Fix links to MBC

README.md

@@ -1,5 +1,5 @@
 # <a name="mbc"></a>Malware Behavior Catalog #
-The Malware Behavior Catalog (MBC) is a catalog of malware Objectives and Behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MAECProject/malware-behaviors/blob/master/yfaq/README.md) page for answers to common questions.
+The Malware Behavior Catalog (MBC) is a catalog of malware Objectives and Behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-markdown/blob/master/yfaq/README.md) page for answers to common questions.
 
 ### Objectives ###
 As shown below, malware Objectives are based on [ATT&CK Tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known Objectives and Behaviors. Two malware analysis-specific Objectives (Anti-Behavioral Analysis and Anti-Static Analysis) not in ATT&CK are also defined. 
@@ -13,24 +13,24 @@ The first letter of a Behavior identifier indicates whether the Behavior is a st
 When two or more MBC Behaviors refine the same ATT&CK Technique, they are given concatenated identifiers where the MBC portion distinguishes them (e.g. T1234:M0123, T1234:M0124). When a new ATT&CK Technique is defined *after* an MBC Behavior has been defined, the preexisting MBC identifier is preserved and the ATT&CK identifier is appended (e.g., M0123:T1234). 
 
 ### Example Malware ###
-The MBC also contains a collection of [example malware](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/) that are characterized with malware Behaviors.
+The MBC also contains a collection of [example malware](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/) that are characterized with malware Behaviors.
 
 ## Malware Objective Descriptions ##
 Malware Objectives are defined below. Follow the links to view associated Behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all Behaviors.
 
 |**Objective**|**Description**|
 |------------------------------------------------------------------|----------------------------|
-|[**Anti-Behavioral Analysis**](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/README.md) |Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
-|[**Anti-Static Analysis**](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/README.md)| Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
-|[**Collection**](https://github.com/MAECProject/malware-behaviors/blob/master/collection/README.md) | Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This Objective includes locations on a system or network where the malware may look for information to exfiltrate.|
-|[**Command and Control**](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/README.md) |Malware aims to communicate (receive and/or execute remotely submitted commands) with systems under its control within a target network or other systems (C2 servers, etc.).|
-|[**Credential Access**](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
-|[**Defense Evasion**](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
-|[**Discovery**](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
-|[**Execution**](https://github.com/MAECProject/malware-behaviors/blob/master/execution/README.md)|Malware aims to execute its code on a system to achieve secondary objectives, in conjunction with its primary objectives.|
-|[**Exfiltration**](https://github.com/MAECProject/malware-behaviors/blob/master/exfiltration/README.md)|  Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
-|[**Impact**](https://github.com/MAECProject/malware-behaviors/blob/master/impact/README.md)|Malware aims to execute its mission.|
-|[**Lateral Movement**](https://github.com/MAECProject/malware-behaviors/blob/master/lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
-|[**Persistence**](https://github.com/MAECProject/malware-behaviors/blob/master/persistence/README.md)|Malware aims to remain on a system regardless of system events.|
-|[**Privilege Escalation**](https://github.com/MAECProject/malware-behaviors/blob/master/privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
+|[**Anti-Behavioral Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/README.md) |Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
+|[**Anti-Static Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/README.md)| Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
+|[**Collection**](https://github.com/MBCProject/mbc-markdown/blob/master/collection/README.md) | Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This Objective includes locations on a system or network where the malware may look for information to exfiltrate.|
+|[**Command and Control**](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/README.md) |Malware aims to communicate (receive and/or execute remotely submitted commands) with systems under its control within a target network or other systems (C2 servers, etc.).|
+|[**Credential Access**](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
+|[**Defense Evasion**](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
+|[**Discovery**](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
+|[**Execution**](https://github.com/MBCProject/mbc-markdown/blob/master/execution/README.md)|Malware aims to execute its code on a system to achieve secondary objectives, in conjunction with its primary objectives.|
+|[**Exfiltration**](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/README.md)|  Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
+|[**Impact**](https://github.com/MBCProject/mbc-markdown/blob/master/impact/README.md)|Malware aims to execute its mission.|
+|[**Lateral Movement**](https://github.com/MBCProject/mbc-markdown/blob/master/lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
+|[**Persistence**](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/README.md)|Malware aims to remain on a system regardless of system events.|
+|[**Privilege Escalation**](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
 

anti-behavioral-analysis/README.md

@@ -7,18 +7,18 @@ Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugge
 
 Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).
 
-* **Debugger Detection** [M0001](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-debugger.md)
-* **Debugger Evasion** [M0002](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/evade-debugger.md)
-* **Dynamic Analysis Evasion** [M0003](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md)
-* **Emulator Detection** [M0004](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-emulator.md)
-* **Emulator Evasion** [M0005](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/evade-emulator.md)
-* **Executable Code Compression** [E1045](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-compression.md)
-* **Executable Code Virtualization** [M0008](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-virtualize.md)
-* **Execution Guardrails** [E1480](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/execution-guardrails.md)
-* **Hooking** [E1179](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/hooking.md)
-* **Memory Dump Evasion** [M0006](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/evade-memory-dump.md)
-* **Sandbox Detection** [M0007](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-sandbox.md)
-* **Virtual Machine Detection** [M0009](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-vm.md)
+* **Debugger Detection** [M0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-debugger.md)
+* **Debugger Evasion** [M0002](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-debugger.md)
+* **Dynamic Analysis Evasion** [M0003](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md)
+* **Emulator Detection** [M0004](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-emulator.md)
+* **Emulator Evasion** [M0005](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-emulator.md)
+* **Executable Code Compression** [E1045](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md)
+* **Executable Code Virtualization** [M0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
+* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
+* **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Memory Dump Evasion** [M0006](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md)
+* **Sandbox Detection** [M0007](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-sandbox.md)
+* **Virtual Machine Detection** [M0009](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-vm.md)
 
 References
 ----------

anti-behavioral-analysis/detect-debugger.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0001**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 
@@ -27,7 +27,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Redhip**](https://github.com/MAECProject/malware-behaviors/tree/master/xample-malware/redhip.md) | January 2011 |Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[4]](#4)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/redhip.md) | January 2011 |Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[4]](#4)|
 
 References
 ----------

anti-behavioral-analysis/detect-emulator.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0004**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 

anti-behavioral-analysis/detect-sandbox.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0007**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 
@@ -9,7 +9,7 @@ Sandbox Detection
 =================
 Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.
 
-The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion): for details, see the ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/).
+The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/).
 
 Methods
 -------
@@ -22,7 +22,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Redhip**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/redhip.md)| January 2011 | Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)| January 2011 | Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
 |**Rombertik**| May 2015| [[2]](#2)|
 
 References

anti-behavioral-analysis/detect-vm.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0009**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|
 
 
@@ -9,7 +9,7 @@ Virtual Machine Detection
 =========================
 Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)
 
-The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion): for details, see the ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/).
+The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/).
 
 Methods
 -------

anti-behavioral-analysis/evade-debugger.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0002**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 

anti-behavioral-analysis/evade-dynamic-analysis.md

@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
 |**ID**|**M0003**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 Dynamic Analysis Evasion
 ========================
 Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine. 
 
-See [Emulator Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis/emulator-evade.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 
+See [Emulator Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/emulator-evade.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 
 
 Methods
 -------
@@ -28,8 +28,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**Ursnif**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/ursnif.md) | May 2016 | Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
-|[**Terminator**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/terminator.md) | October 2013 | The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
+|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md) | May 2016 | Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
+|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md) | October 2013 | The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
 |**Nap**| 2013 | Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
 
 References

anti-behavioral-analysis/evade-emulator.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0005**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 Emulator Evasion

anti-behavioral-analysis/evade-memory-dump.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0006**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 Memory Dump Evasion
@@ -17,7 +17,7 @@ Methods
 * **Tampering**: Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).
 * **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution.
 * **On-the-Fly APIs**: Resolve API addresses before each use to prevent complete dumping.
-* **Feed Misinformation**: API behavior can be altered to prevent prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/hooking.md).
+* **Feed Misinformation**: API behavior can be altered to prevent prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/hooking.md).
 * **Flow Opcode Obstruction**: flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4)
 
 Malware Examples

anti-behavioral-analysis/execution-guardrails.md

@@ -1,12 +1,12 @@
 |||
 |---------|------------------------|
 |**ID**|**E1480**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis), [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480/)|
 
 Execution Guardrails
 ====================
-Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
+Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
 
 **See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480/) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
 

anti-static-analysis/README.md

@@ -7,12 +7,12 @@ Behaviors and methods that prevent static analysis or make it more difficult. Si
 
 Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).
 
-* **Call Graph Generation Evasion** [M0010](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/evade-call-graph.md)
-* **Disassembler Evasion** [M0012](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/evade-disassembler.md)
-* **Executable Code Compression** [E1045](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-compression.md)
-* **Executable Code Obfuscation** [M0032](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-obfuscate.md)
-* **Executable Code Optimization** [M0034](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-optimize.md)
-* **Executable Code Virtualization** [M0008](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-virtualize.md)
+* **Call Graph Generation Evasion** [M0010](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-call-graph.md)
+* **Disassembler Evasion** [M0012](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-disassembler.md)
+* **Executable Code Compression** [E1045](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md)
+* **Executable Code Obfuscation** [M0032](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md)
+* **Executable Code Optimization** [M0034](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-optimize.md)
+* **Executable Code Virtualization** [M0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
 
 
 References

anti-static-analysis/evade-call-graph.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0010**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 

anti-static-analysis/evade-disassembler.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0012**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 

anti-static-analysis/exe-code-compression.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1045**|
-|**Objective(s)**|[Anti-Behaviorial Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**|[Anti-Behaviorial Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Software Packing](https://attack.mitre.org/techniques/T1045/)|
 
 Executable Code Compression

anti-static-analysis/exe-code-obfuscate.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0032**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 
@@ -9,7 +9,7 @@ Executable Code Obfuscation
 ===========================
 Executable code uses obfuscation to hinder disassembly and static code analysis. Methods related to *anti-static analysis* are below. The Executable Code Obfuscation behavior is specific to a malware sample's executable code (data and text sections).
 
-For obfuscation behaviors related to non-malware-sample files and information, see ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/), under the [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion) objective.
+For obfuscation behaviors related to non-malware-sample files and information, see ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/), under the [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion) objective.
 
 Methods
 -------
@@ -43,8 +43,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------------------------|--------|-----------------------------|
-|[**Heriplor Trojan**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/heriplor.md) | March 2019 | The Heriplor Trojan uses API Hashing. [[1]](#1)|
-|[**Geodo**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/geodo.md) |August 2018| Geodo macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
+|[**Heriplor Trojan**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/heriplor.md) | March 2019 | The Heriplor Trojan uses API Hashing. [[1]](#1)|
+|[**Geodo**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/geodo.md) |August 2018| Geodo macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
 
 References
 ----------

anti-static-analysis/exe-code-optimize.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0034**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 

anti-static-analysis/exe-code-virtualize.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0008**|
-|**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique(s)**|None|
 
 

collection/README.md

@@ -5,20 +5,20 @@
 # Collection #
 Behaviors that identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.
 
-* **Access Call Log** [T1433](https://github.com/MAECProject/malware-behaviors/blob/master/collection/access-call-log.md)
-* **Access Sensitive Data or Credentials in Files** [T1409](https://github.com/MAECProject/malware-behaviors/blob/master/collection/access-sensitive-data.md)
-* **Audio Capture** [T1123](https://github.com/MAECProject/malware-behaviors/blob/master/collection/audio-capture.md)
-* **Automated Collection** [T1119](https://github.com/MAECProject/malware-behaviors/blob/master/collection/auto-collect.md)
-* **Capture SMS Message** [T1412](https://github.com/MAECProject/malware-behaviors/blob/master/collection/capture-sms.md)
-* **Clipboard Data** [T1115](https://github.com/MAECProject/malware-behaviors/blob/master/collection/clipboard-data.md)
-* **Data from Local System** [T1005](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-local-system.md)
-* **Data from Network Shared Drive** [T1039](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-network-share.md)
-* **Data from Removable Media** [T1025](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-removable-media.md)
-* **Data Staged** [T1074](https://github.com/MAECProject/malware-behaviors/blob/master/collection/data-staged.md)
-* **Email Collection** [T1114](https://github.com/MAECProject/malware-behaviors/blob/master/collection/email-collect.md)
-* **Input Capture** [T1056](https://github.com/MAECProject/malware-behaviors/blob/master/collection/input-capture.md)
-* **Location Tracking** [T1430](https://github.com/MAECProject/malware-behaviors/blob/master/collection/location-track.md)
-* **Man in the Browser** [T1185](https://github.com/MAECProject/malware-behaviors/blob/master/collection/man-in-browser.md)
-* **Microphone or Camera Recordings** [T1429](https://github.com/MAECProject/malware-behaviors/blob/master/collection/micro-cam-capture.md)
-* **Screen Capture** [T1113](https://github.com/MAECProject/malware-behaviors/blob/master/collection/screen-capture.md)
-* **Video Capture** [T1125](https://github.com/MAECProject/malware-behaviors/blob/master/collection/video-capture.md)
+* **Access Call Log** [T1433](https://github.com/MBCProject/mbc-markdown/blob/master/collection/access-call-log.md)
+* **Access Sensitive Data or Credentials in Files** [T1409](https://github.com/MBCProject/mbc-markdown/blob/master/collection/access-sensitive-data.md)
+* **Audio Capture** [T1123](https://github.com/MBCProject/mbc-markdown/blob/master/collection/audio-capture.md)
+* **Automated Collection** [T1119](https://github.com/MBCProject/mbc-markdown/blob/master/collection/auto-collect.md)
+* **Capture SMS Message** [T1412](https://github.com/MBCProject/mbc-markdown/blob/master/collection/capture-sms.md)
+* **Clipboard Data** [T1115](https://github.com/MBCProject/mbc-markdown/blob/master/collection/clipboard-data.md)
+* **Data from Local System** [T1005](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-local-system.md)
+* **Data from Network Shared Drive** [T1039](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-network-share.md)
+* **Data from Removable Media** [T1025](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-removable-media.md)
+* **Data Staged** [T1074](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-staged.md)
+* **Email Collection** [T1114](https://github.com/MBCProject/mbc-markdown/blob/master/collection/email-collect.md)
+* **Input Capture** [T1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
+* **Location Tracking** [T1430](https://github.com/MBCProject/mbc-markdown/blob/master/collection/location-track.md)
+* **Man in the Browser** [T1185](https://github.com/MBCProject/mbc-markdown/blob/master/collection/man-in-browser.md)
+* **Microphone or Camera Recordings** [T1429](https://github.com/MBCProject/mbc-markdown/blob/master/collection/micro-cam-capture.md)
+* **Screen Capture** [T1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
+* **Video Capture** [T1125](https://github.com/MBCProject/mbc-markdown/blob/master/collection/video-capture.md)

collection/access-call-log.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1433**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Access Call Log](https://attack.mitre.org/techniques/T1433/)|
 
 Access Call Log

collection/access-sensitive-data.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1409**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Access Sensitive Data or Credentials in Files](https://attack.mitre.org/techniques/T1409/)|
 
 Access Sensitive Data or Credentials in Files

collection/audio-capture.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1123**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Audio Capture](https://attack.mitre.org/techniques/T1123/)|
 
 Audio Capture

collection/auto-collect.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1119**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Automated Collection](https://attack.mitre.org/techniques/T1119/)|
 
 Automated Collection

collection/capture-sms.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1412**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Capture SMS Messages](https://attack.mitre.org/techniques/T1412/)|
 
 Capture SMS Messages

collection/clipboard-data.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1115**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Clipboard Data](https://attack.mitre.org/techniques/T1115/)|
 
 Clipboard Data

collection/data-local-system.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1005**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Data from Local System](https://attack.mitre.org/techniques/T1005/)|
 
 Data from Local System

collection/data-network-share.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1039**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Data from Network Shared Drive](https://attack.mitre.org/techniques/T1039/)|
 
 Data from Network Shared Drive

collection/data-removable-media.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1025**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Data from Removable Media](https://attack.mitre.org/techniques/T1025/)|
 
 Data from Removable Media

collection/data-staged.md

@@ -1,11 +1,11 @@
 |||
 |---------|------------------------|
 |**ID**|**T1074**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Data Staged](https://attack.mitre.org/techniques/T1074/)|
 
 Data Staged
 ===========
-Malware stages collected data prior to [Exfiltration](https://github.com/MAECProject/malware-behaviors/tree/master/exfiltration).
+Malware stages collected data prior to [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration).
 
 **See ATT&CK:** [**Data Staged**](https://attack.mitre.org/techniques/T1074/).

collection/email-collect.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1114**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Email Collection](https://attack.mitre.org/techniques/T1114/)|
 
 Email Collection

collection/input-capture.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1056**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Input Capture](https://attack.mitre.org/techniques/T1056/)|
 
 Input Capture

collection/location-track.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1430**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Location Tracking](https://attack.mitre.org/techniques/T1430/)|
 
 Location Tracking

collection/man-in-browser.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1185**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Man in the Browser](https://attack.mitre.org/techniques/T1185/)|
 
 Man in the Browser

collection/micro-cam-capture.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1429**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Microphone or Camera Recordings](https://attack.mitre.org/techniques/T1429/)|
 
 Microphone or Camera Recordings

collection/screen-capture.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1113**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|
 
 Screen Capture

collection/video-capture.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1125**|
-|**Objective(s)**|[Collection](https://github.com/MAECProject/malware-behaviors/tree/master/collection)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
 |**Related ATT&CK Technique(s)**|[Video Capture](https://attack.mitre.org/techniques/T1125/)|
 
 Video Capture

command-and-control/README.md

@@ -5,20 +5,20 @@
 # Command and Control
 Behaviors to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. 
 
-* **Command and Control Communication** [M0030](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/command-control-comm.md)
-* **Commonly Used Port** [T1043](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/common-port.md)
-* **Connection Proxy** [T1090](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/connect-proxy.md)
-* **Custom Command and Control Protocol** [T1094](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/custom-c2-protocol.md)
-* **Custom Cryptographic Protocol** [T1024](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/custom-crypto-protocol.md)
-* **Data Encoding** [T1132](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/data-encode.md)
-* **Data Obfuscation** [T1001](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/data-obfuscate.md)
-* **Domain Name Generation** [M0031:T1483](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/domain-name-generate.md)
-* **Fallback Channels** [T1008](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/fallback-channels.md)
-* **Multi-Stage Channels** [T1104](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/multi-stage-channels.md)
-* **Port Knocking** [T1205](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/port-knocking.md)
-* **Remote File Copy** [T1105](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/remote-file-copy.md)
-* **Standard Application Layer Protocol** [T1071](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/std-app-protocol.md)
-* **Standard Cryptographic Protocol** [T1032](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/std-crypto-protocol.md)
-* **Standard Non-Application Layer Protocol** [T1095](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/std-non-app-protocol.md)
-* **Uncommonly Used Port** [T1065](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/uncommon-port.md)
-* **Web Service** [T1102](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/web-service.md)
+* **Command and Control Communication** [M0030](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md)
+* **Commonly Used Port** [T1043](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/common-port.md)
+* **Connection Proxy** [T1090](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/connect-proxy.md)
+* **Custom Command and Control Protocol** [T1094](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/custom-c2-protocol.md)
+* **Custom Cryptographic Protocol** [T1024](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/custom-crypto-protocol.md)
+* **Data Encoding** [T1132](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/data-encode.md)
+* **Data Obfuscation** [T1001](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/data-obfuscate.md)
+* **Domain Name Generation** [M0031:T1483](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/domain-name-generate.md)
+* **Fallback Channels** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/fallback-channels.md)
+* **Multi-Stage Channels** [T1104](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/multi-stage-channels.md)
+* **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
+* **Remote File Copy** [T1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
+* **Standard Application Layer Protocol** [T1071](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-app-protocol.md)
+* **Standard Cryptographic Protocol** [T1032](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-crypto-protocol.md)
+* **Standard Non-Application Layer Protocol** [T1095](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-non-app-protocol.md)
+* **Uncommonly Used Port** [T1065](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/uncommon-port.md)
+* **Web Service** [T1102](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/web-service.md)

command-and-control/command-control-comm.md

@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
 |**ID**|**M0030**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|None|
 
 C2 Communication
 ================
 All command and control malware uses client/server communication. The methods listed below can be used to capture explicit communication details. 
 
-Command and Control Communication relates to *autonomous* client/server communications, not commands that are provided to an adversary. Commands provided to an attacker should be captured under [Remote Commands](https://github.com/MAECProject/malware-behaviors/blob/master/execution/remote-commands.md) under the Execution objective.
+Command and Control Communication relates to *autonomous* client/server communications, not commands that are provided to an adversary. Commands provided to an attacker should be captured under [Remote Commands](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md) under the Execution objective.
 
 Methods
 -------

command-and-control/common-port.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1043**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Commonly Used Port](https://attack.mitre.org/techniques/T1043/), [Commonly Used Port (Mobile)](https://attack.mitre.org/techniques/T1436/)|
 
 Commonly Used Port

command-and-control/connect-proxy.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1090**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Connection Proxy](https://attack.mitre.org/techniques/T1090/)|
 
 Connection Proxy

command-and-control/custom-c2-protocol.md

@@ -1,11 +1,11 @@
 |||
 |---------|------------------------|
 |**ID**|**T1094**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Custom Command and Control Protocol](https://attack.mitre.org/techniques/T1094/)|
 
 Custom Command and Control Protocol
 ===================================
-Malware may use a custom command and control protocol instead of encapsulating commands and data in a [Standard Application Layer Protocol](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control/std-protocol.md).
+Malware may use a custom command and control protocol instead of encapsulating commands and data in a [Standard Application Layer Protocol](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/std-protocol.md).
 
 **See ATT&CK:** [**Custom Command and Control Protocol**](https://attack.mitre.org/techniques/T1094/).

command-and-control/custom-crypto-protocol.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1024**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Custom Cryptographic Protocol](https://attack.mitre.org/techniques/T1024/)|
 
 Custom Cryptographic Protocol

command-and-control/data-encode.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1132**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Data Encoding](https://attack.mitre.org/techniques/T1132/)|
 
 Data Encoding

command-and-control/data-obfuscate.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1001**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Data Obfuscation](https://attack.mitre.org/techniques/T1001/)|
 
 Data Obfuscation

command-and-control/domain-name-generate.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0031:T1483**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/)|
 
 Domain Name Generation
@@ -14,8 +14,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Kraken**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/kraken.md) | April 2008 | Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
-|[**Conficker**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/conficker.md)| November 2008| Conficker uses a domain name generator. [[3]](#3)
+|[**Kraken**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md) | April 2008 | Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
+|[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)| November 2008| Conficker uses a domain name generator. [[3]](#3)
 
 References
 ----------

command-and-control/fallback-channels.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1008**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Fallback Channels](https://attack.mitre.org/techniques/T1008/)|
 
 Fallback Channels

command-and-control/multi-stage-channels.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1104**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Multi-Stage Channels](https://attack.mitre.org/techniques/T1104/)|
 
 Multi-Stage Channels

command-and-control/port-knocking.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1205**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control), [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Port Knocking](https://attack.mitre.org/techniques/T1205/)|
 
 Port Knocking

command-and-control/remote-file-copy.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1105**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control), [Lateral Movement](https://github.com/MAECProject/malware-behaviors/tree/master/lateral-movement)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
 |**Related ATT&CK Technique(s)**|[Remote File Copy](https://attack.mitre.org/techniques/T1105/)|
 
 Remote File Copy

command-and-control/std-app-protocol.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1071**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Standard Application Layer Protocol](https://attack.mitre.org/techniques/T1071/)|
 
 Standard Application Layer Protocol

command-and-control/std-crypto-protocol.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1032**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Standard Cryptographic Protocol](https://attack.mitre.org/techniques/T1032/)|
 
 Standard Cryptographic Protocol

command-and-control/std-non-app-protocol.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1095**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Standard Non-Application Layer Protocol](https://attack.mitre.org/techniques/T1095/)|
 
 Standard Non-Application Layer Protocol

command-and-control/uncommon-port.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1065**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Uncommonly Used Port](https://attack.mitre.org/techniques/T1065/)|
 
 Uncommonly Used Port

command-and-control/web-service.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1102**|
-|**Objective(s)**|[Command and Control](https://github.com/MAECProject/malware-behaviors/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique(s)**|[Web Service](https://attack.mitre.org/techniques/T1102/)|
 
 Web Service

credential-access/LLMNR-poison.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1171**|
-|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[LLMNR/NBT-NS Poisoning](https://attack.mitre.org/techniques/T1171/)|
 
 LLMNR/NBT-NS Poisoning

credential-access/README.md

@@ -5,14 +5,14 @@
 # Credential Access
 Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.
 
-* **Access Sensitive Data or Credentials in Files** [T1409](https://github.com/MAECProject/malware-behaviors/blob/master/collection/access-sensitive-data.md)
-* **Account Manipulation** [T1098](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/acct-manipulate.md)
-* **Capture SMS Messages** [T1412](https://github.com/MAECProject/malware-behaviors/blob/master/collection/capture-sms.md)
-* **Credential Dumping** [T1003](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/credential-dump.md)
-* **Credentials in Files** [T1081](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/credentials-in-files.md)
-* **Hooking** [E1179](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/hooking.md)
-* **Input Capture** [T1056](https://github.com/MAECProject/malware-behaviors/blob/master/collection/input-capture.md)
-* **LLMNR/NBT-NS Poisoning** [T1171](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/LLMNR-poison.md)
-* **Network Sniffing** [T1040](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/network-sniff.md)
-* **Private Keys** [T1145](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/private-keys.md)
-* **Replication Through Removable Media** [T1091](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/replicate-remove-media.md)
+* **Access Sensitive Data or Credentials in Files** [T1409](https://github.com/MBCProject/mbc-markdown/blob/master/collection/access-sensitive-data.md)
+* **Account Manipulation** [T1098](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/acct-manipulate.md)
+* **Capture SMS Messages** [T1412](https://github.com/MBCProject/mbc-markdown/blob/master/collection/capture-sms.md)
+* **Credential Dumping** [T1003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credential-dump.md)
+* **Credentials in Files** [T1081](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-files.md)
+* **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Input Capture** [T1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
+* **LLMNR/NBT-NS Poisoning** [T1171](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/LLMNR-poison.md)
+* **Network Sniffing** [T1040](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/network-sniff.md)
+* **Private Keys** [T1145](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/private-keys.md)
+* **Replication Through Removable Media** [T1091](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/replicate-remove-media.md)

credential-access/acct-manipulate.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1098**|
-|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Account Manipulation](https://attack.mitre.org/techniques/T1098/)|
 
 Account Manipulation

credential-access/credential-dump.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1003**|
-|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Credential Dumping](https://attack.mitre.org/techniques/T1003/)|
 
 Credential Dumping

credential-access/credentials-in-files.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1081**|
-|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Credentials in Files](https://attack.mitre.org/techniques/T1081/)|
 
 Credentials in Files

credential-access/hooking.md

@@ -1,17 +1,17 @@
 |||
 |------------------|------------------------|
 |**ID**|**E1179**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis), [Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access), [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence), [Privilege Escalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
 |**Related ATT&CK Technique**|[Hooking](https://attack.mitre.org/techniques/T1179/)|
 
 
 Hooking
 =======
-Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Obstruction](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/memory-dump-obstruct.md).
+Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Obstruction](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/memory-dump-obstruct.md).
 
 For discussion related to the Credential Access, Persistence, and Privilege Escalation objectives, see ATT&CK: [**Hooking**](https://attack.mitre.org/techniques/T1179/). 
 
-Note that in MBC, but not in ATT&CK, Hooking is also associated with the [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion) and [Anti-Behavioral Analysis](https://github.com/MAECProject/malware-behaviors/tree/master/anti-behavioral-analysis) objectives.
+Note that in MBC, but not in ATT&CK, Hooking is also associated with the [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion) and [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis) objectives.
 
 Methods
 -------

credential-access/private-keys.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1145**|
-|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Private Keys](https://attack.mitre.org/techniques/T1145/)|
 
 Private Keys

credential-access/replicate-remove-media.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1091**|
-|**Objective(s)**|[Credential Access](https://github.com/MAECProject/malware-behaviors/tree/master/credential-access)|
+|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique(s)**|[Replicate Through Removeable Media](https://attack.mitre.org/techniques/T1091/)|
 
 Replicate Through Removable Media

defense-evasion/README.md

@@ -5,45 +5,45 @@
 # Defense Evasion #
 Behaviors that evade detection or avoid other defenses.
 
-* **Access Token Manipulation** [T1134](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/access-token.md)
-* **Alternative Installation Location** [M0027](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/alter-install-location.md)
-* **Application Discovery** [T1418](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/app-discover.md)
-* **Binary Padding** [T1009](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/binary-pad.md)
-* **BITS Jobs** [T1197](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/bits-jobs.md)
-* **Boot Sector Modification** [M0028](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/boot-sector-mod.md)
-* **Bypass User Account Control** [T1088](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/bypass-user-acct-cntl.md)
-* **Code Signing** [T1116](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/code-signing.md)
-* **Component Object Model Hijacking** [T1122](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/component-hijack.md)
-* **DCShadow** [T1207](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/dcshadow.md)
-* **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/deobfuscate-files.md)
-* **Disabling Security Tools** [E1089](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/disable-security-tools.md)
-* **DLL Search Order Hijacking** [T1038](https://github.com/MAECProject/malware-behaviors/blob/master/privilege-escalation/dll-search-order-hijack.md)
-* **Executable Code Compression** [E1045](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-compression.md)
-* **Execution Guardrails** [E1480](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/execution-guardrails.md)
-* **Exploitations for Defense Evasion** [T1211](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/exploit-for-defense.md)
-* **File Deletion** [E1107](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/file-deletion.md)
-* **File System Logical Offsets** [T1006](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/file-sys-logical-offset.md)
-* **Hidden Files and Directories** [T1158](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/hidden-files.md)
-* **HISTCONTROL** [T1148](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/histcontrol.md)
-* **Hooking** [E1179](https://github.com/MAECProject/malware-behaviors/blob/master/credential-access/hooking.md)
-* **Image File Execution Options Injection** [T1183](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/image-file-exe-opt-inj.md)
-* **Indicator Blocking** [E1054](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/indicator-blocking.md)
-* **Indicator Removal on Host** [T1070](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/indicator-remove-host.md)
-* **Indirect Command Execution** [T1202](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/indirect-command.md)
-* **Install Root Certificate** [T1130](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/install-root-cert.md)
-* **Masquerading** [T1036](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/masquerading.md)
-* **Modify Registry** [T1112](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/modify-reg.md)
-* **Modify Trusted Execution Environment** [T1399](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/mod-trust-exe-environ.md)
-* **Obfuscated Files or Information** [E1027](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/obfuscate-files.md)
-* **Polymorphic Code** [M0029](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/polymorphic-code.md)
-* **Port Knocking** [T1205](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/port-knocking.md)
-* **Process Injection** [T1055](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/process-inject.md)
-* **Redundant Access** [T1008](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/redundant-access.md)
-* **Regsvr32** [T1117](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/regsvr32.md)
-* **Rundll32** [T1085](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/rundll32.md)
-* **Rootkit Behavior** [E1014](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/rootkit-behavior.md)
-* **Scripting** [T1064](https://github.com/MAECProject/malware-behaviors/blob/master/execution/scripting.md)
-* **Software Packing** [E1045](https://github.com/MAECProject/malware-behaviors/blob/master/anti-static-analysis/exe-code-compression.md)
-* **Timestomp** [T1099](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/timestomp.md)
-* **Virtualization/Sandbox Evasion** [T1497](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/virtualization-sandbox-evade.md)
-* **Web Service** [T1102](https://github.com/MAECProject/malware-behaviors/blob/master/command-and-control/web-service.md)
+* **Access Token Manipulation** [T1134](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/access-token.md)
+* **Alternative Installation Location** [M0027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/alter-install-location.md)
+* **Application Discovery** [T1418](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/app-discover.md)
+* **Binary Padding** [T1009](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/binary-pad.md)
+* **BITS Jobs** [T1197](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bits-jobs.md)
+* **Boot Sector Modification** [M0028](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/boot-sector-mod.md)
+* **Bypass User Account Control** [T1088](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-user-acct-cntl.md)
+* **Code Signing** [T1116](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/code-signing.md)
+* **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md)
+* **DCShadow** [T1207](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/dcshadow.md)
+* **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md)
+* **Disabling Security Tools** [E1089](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)
+* **DLL Search Order Hijacking** [T1038](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/dll-search-order-hijack.md)
+* **Executable Code Compression** [E1045](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md)
+* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
+* **Exploitations for Defense Evasion** [T1211](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/exploit-for-defense.md)
+* **File Deletion** [E1107](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/file-deletion.md)
+* **File System Logical Offsets** [T1006](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/file-sys-logical-offset.md)
+* **Hidden Files and Directories** [T1158](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/hidden-files.md)
+* **HISTCONTROL** [T1148](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/histcontrol.md)
+* **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Image File Execution Options Injection** [T1183](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/image-file-exe-opt-inj.md)
+* **Indicator Blocking** [E1054](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indicator-blocking.md)
+* **Indicator Removal on Host** [T1070](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indicator-remove-host.md)
+* **Indirect Command Execution** [T1202](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indirect-command.md)
+* **Install Root Certificate** [T1130](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/install-root-cert.md)
+* **Masquerading** [T1036](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/masquerading.md)
+* **Modify Registry** [T1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
+* **Modify Trusted Execution Environment** [T1399](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/mod-trust-exe-environ.md)
+* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
+* **Polymorphic Code** [M0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md)
+* **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
+* **Process Injection** [T1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md)
+* **Redundant Access** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/redundant-access.md)
+* **Regsvr32** [T1117](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/regsvr32.md)
+* **Rundll32** [T1085](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rundll32.md)
+* **Rootkit Behavior** [E1014](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rootkit-behavior.md)
+* **Scripting** [T1064](https://github.com/MBCProject/mbc-markdown/blob/master/execution/scripting.md)
+* **Software Packing** [E1045](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md)
+* **Timestomp** [T1099](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/timestomp.md)
+* **Virtualization/Sandbox Evasion** [T1497](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/virtualization-sandbox-evade.md)
+* **Web Service** [T1102](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/web-service.md)

defense-evasion/access-token.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1134**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Access Token Manipulation](https://attack.mitre.org/techniques/T1134)|
 
 

defense-evasion/alter-install-location.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0027**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|None|
 
 

defense-evasion/binary-pad.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1009**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Binary Padding](https://attack.mitre.org/techniques/T1009)|
 
 

defense-evasion/bits-jobs.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1197**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[BITS Jobs](https://attack.mitre.org/techniques/T1197)|
 
 

defense-evasion/boot-sector-mod.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0028**|
-|**Objective(s)**|[Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Bootkit](https://attack.mitre.org/techniques/T1067/)|
 
 Boot Sector Modification

defense-evasion/bypass-user-acct-cntl.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1088**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
 |**Related ATT&CK Technique(s)**|[Bypass User Account Control](https://attack.mitre.org/techniques/T1088)|
 
 

defense-evasion/code-signing.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1116**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Code Signing](https://attack.mitre.org/techniques/T1116)|
 
 

defense-evasion/component-hijack.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1122**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Componpent Object Model Hijacking](https://attack.mitre.org/techniques/T1122)|
 
 

defense-evasion/dcshadow.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1207**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[DCShadow](https://attack.mitre.org/techniques/T1207)|
 
 

defense-evasion/deobfuscate-files.md

@@ -1,12 +1,12 @@
 |||
 |---------|------------------------|
 |**ID**|**T1140**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)|
 
 
 Deobfuscate/Decode Files or Information
 =======================================
-This behavior is the counterpart to [Obfuscated Files or Information](https://github.com/MAECProject/malware-behaviors/blob/master/defense-evasion/obfuscate-files.md), which is used to hide artifacts of an intrusion. 
+This behavior is the counterpart to [Obfuscated Files or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md), which is used to hide artifacts of an intrusion. 
 
 See ATT&CK: [**Deobfuscate/Decode Files or Information**](https://attack.mitre.org/techniques/T1140).

defense-evasion/disable-security-tools.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1089**|
-|**Objective(s)**|[Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Disabling Security Tools](https://attack.mitre.org/techniques/T1089/)|
 
 Disabling Security Tools
@@ -22,7 +22,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**WebCobra**](https://github.com/MAECProject/malware-behaviors/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
 
 References
 ----------

defense-evasion/exploit-for-defense.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1211**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211)|
 
 

defense-evasion/file-deletion.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1107**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[File Deletion](https://attack.mitre.org/techniques/T1107)|
 
 

defense-evasion/file-sys-logical-offset.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1006]**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[File System Logical Offsets](https://attack.mitre.org/techniques/T1006)|
 
 

defense-evasion/hidden-files.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1158**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Hidden Files and Directories](https://attack.mitre.org/techniques/T1158)|
 
 

defense-evasion/histcontrol.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1148**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[HISTCONTROL](https://attack.mitre.org/techniques/T1148)|
 
 

defense-evasion/image-file-exe-opt-inj.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1183**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Image File Execution Options Injection](https://attack.mitre.org/techniques/T1183)|
 
 

defense-evasion/indicator-blocking.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1054**|
-|**Objective(s)**|[Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Indicator Blocking](https://attack.mitre.org/techniques/T1054/)|
 
 Indicator Blocking

defense-evasion/indicator-remove-host.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1070**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Indicator Removal on Host](https://attack.mitre.org/techniques/T1070)|
 
 

defense-evasion/indirect-command.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1202**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Indirect Command Execution](https://attack.mitre.org/techniques/T1202)|
 
 

defense-evasion/install-root-cert.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1130**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Install Root Certificate](https://attack.mitre.org/techniques/T1130)|
 
 

defense-evasion/masquerading.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1036**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Masquerading](https://attack.mitre.org/techniques/T1036)|
 
 

defense-evasion/mod-trust-exe-environ.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1399**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Modify Trusted Execution Environment](https://attack.mitre.org/techniques/T1399)|
 
 

defense-evasion/modify-reg.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1112**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|
 
 

defense-evasion/obfuscate-files.md

@@ -1,12 +1,12 @@
 |||
 |---------|------------------------|
 |**ID**|**E1027**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)|
 
 
 Obfuscated Files or Information
 ===============================
-Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. A related MBC behavior, associated explicitly with executable code and its analysis, is [Executable Code Obfuscation](https://github.com/MAECProject/malware-behaviors/tree/master/anti-static-analysis/exe-code-obfuscate.md).
+Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. A related MBC behavior, associated explicitly with executable code and its analysis, is [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis/exe-code-obfuscate.md).
 
 See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).

defense-evasion/polymorphic-code.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0029**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|None|
 
 

defense-evasion/process-inject.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1055**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Privilege Excalation](https://github.com/MAECProject/malware-behaviors/tree/master/privilege-escalation)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Excalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
 |**Related ATT&CK Technique(s)**|[Process Injection](https://attack.mitre.org/techniques/T1055)|
 
 

defense-evasion/redundant-access.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1108**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Persistence](https://github.com/MAECProject/malware-behaviors/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique(s)**|[Redundant Access](https://attack.mitre.org/techniques/T1108)|
 
 

defense-evasion/regsvr32.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1117**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Execution](https://github.com/MAECProject/malware-behaviors/tree/master/execution)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique(s)**|[Regsvr32](https://attack.mitre.org/techniques/T1117)|
 
 Regsvr32

defense-evasion/rootkit-behavior.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1014**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Rootkit](https://attack.mitre.org/techniques/T1014)|
 
 

defense-evasion/rundll32.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1085**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Execution](https://github.com/MAECProject/malware-behaviors/tree/master/execution)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique(s)**|[Rundll32](https://attack.mitre.org/techniques/T1085)|
 
 Rundll32

defense-evasion/timestomp.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1099**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Timestomp](https://attack.mitre.org/techniques/T1099)|
 
 

defense-evasion/virtualization-sandbox-evade.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1497**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique(s)**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)|
 
 
@@ -11,4 +11,4 @@ Malware may check for the presence or a virtual machine or sandbox to avoid dete
 
 See ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497). Note that the ATT&CK technique primarily refers to checks made by an adversary.
 
-The ATT&CK Virtualization/Sandbox Evasion technique relates explicitly to Defense Evasion, whereas two related MBC behaviors pertain to malware anti-analysis objectives: for details see [Sandbox Detection](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-sandbox.md) and [Virtual Machine Detection](https://github.com/MAECProject/malware-behaviors/blob/master/anti-behavioral-analysis/detect-vm.md).
+The ATT&CK Virtualization/Sandbox Evasion technique relates explicitly to Defense Evasion, whereas two related MBC behaviors pertain to malware anti-analysis objectives: for details see [Sandbox Detection](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-sandbox.md) and [Virtual Machine Detection](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-vm.md).

discovery/README.md

@@ -5,24 +5,24 @@
 # Discovery #
 Behaviors that aim to gain knowledge about the system and internal network.
 
-* **Account Discovery** [T1087](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/account-discover.md)
-* **Analysis Tool Discovery** [M0013](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/analysis-tool-discover.md)
-* **Application Discovery** [T1418](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/app-discover.md)
-* **Application Window Discovery** [T1010](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/app-window-discover.md)
-* **Device Type Discovery** [T1419](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/device-type-discover.md)
-* **File and Directory Discovery** [T1083](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/file-and-directory-discover.md)
-* **Local Network Configuration Discovery** [T1422](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/local-network-configuration-discover.md)
-* **Network Sniffing** [T1040](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/network-sniff.md)
-* **Network Service Scanning** [T1046](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/network-service-scan.md)
-* **Peripheral Device Discovery** [T1120](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/peripheral-device-discover.md)
-* **Process Discovery** [T1057](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/process-discover.md)
-* **Query Registry** [T1012](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/query-registry.md)
-* **Remote System Discovery** [T1018](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/remote-sys-discover.md)
-* **Security Software Discovery** [T1063](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/security-sw-discover.md)
-* **SMTP Connection Discovery** [M0014](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/smtp-connect-discover.md)
-* **System Information Discovery** [T1082](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-info-discover.md)
-* **System Network Configuration Discovery** [T1016](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-network-config-discover.md)
-* **System Network Connections Discovery** [T1049](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-network-conn-discover.md)
-* **System Owner/User Discovery** [T1033](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-owner-discover.md)
-* **System Service Discovery** [T1007](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-service-discover.md)
-* **System Time Discovery** [T1124](https://github.com/MAECProject/malware-behaviors/blob/master/discovery/system-time-discover.md)
+* **Account Discovery** [T1087](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/account-discover.md)
+* **Analysis Tool Discovery** [M0013](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/analysis-tool-discover.md)
+* **Application Discovery** [T1418](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/app-discover.md)
+* **Application Window Discovery** [T1010](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/app-window-discover.md)
+* **Device Type Discovery** [T1419](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/device-type-discover.md)
+* **File and Directory Discovery** [T1083](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/file-and-directory-discover.md)
+* **Local Network Configuration Discovery** [T1422](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/local-network-configuration-discover.md)
+* **Network Sniffing** [T1040](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/network-sniff.md)
+* **Network Service Scanning** [T1046](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/network-service-scan.md)
+* **Peripheral Device Discovery** [T1120](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/peripheral-device-discover.md)
+* **Process Discovery** [T1057](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/process-discover.md)
+* **Query Registry** [T1012](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/query-registry.md)
+* **Remote System Discovery** [T1018](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/remote-sys-discover.md)
+* **Security Software Discovery** [T1063](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/security-sw-discover.md)
+* **SMTP Connection Discovery** [M0014](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/smtp-connect-discover.md)
+* **System Information Discovery** [T1082](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-info-discover.md)
+* **System Network Configuration Discovery** [T1016](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-network-config-discover.md)
+* **System Network Connections Discovery** [T1049](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-network-conn-discover.md)
+* **System Owner/User Discovery** [T1033](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-owner-discover.md)
+* **System Service Discovery** [T1007](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-service-discover.md)
+* **System Time Discovery** [T1124](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-time-discover.md)

discovery/account-discover.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1087**|
-|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
+|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique(s)**|[Account Discovery](https://attack.mitre.org/techniques/T1087)|
 
 

discovery/analysis-tool-discover.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**M0013**|
-|**Objective(s)**|[Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
+|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique(s)**|None|
 
 

discovery/app-discover.md

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**T1418**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MAECProject/malware-behaviors/tree/master/defense-evasion), [Discovery](https://github.com/MAECProject/malware-behaviors/tree/master/discovery)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique(s)**|[Application Discovery](https://attack.mitre.org/techniques/T1418)|