diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md
index 056e1d9..df3adc6 100644
--- a/command-and-control/c2-communication.md
+++ b/command-and-control/c2-communication.md
@@ -28,7 +28,7 @@ Methods
|Name|ID|Description|
|---|---|---|
|**Authenticate**|B0030.011|Implant may authenticate itself to the controller, controller may authenticate itself to implant, or both. This is often at or near the start of communication. Examples include but are not limited to a simple shared secret (e.g. password), challenge-response with symmetric encryption, or challenge-response with asymmetric encryption.|
-|**Check for Payload**|B0030.005|Check for payload.|
+|**Check for Payload**|B0030.005|An implant may check with the controller for additional payloads or instructions, sometimes at a regular interval. This is also known as beaconing.|
|**Directory Listing**|B0030.012|Controller requests a directory listing from the implant, optionally from a given path, optionally recursive.|
|**Execute File**|B0030.013|Execute/run/open the file using default operating system functionality, optionally with provided command-and-scripting-interpreter arguments. The file may or may not already exist on the victim.|
|**Execute Shell Command**|B0030.014|Execute/run the given command using a built-in program (e.g. cmd.exe, PowerShell, bash). This differs from Start Interactive Shell because the shell process is started only for the received command or set of commands and then exits. There is no loop looking for additional commands while the shell process is still running.|
diff --git a/discovery/file-and-directory-discovery.md b/discovery/file-and-directory-discovery.md
index 500d603..0163bb3 100644
--- a/discovery/file-and-directory-discovery.md
+++ b/discovery/file-and-directory-discovery.md
@@ -24,6 +24,7 @@ Methods
|Name|ID|Description|
|---|---|---|
|**Log File**|E1083.m01|Malware may look for system log files.|
+|**Filter by Extension**|E1083.m02|Malware may filter by extension (common in ransomware).|
Malware Examples
----------------
diff --git a/micro-behaviors/cryptography/README.md b/micro-behaviors/cryptography/README.md
index 2f6e755..4cc3170 100644
--- a/micro-behaviors/cryptography/README.md
+++ b/micro-behaviors/cryptography/README.md
@@ -9,6 +9,8 @@
# Cryptography Micro-objective #
Micro-behaviors that enable malware to use crypto.
+* **Crypto Algorithm** [C0068](../cryptography/crypto-algorithm.md)
+* **Crypto Constant** [C0069](../cryptography/crypto-constant.md)
* **Crypto Library** [C0059](../cryptography/crypto-lib.md)
* **Encrypt Data** [C0027](../cryptography/encrypt-data.md)
* **Decrypt Data** [C0031](../cryptography/decrypt-data.md)
diff --git a/micro-behaviors/cryptography/crypto-algorithm.md b/micro-behaviors/cryptography/crypto-algorithm.md
new file mode 100644
index 0000000..80ed433
--- /dev/null
+++ b/micro-behaviors/cryptography/crypto-algorithm.md
@@ -0,0 +1,20 @@
+
+
+
+
+Crypto Algorithm
+================
+A known crypto algorithm is implemented in the code. It is unknown whether it is from a public crypto library. When the library is known, **Crypto Library ([C0059](../cryptography/crypto-lib.md))** micro-behavior should be used.
diff --git a/micro-behaviors/cryptography/crypto-constand.md b/micro-behaviors/cryptography/crypto-constand.md
new file mode 100644
index 0000000..6736297
--- /dev/null
+++ b/micro-behaviors/cryptography/crypto-constand.md
@@ -0,0 +1,20 @@
+
+
+
+
+Crypto Constant
+================
+The malware contains a known crypto constant.
diff --git a/micro-behaviors/cryptography/crypto-lib.md b/micro-behaviors/cryptography/crypto-lib.md
index d9d408a..033540e 100644
--- a/micro-behaviors/cryptography/crypto-lib.md
+++ b/micro-behaviors/cryptography/crypto-lib.md
@@ -17,4 +17,11 @@
Crypto Library
==============
-Malware uses a crypto library.
\ No newline at end of file
+Malware uses a crypto library.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**API Call**|C0059.001|Malware uses crypto API calls.|
+|**Static Public Library**|C0059.002|A public crypto library is embedded in the code.|