From cbc9bb78d439daaf523d0329ebe42de5555a1f7d Mon Sep 17 00:00:00 2001
From: brightmt <50853930+brightmt@users.noreply.github.com>
Date: Fri, 3 Jan 2025 13:52:23 -0500
Subject: [PATCH] Create revoked.md (#173)

* Create revoked.md

Added table for tracking revoked IDs.  Unsure of the reason for C0032.004's revocation, although my speculation based on google search is included.

* Update revoked.md

Fixed dates

* Update revoked.md

Added C0013
---
 revoked.md | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 revoked.md

diff --git a/revoked.md b/revoked.md
new file mode 100644
index 0000000..30c6539
--- /dev/null
+++ b/revoked.md
@@ -0,0 +1,10 @@
+# Revoked Behaviors and Methods
+The Malware Behavior Catalog has revoked a small number of behaviors and methods as it has evolved.  The IDs for revoked behaviors and methods are not re-used.  If it appears that we are missing behavior or methods IDs, this page will explain what revoked IDs previously represented, when they were retired, and the reason for retiring them.
+
+| Revoked ID | Behavior or Method | Revocation Date | Reason |
+|--- |--- |--- |--- |
+| C0013 | UDP Communication | 25 September 2020 | Merged into C0001 because UDP also communicates over socket interfaces |
+| B0001.007 | Interrupt 1 | 2 August 2022 | Merged into B0001.006 to create a more general 'Interruption' method |
+| B0012.004 | Variable Recomposition | 21 November 2022 | Moved to B0032.021 |
+| C0032.004 | Verhoeff | 1 February 2023 | Not actually used in malware |
+| E1608 | Install Certificate | 14 February 2024 | Changed from enhanced ATT&CK technique ID (E-prefix) to enhanced ATT&CK sub-technique ID (F-prefix).  Current ID is F0016 |