From a265c734313abe96bd3655742391ac99d48ca1a5 Mon Sep 17 00:00:00 2001 From: Emmanuelle Vargas-Gonzalez Date: Fri, 21 Aug 2020 18:06:30 -0400 Subject: [PATCH] couple of relative path fixes for micro-behaviors --- README.md | 30 +++++++++---------- micro-behaviors/README.md | 12 ++++---- micro-behaviors/communication/README.md | 18 +++++------ micro-behaviors/communication/dns-comm.md | 2 +- micro-behaviors/communication/ftp-comm.md | 2 +- micro-behaviors/communication/http-comm.md | 4 +-- micro-behaviors/communication/icmp-comm.md | 2 +- .../communication/inter-process.md | 2 +- micro-behaviors/communication/smtp-comm.md | 2 +- micro-behaviors/communication/tcp-comm.md | 2 +- micro-behaviors/communication/udp-comm.md | 2 +- micro-behaviors/communication/wininet.md | 2 +- micro-behaviors/cryptography/README.md | 2 +- micro-behaviors/cryptography/gen-random.md | 2 +- micro-behaviors/data-manipulation/README.md | 4 +-- .../data-manipulation/check-string.md | 2 +- .../data-manipulation/use-constant.md | 2 +- micro-behaviors/file-manipulation/README.md | 4 +-- .../file-manipulation/alter-extend.md | 2 +- .../file-manipulation/create-file.md | 2 +- micro-behaviors/hardware/README.md | 2 +- micro-behaviors/hardware/load-driver.md | 2 +- micro-behaviors/memory-manipulation/README.md | 10 +++---- .../memory-manipulation/allocate-memory.md | 2 +- .../memory-manipulation/heapspray.md | 2 +- .../memory-manipulation/memory-protect.md | 2 +- .../memory-manipulation/overflow-buffer.md | 2 +- .../memory-manipulation/stack-pivot.md | 2 +- micro-behaviors/processes/README.md | 6 ++-- micro-behaviors/processes/create-process.md | 2 +- micro-behaviors/processes/synchronization.md | 2 +- .../processes/terminate-process.md | 2 +- 32 files changed, 68 insertions(+), 68 deletions(-) diff --git a/README.md b/README.md index 9b94458..7f16c90 100644 --- a/README.md +++ b/README.md @@ -47,26 +47,26 @@ The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**. Objectives and behaviors can be used alone, but a method *must* be associated with a behavior. ### Example Malware ### -The MBC also contains a collection of [example malware](../xample-malware) that are characterized with malware behaviors. +The MBC also contains a collection of [example malware](./xample-malware) that are characterized with malware behaviors. ## Micro-behavior Objectives ## -[Micro-behaviors](../micro-behaviors/README.md) and their associated objectives are under development. +[Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development. ## Malware Objective Descriptions ## Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors. |**Objective**|**Description**| |---|---| -|[**Anti-Behavioral Analysis**](../anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.| -|[**Anti-Static Analysis**](../anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.| -|[**Collection**](../collection/README.md)|Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.| -|[**Command and Control**](../command-and-control/README.md)|Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).| -|[**Credential Access**](../credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.| -|[**Defense Evasion**](../defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.| -|[**Discovery**](../discovery/README.md)|Malware aims to gain knowledge about the system and internal network.| -|[**Execution**](../execution/README.md)|Malware aims to execute its code on a system to achieve a variety of goals.| -|[**Exfiltration**](../exfiltration/README.md)|Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).| -|[**Impact**](../impact/README.md)|Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.| -|[**Lateral Movement**](../lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).| -|[**Persistence**](../persistence/README.md)|Malware aims to remain on a system regardless of system events.| -|[**Privilege Escalation**](../privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.| +|[**Anti-Behavioral Analysis**](./anti-behavioral-analysis/README.md)|Malware aims to prevent, obstruct, or evade behavioral analysis done in a sandbox, debugger, etc.| +|[**Anti-Static Analysis**](./anti-static-analysis/README.md)|Malware aims to prevent static analysis or make it more difficult. Simpler static analysis identifies features such as embedded strings, executable header information, hash values, and file metadata. More involved static analysis involves the disassembly of the binary code.| +|[**Collection**](./collection/README.md)|Malware aims to identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.| +|[**Command and Control**](./command-and-control/README.md)|Malware aims to communicate (receive and/or execute remotely submitted commands) with controlling or controlled systems within a target network (C2 servers, bots, etc.).| +|[**Credential Access**](./credential-access/README.md)|Malware aims to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.| +|[**Defense Evasion**](./defense-evasion/README.md)|Malware aims to evade detection or avoid other cybersecurity defenses.| +|[**Discovery**](./discovery/README.md)|Malware aims to gain knowledge about the system and internal network.| +|[**Execution**](./execution/README.md)|Malware aims to execute its code on a system to achieve a variety of goals.| +|[**Exfiltration**](./exfiltration/README.md)|Malware aims to steal data from the system on which it executes. This includes stored data (e.g., files) as well as data input into applications (e.g., web browser).| +|[**Impact**](./impact/README.md)|Malware aims to achieve its mission of manipulating, interrupting, or destroying systems and data.| +|[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).| +|[**Persistence**](./persistence/README.md)|Malware aims to remain on a system regardless of system events.| +|[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.| diff --git a/micro-behaviors/README.md b/micro-behaviors/README.md index 69b69ba..1c2caf3 100644 --- a/micro-behaviors/README.md +++ b/micro-behaviors/README.md @@ -5,9 +5,9 @@ Like regular MBC behaviors, micro-behaviors are associated with objectives and c |**Objective**|**Description**| |---|---| -|[**Communication**](../micro-behaviors/communication)|Malware uses various protocols and components to communication.| -|[**Cryptography**](../micro-behaviors/cryptography)|Malware uses elements of cryptography.| -|[**Data Manipulation**](../micro-behaviors/data-manipulation)|Malware manipulates data.| -|[**File Manipulation**](../micro-behaviors/file-manipulation)|Malware manipulates files.| -|[**Memory Manipulation**](../micro-behaviors/memory-manipulation)|Malware manipulates memory.| -|[**Processes**](../micro-behaviors/processes)|Malware uses processes.| +|[**Communication**](../communication)|Malware uses various protocols and components to communication.| +|[**Cryptography**](../cryptography)|Malware uses elements of cryptography.| +|[**Data Manipulation**](../data-manipulation)|Malware manipulates data.| +|[**File Manipulation**](../file-manipulation)|Malware manipulates files.| +|[**Memory Manipulation**](../memory-manipulation)|Malware manipulates memory.| +|[**Processes**](../processes)|Malware uses processes.| diff --git a/micro-behaviors/communication/README.md b/micro-behaviors/communication/README.md index d6fbf15..844e977 100644 --- a/micro-behaviors/communication/README.md +++ b/micro-behaviors/communication/README.md @@ -8,12 +8,12 @@ Micro-behaviors that enable malware to communicate. |Name|ID|Description| |---|---|---| -|[**DNS Communication**](../micro-behaviors/communication/dns-comm.md)|C0011|| -|[**FTP Communication**](../micro-behaviors/communication/ftp-comm.md)|C0004|| -|[**HTTP Communication**](../micro-behaviors/communication/http-comm.md)|C0002|| -|[**ICMP Communication**](../micro-behaviors/communication/icmp-comm.md)|C0014|| -|[**Inter-process Communication**](../micro-behaviors/communication/inter-process.md)|C0003|| -|[**SMTP Communication**](../micro-behaviors/communication/smtp-comm.md)|C0012|| -|[**TCP Communication**](../micro-behaviors/communication/tcp-comm.md)|C0001|| -|[**UDP Communication**](../micro-behaviors/communication/udp-comm.md)|C0013|| -|[**WinINet Communication**](../micro-behaviors/communication/wininet.md)|C0005|| +|[**DNS Communication**](../communication/dns-comm.md)|C0011|| +|[**FTP Communication**](../communication/ftp-comm.md)|C0004|| +|[**HTTP Communication**](../communication/http-comm.md)|C0002|| +|[**ICMP Communication**](../communication/icmp-comm.md)|C0014|| +|[**Inter-process Communication**](../communication/inter-process.md)|C0003|| +|[**SMTP Communication**](../communication/smtp-comm.md)|C0012|| +|[**TCP Communication**](../communication/tcp-comm.md)|C0001|| +|[**UDP Communication**](../communication/udp-comm.md)|C0013|| +|[**WinINet Communication**](../communication/wininet.md)|C0005|| diff --git a/micro-behaviors/communication/dns-comm.md b/micro-behaviors/communication/dns-comm.md index 282be71..db4b3be 100644 --- a/micro-behaviors/communication/dns-comm.md +++ b/micro-behaviors/communication/dns-comm.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0011**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/communication/ftp-comm.md b/micro-behaviors/communication/ftp-comm.md index cb7d964..55d52cf 100644 --- a/micro-behaviors/communication/ftp-comm.md +++ b/micro-behaviors/communication/ftp-comm.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0004**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/communication/http-comm.md b/micro-behaviors/communication/http-comm.md index 9314dd9..e9985cb 100644 --- a/micro-behaviors/communication/http-comm.md +++ b/micro-behaviors/communication/http-comm.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0002**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| @@ -24,4 +24,4 @@ Methods |**Server**|C0002.001|General HTTP server behavior.| |**URLMON Function**|C0002.008|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.| |**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).| -|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../micro-behaviors/communication/wininet.md) microbehavior.| +|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.| diff --git a/micro-behaviors/communication/icmp-comm.md b/micro-behaviors/communication/icmp-comm.md index 48b6ad1..6d98dc5 100644 --- a/micro-behaviors/communication/icmp-comm.md +++ b/micro-behaviors/communication/icmp-comm.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0014**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/communication/inter-process.md b/micro-behaviors/communication/inter-process.md index 50bb80c..7ec4374 100644 --- a/micro-behaviors/communication/inter-process.md +++ b/micro-behaviors/communication/inter-process.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0003**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/communication/smtp-comm.md b/micro-behaviors/communication/smtp-comm.md index 061200d..bc0f9fd 100644 --- a/micro-behaviors/communication/smtp-comm.md +++ b/micro-behaviors/communication/smtp-comm.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0012**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/communication/tcp-comm.md b/micro-behaviors/communication/tcp-comm.md index 2dacaf5..fe38098 100644 --- a/micro-behaviors/communication/tcp-comm.md +++ b/micro-behaviors/communication/tcp-comm.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0001**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/communication/udp-comm.md b/micro-behaviors/communication/udp-comm.md index 3840f8f..2aec101 100644 --- a/micro-behaviors/communication/udp-comm.md +++ b/micro-behaviors/communication/udp-comm.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0013**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/communication/wininet.md b/micro-behaviors/communication/wininet.md index c63ff4d..445ea18 100644 --- a/micro-behaviors/communication/wininet.md +++ b/micro-behaviors/communication/wininet.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0005**| -|**Objective(s)**|[Communication](../micro-behaviors/communication)| +|**Objective(s)**|[Communication](../communication)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/cryptography/README.md b/micro-behaviors/cryptography/README.md index def4425..0264d8d 100644 --- a/micro-behaviors/cryptography/README.md +++ b/micro-behaviors/cryptography/README.md @@ -8,4 +8,4 @@ Micro-behaviors that enable malware to use crypto. |Name|ID|Description| |---|---|---| -|[**Generate Pseudo-random Sequence**](../micro-behaviors/cryptography/gen-random.md)|C0021|| +|[**Generate Pseudo-random Sequence**](../cryptography/gen-random.md)|C0021|| diff --git a/micro-behaviors/cryptography/gen-random.md b/micro-behaviors/cryptography/gen-random.md index 3cd2234..ec13ef2 100644 --- a/micro-behaviors/cryptography/gen-random.md +++ b/micro-behaviors/cryptography/gen-random.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0021**| -|**Objective(s)**|[Cryptography](../micro-behaviors/cryptography)| +|**Objective(s)**|[Cryptography](../cryptography)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/data-manipulation/README.md b/micro-behaviors/data-manipulation/README.md index eda309d..ddd0b83 100644 --- a/micro-behaviors/data-manipulation/README.md +++ b/micro-behaviors/data-manipulation/README.md @@ -8,5 +8,5 @@ Micro-behaviors related to malware manipulating data. |Name|ID|Description| |---|---|---| -|[**Check String**](../micro-behaviors/data-manipulation/check-string.md)|C0019|| -|[**Use Constant**](../micro-behaviors/data-manipulation/use-constant.md)|C0020|| +|[**Check String**](../data-manipulation/check-string.md)|C0019|| +|[**Use Constant**](../data-manipulation/use-constant.md)|C0020|| diff --git a/micro-behaviors/data-manipulation/check-string.md b/micro-behaviors/data-manipulation/check-string.md index f3a75d8..48a0f13 100644 --- a/micro-behaviors/data-manipulation/check-string.md +++ b/micro-behaviors/data-manipulation/check-string.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0019**| -|**Objective(s)**|[Data Manipulation](../micro-behaviors/data-manipulation)| +|**Objective(s)**|[Data Manipulation](../data-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/data-manipulation/use-constant.md b/micro-behaviors/data-manipulation/use-constant.md index 8997f74..1b57cf8 100644 --- a/micro-behaviors/data-manipulation/use-constant.md +++ b/micro-behaviors/data-manipulation/use-constant.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0020**| -|**Objective(s)**|[Data Manipulation](../micro-behaviors/data-manipulation)| +|**Objective(s)**|[Data Manipulation](../data-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/file-manipulation/README.md b/micro-behaviors/file-manipulation/README.md index e4c2ea8..7f852b5 100644 --- a/micro-behaviors/file-manipulation/README.md +++ b/micro-behaviors/file-manipulation/README.md @@ -8,5 +8,5 @@ Micro-behaviors related to file manipulation. |Name|ID|Description| |---|---|---| -|[**Alter File Extension**](../micro-behaviors/file-manipulation/alter-extend.md)|C0015|| -|[**Create File**](../micro-behaviors/file-manipulation/create-file.md)|C0016|| +|[**Alter File Extension**](../file-manipulation/alter-extend.md)|C0015|| +|[**Create File**](../file-manipulation/create-file.md)|C0016|| diff --git a/micro-behaviors/file-manipulation/alter-extend.md b/micro-behaviors/file-manipulation/alter-extend.md index 0fdbf3b..2bfe578 100644 --- a/micro-behaviors/file-manipulation/alter-extend.md +++ b/micro-behaviors/file-manipulation/alter-extend.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0015**| -|**Objective(s)**|[File Manipulation](../micro-behaviors/file-manipulation)| +|**Objective(s)**|[File Manipulation](../file-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/file-manipulation/create-file.md b/micro-behaviors/file-manipulation/create-file.md index e8a538e..581ac83 100644 --- a/micro-behaviors/file-manipulation/create-file.md +++ b/micro-behaviors/file-manipulation/create-file.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0016**| -|**Objective(s)**|[File Manipulation](../micro-behaviors/file-manipulation)| +|**Objective(s)**|[File Manipulation](../file-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/hardware/README.md b/micro-behaviors/hardware/README.md index 3ecaee9..920a9c0 100644 --- a/micro-behaviors/hardware/README.md +++ b/micro-behaviors/hardware/README.md @@ -8,4 +8,4 @@ Micro-behaviors related to hardware. |Name|ID|Description| |---|---|---| -|[**Load Driver**](../micro-behaviors/hardware/load-driver.md)|C0023|| +|[**Load Driver**](../hardware/load-driver.md)|C0023|| diff --git a/micro-behaviors/hardware/load-driver.md b/micro-behaviors/hardware/load-driver.md index 96b6d7a..b1a17a0 100644 --- a/micro-behaviors/hardware/load-driver.md +++ b/micro-behaviors/hardware/load-driver.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0023**| -|**Objective(s)**|[Processes](../micro-behaviors/processes)| +|**Objective(s)**|[Processes](../processes)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/memory-manipulation/README.md b/micro-behaviors/memory-manipulation/README.md index caf478b..801f6ab 100644 --- a/micro-behaviors/memory-manipulation/README.md +++ b/micro-behaviors/memory-manipulation/README.md @@ -8,8 +8,8 @@ Micro-behaviors related to malware manipulating machine memory. |Name|ID|Description| |---|---|---| -|[**Allocate Memory**](../micro-behaviors/memory-manipulation/allocate-memory.md)|C0007|| -|[**Change Memory Protection**](../micro-behaviors/memory-manipulation/memory-protect.md)|C0008|| -|[**Heap Spray**](../micro-behaviors/memory-manipulation/heapspray.md)|C0006|| -|[**Overflow Buffer**](../micro-behaviors/memory-manipulation/overflow-buffer.md)|C0010|| -|[**Stack Pivot**](../micro-behaviors/memory-manipulation/stack-pivot.md)|C0009|| +|[**Allocate Memory**](../memory-manipulation/allocate-memory.md)|C0007|| +|[**Change Memory Protection**](../memory-manipulation/memory-protect.md)|C0008|| +|[**Heap Spray**](../memory-manipulation/heapspray.md)|C0006|| +|[**Overflow Buffer**](../memory-manipulation/overflow-buffer.md)|C0010|| +|[**Stack Pivot**](../stack-pivot.md)|C0009|| diff --git a/micro-behaviors/memory-manipulation/allocate-memory.md b/micro-behaviors/memory-manipulation/allocate-memory.md index 955fb8d..4a52536 100644 --- a/micro-behaviors/memory-manipulation/allocate-memory.md +++ b/micro-behaviors/memory-manipulation/allocate-memory.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0007**| -|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)| +|**Objective(s)**|[Memory Manipulation](../memory-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/memory-manipulation/heapspray.md b/micro-behaviors/memory-manipulation/heapspray.md index 568b8b1..e2163ec 100644 --- a/micro-behaviors/memory-manipulation/heapspray.md +++ b/micro-behaviors/memory-manipulation/heapspray.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0006**| -|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)| +|**Objective(s)**|[Memory Manipulation](../memory-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/memory-manipulation/memory-protect.md b/micro-behaviors/memory-manipulation/memory-protect.md index 5b54c96..43b8043 100644 --- a/micro-behaviors/memory-manipulation/memory-protect.md +++ b/micro-behaviors/memory-manipulation/memory-protect.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0008**| -|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)| +|**Objective(s)**|[Memory Manipulation](../memory-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/memory-manipulation/overflow-buffer.md b/micro-behaviors/memory-manipulation/overflow-buffer.md index 26292cf..428cb51 100644 --- a/micro-behaviors/memory-manipulation/overflow-buffer.md +++ b/micro-behaviors/memory-manipulation/overflow-buffer.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0010**| -|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)| +|**Objective(s)**|[Memory Manipulation](../memory-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/memory-manipulation/stack-pivot.md b/micro-behaviors/memory-manipulation/stack-pivot.md index 6c7d13b..7c511ed 100644 --- a/micro-behaviors/memory-manipulation/stack-pivot.md +++ b/micro-behaviors/memory-manipulation/stack-pivot.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0009**| -|**Objective(s)**|[Memory Manipulation](../micro-behaviors/memory-manipulation)| +|**Objective(s)**|[Memory Manipulation](../memory-manipulation)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/processes/README.md b/micro-behaviors/processes/README.md index db90ebe..44b447e 100644 --- a/micro-behaviors/processes/README.md +++ b/micro-behaviors/processes/README.md @@ -8,6 +8,6 @@ Micro-behaviors related to processes. |Name|ID|Description| |---|---|---| -|[**Create Process**](../micro-behaviors/processes/create-process.md)|C0017|| -|[**Synchronization**](../micro-behaviors/processes/synchronization.md)|C0022|| -|[**Terminate Process**](../micro-behaviors/processes/terminate-process.md)|C0018|| +|[**Create Process**](../processes/create-process.md)|C0017|| +|[**Synchronization**](../processes/synchronization.md)|C0022|| +|[**Terminate Process**](../processes/terminate-process.md)|C0018|| diff --git a/micro-behaviors/processes/create-process.md b/micro-behaviors/processes/create-process.md index 8c4ba66..ddd72c2 100644 --- a/micro-behaviors/processes/create-process.md +++ b/micro-behaviors/processes/create-process.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0017**| -|**Objective(s)**|[Processes](../micro-behaviors/processes)| +|**Objective(s)**|[Processes](../processes)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/processes/synchronization.md b/micro-behaviors/processes/synchronization.md index c074772..c484b3d 100644 --- a/micro-behaviors/processes/synchronization.md +++ b/micro-behaviors/processes/synchronization.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0022**| -|**Objective(s)**|[Processes](../micro-behaviors/processes)| +|**Objective(s)**|[Processes](../processes)| |**Related ATT&CK Technique**|None| diff --git a/micro-behaviors/processes/terminate-process.md b/micro-behaviors/processes/terminate-process.md index 265bc74..f3f15a9 100644 --- a/micro-behaviors/processes/terminate-process.md +++ b/micro-behaviors/processes/terminate-process.md @@ -1,7 +1,7 @@ ||| |---|---| |**ID**|**C0018**| -|**Objective(s)**|[Processes](../micro-behaviors/processes)| +|**Objective(s)**|[Processes](../processes)| |**Related ATT&CK Technique**|None|