Merge branch 'master' of https://github.com/MBCProject/mbc-markdown

command-and-control/remote-file-copy.md

@@ -5,9 +5,9 @@
 |**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)|
 
 
-Remote File Copy
+Ingress Tool Transfer
 ================
-Malware may copy files from one system to another. 
+Malware may copy files from an external system to a system on a compromised network. 
 
 Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](../execution/install-prog.md) behavior. 
 

credential-access/README.md

@@ -7,7 +7,6 @@
 Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.
 
 * **Cryptocurrency** [B0028](../collection/cryptocurrency.md)
-* **Hooking** [F0003](../credential-access/hooking.md)
 * **Input Capture** [E1056](../collection/input-capture.md)
 * **Keylogging** [F0002](../collection/keylogging.md)
 * **Screen Capture** [E1113](../collection/screen-capture.md)

credential-access/hooking.md

@@ -1,42 +0,0 @@
-|||
-|---|---|
-|**ID**|**F0003**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Collection](../collection), [Credential Access](../credential-access), [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
-|**Related ATT&CK Sub-Technique**|[Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)|
-
-
-Hooking
-=======
-Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md).
-
-For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/). 
-
-Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives.
-
-For hooking related to memory dump evasion, see [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Procedure Hooking**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[1]](#1)|
-|**Inline Patching**|F0003.002|Overwrites the first bytes in an API function to redirect code flow.|
-|**Export Address Table (EAT) Hooking**|F0003.006|Hooks the export address table (EAT).|
-|**Import Address Table (IAT) Hooking**|F0003.001|Modifies a process's import address table (IAT), which stores pointers to imported API functions.|
-|**System Service Dispatch Table Hooking**|F0003.004|Hooks the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.|
-|**Shadow SDT Hooking**|F0003.005|Hooks the Shadow SSDT similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).|
-
-Malware Examples
-----------------
-|Name|Date|Description|
-|---|---|---|
-|**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-
-References
-----------
-<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
-
-<a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
-
-

defense-evasion/config-mod.md

@@ -1,12 +1,10 @@
 |||
 |---|---|
-|**ID**|**E1478**|
+|**ID**|**B0047**|
 |**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
-|**Related ATT&CK Technique**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)|
+|**Related ATT&CK Technique**|None|
 
 
 Install Insecure or Malicious Configuration
 ===========================================
-Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective. 
-
-See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).
+Malware may install malicious configuration settings or may modify existing configuration settings. For example, malware may change configuration settings associated with security mechanisms to make it difficult to detect or change configuration settings to maintain a foothold on the network.

defense-evasion/hide-artifacts.md

@@ -5,7 +5,7 @@
 |**Related ATT&CK Technique**|[Hide Artifacts](https://attack.mitre.org/techniques/T1564)|
 
 
-Hidden Artifacts
+Hide Artifacts
 ================
 Malware may hide artifacts to evade detection and/or to persist on the system. See potential methods related to malware below. 
 

defense-evasion/hijack-execution-flow.md

@@ -1,13 +1,19 @@
 |||
 |---|---|
 |**ID**|**F0015**|
-|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
+|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Collection](../collection), [Credential Access](../credential-access), [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
 |**Related ATT&CK Technique**|[Hijack Execution Flow](https://attack.mitre.org/techniques/T1574/)|
 
 
 Hijack Execution Flow
 =====================
-Malware may execute by hijacking the way operating systems run programs. Malware (e.g. rootkit) alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Different types of hooking are defined as methods below.
+Malware may execute by hijacking the way operating systems run programs. Malware (e.g. rootkit) alters API behavior or redirects execution (i.e., hooking) to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Different types of hooking are defined as methods below.
+
+Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives.
+
+For discussion related to the Credential Access and Collection objectives, see [Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/).
+
+For hooking related to memory dump evasion, see [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md).
 
 See ATT&CK: [**Hijack Execution Flow**](https://attack.mitre.org/techniques/T1574/).
 
@@ -18,10 +24,18 @@ Methods
 |**Abuse Windows Function Calls**|F0015.006|Malware abuses native Windows function calls to transfer execution to shellcode that it loads into memory. A pointer to the callback function is used to supply the memory address of the shellcode. Functions that can be abused include EnumResourceTypesA and EnumUILanguagesW. [[4]](#4)|
 |**Export Address Table (EAT) Hooking**|F0015.001|Malware (e.g. rootkit) hooks the export address table (EAT).|
 |**Import Address Table (IAT) Hooking**|F0015.003|Malware (e.g. rootkit) modifies a process's import address table (IAT), which stores pointers to imported API functions.[[1]](#1)|
-|**Inline Patching**|F0015.002|Inline patching (inline hooking) is done by modifying the beginning of a function in order to redirect the execution flow to custom code (i.e. redirecting code flow) before jumping back to the original function.[[2]](#2)|
+|**Inline Patching**|F0015.002|Inline patching (inline hooking) is done by modifying the beginning of a function (e.g., first bytes) in order to redirect the execution flow to custom code (i.e. redirecting code flow) before jumping back to the original function.[[2]](#2)|
+|**Procedure Hooking**|F0015.007|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[5]](#5)|
 |**Shadow System Service Dispatch Table Hooking**|F0015.004|The Shadow System Service Dispatch Table (SSDT) can be hooked similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).[[3]](#3)|
 |**System Service Dispatch Table Hooking**|F0015.005|Malware (e.g. rootkit, malicious drivers) may hook the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.[[3]](#3)|
 
+Malware Examples
+----------------
+|Name|Date|Description|
+|---|---|---|
+|**Kronos**|June 2014|Kronos hooks the API of processes to prevent detection. [[6]](#6)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+
 References
 ----------
 <a name="1">[1]</a> https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf
@@ -32,3 +46,6 @@ References
 
 <a name="4">[4]</a> http://ropgadget.com/posts/abusing_win_functions.html
 
+<a name="5">[5]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
+
+<a name="6">[6]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/

defense-evasion/self-deletion.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**F0007**|
 |**Objective(s)**|[Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)|
+|**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: Uninstall Malicious Application](https://attack.mitre.org/techniques/T1630/001/), [Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)|
 
 
 Self Deletion
 =============
 Malware may uninstall itself to avoid detection. 
 
-See ATT&CK: [**Indicator Removal on Host: File Deletion**](https://attack.mitre.org/techniques/T1070/004/).
+See ATT&CK: [**Indicator Removal on Host: Uninstall Malicious Application**](https://attack.mitre.org/techniques/T1630/001/), [**Indicator Removal on Host: File Deletion**](https://attack.mitre.org/techniques/T1070/004/).
 
 Methods
 -------

impact/README.md

@@ -16,7 +16,7 @@ Behaviors that enable malware to achieve its mission of manipulating, interrupti
 * **Disk Wipe** [F0014](../impact/disk-wipe.md)
 * **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
-* **Generate Fraudulent Advertising Revenue** [E1472](../impact/generate-fraud-rev.md)
+* **Generate Network Traffic from Victim** [E1643](../impact/generate-traffic-from-victim.md)
 * **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md)
 * **Modify Hardware** [B0042](../impact/modify-hardware.md)	
 * **Remote Access** [B0022](../impact/remote-access.md)

impact/data-destruction.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**E1485**|
 |**Objective(s)**|[Impact](../impact)|
-|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/), [Delete Device Data](https://attack.mitre.org/techniques/T1447/)|
+|**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/)|
 
 
 Data Destruction

impact/exploit-kit-behavior.md

@@ -5,7 +5,7 @@
 |**Related ATT&CK Technique**|[Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)|
 
 
-Exploit Kit Behavior
+Exploit Kit
 ====================
 An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver malicious payloads (malware).
 

impact/generate-traffic-from-victim.md

@@ -1,15 +1,13 @@
 |||
 |---|---|
-|**ID**|**E1472**|
+|**ID**|**E1643**|
 |**Objective(s)**|[Impact](../impact)|
-|**Related ATT&CK Technique**|[Generate Fraudulent Advertising Revenue](https://attack.mitre.org/techniques/T1472/)|
+|**Related ATT&CK Technique**|[Generate Traffic from Victim](https://attack.mitre.org/techniques/T1643/)|
 
 
-Generate Fraudulent Advertising Revenue
+Generate Traffic from Victim
 =======================================
-Malware may generate advertising revenue by generating clicks of advertising links. The ATT&CK technique, [Generate Fraudulent Advertising Revenue](https://attack.mitre.org/techniques/T1472/), pertains only to mobile platform, but the behavior is applicable to other platforms as well. 
-
-See ATT&CK: [**Generate Fraudulent Advertising Revenue**](https://attack.mitre.org/techniques/T1472/).
+Malware may generate traffic from the victim system such as clicks of advertising links that generate fraudulent ad revenue. The ATT&CK technique, [Generate Traffic from Victim](https://attack.mitre.org/techniques/T1643/), pertains only to mobile platform, but the behavior is applicable to other platforms as well.
 
 Methods
 -------

persistence/component-firmware.md

@@ -7,7 +7,7 @@
 
 Component Firmware
 ==================
-Malware may overwrite the flash memory contents of system BIOS or other firmware. [[1]](#1). Methods related to malware (extending ATT&CK's definitions) are below. 
+Malware may overwrite the flash memory of firmware outside of the main system firmware or BIOS. [[1]](#1). Methods related to malware (extending ATT&CK's definitions) are below. 
 
 see ATT&CK: [**Pre-OS Boot: Component Firmware**](https://attack.mitre.org/techniques/T1542/002/).