add methods

anti-behavioral-analysis/detect-sandbox.md

@@ -15,7 +15,7 @@ Methods
 -------
 * **Human User Check**: Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox.
 * **Injected DLL Testing**: Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.
-* **Software Checks**: Malware may check software to determine whether its running in a sandbox. For example malicious Office documents might check Microsoft Office version, window size, or VB project name.
+* **Software Check**: Malware may check software to determine whether its running in a sandbox. For example malicious Office documents might check Microsoft Office version, window size, or VB project name.
 * **Product Key/ID Testing**: Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry. 
 * **Screen Resolution Testing**: Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.
 

discovery/README.md

@@ -20,6 +20,7 @@ Behaviors that aim to gain knowledge about the system and internal network.
 * **Query Registry** [T1012](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/query-registry.md)
 * **Remote System Discovery** [T1018](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/remote-sys-discover.md)
 * **Security Software Discovery** [T1063](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/security-sw-discover.md)
+* **Self Discovery** [M0038](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/self-discover.md)
 * **SMTP Connection Discovery** [M0014](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/smtp-connect-discover.md)
 * **System Information Discovery** [T1082](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-info-discover.md)
 * **System Network Configuration Discovery** [T1016](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/system-network-config-discover.md)

discovery/self-discover.md

@@ -0,0 +1,11 @@
+|||
+|---------|------------------------|
+|**ID**|**M0038**|
+|**Objective(s)**|[Discovery](https://github.com/MBCProject/mbc-markdown/tree/master/discovery)|
+|**Related ATT&CK Technique(s)**|None|
+
+
+Self Discovery
+==============
+Malware may gather information about itself, such as its filename or size on disk. 
+

execution/exploit-software.md

@@ -16,6 +16,7 @@ Methods
 * **Java-based Web Servers**: 
 * **File Transfer Protocol (FTP) Servers**:
 * **Red Hat JBoss Enterprise Products**:
+* **Sysinternals**: Use Sysinternals tools for additional command line functionality.
 
 Malware Examples
 ----------------