update mbc-beta hyperlinks to mbc-markdown equivalents

2026-06-08 11:36:36 +00:00 · 2020-08-14 14:54:01 -04:00
parent 2207d845ae
commit 74d816deb1
151 changed files with 467 additions and 467 deletions
@@ -1,5 +1,5 @@
 # <a name="mbc"></a>Malware Behavior Catalog v2.0 #
-The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-beta/blob/master/yfaq/README.md) page for answers to common questions.
+The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-markdown/blob/master/yfaq/README.md) page for answers to common questions.

 Check out the [MBC presentation](https://www.youtube.com/watch?v=KY8Ty-0sdVU) given at BSides DC (October 2019).

@@ -17,7 +17,7 @@ Methods are associated with behaviors and serve different roles, depending on th
 Note that a method cannot be used without a behavior.

 ### Micro-behaviors ###
-Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/README.md) for details.
+Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/README.md) for details.

 ### <a name="ids"></a>Identifiers ###
 As shown below, the letter of an identifier relays information about a behavior. 
@@ -49,27 +49,27 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**.
 Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.

 ### Example Malware ###
-The MBC also contains a collection of [example malware](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/) that are characterized with malware behaviors.
+The MBC also contains a collection of [example malware](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/) that are characterized with malware behaviors.

 ## Micro-behavior Objectives ##
-[Micro-behaviors](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/README.md) and their associated objectives are under development.
+[Micro-behaviors](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/README.md) and their associated objectives are under development.

 ## Malware Objective Descriptions ##
 Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors.

 |**Objective**|**Description**|
 |------------------------------------------------------------------|----------------------------|
-|[**Anti-Behavioral Analysis**](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/README.md) |Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
-|[**Anti-Static Analysis**](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/README.md)| Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
-|[**Collection**](https://github.com/MBCProject/mbc-beta/blob/master/collection/README.md) | Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
-|[**Command and Control**](https://github.com/MBCProject/mbc-beta/blob/master/command-and-control/README.md) |Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
-|[**Credential Access**](https://github.com/MBCProject/mbc-beta/blob/master/credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
-|[**Defense Evasion**](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
-|[**Discovery**](https://github.com/MBCProject/mbc-beta/blob/master/discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
-|[**Execution**](https://github.com/MBCProject/mbc-beta/blob/master/execution/README.md)| Malware aims to execute its code on a system to achieve a variety of goals.|
-|[**Exfiltration**](https://github.com/MBCProject/mbc-beta/blob/master/exfiltration/README.md)|  Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
-|[**Impact**](https://github.com/MBCProject/mbc-beta/blob/master/impact/README.md)| Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
-|[**Lateral Movement**](https://github.com/MBCProject/mbc-beta/blob/master/lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
-|[**Persistence**](https://github.com/MBCProject/mbc-beta/blob/master/persistence/README.md)|Malware aims to remain on a system regardless of system events.|
-|[**Privilege Escalation**](https://github.com/MBCProject/mbc-beta/blob/master/privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
+|[**Anti-Behavioral Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/README.md) |Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.|
+|[**Anti-Static Analysis**](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/README.md)| Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.|
+|[**Collection**](https://github.com/MBCProject/mbc-markdown/blob/master/collection/README.md) | Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.|
+|[**Command and Control**](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/README.md) |Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).|
+|[**Credential Access**](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.|
+|[**Defense Evasion**](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.|
+|[**Discovery**](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/README.md)|Malware aims to gain knowledge about the system and internal network.|
+|[**Execution**](https://github.com/MBCProject/mbc-markdown/blob/master/execution/README.md)| Malware aims to execute its code on a system to achieve a variety of goals.|
+|[**Exfiltration**](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/README.md)|  Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).|
+|[**Impact**](https://github.com/MBCProject/mbc-markdown/blob/master/impact/README.md)| Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.|
+|[**Lateral Movement**](https://github.com/MBCProject/mbc-markdown/blob/master/lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
+|[**Persistence**](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/README.md)|Malware aims to remain on a system regardless of system events.|
+|[**Privilege Escalation**](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|

@@ -7,19 +7,19 @@ Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugge

 Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).

-* **Capture Evasion** [B0036](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/evade-capture.md)
-* **Debugger Detection** [B0001](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/detect-debugger.md)
-* **Debugger Evasion** [B0002](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/evade-debugger.md)
-* **Dynamic Analysis Evasion** [B0003](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md)
-* **Emulator Detection** [B0004](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/detect-emulator.md)
-* **Emulator Evasion** [B0005](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/evade-emulator.md)
-* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/exe-code-virtualize.md)
-* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/execution-guardrails.md)
-* **Hooking** [F0003](https://github.com/MBCProject/mbc-beta/blob/master/credential-access/hooking.md)
-* **Memory Dump Evasion** [B0006](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/evade-memory-dump.md)
-* **Sandbox Detection** [B0007](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/detect-sandbox.md)
-* **Software Packing** [F0001](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/software-packing.md)
-* **Virtual Machine Detection** [B0009](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/detect-vm.md)
+* **Capture Evasion** [B0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-capture.md)
+* **Debugger Detection** [B0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-debugger.md)
+* **Debugger Evasion** [B0002](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-debugger.md)
+* **Dynamic Analysis Evasion** [B0003](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md)
+* **Emulator Detection** [B0004](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-emulator.md)
+* **Emulator Evasion** [B0005](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-emulator.md)
+* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
+* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Memory Dump Evasion** [B0006](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md)
+* **Sandbox Detection** [B0007](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-sandbox.md)
+* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
+* **Virtual Machine Detection** [B0009](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-vm.md)

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0001**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -57,7 +57,7 @@ Malware Examples
 ----------------
 |Name|Date|ID|Description|
 |-----------------------------|--------|--------|-----------------------------|
-|[**Redhip**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/redhip.md)|January 2011|M0001.034, M0001.019|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/redhip.md)|January 2011|M0001.034, M0001.019|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0004**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0007**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Sub-techniques**|[Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/), [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/)|


@@ -9,7 +9,7 @@ Sandbox Detection
 =================
 Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.

-The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
+The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.

 Methods
 -------
@@ -29,10 +29,10 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Redhip**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
-|[**Rombertik**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/rombertik.md)|May 2015|[[2]](#2)|
-|[**Terminator**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4) |
-|[**Ursnif**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
+|[**Rombertik**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/rombertik.md)|May 2015|[[2]](#2)|
+|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4) |
+|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0009**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|


@@ -9,7 +9,7 @@ Virtual Machine Detection
 =========================
 Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)

-The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.
+The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.

 Methods
 -------
@@ -79,9 +79,9 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**GravityRAT**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
-|[**Redhip**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
+|[**GravityRAT**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0036**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

 Capture Evasion
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0002**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -52,7 +52,7 @@ Malware Examples
 |-----------------------------|--------|-----------------------------|
 |**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)|
 |**Dridex**|March 2015|[[3]](#3)|
-|[**Redhip**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|

 References
 ----------
@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
 |**ID**|**B0003**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|

 Dynamic Analysis Evasion
 ========================
 Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine. 

-See [Emulator Evasion](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 
+See [Emulator Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 

 Methods
 -------
@@ -30,11 +30,11 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**Ursnif**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
-|[**Terminator**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/terminator.md)|October 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
+|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)|May 2016|Ursnif uses malware macros to evade sandbox detection. [[2]](#2)|
+|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|October 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
 |**Nap**|2013|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
 |**Smokeloader**|2019|Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [[4]](#4)|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|Evades dynamic analysis.)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades dynamic analysis.)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0005**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

 Emulator Evasion
@@ -21,4 +21,4 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0006**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

 Memory Dump Evasion
@@ -19,14 +19,14 @@ Methods
 |B0006.005|**Tampering**|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
 |B0006.006|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
 |B0006.007|**On-the-Fly APIs**|Resolve API addresses before each use to prevent complete dumping.|
-|B0006.008|**Feed Misinformation**|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-beta/blob/master/credential-access/hooking.md).|
+|B0006.008|**Feed Misinformation**|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md).|
 |B0006.009|**Flow Opcode Obstruction**|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).

 Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[Kraken](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/kraken.md)| April 2008| Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
+|[Kraken](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md)| April 2008| Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|

 References
 ----------
@@ -1,12 +1,12 @@
 |||
 |---------|------------------------|
 |**ID**|**E1480**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|

 Execution Guardrails
 ====================
-Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
+Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.

 **See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).

@@ -7,13 +7,13 @@ Behaviors and code characteristics that prevent static analysis or make it more

 Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).

-* **Call Graph Generation Evasion** [B0010](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/evade-call-graph.md)
-* **Disassembler Evasion** [B0012](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/evade-disassembler.md)
-* **Executable Code Obfuscation** [B0032](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/exe-code-obfuscate.md)
-* **Executable Code Optimization** [B0034](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/exe-code-optimize.md)
-* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/exe-code-virtualize.md)
-* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/obfuscate-files.md)
-* **Software Packing** [F0001](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/software-packing.md)
+* **Call Graph Generation Evasion** [B0010](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-call-graph.md)
+* **Disassembler Evasion** [B0012](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-disassembler.md)
+* **Executable Code Obfuscation** [B0032](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md)
+* **Executable Code Optimization** [B0034](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-optimize.md)
+* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
+* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
+* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)


 References
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0010**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0012**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0032**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -9,7 +9,7 @@ Executable Code Obfuscation
 ===========================
 Executable code can be obfuscated to hinder disassembly and static code analysis. This behavior is specific to a malware sample's executable code (data and text sections).

-For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see [**Obfuscated Files or Information**](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/obfuscate-files.md).
+For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see [**Obfuscated Files or Information**](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md).

 Methods
 -------
@@ -38,9 +38,9 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------------------------|--------|-----------------------------|
-|[**Heriplor**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
-|[**Emotet**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**Heriplor**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
+|[**Emotet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0034**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0008**|
-|**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis)|
+|**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|


@@ -21,7 +21,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Locky Bart**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|
+|[**Locky Bart**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/locky-bart.md)|January 2017|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**F0001**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Obfuscated Files or Information: Software Packing](https://attack.mitre.org/techniques/T1027/002)|

 Software Packing
@@ -31,7 +31,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Redhip**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|

 References
 ----------
@@ -5,8 +5,8 @@
 # Collection #
 Behaviors that identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.

-* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-beta/blob/master/collection/cryptocurrency.md)
-* **Hooking** [F0003](https://github.com/MBCProject/mbc-beta/blob/master/credential-access/hooking.md)
-* **Input Capture** [E1056](https://github.com/MBCProject/mbc-beta/blob/master/collection/input-capture.md)
-* **Keylogging** [F0002](https://github.com/MBCProject/mbc-beta/blob/master/collection/keylogging.md)
-* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-beta/blob/master/collection/screen-capture.md)
+* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-markdown/blob/master/collection/cryptocurrency.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Input Capture** [E1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
+* **Keylogging** [F0002](https://github.com/MBCProject/mbc-markdown/blob/master/collection/keylogging.md)
+* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0028**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-beta/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-beta/tree/master/credential-access)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique**|None|

 Cryptocurrency
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1056**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-beta/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-beta/tree/master/credential-access)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique**|[Input Capture](https://attack.mitre.org/techniques/T1056)|

 Input Capture
@@ -20,4 +20,4 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Poison Ivy**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/poison-ivy.md)|2005|Captures input.|
+|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/poison-ivy.md)|2005|Captures input.|
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**F0002**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-beta/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-beta/tree/master/credential-access)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Sub-Technique**|[Input Capture: Keylogging](https://attack.mitre.org/techniques/T1056/001)|

 Keylogging
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1113**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-beta/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-beta/tree/master/credential-access)|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|

 Screen Capture
@@ -5,6 +5,6 @@
 # Command and Control
 Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.

-* **Command and Control Communication** [B0030](https://github.com/MBCProject/mbc-beta/blob/master/command-and-control/command-control-comm.md)
-* **Domain Name Generation** [B0031](https://github.com/MBCProject/mbc-beta/blob/master/command-and-control/domain-name-generate.md)
-* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-beta/blob/master/command-and-control/remote-file-copy.md)
+* **Command and Control Communication** [B0030](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md)
+* **Domain Name Generation** [B0031](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/domain-name-generate.md)
+* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
 |**ID**|**B0030**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-beta/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique**|None|

 C2 Communication
 ================
-All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](https://github.com/MBCProject/mbc-beta/blob/master/command-and-control/remote-file-copy.md).
+All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md).

-Command and Control Communication relates to *autonomous* client/server communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](https://github.com/MBCProject/mbc-beta/blob/master/execution/remote-commands.md) under the Execution objective).
+Command and Control Communication relates to *autonomous* client/server communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md) under the Execution objective).

 Methods
 -------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0031**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-beta/tree/master/command-and-control)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/)|

 Domain Name Generation
@@ -14,8 +14,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Kraken**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/kraken.md) | April 2008 | Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
-|[**Conficker**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/conficker.md)| November 2008| Conficker uses a domain name generator. [[3]](#3)
+|[**Kraken**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kraken.md) | April 2008 | Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
+|[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)| November 2008| Conficker uses a domain name generator. [[3]](#3)

 References
 ----------
@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
 |**ID**|**E1105**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-beta/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-beta/tree/master/lateral-movement), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence)|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)|

 Remote File Copy
 ================
 Malware may copy files from one system to another. 

-Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](https://github.com/MBCProject/mbc-beta/blob/master/execution/install-prog.md) behavior. 
+Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md) behavior. 

 **See ATT&CK:** [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1105/).

@@ -16,8 +16,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|

 References
 ----------
@@ -5,11 +5,11 @@
 # Credential Access
 Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.

-* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-beta/blob/master/collection/cryptocurrency.md)
-* **Hooking** [F0003](https://github.com/MBCProject/mbc-beta/blob/master/credential-access/hooking.md)
-* **Input Capture** [E1056](https://github.com/MBCProject/mbc-beta/blob/master/collection/input-capture.md)
-* **Keylogging** [F0002](https://github.com/MBCProject/mbc-beta/blob/master/collection/keylogging.md)
-* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-beta/blob/master/collection/screen-capture.md)
+* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-markdown/blob/master/collection/cryptocurrency.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Input Capture** [E1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
+* **Keylogging** [F0002](https://github.com/MBCProject/mbc-markdown/blob/master/collection/keylogging.md)
+* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)



@@ -1,17 +1,17 @@
 |||
 |------------------|------------------------|
 |**ID**|**F0003**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis), [Collection](https://github.com/MBCProject/mbc-beta/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-beta/tree/master/credential-access), [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-beta/tree/master/privilege-escalation)|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
 |**Related ATT&CK Sub-Technique**|[Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)|


 Hooking
 =======
-Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/evade-memory-dump.md).
+Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md).

 For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/). 

-Note that in MBC, Hooking is also associated with the [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-beta/tree/master/privilege-escalation), and [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis) objectives.
+Note that in MBC, Hooking is also associated with the [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation), and [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis) objectives.

 Methods
 -------
@@ -28,7 +28,7 @@ Malware Examples
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
 |**Kronos**|June 2014 |Kronos hooks the API of processes to prevent detection. [[2]](#2)|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|

 References
 ----------
@@ -5,21 +5,21 @@
 # Defense Evasion #
 Behaviors that evade detection or avoid other defenses.

-* **Alternative Installation Location** [B0027](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/alter-install-location.md)
-* **Bootkit** [F0013](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/boot-sector-mod.md)
-* **Bypass DEP** [B0037](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/bypass-dep.md)
-* **Component Firmware** [F0009](https://github.com/MBCProject/mbc-beta/blob/master/persistence/component-firmware.md)
-* **Covert Location** [B0040](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/covert-location.md)
-* **Disable Security Tools** [F0004](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/disable-security-tools.md)
-* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-beta/blob/master/anti-behavioral-analysis/execution-guardrails.md)
-* **Hidden Files and Directories** [F0005](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/hidden-files.md)
-* **Hooking** [F0003](https://github.com/MBCProject/mbc-beta/blob/master/credential-access/hooking.md)
-* **Indicator Blocking** [F0006](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/indicator-blocking.md)
-* **Install Insecure or Malicious Configuration** [E1478](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/config-mod.md)
-* **Modify Registry** [E1112](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/modify-reg.md)
-* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/obfuscate-files.md)
-* **Polymorphic Code** [B0029](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/polymorphic-code.md)
-* **Process Injection** [E1055](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/process-inject.md)
-* **Rootkit** [E1014](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/rootkit-behavior.md)
-* **Self Deletion** [F0007](https://github.com/MBCProject/mbc-beta/blob/master/defense-evasion/self-deletion.md)
-* **Software Packing** [F0001](https://github.com/MBCProject/mbc-beta/blob/master/anti-static-analysis/software-packing.md)
+* **Alternative Installation Location** [B0027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/alter-install-location.md)
+* **Bootkit** [F0013](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/boot-sector-mod.md)
+* **Bypass DEP** [B0037](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-dep.md)
+* **Component Firmware** [F0009](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md)
+* **Covert Location** [B0040](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/covert-location.md)
+* **Disable Security Tools** [F0004](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)
+* **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
+* **Hidden Files and Directories** [F0005](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/hidden-files.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Indicator Blocking** [F0006](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indicator-blocking.md)
+* **Install Insecure or Malicious Configuration** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md)
+* **Modify Registry** [E1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
+* **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
+* **Polymorphic Code** [B0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md)
+* **Process Injection** [E1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md)
+* **Rootkit** [E1014](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rootkit-behavior.md)
+* **Self Deletion** [F0007](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/self-deletion.md)
+* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0027**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -20,7 +20,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Kovter**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
+|[**Kovter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kovter.md)|2016|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**F0013**|
-|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Sub-Technique**|[Pre-OS Boot: Bootkit](https://attack.mitre.org/techniques/T1542/003)|

 Bootkit
@@ -14,7 +14,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**Mebromi**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
+|[**Mebromi**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mebromi.md)|2011|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0037**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1478**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0040**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**F0004**|
-|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|

 Disable Security Tools
@@ -26,9 +26,9 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**DNSChanger**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**F0005**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Sub-Technique**|[Hide Artifacts: Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001/)|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**F0006**|
-|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Impair Defenses: Indicator Blocking](https://attack.mitre.org/techniques/T1562/006/)|

 Indicator Blocking
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1112**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|


@@ -15,8 +15,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1027**|
-|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|[Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)|


@@ -9,7 +9,7 @@ Obfuscated Files or Information
 ===============================
 Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself can be encoded or encrypted (i.e., encoding/encryption is a code characteristic).

-A related MBC behavior, associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](https://github.com/MBCProject/mbc-beta/tree/master/anti-static-analysis/exe-code-obfuscate.md).
+A related MBC behavior, associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis/exe-code-obfuscate.md).

 See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).

@@ -42,6 +42,6 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison Ivy**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/poison-ivy.md)|2005|Obfuscates files.|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|Obfuscates files.|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|Obfuscates files.|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Obfuscates files.|
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0029**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1055**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-beta/tree/master/privilege-escalation)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
 |**Related ATT&CK Technique**|[Process Injection](https://attack.mitre.org/techniques/T1055)|


@@ -20,7 +20,7 @@ See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055).
 |T1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
 |T1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|

-Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hooking](https://github.com/MBCProject/mbc-beta/blob/master/credential-access/hooking.md) behavior.
+Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md) behavior.

 Methods
 ------- 
@@ -35,10 +35,10 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**UP007**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|Injects minor code into a running process.|
+|[**UP007**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/up007.md)|April 2016|Injects secondary payload into memory. [[4]](#4)|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Injects minor code into a running process.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1014**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|[Rootkit](https://attack.mitre.org/techniques/T1014)|


@@ -31,7 +31,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
+|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**F0007**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-beta/tree/master/defense-evasion)|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Sub-Technique**|[Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/)|


@@ -5,7 +5,7 @@
 # Discovery #
 Behaviors that aim to gain knowledge about the system and internal network.

-* **Analysis Tool Discovery** [B0013](https://github.com/MBCProject/mbc-beta/blob/master/discovery/analysis-tool-discover.md)
-* **Self Discovery** [B0038](https://github.com/MBCProject/mbc-beta/blob/master/discovery/self-discover.md)
-* **SMTP Connection Discovery** [B0014](https://github.com/MBCProject/mbc-beta/blob/master/discovery/smtp-connect-discover.md)
-* **System Information Discovery** [E1082](https://github.com/MBCProject/mbc-beta/blob/master/discovery/system-info-discover.md)
+* **Analysis Tool Discovery** [B0013](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/analysis-tool-discover.md)
+* **Self Discovery** [B0038](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/self-discover.md)
+* **SMTP Connection Discovery** [B0014](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/smtp-connect-discover.md)
+* **System Information Discovery** [E1082](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-info-discover.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0013**|
-|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-beta/tree/master/discovery)|
+|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique**|None|


@@ -9,7 +9,7 @@ Analysis Tool Discovery
 =======================
 Malware can employ various means to detect whether analysis tools are present or running on the system on which it is executing. Note that analysis tools are used to *analyze* malware whereas security software (see [Software Discovery: Security Software Discovery](https://attack.mitre.org/techniques/T1518/001/)) aims to *detect/mitigate* malware on a system or network.

-This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-beta/tree/master/anti-behavioral-analysis) objective.
+This behavior corresponds to simple, general discovery of analysis tools. Behaviors to find specific analysis tools (e.g., debuggers or disassemblers) are defined under the [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis) objective.

 Methods
 -------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0038**|
-|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-beta/tree/master/discovery)|
+|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0014**|
-|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-beta/tree/master/discovery)|
+|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1082**|
-|**Objective(s)**| [Discovery](https://github.com/MBCProject/mbc-beta/tree/master/discovery)|
+|**Objective(s)**| [Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
 |**Related ATT&CK Technique**|[System Information Discovery](https://attack.mitre.org/techniques/T1082)

 System Information Discovery
@@ -20,5 +20,5 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|Learns about the system so it can drop compatible miner software.|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Learns about the system so it can drop compatible miner software.|
@@ -5,12 +5,12 @@
 # Execution #
 Behaviors that execute code on a system to achieve a variety of goals.

-* **Command and Scripting Interpreter** [E1059](https://github.com/MBCProject/mbc-beta/blob/master/execution/command-line.md)
-* **Conditional Execution** [B0025](https://github.com/MBCProject/mbc-beta/blob/master/execution/conditional-execute.md)
-* **Exploitation for Client Execution** [E1203](https://github.com/MBCProject/mbc-beta/blob/master/execution/exploit-software.md)
-* **Install Additional Program** [B0023](https://github.com/MBCProject/mbc-beta/blob/master/execution/install-prog.md)
-* **Prevent Concurrent Execution** [B0024](https://github.com/MBCProject/mbc-beta/blob/master/execution/prevent-concurrent-exe.md)
-* **Remote Commands** [B0011](https://github.com/MBCProject/mbc-beta/blob/master/execution/remote-commands.md)
-* **Send Email** [B0020](https://github.com/MBCProject/mbc-beta/blob/master/execution/send-email.md)
-* **Send Poisoned Text Message** [B0021](https://github.com/MBCProject/mbc-beta/blob/master/execution/send-poison-text-msg.md)
-* **User Execution** [E1204](https://github.com/MBCProject/mbc-beta/blob/master/execution/user-interaction.md)
+* **Command and Scripting Interpreter** [E1059](https://github.com/MBCProject/mbc-markdown/blob/master/execution/command-line.md)
+* **Conditional Execution** [B0025](https://github.com/MBCProject/mbc-markdown/blob/master/execution/conditional-execute.md)
+* **Exploitation for Client Execution** [E1203](https://github.com/MBCProject/mbc-markdown/blob/master/execution/exploit-software.md)
+* **Install Additional Program** [B0023](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md)
+* **Prevent Concurrent Execution** [B0024](https://github.com/MBCProject/mbc-markdown/blob/master/execution/prevent-concurrent-exe.md)
+* **Remote Commands** [B0011](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md)
+* **Send Email** [B0020](https://github.com/MBCProject/mbc-markdown/blob/master/execution/send-email.md)
+* **Send Poisoned Text Message** [B0021](https://github.com/MBCProject/mbc-markdown/blob/master/execution/send-poison-text-msg.md)
+* **User Execution** [E1204](https://github.com/MBCProject/mbc-markdown/blob/master/execution/user-interaction.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1059**|
-|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|[Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)|

 Command and Scripting Interpreter
@@ -14,8 +14,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
+|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0025**|
-|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|

 Conditional Execution
@@ -18,8 +18,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
-|[**Conficker**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/conficker.md)|2008|A routine causes the process to suicide exit if the keyboard language is set to Ukranian.|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
+|[**Conficker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/conficker.md)|2008|A routine causes the process to suicide exit if the keyboard language is set to Ukranian.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1203**|
-|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution), [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**| [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203)|

 Exploitation for Client Execution
@@ -25,7 +25,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**SamSam**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|
+|[**SamSam**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/samsam.md)|2015|Attackers associated with SamSam exploit vulnerabilities in remote desktop protocols (RDP), Java-based web servers, or file transfer protocol (FTP) servers. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0023**|
-|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution)|
+|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|


@@ -9,18 +9,18 @@ Install Additional Program
 ==========================
 Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps. 

-Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the [Remote File Copy](https://github.com/MBCProject/mbc-beta/blob/master/command-and-control/remote-file-copy.md) behavior).
+Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the [Remote File Copy](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md) behavior).

 Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)|
-|[**Geneio**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/geneio.md)|August 2015|Tricks OS X keychain to create application files.|
-|[**GotBotKR**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/gotbotkr.md)|July 2019 |GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
-|[**MazarBot**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/mazarbot.md)|2016|Installs a backdoor.|
-|[**Mebromi**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/mebromi.md)|2011|A Trojan downloader.|
-|[**YiSpecter**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)|
+|[**Geneio**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/geneio.md)|August 2015|Tricks OS X keychain to create application files.|
+|[**GotBotKR**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gotbotkr.md)|July 2019 |GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
+|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md)|2016|Installs a backdoor.|
+|[**Mebromi**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mebromi.md)|2011|A Trojan downloader.|
+|[**YiSpecter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0024**|
-|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|

 Prevent Concurrent Execution
@@ -12,7 +12,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Bagle**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/bagle.md)|2004|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)|
+|[**Bagle**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/bagle.md)|2004|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system. [1](#1)|

 References
 ----------
@@ -1,13 +1,13 @@
 |||
 |---------|------------------------|
 |**ID**|**B0011**|
-|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution)|
+|**Objective(s)**| [Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|None|


 Remote Commands
 ===============
-Malware may provide an attacker with explicit commands. This behavior differs from the [Remote Access](https://github.com/MBCProject/mbc-beta/blob/master/impact/remote-access.md) behavior under the [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact) objective in that *Impact: Remote Access* is potentially much broader and may include full remote access.
+Malware may provide an attacker with explicit commands. This behavior differs from the [Remote Access](https://github.com/MBCProject/mbc-markdown/blob/master/impact/remote-access.md) behavior under the [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact) objective in that *Impact: Remote Access* is potentially much broader and may include full remote access.

 Given an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., "delete file"). 

@@ -15,7 +15,7 @@ Commands provided by the malware can be captured with the methods defined below.

 It may be useful to capture remote commands along with related behaviors because the associated descriptions could provide details of how the malware implements the command. For example, *Defense Evasion:File Deletion* could be used to provide details and context to *Execution:Remote Commands:Delete File*.

-Autonomous behaviors - those done by the malware without an active attacker - should not be captured with *Execution:Remote Commands*. For example, malware that *automatically* destroys data would be tagged with the [Impact: Data Destruction](https://github.com/MBCProject/mbc-beta/blob/master/impact/data-destruction.md) behavior.
+Autonomous behaviors - those done by the malware without an active attacker - should not be captured with *Execution:Remote Commands*. For example, malware that *automatically* destroys data would be tagged with the [Impact: Data Destruction](https://github.com/MBCProject/mbc-markdown/blob/master/impact/data-destruction.md) behavior.

 Methods
 -------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0020**|
-|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-beta/tree/master/lateral-movement)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
 |**Related ATT&CK Technique**|[Phishing](https://attack.mitre.org/techniques/T1566/)|

 Send Email
@@ -14,9 +14,9 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |--------------|--------------------------|-----------------------------|
-|[**Gamut**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/gamut.md)|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
-|[**Bagle**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/bagle.md)|2004|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**Gamut**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gamut.md)|2014|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
+|[**Bagle**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/bagle.md)|2004|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0021**|
-|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-beta/tree/master/lateral-movement/)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/)|
 |**Related ATT&CK Technique**| None |


@@ -13,7 +13,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**MazarBot**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/mazarbot.md) |  | MazarBot is delivered via a poisoned SMS message. [[1]](#1)|
+|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md) |  | MazarBot is delivered via a poisoned SMS message. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1204**|
-|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-beta/tree/master/execution)|
+|**Objective(s)**|[Execution](https://github.com/MBCProject/mbc-markdown/tree/master/execution)|
 |**Related ATT&CK Technique**|[User Execution](https://attack.mitre.org/techniques/T1204)|

 User Interaction
@@ -14,4 +14,4 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -5,5 +5,5 @@
 # Exfiltration #
 Behaviors that steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).

-* **Automated Exfiltration** [E1020](https://github.com/MBCProject/mbc-beta/blob/master/exfiltration/auto-exfiltrate.md)
-* **Archive Collected Data** [E1560](https://github.com/MBCProject/mbc-beta/blob/master/exfiltration/data-encrypted.md)
+* **Automated Exfiltration** [E1020](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/auto-exfiltrate.md)
+* **Archive Collected Data** [E1560](https://github.com/MBCProject/mbc-markdown/blob/master/exfiltration/data-encrypted.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1020**|
-|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-beta/tree/master/exfiltration)|
+|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
 |**Related ATT&CK Technique**|[Automated Exfiltration](https://attack.mitre.org/techniques/T1020/)|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1560**|
-|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-beta/tree/master/exfiltration)|
+|**Objective(s)**| [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration)|
 |**Related ATT&CK Technique**|[Archive Collected Data](https://attack.mitre.org/techniques/T1560/)|


@@ -5,16 +5,16 @@
 # Impact #
 Behaviors that enable malware to achieve its mission of manipulating, interrupting, or destroying systems and/or data.

-* **Component Firmware** [F0009](https://github.com/MBCProject/mbc-beta/blob/master/persistence/component-firmware.md)
-* **Compromise Data Integrity** [B0016](https://github.com/MBCProject/mbc-beta/blob/master/impact/compromise-data.md)
-* **Data Destruction** [E1485](https://github.com/MBCProject/mbc-beta/blob/master/impact/data-destruction.md)
-* **Data Encrypted for Impact** [E1486](https://github.com/MBCProject/mbc-beta/blob/master/impact/encrypt-impact.md)
-* **Denial of Service** [B0033](https://github.com/MBCProject/mbc-beta/blob/master/impact/denial-of-service.md)
-* **Destroy Hardware** [B0017](https://github.com/MBCProject/mbc-beta/blob/master/impact/destroy-hardware.md)
-* **Exploit Kit Behavior** [E1190](https://github.com/MBCProject/mbc-beta/blob/master/impact/exploit-kit-behavior.md)
-* **Exploitation for Client Execution** [E1203](https://github.com/MBCProject/mbc-beta/blob/master/execution/exploit-software.md)
-* **Generate Fraudulent Advertising Revenue** [E1472](https://github.com/MBCProject/mbc-beta/blob/master/impact/generate-fraud-rev.md)
-* **Manipulate Network Traffic** [B0019](https://github.com/MBCProject/mbc-beta/blob/master/impact/manipulate-network-traffic.md)
-* **Remote Access** [B0022](https://github.com/MBCProject/mbc-beta/blob/master/impact/remote-access.md)
-* **Resource Hijacking** [B0018](https://github.com/MBCProject/mbc-beta/blob/master/impact/hijack-sys-resources.md)
-* **Spamming** [B0039](https://github.com/MBCProject/mbc-beta/blob/master/impact/spamming.md)
+* **Component Firmware** [F0009](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md)
+* **Compromise Data Integrity** [B0016](https://github.com/MBCProject/mbc-markdown/blob/master/impact/compromise-data.md)
+* **Data Destruction** [E1485](https://github.com/MBCProject/mbc-markdown/blob/master/impact/data-destruction.md)
+* **Data Encrypted for Impact** [E1486](https://github.com/MBCProject/mbc-markdown/blob/master/impact/encrypt-impact.md)
+* **Denial of Service** [B0033](https://github.com/MBCProject/mbc-markdown/blob/master/impact/denial-of-service.md)
+* **Destroy Hardware** [B0017](https://github.com/MBCProject/mbc-markdown/blob/master/impact/destroy-hardware.md)
+* **Exploit Kit Behavior** [E1190](https://github.com/MBCProject/mbc-markdown/blob/master/impact/exploit-kit-behavior.md)
+* **Exploitation for Client Execution** [E1203](https://github.com/MBCProject/mbc-markdown/blob/master/execution/exploit-software.md)
+* **Generate Fraudulent Advertising Revenue** [E1472](https://github.com/MBCProject/mbc-markdown/blob/master/impact/generate-fraud-rev.md)
+* **Manipulate Network Traffic** [B0019](https://github.com/MBCProject/mbc-markdown/blob/master/impact/manipulate-network-traffic.md)
+* **Remote Access** [B0022](https://github.com/MBCProject/mbc-markdown/blob/master/impact/remote-access.md)
+* **Resource Hijacking** [B0018](https://github.com/MBCProject/mbc-markdown/blob/master/impact/hijack-sys-resources.md)
+* **Spamming** [B0039](https://github.com/MBCProject/mbc-markdown/blob/master/impact/spamming.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0016**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/)|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1485**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Data Destruction](https://attack.mitre.org/techniques/T1485/), [Delete Device Data](https://attack.mitre.org/techniques/T1447/)| 


@@ -23,7 +23,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**Shamoon**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/shamoon.md)| 2012 |A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)| 
+|[**Shamoon**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/shamoon.md)| 2012 |A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery.[[1]](#1)| 

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0033**|
-|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Network Denial of Device](https://attack.mitre.org/techniques/T1498/)|


@@ -17,7 +17,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**BlackEnergy**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/blackenergy.md)| October 2007| Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
+|[**BlackEnergy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/blackenergy.md)| October 2007| Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0017**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|None|


@@ -13,7 +13,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Stuxnet**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/stuxnet.md)|2010| Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|
+|[**Stuxnet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/stuxnet.md)|2010| Stuxnet made centrifuges at Iran's nuclear plant spin dangerously fast for a few minutes, before returning to normal speed. A month later, it slowed the centrifuges down for nearly an hour. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1486**|
-|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Techniques**|[Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/), [Data Encrypted for Impact (Mobile)](https://attack.mitre.org/techniques/T1471/)|


@@ -15,10 +15,10 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**CryptoWall**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/cryptowall.md)| 2014 | [[1]](#1)| 
-|[**CryptoLocker**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/cryptolocker.md)| 2013| [[2]](#2)| 
-|[**Locky Bart**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/locky-bart.md)|2017|Encrypts files for ransom without any connection to the Internet.|
-|[**SamSam**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/samsam.md)|2015|Ransomware.|
+|[**CryptoWall**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptowall.md)| 2014 | [[1]](#1)| 
+|[**CryptoLocker**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/cryptolocker.md)| 2013| [[2]](#2)| 
+|[**Locky Bart**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/locky-bart.md)|2017|Encrypts files for ransom without any connection to the Internet.|
+|[**SamSam**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/samsam.md)|2015|Ransomware.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1190**|
-|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)|


@@ -15,7 +15,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Ursnif**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/ursnif.md)| | Ursnif is sometimes delivered via exploit kit. [[1]](#1)|
+|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)| | Ursnif is sometimes delivered via exploit kit. [[1]](#1)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1472**|
-|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Generate Fraudulent Advertising Revenue](https://attack.mitre.org/techniques/T1472/)|


@@ -22,8 +22,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**DNSChanger**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/dnschanger.md)| November 2011| Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
-|[**Kovter**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)|
+|[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)| November 2011| Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
+|[**Kovter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/kovter.md)|2016|Performs click-fraud. [[4]](#4)|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0018**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|[Resource Hijacking](https://attack.mitre.org/techniques/T1496/)|


@@ -22,7 +22,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**WebCobra**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)|
 | Adylkuzz| May 2017| Consumes system resources to mine for cryptocurrency. [[2]](#2)| 

 References
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0019**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/)|


@@ -15,8 +15,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**SearchAwesome**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/searchawesome.md)| 2018| Intercepts encrypted web traffic to inject adds. [[1]](#1)|
-|[**MazarBot**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/mazarbot.md)|2016|Intercepts data coming into and going out of device.|
+|[**SearchAwesome**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/searchawesome.md)| 2018| Intercepts encrypted web traffic to inject adds. [[1]](#1)|
+|[**MazarBot**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/mazarbot.md)|2016|Intercepts data coming into and going out of device.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0022**|
-|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact), [Persistence](https://github.com/MBCProject/mbc-beta/tree/master/persistence)|
+|**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|None|


@@ -9,7 +9,7 @@ Remote Access
 =============
 Malware may provide an attacker with potentially full access to a system via a remote network connection, which may also provide persistence.

-A RAT (Remote Access Trojan) is an example of malware that provides a degree of remote access. If the malware provides an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., Delete File). Explicit commands provided by the malware can be captured with Methods associated with the [**Execution::Remote Commands**](https://github.com/MBCProject/mbc-beta/blob/master/execution/remote-commands.md) behavior; examples include *Execution:Remote Commands:Execute* and *Execution:Remote Commands:Delete File*.
+A RAT (Remote Access Trojan) is an example of malware that provides a degree of remote access. If the malware provides an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., Delete File). Explicit commands provided by the malware can be captured with Methods associated with the [**Execution::Remote Commands**](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md) behavior; examples include *Execution:Remote Commands:Execute* and *Execution:Remote Commands:Delete File*.

 Note that the [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1105/) technique defined under the Command and Control tactic is no longer specific to "legitimate desktop support and remote access software” as it was under a previous version of ATT&CK. However, *Ingress Tool Transfer* relates only to files copied; this MBC behavior is broader, allowing for remote access behaviors beyond file transfers (i.e., *Impact:Remote Access* and *Command and Control: Ingress Tool Transfer* are not equivalent).

@@ -23,8 +23,8 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
-|[**Dark Comet**](https://github.com/MBCProject/mbc-beta/tree/master/xample-malware/dark-comet.md)|2008|Allows an attacker to control the system via a GUI.|
+|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
+|[**Dark Comet**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/dark-comet.md)|2008|Allows an attacker to control the system via a GUI.|

 References
 ----------
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**B0039**|
-|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-beta/tree/master/impact)|
+|**Objective(s)**|[Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
 |**Related ATT&CK Technique**|None|


@@ -5,8 +5,8 @@
 # Lateral Movement
 Behaviors that enable propagation through a compromised system or infected files. The malware may move actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).

-* **Malicious Network Driver** [B0026](https://github.com/MBCProject/mbc-beta/blob/master/persistence/malicious-network-drv.md)
-* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-beta/tree/master/command-and-control/remote-file-copy.md)
-* **Send Email** [B0020](https://github.com/MBCProject/mbc-beta/tree/master/execution/send-email.md)
-* **Send Poison Text Message** [B0021](https://github.com/MBCProject/mbc-beta/tree/master/execution/send-poison-text-msg.md)
-* **Supply Chain Compromise** [E1195](https://github.com/MBCProject/mbc-beta/tree/master/lateral-movement/supply-chain-compromise.md)
+* **Malicious Network Driver** [B0026](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/malicious-network-drv.md)
+* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/remote-file-copy.md)
+* **Send Email** [B0020](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-email.md)
+* **Send Poison Text Message** [B0021](https://github.com/MBCProject/mbc-markdown/tree/master/execution/send-poison-text-msg.md)
+* **Supply Chain Compromise** [E1195](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement/supply-chain-compromise.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**E1195**|
-|**Objective(s)**|[Lateral Movement](https://github.com/MBCProject/mbc-beta/tree/master/lateral-movement)|
+|**Objective(s)**|[Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement)|
 |**Related ATT&CK Technique**|[Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)|

 Supply Chain Compromise
@@ -19,7 +19,7 @@ Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|[**YiSpecter**](https://github.com/MBCProject/mbc-beta/blob/master/xample-malware/yispecter.md)|October 2015|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)|
+|[**YiSpecter**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/yispecter.md)|October 2015|Attacks both jailbroken and non-jailbroken iOS devices by exploiting private APIs. [[1]](#1)|

 References
 ----------
@@ -5,9 +5,9 @@ Like regular MBC behaviors, micro-behaviors are associated with objectives and c

 |**Objective**|**Description**|
 |------------------------------------------------------------------|----------------------------|
-|[**Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication) |Malware uses various protocols and components to communication.|
-|[**Cryptography**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/cryptography)|Malware uses elements of cryptography.|
-|[**Data Manipulation**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/data-manipulation)| Malware manipulates data.|
-|[**File Manipulation**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/file-manipulation) | Malware manipulates files.|
-|[**Memory Manipulation**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/memory-manipulation) |Malware manipulates memory.|
-|[**Processes**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/processes)|Malware uses processes.|
+|[**Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication) |Malware uses various protocols and components to communication.|
+|[**Cryptography**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/cryptography)|Malware uses elements of cryptography.|
+|[**Data Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation)| Malware manipulates data.|
+|[**File Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation) | Malware manipulates files.|
+|[**Memory Manipulation**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation) |Malware manipulates memory.|
+|[**Processes**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/processes)|Malware uses processes.|
@@ -7,13 +7,13 @@ Micro-behaviors that enable malware to communicate.

 |ID|Name|
 |-----------------------------|--------|
-|R0011|[**DNS Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/dns-comm.md)|
-|R0004|[**FTP Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/ftp-comm.md)|
-|R0002|[**HTTP Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/http-comm.md)|
-|R0014|[**ICMP Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/icmp-comm.md)|
-|R0003|[**Inter-process Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/inter-process.md)|
-|R0012|[**SMTP Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/smtp-comm.md)|
-|R0001|[**TCP Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/tcp-comm.md)|
-|R0013|[**UDP Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/udp-comm.md)|
-|R0005|[**WinINet Communication**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/wininet.md)|
+|R0011|[**DNS Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/dns-comm.md)|
+|R0004|[**FTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/ftp-comm.md)|
+|R0002|[**HTTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/http-comm.md)|
+|R0014|[**ICMP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/icmp-comm.md)|
+|R0003|[**Inter-process Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/inter-process.md)|
+|R0012|[**SMTP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/smtp-comm.md)|
+|R0001|[**TCP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/tcp-comm.md)|
+|R0013|[**UDP Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/udp-comm.md)|
+|R0005|[**WinINet Communication**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md)|

@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0011**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0004**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0002**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -19,7 +19,7 @@ Methods
 |C0002.004|**GET Request**|HTTP Get request.|
 |C0002.005|**POST Request**|HTTP Post request.|
 |C0002.006|**PUT Request**|HTTP Put request.| 
-|C0002.007|**WinINet API**|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/communication/wininet.md) microbehavior.
+|C0002.007|**WinINet API**|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/communication/wininet.md) microbehavior.
 |C0002.008|**WinHTTP API**|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
 |C0002.008|**URLMON Function**|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.  
 |C0002.008|**IWebBrowser**|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0014**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0003**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0012**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0001**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0013**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0005**|
-|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/communication)|
+|**Objective(s)**|[Communication](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/communication)|
 |**Related ATT&CK Technique**|None|


@@ -7,4 +7,4 @@ Micro-behaviors that enable malware to use crypto.

 |ID|Name|
 |-----------------------------|--------|
-|R0021|[**Generate Pseudo-random Sequence**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/cryptography/gen-random.md)|
+|R0021|[**Generate Pseudo-random Sequence**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/cryptography/gen-random.md)|
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0021**|
-|**Objective(s)**|[Cryptography](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/cryptography)|
+|**Objective(s)**|[Cryptography](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/cryptography)|
 |**Related ATT&CK Technique**|None|


@@ -7,5 +7,5 @@ Micro-behaviors related to malware manipulating data.

 |ID|Name|
 |-----------------------------|--------|
-|R0019|[**Check String**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/data-manipulation/check-string.md)|
-|R0020|[**Use Constant**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/data-manipulation/use-constant.md)|
+|R0019|[**Check String**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/check-string.md)|
+|R0020|[**Use Constant**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/data-manipulation/use-constant.md)|
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0019**|
-|**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/data-manipulation)|
+|**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/data-manipulation)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0020**|
-|**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/data-manipulation)|
+|**Objective(s)**|[Data Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/data-manipulation)|
 |**Related ATT&CK Technique**|None|


@@ -7,5 +7,5 @@ Micro-behaviors related to file manipulation.

 |ID|Name|
 |-----------------------------|--------|
-|R0015|[**Alter File Extension**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/file-manipulation/alter-extend.md)|
-|R0016|[**Create File**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/file-manipulation/create-file.md)|
+|R0015|[**Alter File Extension**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/alter-extend.md)|
+|R0016|[**Create File**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/file-manipulation/create-file.md)|
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0015**|
-|**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/file-manipulation)|
+|**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/file-manipulation)|
 |**Related ATT&CK Technique**|None|


@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0016**|
-|**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/file-manipulation)|
+|**Objective(s)**|[File Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/file-manipulation)|
 |**Related ATT&CK Technique**|None|


@@ -7,4 +7,4 @@ Micro-behaviors related to hardware.

 |ID|Name|
 |-----------------------------|--------|
-|R0023|[**Load Driver**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/hardware/load-driver.md)|
+|R0023|[**Load Driver**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/hardware/load-driver.md)|
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0023**|
-|**Objective(s)**|[Processes](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/processes)|
+|**Objective(s)**|[Processes](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/processes)|
 |**Related ATT&CK Technique**|None|


@@ -7,8 +7,8 @@ Micro-behaviors related to malware manipulating machine memory.

 |ID|Name|
 |-----------------------------|--------|
-|R0007|[**Allocate Memory**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/memory-manipulation/allocate-memory.md)|
-|R0006|[**Heap Spray**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/memory-manipulation/heapspray.md)|
-|R0008|[**Change Memory Protection**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/memory-manipulation/memory-protect.md)
-|R0010|[**Overflow Buffer**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/memory-manipulation/overflow-buffer.md)
-|R0009|[**Stack Pivot**](https://github.com/MBCProject/mbc-beta/blob/master/micro-behaviors/memory-manipulation/stack-pivot.md)
+|R0007|[**Allocate Memory**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/allocate-memory.md)|
+|R0006|[**Heap Spray**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/heapspray.md)|
+|R0008|[**Change Memory Protection**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/memory-protect.md)
+|R0010|[**Overflow Buffer**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/overflow-buffer.md)
+|R0009|[**Stack Pivot**](https://github.com/MBCProject/mbc-markdown/blob/master/micro-behaviors/memory-manipulation/stack-pivot.md)
@@ -1,7 +1,7 @@
 |||
 |---------|------------------------|
 |**ID**|**C0007**|
-|**Objective(s)**|[Memory Manipulation](https://github.com/MBCProject/mbc-beta/tree/master/micro-behaviors/memory-manipulation)|
+|**Objective(s)**|[Memory Manipulation](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/memory-manipulation)|
 |**Related ATT&CK Technique**|None|


--- a/Show More
+++ b/Show More