new behavior

defense-evasion/README.md

@@ -15,6 +15,7 @@ Behaviors that evade detection or avoid other defenses.
 * **Code Signing** [T1116](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/code-signing.md)
 * **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md)
 * **Configuration Modification** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md)
+* **Covert Location** [M0040](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/convert-location.md)
 * **DCShadow** [T1207](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/dcshadow.md)
 * **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md)
 * **Disabling Security Tools** [E1089](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)

defense-evasion/covert-location.md

@@ -0,0 +1,15 @@
+|||
+|---------|------------------------|
+|**ID**|**M0040**|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Related ATT&CK Technique**|None|
+
+
+Covert Location
+===============
+Malware may hide data or binary files within other files, the registry, etc. 
+
+Methods
+-------
+* **Hide Data in Registry**: malware may use a registry key to store a long sequence of bytes.
+* **Steganography**: malware may store information in an image.