shortcut Modification** [T1023](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/shortcut-mod.md)