rephrasing

command-and-control/README.md

@@ -3,7 +3,7 @@
 |**ID**|**M9004**|
 
 # Command and Control
-Behaviors to communicate with controlling or controlled systems within a target network (e.g., c2 server, bots). There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Malware may be part of a larger botnet.
+Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.
 
 * **Command and Control Communication** [M0030](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md)
 * **Commonly Used Port** [T1043](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/common-port.md)
@@ -16,6 +16,7 @@ Behaviors to communicate with controlling or controlled systems within a target
 * **Fallback Channels** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/fallback-channels.md)
 * **Multi-Stage Channels** [T1104](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/multi-stage-channels.md)
 * **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
+* **Remote Access Tools** [T1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-access-tools.md)
 * **Remote File Copy** [T1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
 * **Standard Application Layer Protocol** [T1071](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-app-protocol.md)
 * **Standard Cryptographic Protocol** [T1032](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-crypto-protocol.md)

command-and-control/remote-access-tools.md

@@ -0,0 +1,11 @@
+|||
+|---------|------------------------|
+|**ID**|**T1219**|
+|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
+|**Related ATT&CK Technique(s)**|[Remote Access Tools](https://attack.mitre.org/techniques/T1219/)|
+
+Remote Access Tools
+===================
+Malware may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems.
+
+**See ATT&CK:** [**Remote Access Tools**](https://attack.mitre.org/techniques/T1219/).

impact/remote-access.md

@@ -2,16 +2,16 @@
 |---------|------------------------|
 |**ID**|**M0022**|
 |**Objective(s)**| [Impact](https://github.com/MBCProject/mbc-markdown/tree/master/impact)|
-|**Related ATT&CK Technique(s)**|[**Remote Access Tools**](https://attack.mitre.org/techniques/T1219/)|
+|**Related ATT&CK Technique(s)**|None|
 
 
 Remote Access
 =============
-Malware may provide an attacker with potentially full access to a system via a remote network connection. 
+Malware may provide an attacker with potentially full access to a system via a remote network connection. Such malware is often referred to as a RAT (Remote Access Trojan).
 
-Malware may also provide specific commands. Given an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., Delete File). Explicit commands provided by the malware can be captured with Methods associated with the [Execution:Remote Commands](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md) Behavior; examples include Execution:Remote Commands:Execute and Execution:Remote Commands:Delete File.
+If the malware provides an "execute" command, the attacker may choose to delete files or corrupt data, power-off the machine, or upload and execute other applications. The malware may also provide specific commands to the attacker (e.g., Delete File). Explicit commands provided by the malware can be captured with Methods associated with the [Execution:Remote Commands](https://github.com/MBCProject/mbc-markdown/blob/master/execution/remote-commands.md) behavior; examples include *Execution:Remote Commands:Execute* and *Execution:Remote Commands:Delete File*.
 
-This behavior is related to the ATT&CK [**Remote Access Tools**](https://attack.mitre.org/techniques/T1219/) technique which is defined under the ATT&CK Command and Control tactic, but it is not equivalent (reflected by its "M" ID).
+Note that the ATT&CK [**Remote Access Tools**](https://attack.mitre.org/techniques/T1219/) technique which is defined under the ATT&CK Command and Control tactic, is specific to "legitimate desktop support and remote access software” – which is different than a RAT malware. *Impact:Remote Access* and *Command and Control: Remote Access Tools* are equivalent (reflected by its "M" ID).
 
 Methods
 -------

yfaq/README.md

@@ -69,11 +69,11 @@ The cyber adversary behavior and malware analysis realms each have their own voc
 
 ### ATT&CK is organized by the Enterprise and Mobile technology domains. Why isn't MBC? ###
 
-To support malware analysis use cases, we didn't see value in distinguishing between enterprise and mobile malware.
+Although both domains are included in MBC, we didn't see value in distinguishing between enterprise and mobile malware for supporting malware analysis use cases.
 
 ### ATT&CK is a mid-level adversary model. Does MBC model malware in a similar way? ###
 
-ATT&CK models the lifecycle of a human adversary, which results in an ordering of tactics (not necessarily strict), starting with Initial Access and ending with Impact. Software (malware code) executes sequentially but from a timing, lifecycle perspective, it executes simultaneously. Therefore, MBC objectives are presented alphabetically, and MBC doesn't provide a model in the same sense as ATT&CK: rather MBC captures an unordered collection of objections and behaviors applicable to a malware sample.
+ATT&CK models the life cycle of a human adversary, which results in an ordering of tactics (not necessarily strict), starting with Initial Access and ending with Impact. Software (malware code) executes sequentially but from a timing, life cycle perspective, it executes simultaneously. Therefore, MBC objectives are presented alphabetically, and MBC doesn't provide a model in the same sense as ATT&CK: rather MBC captures an unordered collection of objections and behaviors applicable to a malware sample.
 
 ### Some MBC behaviors seem to be characteristics of code, not actual behaviors (e.g., [Executable Code Optimization](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-optimize.md)). Why are they captured and why are they called behaviors? ###
 
@@ -127,15 +127,15 @@ For example, a [GotBotKR](https://github.com/MBCProject/mbc-markdown/blob/master
 
 ### Can malware behaviors identified by automated sandboxes and tools map to multiple MBC behaviors or should correspondence be one-to-one? ###
 
-Behaviors identified by automated tools are often intentionally broad to give an overview of the malware's behavior. Broad behaviors will often map to multiple MBC behaviors. For example, if a tool reports that the Armadillo was used on the sample, both [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md) and [Executable Code Compression](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md) behaviors apply.
+Behaviors identified by automated tools are often intentionally broad to give an overview of the malware sample's behavior. Broad behaviors will often map to multiple MBC behaviors. For example, if a tool reports that the Armadillo was used on the sample, both [Executable Code Obfuscation](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md) and [Executable Code Compression](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-compression.md) behaviors apply.
 
 ### How are MBC behaviors, possibly at different levels of abstraction, associated? ###
 
 MBC does not define relationships between behaviors, so association of behaviors must be done at the reporting level. The [GotBotKR](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gotbotkr.md) example [above](./gotbotkr) illustrates how multiple (three) behaviors can be associated by the human-readable text: "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2).
 
-### How do I map an analysis product's output to MBC when I don't know the details behind the behavior indicator? ###
+### How do I map an analysis product's output to MBC when I don't know the details behind the behavior indicators? ###
 
-Ideally, the product vendor will provide the MBC mapping, but if not, it may be best to map to all potentially relevant MBC behaviors (a one-to-many mapping). For example, the indicator "opened listening port" could be mapped to both [Command and Control:C2 Communication](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md) and [Impact:Remote Access](https://github.com/MBCProject/mbc-markdown/blob/master/impact/remote-access.md).
+Ideally, the product vendor will provide the MBC mapping, but if not and it's not possible to ask the signature developer for details, it may be best to map the indicator to all potentially relevant MBC behaviors (a one-to-many mapping). For example, the indicator "opened listening port" could be mapped to both [Command and Control:C2 Communication](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md) and [Impact:Remote Access](https://github.com/MBCProject/mbc-markdown/blob/master/impact/remote-access.md).
 
 ### How should information in the Methods section be used? ###