Normalizing tables, dividers, style layout, minor content typos

2026-06-08 11:36:36 +00:00 · 2020-08-20 16:05:08 -04:00
parent ed2a32e60b
commit 3e5d257030
149 changed files with 747 additions and 798 deletions
@@ -23,21 +23,21 @@ Some malware behaviors are low-level, support many objectives and other behavior
 As shown below, the letter of an identifier relays information about a behavior. 

 |**Letter**|**Example**|**Description**|
-|----------------|----------------------|-------------|
-| **B** | *B0040* | An MBC behavior. |
-| **C** | *C0015* | An MBC micro-behavior.|
-| **T** | *T1234* | An ATT&CK technique.|
-| **E** | *E1234* | An ATT&CK technique that has been enhanced with malware-specific details. The numerical portion of the identifier will match the ATT&CK ID (e.g., E1234 enhances T1234).|
-| **F** | *F0004* | An ATT&CK sub-technique that has been enhanced with malware-specific details.| 
+|---|---|---|
+|**B**|*B0040*|An MBC behavior.|
+|**C**|*C0015*|An MBC micro-behavior.|
+|**T**|*T1234*|An ATT&CK technique.|
+|**E**|*E1234*|An ATT&CK technique that has been enhanced with malware-specific details. The numerical portion of the identifier will match the ATT&CK ID (e.g., E1234 enhances T1234).|
+|**F**|*F0004*|An ATT&CK sub-technique that has been enhanced with malware-specific details.|

 Two letters of an identifier relay information about an objective.

 |**Letter**|**Example**|**Description**|
-|----------------|----------------------|-------------|
-| **OB** | *OB0001* | An MBC objective.|
-| **OC** | *OC0003* | An MBC micro-objective.|
-| **TA**| *TA0005*| An ATT&CK tactic.|
-| **TE** | *TE0006* | An ATT&CK tactic that has been made malware-focused. The numerical portion of the identifier will match the ATT&CK ID (e.g., TE0007 enhances TA0007).|
+|---|---|---|
+|**OB**|*OB0001*|An MBC objective.|
+|**OC**|*OC0003*|An MBC micro-objective.|
+|**TA**|*TA0005*|An ATT&CK tactic.|
+|**TE**|*TE0006*|An ATT&CK tactic that has been made malware-focused. The numerical portion of the identifier will match the ATT&CK ID (e.g., TE0007 enhances TA0007).|

 Identifiers of methods are formatted in the same say as ATT&CK sub-techniques. If MBC defines a new method for an existing ATT&CK technique, the identifier is changed from "T" to "E" and an "m" identifier is added (e.g., a method added to T1234 would be denoted *E1234.m01* and is different than *T1234.001*, although both refer to the T1234 ATT&CK technique). Method identifiers of "B", "C", and "F" behaviors are defined without the "m" (e.g., *B0008.009*; *C0005.002*; *F0001.005*).

@@ -58,18 +58,17 @@ The MBC also contains a collection of [example malware](https://github.com/MBCPr
 Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors.

 |**Objective**|**Description**|
-|------------------------------------------------------------------|----------------------------|
-|[**Anti-Behavioral Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/README.md) |Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
-|[**Anti-Static Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/README.md)| Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
-|[**Collection**](https://github.com/MBCProject/mbc-markdown/blob/master/collection/README.md) | Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
-|[**Command and Control**](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/README.md) |Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
+|---|---|
+|[**Anti-Behavioral Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
+|[**Anti-Static Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
+|[**Collection**](https://github.com/MBCProject/mbc-markdown/blob/master/collection/README.md)|Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
+|[**Command and Control**](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/README.md)|Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
 |[**Credential Access**](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
 |[**Defense Evasion**](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
 |[**Discovery**](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
-|[**Execution**](https://github.com/MBCProject/mbc-markdown/blob/master/execution/README.md)| Malware aims to execute its code on a system to achieve a variety of goals.|
-|[**Exfiltration**](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/README.md)|  Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
-|[**Impact**](https://github.com/MBCProject/mbc-markdown/blob/master/impact/README.md)| Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
+|[**Execution**](https://github.com/MBCProject/mbc-markdown/blob/master/execution/README.md)|Malware aims to execute its code on a system to achieve a variety of goals.|
+|[**Exfiltration**](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/README.md)|Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
+|[**Impact**](https://github.com/MBCProject/mbc-markdown/blob/master/impact/README.md)|Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
 |[**Lateral Movement**](https://github.com/MBCProject/mbc-markdown/blob/master/lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
 |[**Persistence**](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/README.md)|Malware aims to remain on a system regardless of system events.|
 |[**Privilege Escalation**](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
-
@@ -1,7 +1,8 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0001**|

+
 # Anti-Behavioral Analysis
 Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger). 

@@ -26,5 +27,3 @@ References
 <a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project

 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
-
- 
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0001**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|
@@ -14,7 +14,7 @@ Details on methods of detecting debuggers are given in the references; many are
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0001.001|**API Hook Detection**|Module bounds based [[7]](#7).|
 |B0001.034|**Anti-debugging Instructions**|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).|
 |B0001.002|**CheckRemoteDebuggerPresent**|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).|
@@ -30,9 +30,9 @@ Methods
 |B0001.012|**NtQueryInformationProcess**|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).|
 |B0001.013|**NtQueryObject**|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.|
 |B0001.014|**NtSetInformationThread**|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)|
-|B0001.015|**NtYieldExecution/SwitchToThread**| [[7]](#7)|
+|B0001.015|**NtYieldExecution/SwitchToThread**|[[7]](#7)|
 |B0001.016|**OutputDebugString**|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.|
-|B0001.017|**Page Exception Breakpoint Detection**| [[7]](#7).|
+|B0001.017|**Page Exception Breakpoint Detection**|[[7]](#7)|
 |B0001.018|**Parent Process**|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)|
 |B0001.019|**Process Environment Block**|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method).|
 |B0001.035|**Process Environment Block BeingDebugged**|The BeingDebugged field is tested to determine whether the process is being debugged.|
@@ -55,9 +55,9 @@ Methods

 Malware Examples
 ----------------
-|Name|Date|ID|Description|
-|-----------------------------|--------|--------|-----------------------------|
-|[**Redhip**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/redhip.md)|January 2011|M0001.034, M0001.019|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
+|Name|Date|Description|
+|---|---|---|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/redhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|

 References
 ----------
@@ -74,4 +74,3 @@ References
 <a name="6">[6]</a> Nicolas Falliere, Symantec, "Windows Anti-Debug Reference," 11 September 2007. https://www.symantec.com/connect/articles/windows-anti-debug-reference.

 <a name="7">[7]</a> Anti Debugging Tricks, Al-Khaser. https://github.com/LordNoteworthy/al-khaser/wiki/Anti-Debugging-Tricks
- 
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0004**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|
@@ -12,7 +12,7 @@ Detects whether the malware instance is being executed inside an emulator. If so
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0004.001|**Check for Emulator-related Files**|Checks whether particular files (e.g., QEMU files) exist.|
 |B0004.002|**Check for WINE Version**|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
 |B0004.003|**Check Emulator-related Registry Keys**|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)|
@@ -21,5 +21,3 @@ Methods
 References
 ----------
 <a name="1">[1]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion
- 
- 
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0007**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Sub-techniques**|[Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/), [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/)|
@@ -14,7 +14,7 @@ The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&C
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0007.001|**Check Clipboard Data**|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
 |B0007.002|**Check Files**|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
 |B0007.003|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
@@ -28,10 +28,10 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
 |[**Rombertik**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/rombertik.md)|May 2015|[[2]](#2)|
-|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4) |
+|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
 |[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|

 References
@@ -42,4 +42,4 @@ References

 <a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser

-<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf 
+<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0009**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
@@ -14,7 +14,7 @@ The Virtual Machine Detection behavior relates to anti-analysis, whereas a relat
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0009.001|**Check File and Directory Artifacts**|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)|
 |B0009.002|**Check Memory Artifacts**|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)|
 |B0009.003|**Check Named System Objects**|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.|
@@ -24,73 +24,52 @@ Methods
 |B0009.007|**Check Software**|Malware may check software version; for example, to determine whether the software is relatively current.|
 |B0009.008|**Check Virtual Devices**|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)|
 |B0009.009|**Check Windows**|Malware may check windows for VM-related characteristics.|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |B0009.020|*Window size*| Tiny window size may indicate a VM.|
-| |B0009.021|*Unique windows*|May check for the presence of known windows from analysis tools running in a VM.|
-| |B0009.022|*Title bars*|May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
-
-| | | |
-|-----------------------------|--------|-----------------------------|
 |B0009.010|**Guest Process Testing**|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
 |B0009.011|**HTML5 Performance Object Check**|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
 |B0009.012|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
 |B0009.013|**Modern Specs Check**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |B0009.014|*Total physical memory*|Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
-| |B0009.015|*Drive size*|Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
-| |B0009.016|*USB drive*|Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
-| |B0009.017|*Printer*|Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
-| |B0009.018|*Processor count*|Checks number of processors; single CPU machines are suspect.|
-| |B0009.019|*Keyboard layout*|Check keyboard layout.|
-
-| | | |
-|-----------------------------|--------|-----------------------------|
+|B0009.014|**Total physical memory**|Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
+|B0009.015|**Drive size**|Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
+|B0009.016|**USB drive**|Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
+|B0009.017|**Printer**|Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
+|B0009.018|**Processor count**|Checks number of processors; single CPU machines are suspect.|
+|B0009.019|**Keyboard layout**|Check keyboard layout.|
+|B0009.020|**Window size**|Tiny window size may indicate a VM.|
+|B0009.021|**Unique windows**|May check for the presence of known windows from analysis tools running in a VM.|
+|B0009.022|**Title bars**|May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
 |B0009.023|**Unique Hardware/Firmware Check**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Items checked include:|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |B0009.024|*BIOS*|Characteristics of the BIOS, such as version, can indicate virtualization.|
-| |B0009.025|*I/O Communication Port*|VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
-| |B0009.026|*CPU Name*|Checks the CPU name to determine virtualization.|
-| |B0009.027|*CPU Location*|When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
-| |B0009.028|*MAC Address*|VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
-
-| | | |
-|-----------------------------|--------|-----------------------------|
+|B0009.024|**BIOS**|Characteristics of the BIOS, such as version, can indicate virtualization.|
+|B0009.025|**I/O Communication Port**|VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
+|B0009.026|**CPU Name**|Checks the CPU name to determine virtualization.|
+|B0009.027|**CPU Location**|When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
+|B0009.028|**MAC Address**|VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
 |B0009.029|**Instruction Testing**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |B0009.030|*SIDT (red pill)*|Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
-| |B0009.031|*SGDT/SLDT (no pill)*|The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.
-| |B0009.032|*SMSW*| |
-| |B0009.033|*STR*| |
-| |B0009.034|*CPUID*|Checking the CPU ID found within the registry can provide information to system type.|
-| |B0009.035|*IN*| |
-| |B0009.036|*RDTSC*| |
-| |B0009.037|*VMCPUID*| |
-| |B0009.038|*VPCEXT*| |
+|B0009.030|**SIDT (red pill)**|Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
+|B0009.031|**SGDT/SLDT (no pill)**|The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.|
+|B0009.032|**SMSW**||
+|B0009.033|**STR**||
+|B0009.034|**CPUID**|Checking the CPU ID found within the registry can provide information to system type.|
+|B0009.035|**IN**||
+|B0009.036|**RDTSC**||
+|B0009.037|**VMCPUID**||
+|B0009.038|**VPCEXT**||

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**GravityRAT**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
 |[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|

 References
 ----------
-<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 
+<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

 <a name="2">[2]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion

 <a name="3">[3]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
- 
+
 <a name="4">[4]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="5">[5]</a> https://github.com/LordNoteworthy/al-khaser
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0036**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

+
 Capture Evasion
 ===============
 Malware has characteristics enabling it to evade capture from the infected system.
@@ -11,10 +12,7 @@ Malware has characteristics enabling it to evade capture from the infected syste
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0036.001|**Memory-only Payload**|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).|
 |B0036.002|**Encrypted Payloads**|Decryption key is stored external to the executable or never touches the disk.|
-|B0036.003|**Multiple Stages of Loaders**: Multiple stages of loaders are used with an encoded payload.|
-
- 
- 
+|B0036.003|**Multiple Stages of Loaders**|Multiple stages of loaders are used with an encoded payload.|
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0002**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|
@@ -14,17 +14,17 @@ A thorough reference for anti-debugging, both detection and evasion, is given in
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0002.001|**Block Interrupts**|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.|
 |B0002.002|**Break Point Clearing**|Intentionally clearing software or hardware breakpoints.|
 |B0002.003|**Byte Stealing**|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.|
-|B0002.004|**Change SizeOfImage**|Changinging this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.|
+|B0002.004|**Change SizeOfImage**|Changing this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.|
 |B0002.005|**Code Integrity Check**|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.|
 |B0002.006|**Exception Misdirection**|Using exception handling (SEH) to cause flow of program to non-obvious paths.|
 |B0002.007|**Get Base Indirectly**|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.|
 |B0002.008|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
 |B0002.009|**Hook Interrupt**|Modification of interrupt vector or descriptor tables.|
-|B0002.010|**Import Obfuscation**: Add obfuscation between imports calls and APIs.|
+|B0002.010|**Import Obfuscation**|Add obfuscation between imports calls and APIs.|
 |B0002.011|**Inlining**|Variation of static linking where full API code inserted everywhere it would have been called.|
 |B0002.012|**Loop Escapes**|Use SEH or other methods to break out of a loop instead of a conditional jump.|
 |B0002.013|**Malloc Use**|Instead of unpacking into a pre-defined section/segment (ex: .text) of the binary, use malloc() / VirtualAlloc() to create a new segment. This makes keeping track of memory locations across different runs more difficult, as there is no guarantee that malloc/VirtualAlloc will assign the same address range each time.|
@@ -49,7 +49,7 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)|
 |**Dridex**|March 2015|[[3]](#3)|
 |[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
@@ -65,5 +65,5 @@ References
 <a name="4">[4]</a> http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/

 <a name="5">[5]</a> http://unprotect.tdgt.org/index.php/Unprotect_Project
- 
-<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 
+
+<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0003**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|

+
 Dynamic Analysis Evasion
 ========================
 Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine. 
@@ -13,10 +14,10 @@ See [Emulator Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/an
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0003.001|**Alternative ntdll.dll**|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.|
 |B0003.002|**Data Flood**|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)|
-|B0003.003|**Delayed Execution**|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.| 
+|B0003.003|**Delayed Execution**|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.|
 |B0003.004|**Demo Mode**|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.|
 |B0003.005|**Drop Code**|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).|
 |B0003.006|**Encode File**|Encode a file on disk, such as an implant's config file.|
@@ -29,7 +30,7 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
 |[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|October 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
 |**Nap**|2013|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0005**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

+
 Emulator Evasion
 ================
 Behaviors that obstruct analysis in an emulator.
@@ -11,7 +12,7 @@ Behaviors that obstruct analysis in an emulator.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0005.001|**Different Opcode Sets**|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.|
 |B0005.002|**Undocumented Opcodes**|Use rare or undocumented opcodes to block non-exhaustive emulators.|
 |B0005.003|**Unusual/Undocumented API Calls**|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).|
@@ -20,5 +21,5 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
+|---|---|---|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0006**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

+
 Memory Dump Evasion
 ===================
 Malware hinders retrieval and/or discovery of the contents of the physical memory of the system on which the malware instance is executing [[1]](#1).
@@ -11,7 +12,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0006.001|**Code Encryption in Memory**|Encrypt the executing malware instance code in memory.|
 |B0006.002|**Erase the PE header**|Erase PE header from memory.|
 |B0006.003|**Hide virtual memory**|Hide arbitrary segments of virtual memory.|
@@ -20,13 +21,13 @@ Methods
 |B0006.006|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
 |B0006.007|**On-the-Fly APIs**|Resolve API addresses before each use to prevent complete dumping.|
 |B0006.008|**Feed Misinformation**|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md).|
-|B0006.009|**Flow Opcode Obstruction**|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).
+|B0006.009|**Flow Opcode Obstruction**|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[Kraken](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md)| April 2008| Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
+|---|---|---|
+|[Kraken](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md)|April 2008|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|

 References
 ----------
@@ -37,5 +38,3 @@ References
 <a name="3">[3]</a> http://waleedassar.blogspot.com/search/label/anti-dump

 <a name="4">[4]</a> https://www.gironsec.com/code/packers.pdf
- 
- 
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1480**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|

+
 Execution Guardrails
 ====================
 Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
@@ -13,13 +14,10 @@ Malware may use execution guardrails (environmental conditions) to constrain exe
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1480.m01|**Deposited Keys**|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
 |E1480.m02|**Environmental Keys**|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
 |E1480.m03|**GetVolumeInformation**|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
-|E1480.m04|**Host Fingerprint Check**| Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
+|E1480.m04|**Host Fingerprint Check**|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
 |E1480.m05|**Secure Triggers**|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
 |E1480.m06|**Token Check**|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
-
-
-
@@ -1,7 +1,8 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0002**|

+
 # Anti-Static Analysis
 Behaviors and code characteristics that prevent static analysis or make it more difficult. Simple static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.

@@ -15,9 +16,8 @@ Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]]
 * **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
 * **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)

-
 References
 ----------
 <a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project

-<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
+<a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0010**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
+|**Objective(s)**|[Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -12,7 +12,7 @@ Malware code evades accurate call graph generation during disassembly. Call grap
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0010.001|**Two-layer Function Return**|Two layer jumping confuses tools plotting call graphs. [[3]](#3)|
 |B0010.002|**Invoke NTDLL System Calls via Encoded Table**|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)|

@@ -24,4 +24,4 @@ References

 <a name="3">[3]</a> http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html

-<a name="4">[4]</a> S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. http://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf
+<a name="4">[4]</a> S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. http://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0012**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
+|**Objective(s)**|[Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -12,7 +12,7 @@ Malware code evades disassembly in a recursive or linear disassembler. Some meth
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0012.001|**Argument Obfuscation**|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
 |B0012.002|**Conditional Misdirection**|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
 |B0012.003|**Value Dependent Jumps**|Explicit use of computed values for control flow, often many times in the same basic block or function.|
@@ -27,4 +27,4 @@ References

 <a name="3">[3]</a> https://isc.sans.edu/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870

-<a name="4">[4]</a> https://boingboing.net/2019/05/05/p-code-r-us.html 
+<a name="4">[4]</a> https://boingboing.net/2019/05/05/p-code-r-us.html
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0032**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
+|**Objective(s)**|[Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -14,14 +14,14 @@ For encryption and encoding characteristics of malware samples, as well as malwa
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|B0032.001|**API Hashing**|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)| 
-|M0032.002 |**Code Insertion**|Insert code to impede disassembly.|
-|B0032.003|*Dead Code Insertion*|Include "dead" code with no real functionality.|
-|B0032.004|*Fake Code Insertion*|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.|
-|B0032.005|*Jump Insertion*|Insert jumps to make analysis visually harder.|
-|B0032.006|*Thunk Code Insertion*|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
-|B0032.007|*Junk Code Insertion*|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
+|---|---|---|
+|B0032.001|**API Hashing**|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)|
+|B0032.002|**Code Insertion**|Insert code to impede disassembly.|
+|B0032.003|**Dead Code Insertion**|Include "dead" code with no real functionality.|
+|B0032.004|**Fake Code Insertion**|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.|
+|B0032.005|**Jump Insertion**|Insert jumps to make analysis visually harder.|
+|B0032.006|**Thunk Code Insertion**|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
+|B0032.007|**Junk Code Insertion**|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
 |B0032.008|**Data Value Obfuscation**|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*.  [NEEDS REVIEW]|
 |B0032.009|**Entry Point Obfuscation**|Obfuscate the entry point of the malware executable.|
 |B0032.010|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
@@ -37,15 +37,15 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Heriplor**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
 |[**Emotet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|

 References
 ----------
-<a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html 
+<a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html

-<a name="2">[2]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ 
+<a name="2">[2]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/

-<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons 
+<a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0034**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
+|**Objective(s)**|[Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -12,11 +12,10 @@ Code is optimized, making it harder to statically analyze.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0034.001|**Jump/Call Absolute Address**|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.|
 |B0034.002|**Minification**|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.|

-
 References
 ----------
-<a name="1">[1]</a> https://en.wikipedia.org/wiki/Minification_(programming)
+<a name="1">[1]</a> https://en.wikipedia.org/wiki/Minification_(programming)
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0008**|
-|**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -14,13 +14,13 @@ Virtualized code is a software protection technique. Themida is a commercial too
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0008.001|**Multiple VMs**|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Locky Bart**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|

 References
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**F0001**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Obfuscated Files or Information: Software Packing](https://attack.mitre.org/techniques/T1027/002)|
@@ -13,7 +13,7 @@ This description refines the ATT&CK [**Obfuscated Files or Information: Software
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |F0001.001|**Nested Packing**|The malware is packed by one packer, the result is packed, etc.|
 |F0001.002|**Standard Compression**|Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.|
 |F0001.003|**Standard Compression of Code**|Uses a standard algorithm to compress the opcode mnemonics.|
@@ -30,7 +30,7 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|

 References
@@ -38,5 +38,5 @@ References
 <a name="1">[1]</a> Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf

 <a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.
- 
+
 <a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
@@ -1,7 +1,8 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0003**|

+
 # Collection #
 Behaviors that identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.

@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0028**|
 |**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique**|None|

+
 Cryptocurrency
 ==============
 Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets.
@@ -11,7 +12,7 @@ Malware accesses files that contain sensitive data or credentials related to Bit
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0028.001|**Bitcoin**|Access Bitcoin data.|
 |B0028.002|**Ethereum**|Access Ethereum data.|
-|B0028.003|**Zcash**|Access Zcash data.|
+|B0028.003|**Zcash**|Access Zcash data.|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1056**|
 |**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique**|[Input Capture](https://attack.mitre.org/techniques/T1056)|

+
 Input Capture
 =============
 Malware captures user input.
@@ -13,11 +14,11 @@ Malware captures user input.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1056.m01|**Mouse Events**|Mouse events are captured.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/poison-ivy.md)|2005|Captures input.|
+|---|---|---|
+|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/poison-ivy.md)|2005|Captures input.|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**F0002**|
 |**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Sub-Technique**|[Input Capture: Keylogging](https://attack.mitre.org/techniques/T1056/001)|

+
 Keylogging
 ==========
 Malware captures user keyboard input.
@@ -13,6 +14,6 @@ Malware captures user keyboard input.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |F0002.001|**Application Hook**|Keystrokes are captured with an application hook.|
 |F0002.002|**Polling**|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1113**|
 |**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|

+
 Screen Capture
 =============
 Malware takes screen captures of the desktop.
@@ -13,5 +14,5 @@ Malware takes screen captures of the desktop.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1113.m01|**WinAPI**|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).|
@@ -1,10 +1,11 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0004**|

+
 # Command and Control
 Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.

 * **Command and Control Communication** [B0030](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md)
 * **Domain Name Generation** [B0031](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/domain-name-generate.md)
-* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
+* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0030**|
 |**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique**|None|

+
 C2 Communication
 ================
 All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md).
@@ -13,7 +14,7 @@ Command and Control Communication relates to *autonomous* client/server communic
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0030.001|**Send Data**|Send data to a C2 server.|
 |B0030.002|**Receive Data**|Receive data from a C2 server.|
 |B0030.003|**Server to Client File Transfer**|File is transferred from server to client.|
@@ -23,4 +24,4 @@ Methods
 |B0030.007|**Send Heartbeat**|Heartbeat sent.|
 |B0030.008|**Request Command**|Client requests a command.|
 |B0030.009|**Request Email Template**|Request email template.|
-|B0030.010|**Request Email Address List**|Request email address list.|
+|B0030.010|**Request Email Address List**|Request email address list.|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0031**|
 |**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/)|

+
 Domain Name Generation
 ======================
 Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
@@ -13,9 +14,9 @@ The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Genera
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**Kraken**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md) | April 2008 | Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
-|[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)| November 2008| Conficker uses a domain name generator. [[3]](#3)
+|---|---|---|
+|[**Kraken**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md)|April 2008|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
+|[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)|November 2008|Conficker uses a domain name generator. [[3]](#3)|

 References
 ----------
@@ -23,4 +24,4 @@ References

 <a name="2">[2]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html

-<a name="3">[3]</a> https://en.wikipedia.org/wiki/Conficker
+<a name="3">[3]</a> https://en.wikipedia.org/wiki/Conficker
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1105**|
 |**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)|

+
 Remote File Copy
 ================
 Malware may copy files from one system to another. 
@@ -15,7 +16,7 @@ Note that this behavior is separate from possible execution (installation) of th
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|

@@ -1,7 +1,8 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0005**|

+
 # Credential Access
 Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.

@@ -10,6 +11,3 @@ Behaviors to obtain credential access, allowing it or its underlying threat acto
 * **Input Capture** [E1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
 * **Keylogging** [F0002](https://github.com/MBCProject/mbc-markdown/blob/master/collection/keylogging.md)
 * **Screen Capture** [E1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
-
-
-
@@ -1,5 +1,5 @@
 |||
-|------------------|------------------------|
+|---|---|
 |**ID**|**F0003**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
 |**Related ATT&CK Sub-Technique**|[Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)|
@@ -16,8 +16,8 @@ Note that in MBC, Hooking is also associated with the [Defense Evasion](https://
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|F0003.001|**Patch MmGetPhysicalMemoryRanges**| Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
+|---|---|---|
+|F0003.001|**Patch MmGetPhysicalMemoryRanges**|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
 |F0003.002|**Hook memory mapping APIs**|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
 |F0003.003|**Hook procedures**|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)|
 |F0003.004|**Import Address Hooking (IAT) Hooking**|Uses modifications to a process's IAT where pointers to imported API functions are stored.|
@@ -26,14 +26,14 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|**Kronos**|June 2014 |Kronos hooks the API of processes to prevent detection. [[2]](#2)|
+|---|---|---|
+|**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[2]](#2)|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|

 References
 ----------
 <a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf

-<a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/ 
+<a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/

-<a name="3">[3]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
+<a name="3">[3]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
@@ -1,7 +1,8 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0006**|

+
 # Defense Evasion #
 Behaviors that evade detection or avoid other defenses.

@@ -22,4 +23,4 @@ Behaviors that evade detection or avoid other defenses.
 * **Process Injection** [E1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md)
 * **Rootkit** [E1014](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rootkit-behavior.md)
 * **Self Deletion** [F0007](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/self-deletion.md)
-* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
+* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0027**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -12,16 +12,16 @@ Malware may install itself not as a file on the hard drive. [[1]](#1)
 Methods
 ------- 
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0027.001|**Fileless Malware**|Stores itself in memory.|
 |B0027.002|**Registry Install**|Stores itself in the Windows registry.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Kovter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|

 References
 ----------
-<a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
+<a name="1">[1]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**F0013**|
 |**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Sub-Technique**|[Pre-OS Boot: Bootkit](https://attack.mitre.org/techniques/T1542/003)|

+
 Bootkit
 =======
 The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: [**Pre-OS Boot: Bootkit**](https://attack.mitre.org/techniques/T1067/).
@@ -13,10 +14,9 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**Mebromi**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|

 References
 ----------
 <a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
- 
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0037**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -12,9 +12,9 @@ Malware may bypass Data Execution Prevention (DEP).
 Methods
 ------- 
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|B0037.001|**ROP Chains**| Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)
+|---|---|---|
+|B0037.001|**ROP Chains**|Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)|

 References
 ----------
-<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce 
+<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1478**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)|


@@ -9,4 +9,4 @@ Install Insecure or Malicious Configuration
 ===========================================
 Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective. 

-See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).
+See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0040**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -12,6 +12,6 @@ Malware may hide data or binary files within other files, the registry, etc.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0040.001|**Hide Data in Registry**|Malware may use a registry key to store a long sequence of bytes.|
-|B0040.002|**Steganography**|Malware may store information in an image.|
+|B0040.002|**Steganography**|Malware may store information in an image.|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**F0004**|
 |**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|

+
 Disable Security Tools
 ========================
 Malware may disable security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities.
@@ -15,7 +16,7 @@ See ATT&CK: [**Impair Defenses: Disable or Modify Tools**](https://attack.mitre.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |F0004.001|**Disable Kernel Patch Protection**|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
 |F0004.002|**Disable System File Overwrite Protection**|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
 |F0004.003|**Unhook APIs**|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
@@ -25,8 +26,8 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
+|---|---|---|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|

@@ -34,4 +35,4 @@ References
 ----------
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

-<a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html 
+<a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**F0005**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Sub-Technique**|[Hide Artifacts: Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001/)|


@@ -14,6 +14,6 @@ See ATT&CK: [**Hide Artifacts: Hidden Files and Directories**](https://attack.mi
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |F0005.001|**File Extension Change**|Malware may change the file extension of a file.|
-|F0005.002|**Change File Location**|Malware may change the location of itself or another file to prevent detection.|
+|F0005.002|**Change File Location**|Malware may change the location of itself or another file to prevent detection.|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**F0006**|
 |**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Impair Defenses: Indicator Blocking](https://attack.mitre.org/techniques/T1562/006/)|

+
 Indicator Blocking
 ==================
 Malware blocks indicators or events that would indicate malicious activity. Methods relevant to the malware domain are below. 
@@ -13,5 +14,5 @@ See ATT&CK: [**Impair Defenses: Indicator Blocking**](https://attack.mitre.org/t
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |F0006.001|**Remove SMS Warning Messages**|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.|
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1112**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|


@@ -14,7 +14,7 @@ See ATT&CK: [**Modify Registry**](https://attack.mitre.org/techniques/T1112).
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|

@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1027**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)|


@@ -16,32 +16,22 @@ See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techn
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1027.m01|**Encoding**|The malware sample, file, or other information is encoded.|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |E1027.m02|*Standard Encoding*|A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
-| |E1027.m03|*Custom Encoding*|A custom algorithm is used to encode the malware sample, a file, or other information.|
-
-| | | |
-|-----------------------------|--------|-----------------------------|
+|E1027.m02|**Standard Encoding**|A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
+|E1027.m03|**Custom Encoding**|A custom algorithm is used to encode the malware sample, a file, or other information.|
 |E1027.m04|**Encryption**|The malware sample, file, or other information is encrypted.|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |E1027.m05|*Standard Encryption*|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
-| |E1027.m06|*Standard Encryption of Code*|A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-| |E1027.m07|*Standard Encryption of Data*|A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
-| |E1027.m08|*Custom Encryption*|A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
-| |E1027.m09|*Custom Encryption of Code*|A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-| |E1027.m10|*Custom Encryption of Data*|A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
-
+|E1027.m05|**Standard Encryption**|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
+|E1027.m06|**Standard Encryption of Code**|A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
+|E1027.m07|**Standard Encryption of Data**|A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
+|E1027.m08|**Custom Encryption**|A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
+|E1027.m09|**Custom Encryption of Code**|A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
+|E1027.m10|**Custom Encryption of Data**|A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|Obfuscates files.|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Obfuscates files.|
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0029**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -12,11 +12,11 @@ Polymorphic code, a file with the same functionality but different execution, is
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0029.001|**Packer Stub**|A packer stub can generate polymorphic code.|
-|B0029.002|**Call Indirections**|[[1]](#1).
-|B0029.003|**Code Reordering**|[[1]](#1).
+|B0029.002|**Call Indirections**|[[1]](#1)|
+|B0029.003|**Code Reordering**|[[1]](#1)|

 References
 ----------
-<a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
+<a name="1">[1]</a> https://www.mccormick.northwestern.edu/eecs/documents/tech-reports/2010-2014/evaluating-android-anti-malware-against-transformation-attacks.pdf
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1055**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
 |**Related ATT&CK Technique**|[Process Injection](https://attack.mitre.org/techniques/T1055)|


@@ -12,7 +12,7 @@ Malware may execute code in the address space of a separate process.
 See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on sub-techniques in the context of [[1]](#1) are in as follows:

 |ID|ATT&CK Sub-Technique|Notes|
-|---------------|--------|---------------------------|
+|---|---|---|
 |T1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
 |T1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
 |T1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
@@ -25,16 +25,15 @@ Methods not captured by ATT&CK Process Injection sub-techniques are listed below
 Methods
 ------- 
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1055.m01|**Hook Injection via SetWindowsHooksEx**|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)|
 |E1055.m02|**Injection and Persistence via Registry Modification**|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
 |E1055.m03|**Injection using Shims**|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)|

-
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**UP007**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
@@ -42,10 +41,10 @@ Malware Examples

 References
 ----------
-<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process 
+<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process

 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

-<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser 
+<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser

-<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+<a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1014**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|[Rootkit](https://attack.mitre.org/techniques/T1014)|


@@ -14,7 +14,7 @@ See ATT&CK: [**Rootkit**](https://attack.mitre.org/techniques/T1014).
 Methods
 ------- 
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1014.m01|**Hide Kernel Modules**|Hides the usage of any kernel modules by the malware instance.|
 |E1014.m02|**Hide Services**|Hides any system services that the malware instance creates or injects itself into.|
 |E1014.m04|**Hide Threads**|Hides one or more threads that belong to the malware instance.|
@@ -30,7 +30,7 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|

 References
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**F0007**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)|


@@ -14,6 +14,5 @@ See ATT&CK: [**Indicator Removal on Host: File Deletion**](https://attack.mitre.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |F0007.001|**COMSPEC Environment Variable**|Uninstalls self via COMSPEC environment variable.|
-
@@ -1,11 +1,12 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0007**|

+
 # Discovery #
 Behaviors that aim to gain knowledge about the system and internal network.

 * **Analysis Tool Discovery** [B0013](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/analysis-tool-discover.md)
 * **Self Discovery** [B0038](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/self-discover.md)
 * **SMTP Connection Discovery** [B0014](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/smtp-connect-discover.md)
-* **System Information Discovery** [E1082](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-info-discover.md)
+* **System Information Discovery** [E1082](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-info-discover.md)
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0013**|
 |**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique**|None|
@@ -14,19 +14,13 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0013.001|**Process detection**|Malware can scan for the process name associated with common analysis tools.|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------| 
-| |B0013.002|*Debuggers*|OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
-| |B0013.003|*SysInternals Suite Tools*|Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|
-| |B0013.004|*PCAP Utilities*|Wireshark / Dumpcap|
-| |B0013.005|*Process Utilities*|ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
-| |B0013.006|*PE Utilities*|ImportREC / PETools / LordPE|
-| |B0013.007|*Sandboxes*|Joe Sandbox, etc.|
-
-|  |    |           |
-|-----------------------------|--------|-----------------------------|
+|B0013.002|**Debuggers**|OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
+|B0013.003|**SysInternals Suite Tools**|Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|
+|B0013.004|**PCAP Utilities**|Wireshark / Dumpcap|
+|B0013.005|**Process Utilities**|ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
+|B0013.006|**PE Utilities**|ImportREC / PETools / LordPE|
+|B0013.007|**Sandboxes**|Joe Sandbox, etc.|
 |B0013.008|**Known File Location**|Malware may detect an analysis tool by the presence of a file in a known location.|
-|B0013.009|**Known Window**|Malware may detect an analysis tool via the presence of a known window.|
+|B0013.009|**Known Window**|Malware may detect an analysis tool via the presence of a known window.|
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0038**|
 |**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique**|None|
@@ -8,4 +8,3 @@
 Self Discovery
 ==============
 Malware may gather information about itself, such as its filename or size on disk. 
-
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0014**|
 |**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique**|None|
@@ -8,4 +8,3 @@
 SMTP Connection Discovery
 =========================
 Malware may test whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction. 
-
@@ -1,8 +1,9 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1082**|
-|**Objective(s)**| [Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
-|**Related ATT&CK Technique**|[System Information Discovery](https://attack.mitre.org/techniques/T1082)
+|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
+|**Related ATT&CK Technique**|[System Information Discovery](https://attack.mitre.org/techniques/T1082)|
+

 System Information Discovery
 ============================
@@ -13,12 +14,12 @@ See ATT&CK: [**System Information Discovery**](https://attack.mitre.org/techniqu
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1082.m01|**Generate Windows Exception**|Malware may trigger an exception as a way of gathering system details.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Learns about the system so it can drop compatible miner software.|
@@ -1,5 +1,5 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0009**|

 # Execution #
@@ -13,4 +13,4 @@ Behaviors that execute code on a system to achieve a variety of goals.
 * **Remote Commands** [B0011](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md)
 * **Send Email** [B0020](https://github.com/MBCProject/mbc-markdown/blob/master/execution/send-email.md)
 * **Send Poisoned Text Message** [B0021](https://github.com/MBCProject/mbc-markdown/blob/master/execution/send-poison-text-msg.md)
-* **User Execution** [E1204](https://github.com/MBCProject/mbc-markdown/blob/master/execution/user-interaction.md)
+* **User Execution** [E1204](https://github.com/MBCProject/mbc-markdown/blob/master/execution/user-interaction.md)
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1059**|
 |**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|[Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)|

+
 Command and Scripting Interpreter
 =================================
 Malware may abuse command and script interpreters to execute commands, scripts, or binaries.
@@ -13,7 +14,7 @@ Malware may abuse command and script interpreters to execute commands, scripts,
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|

@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0025**|
 |**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|

+
 Conditional Execution
 =====================
 Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution happens autonomously, not because of an attacker's command.
@@ -11,13 +12,13 @@ Malware checks system environment conditions or characteristics to determine exe
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0025.001|**Suicide Exit**|Malware terminates its execution based on a trigger condition or value (or because it has completed).|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
 |[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)|2008|A routine causes the process to suicide exit if the keyboard language is set to Ukranian.|

@@ -1,8 +1,9 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1203**|
 |**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
-|**Related ATT&CK Technique**| [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|
+|**Related ATT&CK Technique**|[Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|
+

 Exploitation for Client Execution
 =================================
@@ -13,18 +14,18 @@ Software is exploited - either because of a vulnerability or through its designe
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|E1203.m01|**Remote Desktop Protocols (RDP)**| RDP is used by malware.|
-|E1203.m02|**Java-based Web Servers**| |
+|---|---|---|
+|E1203.m01|**Remote Desktop Protocols (RDP)**|RDP is used by malware.|
+|E1203.m02|**Java-based Web Servers**||
 |E1203.m03|**File Transfer Protocol (FTP) Servers**|Malware leverages an FTP server.|
-|E1203.m04|**Red Hat JBoss Enterprise Products**| |
-|E1203.m05|**Sysinternals**| Sysinternals tools are used for additional command line functionality.|
+|E1203.m04|**Red Hat JBoss Enterprise Products**||
+|E1203.m05|**Sysinternals**|Sysinternals tools are used for additional command line functionality.|
 |E1203.m06|**Windows Utilities**|One or more Windows utilities are used.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**SamSam**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|

 References
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0023**|
-|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|


@@ -14,10 +14,10 @@ Malware that installs another component is called a "dropper." If the code is co
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)|
 |[**Geneio**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/geneio.md)|August 2015|Tricks OS X keychain to create application files.|
-|[**GotBotKR**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gotbotkr.md)|July 2019 |GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
+|[**GotBotKR**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gotbotkr.md)|July 2019|GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
 |[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md)|2016|Installs a backdoor.|
 |[**Mebromi**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mebromi.md)|2011|A Trojan downloader.|
 |[**YiSpecter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.|
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0024**|
 |**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|

+
 Prevent Concurrent Execution
 ============================
 To avoid running multiple instances of itself, malware may check a system to see if it is already running.
@@ -11,9 +12,9 @@ To avoid running multiple instances of itself, malware may check a system to see
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Bagle**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/bagle.md)|2004|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)|

 References
 ----------
-<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_bagle.u
+<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/worm_bagle.u
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0011**|
-|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|


@@ -20,12 +20,11 @@ Autonomous behaviors - those done by the malware without an active attacker - sh
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|B0011.001|**Delete File**| |
-|B0011.002|**Download File**| |
-|B0011.003|**Execute**| |
-|B0011.004|**Shutdown**| |
-|B0011.005|**Sleep**| |
-|B0011.006|**Uninstall**| |
-|B0011.007|**Upload File**| |
-
+|---|---|---|
+|B0011.001|**Delete File**||
+|B0011.002|**Download File**||
+|B0011.003|**Execute**||
+|B0011.004|**Shutdown**||
+|B0011.005|**Sleep**||
+|B0011.006|**Uninstall**||
+|B0011.007|**Upload File**||
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0020**|
 |**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
 |**Related ATT&CK Technique**|[Phishing](https://attack.mitre.org/techniques/T1566/)|

+
 Send Email
 ==========
 Sends an email message from the system on which the malware is executing to one or more recipients, mostly commonly for the purpose of spamming or for distributing a malicious attachment or URL (malspamming).
@@ -13,7 +14,7 @@ Sends an email message from the system on which the malware is executing to one
 Malware Examples
 ----------------
 |Name|Date|Description|
-|--------------|--------------------------|-----------------------------|
+|---|---|---|
 |[**Gamut**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gamut.md)|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
 |[**Bagle**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/bagle.md)|2004|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -22,4 +23,4 @@ References
 ----------
 <a name="1">[1]</a> https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/

-<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
+<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
@@ -1,8 +1,8 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0021**|
 |**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/)|
-|**Related ATT&CK Technique**| None |
+|**Related ATT&CK Technique**|None|


 Send Poisoned Text Message
@@ -12,8 +12,8 @@ A malicious attachment is sent via spam SMS or MMS messages. When the user click
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md) |  | MazarBot is delivered via a poisoned SMS message. [[1]](#1)|
+|---|---|---|
+|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md)||MazarBot is delivered via a poisoned SMS message. [[1]](#1)|

 References
 ----------
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1204**|
 |**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|[User Execution](https://attack.mitre.org/techniques/T1204)|

+
 User Interaction
 ================
 Malware may include code that relies on specific actions by a user to execute. Note that this MBC behavior differs from [User Execution](https://attack.mitre.org/techniques/T1204) in that it does do not include direct code execution (user action for *initial* execution) - MBE does not encompass ATT&CK's Initial Access Tactic.  
@@ -13,5 +14,5 @@ Malware may include code that relies on specific actions by a user to execute. N
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -1,9 +1,10 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0010**|

+
 # Exfiltration #
 Behaviors that steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).

 * **Automated Exfiltration** [E1020](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/auto-exfiltrate.md)
-* **Archive Collected Data** [E1560](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/data-encrypted.md)
+* **Archive Collected Data** [E1560](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/data-encrypted.md)
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1020**|
-|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
+|**Objective(s)**|[Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
 |**Related ATT&CK Technique**|[Automated Exfiltration](https://attack.mitre.org/techniques/T1020/)|


@@ -14,6 +14,5 @@ Malware may exfiltrate data via automated processing or scripting.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1020.m01|**Exfiltrate via File Hosting Service**|Malware may exfiltrate files to a file hosting location.|
-
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1560**|
-|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
+|**Objective(s)**|[Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
 |**Related ATT&CK Technique**|[Archive Collected Data](https://attack.mitre.org/techniques/T1560/)|


@@ -14,19 +14,10 @@ Malware may obfuscate data via encryption or encoding before exfiltration.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1560.m01|**Encoding**|Data is encoded.|
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |E1560.m03|*Standard Encoding*|A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
-| |E1560.m04|*Custom Encoding*|A custom algorithm is used to encode the exfiltrated data.|
-   
-| | | |
-|-----------------------------|--------|-----------------------------|
-|E1560.m02|**Encryption**|Data is encrypted.| 
-
-| | | | |
-|----------|-----------------------------|--------|-----------------------------|
-| |E1560.m05|*Standard Encryption*|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
-| |E1560.m06|*Custom Encryption*|A custom algorithm is used to encrypt the exfiltrated data.|
+|E1560.m02|**Encryption**|Data is encrypted.|
+|E1560.m03|**Standard Encoding**|A standard algorithm, such as base64 encoding, is used to encode the exfiltrated data.|
+|E1560.m04|**Custom Encoding**|A custom algorithm is used to encode the exfiltrated data.|
+|E1560.m05|**Standard Encryption**|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt the exfiltrated data.|
+|E1560.m06|**Custom Encryption**|A custom algorithm is used to encrypt the exfiltrated data.|
@@ -1,7 +1,8 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0008**|

+
 # Impact #
 Behaviors that enable malware to achieve its mission of manipulating, interrupting, or destroying systems and/or data.

@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0016**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/)|


@@ -1,8 +1,8 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1485**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
-|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/), [Delete Device Data](https://attack.mitre.org/techniques/T1447/)| 
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
+|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/), [Delete Device Data](https://attack.mitre.org/techniques/T1447/)|


 Data Destruction
@@ -14,7 +14,7 @@ see ATT&CK: [**Data Destruction**](https://attack.mitre.org/techniques/T1485/).
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1485.m01|**Delete Shadow Drive**|Deletes shadow drive data, which is related to ransomware.|
 |E1485.m02|**Empty Recycle Bin**|Empties the recycle bin, which can be related to ransomware.|
 |E1485.m03|**Delete Application/Software**|An application or software is deleted.|
@@ -22,9 +22,9 @@ Methods
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**Shamoon**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/shamoon.md)| 2012 |A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)| 
+|---|---|---|
+|[**Shamoon**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/shamoon.md)|2012|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)|

 References
 ----------
-<a name="1">[1]</a> http://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509 
+<a name="1">[1]</a> http://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0033**|
 |**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Network Denial of Device](https://attack.mitre.org/techniques/T1498/)|
@@ -16,12 +16,10 @@ The subsequently defined ATT&CK technique [Network Denial of Device](https://att
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**BlackEnergy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/blackenergy.md)| October 2007| Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
+|---|---|---|
+|[**BlackEnergy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/blackenergy.md)|October 2007|Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|

 References
 ----------
 <a name="1">[1]</a> http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf
-
-
 
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0017**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|None|


@@ -12,9 +12,9 @@ Destroys a physical piece of hardware. For example, malware may cause hardware t
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**Stuxnet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/stuxnet.md)|2010| Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|
+|---|---|---|
+|[**Stuxnet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/stuxnet.md)|2010|Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|

 References
 ----------
-<a name="1">[1]</a> https://www.bbc.com/timelines/zc6fbk7
+<a name="1">[1]</a> https://www.bbc.com/timelines/zc6fbk7
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1486**|
 |**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Techniques**|[Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/), [Data Encrypted for Impact (Mobile)](https://attack.mitre.org/techniques/T1471/)|
@@ -14,9 +14,9 @@ See ATT&CK: [**Data Encrypted for Impact**](https://attack.mitre.org/techniques/
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**CryptoWall**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptowall.md)| 2014 | [[1]](#1)| 
-|[**CryptoLocker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptolocker.md)| 2013| [[2]](#2)| 
+|---|---|---|
+|[**CryptoWall**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptowall.md)|2014|[[1]](#1)|
+|[**CryptoLocker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptolocker.md)|2013|[[2]](#2)|
 |[**Locky Bart**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/locky-bart.md)|2017|Encrypts files for ransom without any connection to the Internet.|
 |[**SamSam**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/samsam.md)|2015|Ransomware.|

@@ -25,6 +25,3 @@ References
 <a name="1">[1]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptowall-ransomware/

 <a name="2">[2]</a> http://www.secureworks.com/cyber-threat-intelligence/threats/cryptolocker-ransomware/
-
-
- 
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1190**|
 |**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)|
@@ -14,9 +14,9 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)| | Ursnif is sometimes delivered via exploit kit. [[1]](#1)|
+|---|---|---|
+|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)||Ursnif is sometimes delivered via exploit kit. [[1]](#1)|

 References
 ----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif 
+<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1472**|
 |**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Generate Fraudulent Advertising Revenue](https://attack.mitre.org/techniques/T1472/)|
@@ -14,15 +14,15 @@ See ATT&CK: [**Generate Fraudulent Advertising Revenue**](https://attack.mitre.o
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1472.m01|**Click Hijacking**|Malware alters DNS server settings to route to a rogue DNS server: when the user clicks on a search result link displayed through a search engine query, malware re-routes the user to different website. Instead of going to the requested site, the user is taken to an alternate website such that the click triggers payment to the threat actor. [[1]](#1)|
 |E1472.m02|**Advertisement Replacement Fraud**|Malware injects ad windows onto websites the user views. [[2]](#2)|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)| November 2011| Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
+|---|---|---|
+|[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)|November 2011|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
 |[**Kovter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)|

 References
@@ -34,5 +34,3 @@ References
 <a name="3">[3]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html

 <a name="4">[4]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
-
- 
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0018**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Resource Hijacking](https://attack.mitre.org/techniques/T1496/)|


@@ -14,16 +14,16 @@ The subsequently defined ATT&CK technique [Resource Hijacking](https://attack.mi
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0018.001|**Password Cracking**|Consume system resources for the purpose of password cracking.|
 |B0018.002|**Cryptojacking**|Consume system resources to mine for cryptocurrency (e.g., Bitcoin, Litecoin, etc.).|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)|
-| Adylkuzz| May 2017| Consumes system resources to mine for cryptocurrency. [[2]](#2)| 
+|Adylkuzz|May 2017|Consumes system resources to mine for cryptocurrency. [[2]](#2)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0019**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/)|


@@ -14,10 +14,10 @@ The subsequently defined ATT&CK sub-technique [Data Manipulation: Transmitted Da
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**SearchAwesome**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/searchawesome.md)| 2018| Intercepts encrypted web traffic to inject adds. [[1]](#1)|
+|---|---|---|
+|[**SearchAwesome**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/searchawesome.md)|2018|Intercepts encrypted web traffic to inject adds. [[1]](#1)|
 |[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md)|2016|Intercepts data coming into and going out of device.|

 References
 ----------
-<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
@@ -1,7 +1,7 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0022**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|None|


@@ -16,13 +16,13 @@ Note that the [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |B0022.001|**Reverse Shell**|Malware may create a reverse shell. For example, malware can invoke cmd.exe and create three pipes (stdin, stdout, stderr) to forward data between cmd.exe and an adversary.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
 |[**Dark Comet**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/dark-comet.md)|2008|Allows an attacker to control the system via a GUI.|

@@ -32,4 +32,4 @@ References

 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

-<a name="3">[3]</a> https://en.wikipedia.org/wiki/DarkComet
+<a name="3">[3]</a> https://en.wikipedia.org/wiki/DarkComet
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**B0039**|
 |**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|None|
@@ -9,16 +9,12 @@ Spamming
 ========
 Malware may use a victim machine to create and send spam. 

-
 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|**TrickBot**| July 2019 | In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
+|---|---|---|
+|**TrickBot**|July 2019|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|

 References
 ----------
 <a name="1">[1]</a> https://techcrunch.com/2019/07/12/trickbot-spam-millions-emails/
-
-
- 
@@ -1,7 +1,8 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OB0011**|

+
 # Lateral Movement
 Behaviors that enable propagation through a compromised system or infected files. The malware may move actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).

@@ -9,4 +10,4 @@ Behaviors that enable propagation through a compromised system or infected files
 * **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/remote-file-copy.md)
 * **Send Email** [B0020](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-email.md)
 * **Send Poison Text Message** [B0021](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-poison-text-msg.md)
-* **Supply Chain Compromise** [E1195](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/supply-chain-compromise.md)
+* **Supply Chain Compromise** [E1195](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/supply-chain-compromise.md)
@@ -1,9 +1,10 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**E1195**|
 |**Objective(s)**|[Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
 |**Related ATT&CK Technique**|[Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)|

+
 Supply Chain Compromise
 =======================
 The supply chain may be compromised to enable initial malware infection. Malware-related methods are listed below to supplement the information available defined in ATT&CK: [**Supply Chain Compromise**](https://attack.mitre.org/techniques/T1195/).  
@@ -11,16 +12,16 @@ The supply chain may be compromised to enable initial malware infection. Malware
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |E1195.m01|**Abuse Enterprise Certificates**|Abusing enterprise certificates enables malware to exploit private APIs and infect a wide range of users (see *Exploit Private APIs* below).|
 |E1195.m02|**Exploit Private APIs**|Malware can exploit private APIs to infect jailbroken and non-jailbroken iOS devices. Research shows that over 100 apps in the App Store have abused private APIs and bypassed Apple’s strict code review.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|---|---|---|
 |[**YiSpecter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/yispecter.md)|October 2015|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)|

 References
 ----------
-<a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
+<a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
@@ -4,10 +4,10 @@ Some malware behaviors are low-level, support many objectives and other behavior
 Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-behavior objectives are shown below.

 |**Objective**|**Description**|
-|------------------------------------------------------------------|----------------------------|
-|[**Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication) |Malware uses various protocols and components to communication.|
+|---|---|
+|[**Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication)|Malware uses various protocols and components to communication.|
 |[**Cryptography**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/cryptography)|Malware uses elements of cryptography.|
-|[**Data Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation)| Malware manipulates data.|
-|[**File Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation) | Malware manipulates files.|
-|[**Memory Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation) |Malware manipulates memory.|
-|[**Processes**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/processes)|Malware uses processes.|
+|[**Data Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation)|Malware manipulates data.|
+|[**File Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation)|Malware manipulates files.|
+|[**Memory Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation)|Malware manipulates memory.|
+|[**Processes**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/processes)|Malware uses processes.|
@@ -1,19 +1,19 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OC0006**|

+
 # Communication Micro-objectives #
 Micro-behaviors that enable malware to communicate.

-|ID|Name|
-|-----------------------------|--------|
-|R0011|[**DNS Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/dns-comm.md)|
-|R0004|[**FTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/ftp-comm.md)|
-|R0002|[**HTTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/http-comm.md)|
-|R0014|[**ICMP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/icmp-comm.md)|
-|R0003|[**Inter-process Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/inter-process.md)|
-|R0012|[**SMTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/smtp-comm.md)|
-|R0001|[**TCP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/tcp-comm.md)|
-|R0013|[**UDP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/udp-comm.md)|
-|R0005|[**WinINet Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md)|
-
+|ID|Name|Description|
+|---|---|---|
+|R0011|[**DNS Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/dns-comm.md)||
+|R0004|[**FTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/ftp-comm.md)||
+|R0002|[**HTTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/http-comm.md)||
+|R0014|[**ICMP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/icmp-comm.md)||
+|R0003|[**Inter-process Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/inter-process.md)||
+|R0012|[**SMTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/smtp-comm.md)||
+|R0001|[**TCP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/tcp-comm.md)||
+|R0013|[**UDP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/udp-comm.md)||
+|R0005|[**WinINet Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md)||
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0011**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -12,10 +12,9 @@ The DNS Communication micro-behavior focuses on DNS communication.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|C0011.001|**Resolve**|Resolves a domain.| 
+|---|---|---|
+|C0011.001|**Resolve**|Resolves a domain.|
 |C0011.002|**Server Connect**|Connects to DNS server.|
 |C0011.003|**DDNS Domain Connect**|Connects to dynamic DNS domain.|
 |C0011.004|**Resolve TLD**|Resolves top level domain.|
 |C0011.005|**Resolve Free Hosting Domain**|Resolves a free hosting domain (e.g., freeiz.com).|
-
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0004**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -12,8 +12,6 @@ The FTP Communication micro-behavior focuses on FTP communication.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|C0004.001|**Put**|FTP Put| 
+|---|---|---|
+|C0004.001|**Put**|FTP Put|
 |C0004.002|**WinINet API**|Send FTP command via WinINet.|
-
-
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0002**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -12,17 +12,16 @@ This micro-behavior is related to HTTP communication.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |C0002.001|**Server**|General HTTP server behavior.|
 |C0002.002|**Client**|General HTTP client behavior.|
 |C0002.003|**Request**|Non-specific HTTP request.|
 |C0002.004|**GET Request**|HTTP Get request.|
 |C0002.005|**POST Request**|HTTP Post request.|
-|C0002.006|**PUT Request**|HTTP Put request.| 
-|C0002.007|**WinINet API**|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md) microbehavior.
+|C0002.006|**PUT Request**|HTTP Put request.|
+|C0002.007|**WinINet API**|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md) microbehavior.|
 |C0002.008|**WinHTTP API**|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
-|C0002.008|**URLMON Function**|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.  
-|C0002.008|**IWebBrowser**|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.
-|C0002.008|**IHTMLDocument**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.
-|C0002.008|**IHTMLElement**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.
-
+|C0002.008|**URLMON Function**|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.|
+|C0002.008|**IWebBrowser**|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
+|C0002.008|**IHTMLDocument**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.|
+|C0002.008|**IHTMLElement**|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.|
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0014**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -12,5 +12,5 @@ This micro-behavior is related to ICMP communication.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|C0014.001|**Generate Traffic**|Generate ICMP traffic.|
+|---|---|---|
+|C0014.001|**Generate Traffic**|Generate ICMP traffic.|
@@ -1,19 +1,19 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0003**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


 Interprocess Communication
-===========================
+==========================
 The Interprocess Communication micro-behavior focuses on interprocess communication. 

 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|C0003.001|**Create Pipe**| | 
-|C0003.002|**Connect Pipe**| |
-|C0003.003|**Read Pipe**| | 
-|C0003.004|**Write Pipe**| | 
+|---|---|---|
+|C0003.001|**Create Pipe**||
+|C0003.002|**Connect Pipe**||
+|C0003.003|**Read Pipe**||
+|C0003.004|**Write Pipe**||
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0012**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -12,6 +12,6 @@ This micro-behavior focuses on SMTP communication.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |C0012.001|**Server Connect**|Connects to an smtp server.|
 |C0012.002|**Request**|Makes SMTP request.|
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0001**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -12,7 +12,7 @@ This micro-behavior focuses on TCP communication.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |C0001.001|**Client**|General TCP client behavior.|
 |C0001.002|**Server**|General TCP server behavior.|
 |C0001.003|**Create Socket**|A server or client creates a TCP socket.|
@@ -20,4 +20,3 @@ Methods
 |C0001.005|**Listen Socket**|A server listens for client requests.|
 |C0001.006|**Receive Data**|Receive data on socket.|
 |C0001.007|**Send Data**|Send data on socket.|
-
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0013**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -12,5 +12,5 @@ The micro-behavior is related to UDP communication.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |C0013.001|**STUN Server**|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.|
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0005**|
 |**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|
@@ -14,7 +14,7 @@ The methods below are those of most interest in malware analysis. Details can be
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |C0005.001|**InternetConnect**|Opens an FTP or HTTP session for a given site.|
 |C0005.002|**InternetOpen**|Initializes an application's use of the WinINet functions.|
 |C0005.003|**InternetOpenURL**|Opens a resource specified by a complete FTP or HTTP URL.|
@@ -23,5 +23,4 @@ Methods

 References
 ----------
-<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions. 
-
+<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-functions
@@ -1,10 +1,11 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OC0005**|

+
 # Cryptography Micro-objectives #
 Micro-behaviors that enable malware to use crypto.

-|ID|Name|
-|-----------------------------|--------|
-|R0021|[**Generate Pseudo-random Sequence**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/cryptography/gen-random.md)|
+|ID|Name|Description|
+|---|---|---|
+|R0021|[**Generate Pseudo-random Sequence**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/cryptography/gen-random.md)||
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0021**|
 |**Objective(s)**|[Cryptography](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/cryptography)|
 |**Related ATT&CK Technique**|None|
@@ -12,9 +12,7 @@ The Generate Pseudo-random Sequence microbehavior can be used for a number of pu
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |C0021.001|**GetTickCount**|Generate random using GetTickCount.|
 |C0021.002|**rand**|Generate random using rand.|
 |C0021.003|**Use API**|Generate random using a Windows API.|
-
-
@@ -1,11 +1,12 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OC0004**|

+
 # Data Manipulation Micro-objectives #
 Micro-behaviors related to malware manipulating data.

-|ID|Name|
-|-----------------------------|--------|
-|R0019|[**Check String**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/check-string.md)|
-|R0020|[**Use Constant**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/use-constant.md)|
+|ID|Name|Description|
+|---|---|---|
+|R0019|[**Check String**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/check-string.md)||
+|R0020|[**Use Constant**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/use-constant.md)||
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0019**|
 |**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/data-manipulation)|
 |**Related ATT&CK Technique**|None|
@@ -8,4 +8,3 @@
 Check String
 ============
 Malware may check a string for some characteristics, such as being ascii content or length.
-
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0020**|
 |**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/data-manipulation)|
 |**Related ATT&CK Technique**|None|
@@ -8,6 +8,3 @@
 Use Constant
 ============
 Malware may manipulate or use a constant value, for example as part of a larger string used by some function.
-
-
-
@@ -1,11 +1,12 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OC0001**|

+
 # File Manipulation Micro-objectives #
 Micro-behaviors related to file manipulation.

-|ID|Name|
-|-----------------------------|--------|
-|R0015|[**Alter File Extension**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/alter-extend.md)|
-|R0016|[**Create File**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/create-file.md)|
+|ID|Name|Description|
+|---|---|---|
+|R0015|[**Alter File Extension**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/alter-extend.md)||
+|R0016|[**Create File**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/create-file.md)||
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0015**|
 |**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/file-manipulation)|
 |**Related ATT&CK Technique**|None|
@@ -12,5 +12,5 @@ Malware alters a file extension. This could be done for many reasons, including
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
-|C0015.001|**Append Extension**|A new extension is appended.| 
+|---|---|---|
+|C0015.001|**Append Extension**|A new extension is appended.|
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0016**|
 |**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/file-manipulation)|
 |**Related ATT&CK Technique**|None|
@@ -12,7 +12,6 @@ Malware creates a file.
 Methods
 -------
 |ID|Name|Description|
-|-----------------------------|--------|-----------------------------|
+|---|---|---|
 |C0016.001|**Create Office Document**|An Office document is created.|
 |C0016.002|**Create Ransomware File**|Create a file used by ransomware.|
-
@@ -1,10 +1,11 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OC0007**|

+
 # Hardware Micro-objectives #
 Micro-behaviors related to hardware.

-|ID|Name|
-|-----------------------------|--------|
-|R0023|[**Load Driver**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/hardware/load-driver.md)|
+|ID|Name|Description|
+|---|---|---|
+|R0023|[**Load Driver**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/hardware/load-driver.md)||
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0023**|
 |**Objective(s)**|[Processes](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/processes)|
 |**Related ATT&CK Technique**|None|
@@ -8,4 +8,3 @@
 Load Driver
 ===========
 Malware loads a device driver.
-
@@ -1,14 +1,15 @@
 |||
-|--|-----|
+|---|---|
 |**ID**|**OC0002**|

+
 # Memory Manipulation Micro-objectives #
 Micro-behaviors related to malware manipulating machine memory.

-|ID|Name|
-|-----------------------------|--------|
-|R0007|[**Allocate Memory**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/allocate-memory.md)|
-|R0006|[**Heap Spray**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/heapspray.md)|
-|R0008|[**Change Memory Protection**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/memory-protect.md)
-|R0010|[**Overflow Buffer**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/overflow-buffer.md)
-|R0009|[**Stack Pivot**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/stack-pivot.md)
+|ID|Name|Description|
+|---|---|---|
+|R0007|[**Allocate Memory**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/allocate-memory.md)||
+|R0006|[**Heap Spray**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/heapspray.md)||
+|R0008|[**Change Memory Protection**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/memory-protect.md)||
+|R0010|[**Overflow Buffer**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/overflow-buffer.md)||
+|R0009|[**Stack Pivot**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/stack-pivot.md)||
@@ -1,5 +1,5 @@
 |||
-|---------|------------------------|
+|---|---|
 |**ID**|**C0007**|
 |**Objective(s)**|[Memory Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/memory-manipulation)|
 |**Related ATT&CK Technique**|None|
@@ -8,5 +8,3 @@
 Allocate Memory
 ===============
 Malware allocates memory, often to unpack itself. 
-
-
--- a/Show More
+++ b/Show More