mbc behavior related techniques

anti-behavioral-analysis/detect-sandbox.md

@@ -9,7 +9,7 @@ Sandbox Detection
 =================
 Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.
 
-The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior.
+The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK techniques were defined subsequent to this MBC behavior.
  
 Methods
 -------
@@ -17,7 +17,7 @@ Methods
 |---|---|---|
 |**Check Clipboard Data**|B0007.001|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
 |**Check Files**|B0007.002|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
-|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
+|**Human User Check**|B0007.003|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
 |**Injected DLL Testing**|B0007.004|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
 |**Product Key/ID Testing**|B0007.005|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
 |**Screen Resolution Testing**|B0007.006|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|

anti-behavioral-analysis/detect-vm.md

@@ -9,7 +9,7 @@ Virtual Machine Detection
 =========================
 Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)
 
-The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior.
+The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK techniques were defined subsequent to this MBC behavior.
 
 Methods
 -------

anti-behavioral-analysis/evade-dynamic-analysis.md

@@ -11,7 +11,7 @@ Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine
 
 See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Conditional Execution](../anti-behavioral-analysis/conditional-execute.md) for a behavior that constrains dynamic execution based on environmental conditions. 
 
-The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior.
+The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK techniques were defined subsequent to this MBC behavior.
 
 Methods
 -------

command-and-control/domain-name-generate.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**B0031**|
 |**Objective(s)**|[Command and Control](../command-and-control)|
-|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/)|
+|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/)|
 
 
 Domain Name Generation
 ======================
 Malware generates the domain name of the controller to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced implants; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
 
-The related [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/) ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior.
+The related [Dynamic Resolution: Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/) ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior.
 
 Malware Examples
 ----------------

execution/send-email.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**B0020**|
 |**Objective(s)**|[Execution](../execution), [Lateral Movement](../lateral-movement)|
-|**Related ATT&CK Technique**|[Phishing](https://attack.mitre.org/techniques/T1566/)|
+|**Related ATT&CK Technique**|[Phishing (T1566)](https://attack.mitre.org/techniques/T1566/)|
 
 
 Send Email

impact/compromise-data.md

@@ -2,11 +2,11 @@
 |---|---|
 |**ID**|**B0016**|
 |**Objective(s)**|[Impact](../impact)|
-|**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/)|
+|**Related ATT&CK Sub-Technique**|[Data Manipulation: Stored Data Manipulation (T1565.001)](https://attack.mitre.org/techniques/T1565/001/)|
 
 
 Compromise Data Integrity
 =========================
 Data stored on the file system of a compromised system is manipulated to compromise its integrity.
 
-The related [Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/) ATT&CK sub-technique was defined subsequent to this MBC behavior.
+The related [Data Manipulation: Stored Data Manipulation (T1565.001)](https://attack.mitre.org/techniques/T1565/001/) ATT&CK sub-technique was defined subsequent to this MBC behavior.

impact/denial-of-service.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**B0033**|
 |**Objective(s)**|[Impact](../impact)|
-|**Related ATT&CK Technique**|[Network Denial of Service](https://attack.mitre.org/techniques/T1498/)|
+|**Related ATT&CK Technique**|[Network Denial of Service (T1498)](https://attack.mitre.org/techniques/T1498/)|
 
 
 Denial of Service
@@ -11,7 +11,7 @@ Malware may make a network unavailable, for example, by launching a network-base
 
 Endpoint denial of service behaviors are captured by the [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499/) technique.
 
-The related [Network Denial of Service](https://attack.mitre.org/techniques/T1498/) ATT&CK technique was defined subsequent to this MBC behavior.
+The related [Network Denial of Service (T1498)](https://attack.mitre.org/techniques/T1498/) ATT&CK technique was defined subsequent to this MBC behavior.
 
 Malware Examples
 ----------------

impact/hijack-sys-resources.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**B0018**|
 |**Objective(s)**|[Impact](../impact)|
-|**Related ATT&CK Technique**|[Resource Hijacking](https://attack.mitre.org/techniques/T1496/)|
+|**Related ATT&CK Technique**|[Resource Hijacking (T1496)](https://attack.mitre.org/techniques/T1496/)|
 
 
 Resource Hijacking
 ==================
 Uses system resources for other purposes; as a result, the system may not be available for intended uses.
 
-The related [Resource Hijacking](https://attack.mitre.org/techniques/T1496/) ATT&CK technique was defined subsequent to this MBC behavior.
+The related [Resource Hijacking (T1496)](https://attack.mitre.org/techniques/T1496/) ATT&CK technique was defined subsequent to this MBC behavior.
 
 Methods
 -------

impact/manipulate-network-traffic.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**B0019**|
 |**Objective(s)**|[Impact](../impact)|
-|**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/)|
+|**Related ATT&CK Sub-Technique**|[Data Manipulation: Transmitted Data Manipulation (T1565.002)](https://attack.mitre.org/techniques/T1565/002/)|
 
 
 Manipulate Network Traffic
 ==========================
 Malware intercepts and manipulates network traffic, typically accessing or modifying data, going to or originating from the system on which the malware instance is executing. Also known as a Man-in-the-Middle attack.
 
-The related [Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/) ATT&CK sub-technique was defined subsequent to this MBC behavior.
+The related [Data Manipulation: Transmitted Data Manipulation (T1565.002)](https://attack.mitre.org/techniques/T1565/002/) ATT&CK sub-technique was defined subsequent to this MBC behavior.
 
 Malware Examples
 ----------------