diff --git a/defense-evasion/obfuscate-files.md b/defense-evasion/obfuscate-files.md
index 9aa2b2c..a5726b3 100644
--- a/defense-evasion/obfuscate-files.md
+++ b/defense-evasion/obfuscate-files.md
@@ -15,20 +15,21 @@ Another related MBC behavior (code characteristic), is [Software Packing](../ant
 
 See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
 
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
 |**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
-|**Encoding-Custom Encoding**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
-|**Encoding-Standard Encoding**|E1027.m02|A standard algorithm, such as base64 encoding, is used to encode a malware sample, file, or other information.|
+|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
+|**Encoding-Standard Algorithm**|E1027.m02|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
 |**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted.|
-|**Encryption-Custom Encryption**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
-|**Encryption-Custom Encryption of Code**|E1027.m09|A custom algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-|**Encryption-Custom Encryption of Data**|E1027.m10|A custom algorithm is used to encrypt a file's data, but not necessarily the file's code.|
-|**Encryption-Standard Encryption**|E1027.m05|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt a malware sample, file, or other information.|
-|**Encryption-Standard Encryption of Code**|E1027.m06|A standard algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-|**Encryption-Standard Encryption of Data**|E1027.m07|A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
+|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
+|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information.|
+|**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
+|**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
+
 
 Malware Examples
 ----------------
diff --git a/micro-behaviors/cryptography/README.md b/micro-behaviors/cryptography/README.md
index 92301ab..0698ca8 100644
--- a/micro-behaviors/cryptography/README.md
+++ b/micro-behaviors/cryptography/README.md
@@ -9,6 +9,7 @@ Micro-behaviors that enable malware to use crypto.
 |Name|ID|Description|
 |---|---|---|
 |[**Encrypt Data**](../cryptography/encrypt.md)|C0027||
+|[**Decrypt Data**](../cryptography/decrypt.md)|C0031||
 |[**Generate Pseudo-random Sequence**](../cryptography/gen-random.md)|C0021||
 |[**Use Cryptography Hash**](../cryptography/crypto-hash.md)|C0029||
 |[**Use Encryption Key**](../cryptography/key.md)|C0028||
\ No newline at end of file