diff --git a/defense-evasion/modify-registry.md b/defense-evasion/modify-registry.md
index 819e5da..af9f461 100644
--- a/defense-evasion/modify-registry.md
+++ b/defense-evasion/modify-registry.md
@@ -79,7 +79,7 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
 |[disables_startmenu_search](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_startmenu_search.py)|Modify Registry (E1112)|--|
 |[stealth_hide_notifications](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stealth_hidenotifications.py)|Modify Registry (E1112)|--|
 |[disables_app_launch](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/disables_app.py)|Modify Registry (E1112)|--|
-|[neshta_regkeys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/neshta_regkeys.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
+|[neshta_regkeys](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|Modify Registry (E1112)|RegSetValueExA, RegSetValueExW|
 |[creates_nullvalue](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/creates_nullvalue.py)|Modify Registry (E1112)|NtCreateKey, NtSetValueKey|
 |[geodo_banking_trojan](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_geodo.py)|Modify Registry (E1112)|--|
 |[persistence_autorun](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_autorun.py)|Modify Registry (E1112)|NtSetValueKey, RegSetValueExA, RegSetValueExW, CreateServiceW, CreateServiceA|
diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md
index d7f8c03..a4b304d 100644
--- a/defense-evasion/process-injection.md
+++ b/defense-evasion/process-injection.md
@@ -100,7 +100,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan
 |[transacted_hollowing](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Process Injection (E1055)|NtRollbackTransaction, NtMapViewOfSection, RtlSetCurrentTransaction|
 |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
 |[persistence_ifeo](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection::Injection and Persistence via Registry Modification (E1055.m02)|--|
-|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_silent_process_exit.py)|Process Injection (E1055)|--|
+|[persistence_silent_process_exit](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/persistence_ifeo.py)|Process Injection (E1055)|--|
 |[injection_rwx](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_rwx.py)|Process Injection (E1055)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 |[persistence_shim_database](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/persistence_shim.py)|Process Injection::Injection using Shims (E1055.m03)|--|
 |[injection_runpe](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/injection_runpe.py)|Process Injection (E1055)|--|
diff --git a/execution/exploitation-for-client-execution.md b/execution/exploitation-for-client-execution.md
index e355e29..623cd5f 100644
--- a/execution/exploitation-for-client-execution.md
+++ b/execution/exploitation-for-client-execution.md
@@ -67,8 +67,8 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
 |[stack_pivot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|VirtualProtectEx, NtAllocateVirtualMemory, NtMapViewOfSection, NtWriteVirtualMemory, NtWow64WriteVirtualMemory64, URLDownloadToFileW, WriteProcessMemory, NtProtectVirtualMemory|
 |[stack_pivot_file_created](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateFile|
 |[stack_pivot_process_create](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/stack_pivot.py)|Exploitation for Client Execution (E1203)|NtCreateUserProcess, CreateProcessInternalW|
-|[uses_windows_utilities](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
-|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/uses_windows.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[uses_windows_utilities](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
+|[uses_windows_utilities_curl](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/windows_utilities.py)|Exploitation for Client Execution::Windows Utilities (E1203.m06)|--|
 |[cve_2014_6332](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2014_6332.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
 |[exploit_gethaldispatchtable](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/exploit_gethaldispatchtable.py)|Exploitation for Client Execution (E1203)|LdrGetProcedureAddress, LdrLoadDll|
 |[cve_2015_2419_js](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/cve_2015_2419.py)|Exploitation for Client Execution (E1203)|JsEval, COleScript_ParseScriptText, COleScript_Compile|
diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md
index 43a4998..3e6b812 100644
--- a/micro-behaviors/cryptography/decrypt-data.md
+++ b/micro-behaviors/cryptography/decrypt-data.md
@@ -63,9 +63,9 @@ Malware may decrypt data.
 |[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey|
 |[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decrypt Data (C0031)|CryptDecrypt|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Decryption|Decrypt Data (C0031)|CryptDecrypt|
 
 ## Code Snippets
 
diff --git a/micro-behaviors/data/decompress-data.md b/micro-behaviors/data/decompress-data.md
index 8c72867..631e6db 100644
--- a/micro-behaviors/data/decompress-data.md
+++ b/micro-behaviors/data/decompress-data.md
@@ -54,9 +54,9 @@ Malware may decompress data.
 |[decompress data using QuickLZ](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-quicklz.yml)|Decompress Data::QuickLZ (C0025.001)|--|
 |[decompress data using UCL](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/compression/decompress-data-using-ucl.yml)|Decompress Data (C0025)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decompress Data (C0025)|RtlDecompressBuffer|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[compression](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Compression|Decompress Data (C0025)|RtlDecompressBuffer|
 
 ## References
 
diff --git a/micro-behaviors/file-system/move-file.md b/micro-behaviors/file-system/move-file.md
index 7235f75..d205a65 100644
--- a/micro-behaviors/file-system/move-file.md
+++ b/micro-behaviors/file-system/move-file.md
@@ -47,9 +47,9 @@ Malware moves a file.
 |---|---|---|
 |[move file](https://github.com/mandiant/capa-rules/blob/master/host-interaction/file-system/move/move-file.yml)|Move File (C0063)|kernel32.MoveFile, kernel32.MoveFileEx, MoveFileWithProgress, MoveFileTransacted, rename, _wrename, System.IO.FileInfo::MoveTo, System.IO.File::Move, kernel32.SHFileOperation|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[move_file_on_reboot](https://github.com/CAPESandbox/community/tree/master/modules/signatures/move_file_on_reboot.py)|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[move_file_on_reboot](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/move_file_on_reboot.py)|move_file_on_reboot|Move File (C0063)|MoveFileWithProgressTransactedA, MoveFileWithProgressTransactedW|
 
 ### C0063 Snippet
 <details>
diff --git a/micro-behaviors/memory/allocate-memory.md b/micro-behaviors/memory/allocate-memory.md
index 357d8b8..3bcf76e 100644
--- a/micro-behaviors/memory/allocate-memory.md
+++ b/micro-behaviors/memory/allocate-memory.md
@@ -48,14 +48,14 @@ Malware allocates memory, often to unpack itself.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[allocate RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-rwx-memory.yml)|Allocate Memory (C0007)|--|
+|[allocate or change RWX memory](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/inject/allocate-or-change-rwx-memory.yml)|Allocate Memory (C0007)|--|
 |[allocate memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-memory.yml)|Allocate Memory (C0007)|kernel32.VirtualAlloc, kernel32.VirtualAllocEx, kernel32.VirtualAllocExNuma, kernel32.VirtualProtect, kernel32.VirtualProtectEx, NtAllocateVirtualMemory, ZwAllocateVirtualMemory, NtMapViewOfSection, ZwMapViewOfSection, NtProtectVirtualMemory, ZwProtectVirtualMemory|
-|[allocate RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-rw-memory.yml)|Allocate Memory (C0007)|--|
+|[allocate or change RW memory](https://github.com/mandiant/capa-rules/blob/master/lib/allocate-or-change-rw-memory.yml)|Allocate Memory (C0007)|--|
 |[spawn thread to RWX shellcode](https://github.com/mandiant/capa-rules/blob/master/load-code/shellcode/spawn-thread-to-rwx-shellcode.yml)|Allocate Memory (C0007)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[Unpacker](https://github.com/CAPESandbox/community/tree/master/modules/signatures/Unpacker.py)|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[Unpacker](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Unpacker|Allocate Memory (C0007)|VirtualProtectEx, NtAllocateVirtualMemory, NtProtectVirtualMemory|
 
 ### C0007 Snippet
 <details>
diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md
index a6f09f3..fb509d7 100644
--- a/micro-behaviors/operating-system/registry.md
+++ b/micro-behaviors/operating-system/registry.md
@@ -193,7 +193,7 @@ Malware modifies the registry.
 |[antivm_xen_keys](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_xen_keys.py)|XenDetectKeys|Registry::Query Registry Key (C0036.005)|--|
 |[antivm_generic_system](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_system.py)|AntiVMSystem|Registry::Query Registry Key (C0036.005)|--|
 |[antiemu_wine](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiemu_wine.py)|WineDetectReg|Registry::Query Registry Key (C0036.005)|--|
-|[virus_neshta](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/virus_neshta.py)|NeshtaRegKeys|Registry (C0036)| RegSetValueExA, RegSetValueExW|
+|[virus_neshta](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/virus_neshta.py)|NeshtaRegKeys|Registry (C0036)| RegSetValueExA, RegSetValueExW|
 |[antivm_generic_bios](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antivm_generic_bios.py)|AntiVMBios|Registry::Query Registry Key (C0036.005)|--|
 |[hides_recyclebin_icon](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/hides_recyclebin_icon.py)|HidesRecycleBinIcon|Registry (C0036)|--|
 |[antiav_detectreg](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/antiav_detectreg.py)|AntiAVDetectReg|Registry::Query Registry Key (C0036.005)|--|
diff --git a/micro-behaviors/process/allocate-thread-local-storage.md b/micro-behaviors/process/allocate-thread-local-storage.md
index 365b0a2..92f43bd 100644
--- a/micro-behaviors/process/allocate-thread-local-storage.md
+++ b/micro-behaviors/process/allocate-thread-local-storage.md
@@ -41,7 +41,7 @@ Malware allocates thread local storage.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
+|[allocate thread local storage](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/allocate-thread-local-storage.yml)|Allocate Thread Local Storage (C0040)|kernel32.TlsAlloc|
 
 ### C0040 Snippet
 <details>
diff --git a/micro-behaviors/process/create-mutex.md b/micro-behaviors/process/create-mutex.md
index ccbe4ba..a5e0f33 100644
--- a/micro-behaviors/process/create-mutex.md
+++ b/micro-behaviors/process/create-mutex.md
@@ -56,7 +56,7 @@ Malware creates a mutex. Mutexes may be created for synchronization purposes (tw
 |[banker_cridex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_cridex.py)|Cridex|Create Mutex (C0042)|--|
 |[deepfreeze_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/deepfreeze_mutex.py)|DeepFreezeMutex|Create Mutex (C0042)|--|
 |[bot_russkill](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/bot_russkill.py)|Ruskill|Create Mutex (C0042)|--|
-|[banker_zeus_p2p](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/banker_zeus_p2p.py)|ZeusP2P|Create Mutex (C0042)|--|
+|[banker_zeus_p2p](https://github.com/CAPESandbox/community/blob/master/modules/signatures/all/banker_zeus_p2p.py)|ZeusP2P|Create Mutex (C0042)|--|
 |[carberp_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/carberp_mutex.py)|CarberpMutexes|Create Mutex (C0042)|--|
 |[ransomware_radamant](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/ransomware_radamant.py)|RansomwareRadamant|Create Mutex (C0042)|--|
 |[rat_plugx_mutex](https://github.com/CAPESandbox/community/tree/master/modules/signatures/windows/rat_plugx_mutex.py)|PlugxMutexes|Create Mutex (C0042)|--|
diff --git a/micro-behaviors/process/set-thread-local-storage-value.md b/micro-behaviors/process/set-thread-local-storage-value.md
index da8e420..ac1d9ed 100644
--- a/micro-behaviors/process/set-thread-local-storage-value.md
+++ b/micro-behaviors/process/set-thread-local-storage-value.md
@@ -45,7 +45,7 @@ Malware allocates thread local storage.
 
 |Tool: capa|Mapping|APIs|
 |---|---|---|
-|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
+|[set thread local storage value](https://github.com/mandiant/capa-rules/blob/master/host-interaction/thread/tls/set-thread-local-storage-value.yml)|Set Thread Local Storage Value (C0041)|kernel32.TlsSetValue|
 
 ### C0041 Snippet
 <details>
diff --git a/micro-behaviors/process/terminate-process.md b/micro-behaviors/process/terminate-process.md
index b658727..5dc7ad0 100644
--- a/micro-behaviors/process/terminate-process.md
+++ b/micro-behaviors/process/terminate-process.md
@@ -52,9 +52,9 @@ Malware terminates a process.
 |[terminate process via kill](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process-via-kill.yml)|Terminate Process (C0018)|kill|
 |[terminate process](https://github.com/mandiant/capa-rules/blob/master/host-interaction/process/terminate/terminate-process.yml)|Terminate Process (C0018)|System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[terminates_remote_process](https://github.com/CAPESandbox/community/tree/master/modules/signatures/terminates_remote_process.py)|Terminate Process (C0018)|NtTerminateProcess|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[terminates_remote_process](https://github.com/CAPESandbox/community/blob/master/modules/signatures/windows/terminates_process.py)|TerminatesRemoteProcess|Terminate Process (C0018)|NtTerminateProcess|
 
 ### C0018 Snippet
 <details>