Merge branch 'master' of github.com:MBCProject/mbc-markdown into xample-malware-update

command-and-control/domain-name-generate.md

@@ -8,7 +8,7 @@ Domain Name Generation
 ======================
 Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
 
-The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/) is oriented toward an adversary perspective (although its examples include malware) is related to this MBC behavior.
+The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.
 
 Malware Examples
 ----------------

credential-access/README.md

@@ -11,6 +11,7 @@ Behaviors to obtain credential access, allowing it or its underlying threat acto
 * **Credential Dumping** [T1003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credential-dump.md)
 * **Credentials in Files** [T1081](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-files.md)
 * **Credentials in Registry** [T1214](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-registry.md)
+* **Credentials in Web Browsers** [T1503](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-web-browsers.md)
 * **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
 * **Input Capture** [T1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
 * **LLMNR/NBT-NS Poisoning** [T1171](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/LLMNR-poison.md)

credential-access/credentials-in-web-browsers.md

@@ -0,0 +1,11 @@
+|||
+|---------|------------------------|
+|**ID**|**T1503**|
+|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
+|**Related ATT&CK Technique(s)**|[Credentials in Web Browsers](https://attack.mitre.org/techniques/T1503/)|
+
+Credentials in Web Browsers
+===========================
+Malware may acquire credentials from web browsers by reading files specific to the target browser.
+
+**See ATT&CK:** [**Credentials in Web Browsers**](https://attack.mitre.org/techniques/T1503/).

credential-access/hooking.md

@@ -17,6 +17,9 @@ Methods
 -------
 * **Patch MmGetPhysicalMemoryRanges**: Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)
 * **Hook memory mapping APIs**: Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)
+* **Hook procedures**: Intercepts and executes designated code in response to events such as messages, keystrokes, and moust inputs.
+* **Import Address Hooking (IAT) Hooking**: uses modifications to a process's IAT where pointers to imported API functions are stored.
+* **Inline Hooking**: overwrites the first bytes in an API function to redirect code flow.
 
 Malware Examples
 ----------------