fix format

This commit is contained in:
Desiree Beck
2019-11-30 13:54:59 -05:00
parent 22afb8a700
commit 5533c13752
2 changed files with 3 additions and 5 deletions
+2 -4
View File
@@ -2,15 +2,13 @@
The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-markdown/blob/master/yfaq/README.md) page for answers to common questions.
### Objectives ###
As shown below, malware objectives are based on [ATT&CK Tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known objectives and behaviors. Two malware analysis-specific objectives not in ATT&CK are also defined (Anti-Behavioral Analysis and Anti-Static Analysis).
As shown below, malware objectives are based on [ATT&CK Tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known objectives and behaviors. Two malware analysis-specific objectives not in ATT&CK are also defined (ANTI-BEHAVIORAL ANALYSIS and ANTI-STATIC ANALYSIS).
### Behaviors ###
Under each objective, MBC captures all behaviors and code characteristics discovered during malware analysis, with links to [ATT&CK Techniques](https://attack.mitre.org/techniques/enterprise/) as appropriate. Names of MBC behaviors may or may not match related ATT&CK techniques. Any content provided on behavior pages is *supplemental* to ATT&CK content. In other words, ATT&CK content is not duplicated in MBC, and MBC users will want to reference ATT&CK while capturing malware behaviors.
### <a name="ids"></a>Identifiers ###
The first letter of a behavior identifier indicates whether the behavior is a stub referencing an ATT&CK technique ("T", matching the ATT&CK identifier; e.g. T1234), whether it enhances an ATT&CK technique with malware-specific details ("E"; e.g. E1234), or whether it is a newly defined behavior in MBC ("M"; e.g. M1234).
When two or more MBC behaviors refine the same ATT&CK technique, they are given concatenated identifiers where the MBC portion distinguishes them (e.g. T1234:M0123, T1234:M0124). When a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier is preserved and the ATT&CK identifier is appended (e.g., M0123:T1234).
The first letter of a behavior identifier indicates whether the behavior is a stub referencing an ATT&CK technique ("T", matching the ATT&CK identifier; e.g. T1234), whether it enhances an ATT&CK technique with malware-specific details ("E"; e.g. E1234), or whether it is a newly defined behavior in MBC ("M"; e.g. M1234). When two or more MBC behaviors refine the same ATT&CK technique, they are given MBC identifiers and when a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier is preserved.
### Example Malware ###
The MBC also contains a collection of [example malware](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/) that are characterized with malware behaviors.
+1 -1
View File
@@ -30,7 +30,7 @@ No. Given that MBC aims to serve as a model and test case for how ATT&CK can be
### Will MBC be updated when ATT&CK is updated? ###
Yes. New and updated ATT&CK content supporting malware analysis use cases will be integrated into MBC. When a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier will be preserved and the ATT&CK identifier will be appended (e.g., M0123:T1234). See the [Identifier](https://github.com/MBCProject/mbc-markdown#ids) section for details.
Yes. New and updated ATT&CK content supporting malware analysis use cases will be integrated into MBC. When a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier will be preserved. See the [Identifier](https://github.com/MBCProject/mbc-markdown#ids) section for details.
### Will MBC *always* remain distinct from ATT&CK, or someday might its content be merged into ATT&CK? ###