add behavior

defense-evasion/README.md

@@ -14,6 +14,7 @@ Behaviors that evade detection or avoid other defenses.
 * **Bypass User Account Control** [T1088](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-user-acct-cntl.md)
 * **Code Signing** [T1116](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/code-signing.md)
 * **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md)
+* **Configuration Modification** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md)
 * **DCShadow** [T1207](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/dcshadow.md)
 * **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md)
 * **Disabling Security Tools** [E1089](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)

defense-evasion/config-mod.md

@@ -0,0 +1,12 @@
+|||
+|---------|------------------------|
+|**ID**|**E1478**|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
+|**Related ATT&CK Technique(s)**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)|
+
+
+Configuration Modification
+==========================
+Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective. 
+
+See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).

persistence/README.md

@@ -14,6 +14,7 @@ Malware aims to remain on a system regardless of system events.
 * **Change Default File Association** [T1042](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/change-default-file-assoc.md)
 * **Component Firmware** [E1109](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md)
 * **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md)
+* **Configuration Modification** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md)
 * **Create Account** [T1136](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/create-account.md)
 * **DLL Search Order Hijacking** [T1038](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/dll-search-order-hijack.md)
 * **File System Permissions Weakness** [T1044](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/file-system-perm-weakness.md)