renamed behaviors

anti-static-analysis/README.md

@@ -3,16 +3,17 @@
 |**ID**|**M9002**|
 
 # Anti-Static Analysis
-Behaviors and methods that prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.
+Behaviors and code characteristics that prevent static analysis or make it more difficult. Simple static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.
 
 Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).
 
 * **Call Graph Generation Evasion** [M0010](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-call-graph.md)
 * **Disassembler Evasion** [M0012](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-disassembler.md)
-* **Executable Code Compression** [M0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md)
 * **Executable Code Obfuscation** [M0032](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md)
 * **Executable Code Optimization** [M0034](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-optimize.md)
 * **Executable Code Virtualization** [M0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
+* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
+* **Software Packing** [M0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
 
 
 References

anti-static-analysis/exe-code-obfuscate.md

@@ -2,16 +2,14 @@
 |---------|------------------------|
 |**ID**|**M0032**|
 |**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique(s)**|[Software Packing](https://attack.mitre.org/techniques/T1045/)|
+|**Related ATT&CK Technique(s)**|None|
 
 
 Executable Code Obfuscation
 ===========================
 Executable code uses obfuscation to hinder disassembly and static code analysis. Methods related to *anti-static analysis* are below. The Executable Code Obfuscation behavior is specific to a malware sample's executable code (data and text sections).
 
-This and the [Executable Code Compression](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md) behavior refine the ATT&CK [**Software Packing**](https://attack.mitre.org/techniques/T1045) technique.
-
-For obfuscation behaviors related to non-malware-sample files and information, see ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/), under the [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion) objective.
+For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see [**Obfuscated Files or Information**](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md).
 
 Methods
 -------
@@ -23,16 +21,6 @@ Methods
    * *Thunk Code Insertion*: Variation on Jump Insertion. Used by some compilers for user-generated functions.
    * *Junk Code Insertion*: Insert dummy code between relevant opcodes. Can make signature writing more complex.
 * **Data Value Obfuscation**: Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*.  [NEEDS REVIEW]
-* **Encoding**:
-   * *Standard Encoding*: A standard algorithm, such as base64 encoding, is used to encode the malware sample.
-   * *Custom Encoding*: A custom algorithm is used to encode the malware sample.
-* **Encryption**: 
-   * *Standard Encryption*: A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
-   * *Standard Encryption of Code*: A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data. 
-   * *Standard Encryption of Data*: A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code. 
-   * *Custom Encryption*: A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
-   * *Custom Encryption of Code*: A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.
-   * *Custom Encryption of Data*: A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.
 * **Entry Point Obfuscation**: Obfuscate the entry point of the malware executable.
 * **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution.
 * **Import Address Table Obfuscation**: Obfuscate the import address table.

anti-static-analysis/software-packing.md

@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
-|**ID**|**M0036**|
+|**ID**|**E1045**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Software Packing](https://attack.mitre.org/techniques/T1045/)|
 
-Executable Code Compression
-===========================
-Executable Code Compression can make static and behavioral analysis difficult [[1]](#1). Methods related to anti-analysis are below. 
+Software Packing
+================
+This code characteristic - Executable Code Compression - can make static and behavioral analysis difficult and includes malware packed with a software protectors, such as Themida and Armadillo [[1]](#1). Methods related to anti-analysis are below. 
 
-This and the [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md) behavior refine the ATT&CK [**Software Packing**](https://attack.mitre.org/techniques/T1045/) technique.
+This description refines the ATT&CK [**Software Packing**](https://attack.mitre.org/techniques/T1045/) technique.
 
 Methods
 -------

defense-evasion/README.md

@@ -18,8 +18,6 @@ Behaviors that evade detection or avoid other defenses.
 * **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md)
 * **Disabling Security Tools** [E1089](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)
 * **DLL Search Order Hijacking** [T1038](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/dll-search-order-hijack.md)
-* **Executable Code Compression** [M0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md)
-* **Executable Code Obfuscation** [M0032](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md)
 * **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
 * **Exploitation for Defense Evasion** [T1211](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/exploit-for-defense.md)
 * **File Deletion** [E1107](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/file-deletion.md)
@@ -48,6 +46,7 @@ Behaviors that evade detection or avoid other defenses.
 * **Rundll32** [T1085](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rundll32.md)
 * **Rootkit Behavior** [E1014](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rootkit-behavior.md)
 * **Scripting** [T1064](https://github.com/MBCProject/mbc-markdown/blob/master/execution/scripting.md)
+* **Software Packing** [M0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
 * **Timestomp** [T1099](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/timestomp.md)
 * **Virtualization/Sandbox Evasion** [T1497](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/virtualization-sandbox-evade.md)
 * **Web Service** [T1102](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/web-service.md)

defense-evasion/obfuscate-files.md

@@ -7,10 +7,26 @@
 
 Obfuscated Files or Information
 ===============================
-Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. A related MBC behavior, associated explicitly with executable code and its analysis, is [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis/exe-code-obfuscate.md).
+Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself be encoded or encrypted (i.e., encoding/encryption is a code characteristic).
+
+A related MBC behavior, associated explicitly with executable code and its analysis, is [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis/exe-code-obfuscate.md).
 
 See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
 
+Methods
+-------
+* **Encoding**:
+   * *Standard Encoding*: A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.
+   * *Custom Encoding*: A custom algorithm is used to encode the malware sample, a file, or other information.
+* **Encryption**: 
+   * *Standard Encryption*: A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
+   * *Standard Encryption of Code*: A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data. 
+   * *Standard Encryption of Data*: A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code. 
+   * *Custom Encryption*: A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
+   * *Custom Encryption of Code*: A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.
+   * *Custom Encryption of Data*: A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.
+
+
 Malware Examples
 ----------------
 |Name|Date|Description|