Merge pull request #46 from MBCProject/example-readme

Example readme

README.md

@@ -54,8 +54,8 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**.
 
 Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.
 
-### Example Malware ###
-The MBC also contains a collection of [example malware](./xample-malware/README.md) that are characterized with malware behaviors.
+### Malware Corpus ###
+The MBC contains a [malware corpus](./xample-malware/README.md) where each malware entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports.
 
 ## Micro-behavior Objectives ##
 [Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.

xample-malware/README.md

@@ -1,7 +1,13 @@
-# Example Malware # 
-The following malware are used as examples on MBC behavior pages. 
+# Malware Corpus # 
+The MBC malware corpus comprises a variety of malware where each entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports and are separated into three categories: "ATT&CK Techniques," "Enhanced ATT&CK Techniques," and "MBC Behaviors."
 
-If malware appears on ATT&CK's software list, ATT&CK is referenced. Behaviors (techniques) listed on an ATT&CK page may be included in an MBC Behavior table, but the user should reference ATT&CK for details (MBC does not duplicate ATT&CK content). Behaviors not included on an ATT&CK page will include details of use. 
+**ATT&CK Techniques** - If a malware entry *is not* included in ATT&CK's software collection, then all ATT&CK techniques to which its malware behaviors map are listed. If a malware entry *is* included in ATT&CK's software collection, then the corresponding software page is referenced under "ATT&CK Techniques" (individual mappings *not* captured in ATT&CK are still listed). These techniques have T identifiers (e.g., T1012).
+
+**Enhanced ATT&CK Techniques** - Any ATT&CK techniques that would be listed under "ATT&CK Techniques" but have been enhanced in MBC are listed in this section instead. These techniques have E and F identifiers (e.g., E1560, F0008).
+
+**MBC Behaviors** - This section lists all MBC behaviors to which an entry's malware behaviors map.  These techniques have B and C identifiers (e.g., B0032, C0010).
+
+Please see [Poison-Ivy X0014](../xample-malware/poison-ivy.md) and [Kovter X0009](../xample-malware/kovter.md) for examples of malware entries included and *not* included in ATT&CK's collection, respectively.
 
 * **Bagle** [X0001](../xample-malware/bagle.md)
 * **Black Energy** [X0002](../xample-malware/blackenergy.md)