Adding PR feedback

anti-behavioral-analysis/debugger-detection.md

@@ -22,7 +22,7 @@ Methods
 |**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)|
 |**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
 |**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.|
-|**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.|
+|**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware. Examples include Interrupt 0x2d and Interrupt 1 [7].|
 |**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.|
 |**Memory Breakpoints**|B0001.009|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.|
 |**Memory Write Watching**|B0001.010|[[7]](#7)|

defense-evasion/process-injection.md

@@ -47,7 +47,7 @@ Malware Examples
 
 References
 ----------
-<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injectionion-techniques-technical-survey-common-and-trending-process
+<a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
 
 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
 
@@ -55,7 +55,7 @@ References
 
 <a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
 
-<a name="5">[5]</a> https://www.ired.team/offensive-security/code-injection-process-injectionion/executing-shellcode-with-createfiber
+<a name="5">[5]</a> https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber
 
 <a name="6">[6]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
 

micro-behaviors/cryptography/hashed-message-authentication-code.md

@@ -7,4 +7,4 @@
 
 Hashed Message Authentication Code
 ==================================
-Malware uses an hashed-message-authentication-code schema.
+Malware uses a hashed message authentication code (HMAC) schema.

persistence/README.md

@@ -11,7 +11,7 @@ Behaviors that enable malware to remain on a system regardless of system events,
 * **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md)
 * **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md)
 * **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md)
-* **Install Insecure or Malicious Configuration** [E1478](../defense-evasion/install-insecure-or-malicious-configuration.md)
+* **Install Insecure or Malicious Configuration** [B0047](../defense-evasion/install-insecure-or-malicious-configuration.md)
 * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-and-extensions.md)
 * **Malicious Network Driver** [B0026](../persistence/malicious-network-driver.md)
 * **Modify Existing Service** [F0011](../persistence/modify-existing-service.md)

xample-malware/bagle.md

@@ -11,7 +11,7 @@ Bagle
 =====
 A mass-mailing computer worm affecting Microsoft Windows. [[1]](#1)
 
-Behaviors
+MBC MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/blackenergy.md

@@ -11,7 +11,7 @@ BlackEnergy
 ===========
 An HTTP-based botnet used mostly for DDoS attacks. [[1]](#1)
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/conficker.md

@@ -11,7 +11,7 @@ Conficker
 =========
 A worm targeting Microsoft Windows operations systems. 
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/cryptolocker.md

@@ -20,7 +20,7 @@ ATT&CK Techniques
 |[Command and Control::Encrypted Channel::Asymmetric Cryptography (T1573.002)](https://attack.mitre.org/techniques/T1573/002/)|The malware encrypts messages with a public RSA key [[1]](#1)|
 |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses http to communicate with C2 [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/cryptowall.md

@@ -21,7 +21,7 @@ ATT&CK Techniques
 |[Command and Control:Proxy (T1090)](https://attack.mitre.org/techniques/T1090/)|The malware tries to connect to I2P proxies  [[1]](#1)|
 |[Impact::Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)|The malware encrypts files [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/dark-comet.md

@@ -11,7 +11,7 @@ Dark Comet
 ==========
 A Remote Access Trojan (RAT) that allows a user to control the system via a GUI. It has many features which allows a user to use it as administrative remote help tool; however, DarkComet has many features which can be used maliciously. DarkComet is commonly used to spy on the victims by taking screen captures, key-logging, or password stealing. [[1]](#1)
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/dnschanger.md

@@ -11,7 +11,7 @@ DNSChanger
 ==========
 Used to change DNS settings to generate fraudulent advertising revenue.
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/emotet.md

@@ -11,7 +11,7 @@ Emotet
 =====
 Emotet is a banking trojan. [[1]](#1)
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/gamut.md

@@ -19,7 +19,7 @@ ATT&CK Techniques
 |[Command and Control::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)|The malware receives files from C2 [[1]](#1)|
 |[Command and Control::Application Layer Protocol:Web Protocol (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP for command and control [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/geneio.md

@@ -34,7 +34,7 @@ ATT&CK Techniques
 |---|---|
 |[Persistence::Browser Extensions (T1176)](https://attack.mitre.org/techniques/T1176/)|Geneio installs Safari Extensions that are adware [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/gotbotkr.md

@@ -37,11 +37,11 @@ ATT&CK Techniques
 |[Command and Control::Standard Application Layer Protocol (T1071)](https://attack.mitre.org/techniques/T1071/)|GoBotKR uses HTTP or HTTPS for C&C. [[1]](#1)|
 |[Command and Control::Uncommonly Used Port (T1571)](https://attack.mitre.org/techniques/T1571/)|GoBotKR uses non-standard ports, such as 6446, 6556 and 7777, for C&C. [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|
-|[Execution::Install Additional Program](../execution/install-additional-program.md)|GotBotKR reinstalls its running instance if it is removed. [[1]](#1)|
+|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GotBotKR reinstalls its running instance if it is removed. [[1]](#1)|
 |[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|GoBotKR uses cmd.exe to execute commands. [[1]](#1)|
 |[Persistence::Registry Run Keys/Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)| GoBotKR installs itself under registry run keys to establish persistence. [[1]](#1)|
 |[Defense Evasion::Hidden Files and Directories (F0005)](../defense-evasion/hidden-files-and-directories.md)| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|

xample-malware/gravity-rat.md

@@ -17,7 +17,7 @@ ATT&CK Techniques
 |Name|Use|
 |---|---|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/heriplor.md

@@ -11,7 +11,7 @@ Heriplor
 ========
 This Trojan is associated with the Energetic Bear group  [[1]](#1).
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/hupigon.md

@@ -18,11 +18,11 @@ ATT&CK Techniques
 |---|---|
 |[Defense Evasion::Obfuscated Files or Information:Software Packing (T1027.002)](https://attack.mitre.org/techniques/T1027/002/)|The malware may be packed with UPX [[2]](#2)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|
-|[Registry Run Keys / Startup Folder](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1)|
+|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md)|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[1]](#1)|
 |[Defense Evasion::Modify Registry (E1112)](../defense-evasion/modify-registry.md)|The malware adds many entries to the registry [[1]](#1)|
 |[Impact::Remote Access (B0022)](../impact/remote-access.md)|The malware acts as a backdoor [[1]](#1)|
 |[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|The malware injects itself into processes such as cmd.exe, notepad.exe [[2]](#2)|

xample-malware/kovter.md

@@ -20,7 +20,7 @@ ATT&CK Techniques
 |[Execution::User Execution::Malicious File (T1204.002)](https://attack.mitre.org/techniques/T1204/002/)|The malware relies on a victim to execute itself [[2]](#2)|
 |[Defense Evasion::System Binary Proxy Execution:Mshta (T1218.005)](https://attack.mitre.org/techniques/T1218/005/)|	The malware uses mshta.exe to run Javascript [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/kraken.md

@@ -18,11 +18,11 @@ ATT&CK Techniques
 |[Command and Control::Dynamic Resolution:Domain Generation Algorithms (T1568.002)](https://attack.mitre.org/techniques/T1568/002/)|Uses a domain name generator.  [[1]](#1)|
 |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware uses HTTP to communicate with C2 [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|
-|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| [[1]](#1)|
+|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Uses a domain name generator.  [[1]](#1)|
 |[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is wiped out. [[1]](#1)|
 
 References

xample-malware/locky-bart.md

@@ -11,7 +11,7 @@ Locky Bart
 ==========
 Locky Bart is ransomware.  [[1]](#1)
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/mazarbot.md

@@ -11,7 +11,7 @@ MazarBot
 ==========
 Targets Android phones via a poisoned text message.
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/mebromi.md

@@ -18,7 +18,7 @@ ATT&CK Techniques
 |---|---|
 |[Defense Evasion::Pre-OS Boot::System Firmware (T1542.001)](https://attack.mitre.org/techniques/T1542/001/)|Malware performs BIOS modification and can download and execute a file as well as protect itself from removal [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/poison-ivy.md

@@ -15,7 +15,7 @@ ATT&CK Techniques
 -----------------
 See ATT&CK: [Poison Ivy - Techniques Used](https://attack.mitre.org/software/S0012/).
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/redhip.md

@@ -11,7 +11,7 @@ Redhip
 ======
 An information stealer.
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/rombertik.md

@@ -23,7 +23,7 @@ ATT&CK Techniques
 |[Command and Control::Data Encoding::Standard Encoding (T1132.001)](https://attack.mitre.org/techniques/T1132/001/)|The malware transmits Base64 encoded data to C2 [[1]](#1)|
 |[Command and Control::Application Layer Protocol::Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware transmits data over HTTP [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/samsam.md

@@ -16,7 +16,7 @@ ATT&CK Techniques
 -----------------
 See ATT&CK: [SamSam - Techniques Used](https://attack.mitre.org/software/S0370/).
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/searchawesome.md

@@ -22,7 +22,7 @@ ATT&CK Techniques
 |[Execution:Command and Scripting Interpreter (T1059.007)](https://attack.mitre.org/techniques/T1059/007/)|The malware installs a script to inject JavaScript script and modify web traffic. [[1]](#1)|
 
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/shamoon.md

@@ -16,7 +16,7 @@ ATT&CK Techniques
 -----------------
 See ATT&CK: [Shamoon - Techniques Used](https://attack.mitre.org/software/S0140/).
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/stuxnet.md

@@ -17,7 +17,7 @@ ATT&CK Techniques
 See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/).
 
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/synful-knock.md

@@ -11,7 +11,7 @@ SYNful Knock
 ============
 A modification of the router's firmware images used to maintain persistence. [[1]](#1)
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/terminator.md

@@ -18,7 +18,7 @@ ATT&CK Techniques
 |---|---|
 |[Defense Evasion::Virtualization/Sandbox Evasion: User Activity Based Checks (T1497)](https://attack.mitre.org/techniques/T1497/)|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[2]](#2)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/trickbot.md

@@ -14,40 +14,9 @@ Trojan spyware program that has mainly been used for targeting banking sites. Tr
 
 ATT&CK Techniques
 -----------------
-|Name|Use|
-|---|---|
-|[Account Discovery](https://attack.mitre.org/techniques/T1087/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Non-Standard Port](https://attack.mitre.org/techniques/T1571/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Credentials from Password Stores::Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Unsecured Credentials::Credentials In Files](https://attack.mitre.org/techniques/T1552/001/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Unsecured Credentials::Credentials in Registry](https://attack.mitre.org/techniques/T1552/002/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Encrypted Channel](https://attack.mitre.org/techniques/T1573/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Data from Local System](https://attack.mitre.org/techniques/T1005/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Disable or Evade Security Tools](../defense-evasion/disable-or-evade-security-tools.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Domain Trust Discovery](https://attack.mitre.org/techniques/T1482/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Email Collection](https://attack.mitre.org/techniques/T1114/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Native API](https://attack.mitre.org/techniques/T1106/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Hooking](../credential-access/hooking.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Man in the Browser](https://attack.mitre.org/techniques/T1185/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Modify Registry](../defense-evasion/modify-registry.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Obfuscated Files or Information](../defense-evasion/obfuscated-files-or-information.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Process Injection](../defense-evasion/process-injection.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Registry Run Keys / Startup Folder](../persistence/registry-run-keys-startup-folder.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Remote File Copy](../command-and-control/ingress-tool-transfer.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Scheduled Task/Job](https://attack.mitre.org/techniques/T1053/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Executable Code Obfuscation](../anti-static-analysis/executable-code-obfuscation.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Send Email](../execution/send-email.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Application Layer Protocol](https://attack.mitre.org/techniques/T1071/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[System Information Discovery](../discovery/system-information-discovery.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[System Service Discovery](https://attack.mitre.org/techniques/T1016/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Non-Standard Port](https://attack.mitre.org/techniques/T1571/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[User Interaction](../execution/user-execution.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
+See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/).
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/up007.md

@@ -23,7 +23,7 @@ ATT&CK Techniques
 |[Command and Control::Ingress Tool Transfer (T1105)](https://attack.mitre.org/techniques/T1105/)|The malware downloads files from C2 [[1]](#1)|
 |[Command and Control::Application Layer Protocol: Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/)|The malware communicates to the C2 server using HTTP [[1]](#1)|
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/ursnif.md

@@ -11,7 +11,7 @@ Ursnif
 ======
 A banking trojan that uses malware macros to evade sandbox detection. Variant of Gozi.
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|

xample-malware/webcobra.md

@@ -11,28 +11,33 @@ WebCobra
 ========
 Cryptojacking malware. [[1]](#1)
 
-Behaviors
+ATT&CK Techniques
+-----------------
+|Name|Use|
+|---|---|
+|[Discovery::File and Directory Discovery (T1083)](https://attack.mitre.org/techniques/T1083/)|[[1]](#1)|
+|[Discovery::Query Registry (T1012)](https://attack.mitre.org/techniques/T1012/)|[[1]](#1)|
+|[Discovery::Process Discovery (T1057)](https://attack.mitre.org/techniques/T1057/)|[[1]](#1)|
+|[Discovery::System Time Discovery (T1124)](https://attack.mitre.org/techniques/T1124/)|[[1]](#1)|
+|[Discovery::Software Discovery::Security Software Discovery (T1518.001)](https://attack.mitre.org/techniques/T1518/001/)|Learns about security software. [[1]](#1)|
+|[Defense Evasion::Deobfuscate/Decode Files or Information (T1140)](https://attack.mitre.org/techniques/T1140/)|[[1]](#1)|
+|[Defense Evasion::Indicator Removal on Host::File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/)|[[1]](#1)|
+
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|
-|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)|[[1]](#1)|
-|[Query Registry](https://attack.mitre.org/techniques/T1012/)|[[1]](#1)|
-|[System Information Discovery](../discovery/system-information-discovery.md)|Learns about the system so it can drop compatible miner software.  [[1]](#1)|
-|[Process Discovery](https://attack.mitre.org/techniques/T1057/)|[[1]](#1)|
-|[System Time Discovery](https://attack.mitre.org/techniques/T1124/)|[[1]](#1)|
-|[Software Discovery::Security Software Discovery](https://attack.mitre.org/techniques/T1518/001/)|Learns about security software. [[1]](#1)|
-|[Command and Scripting Interpreter](../execution/command-and-scripting-interpreter.md)|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
-|[Install Additional Program](../execution/install-additional-program.md)|Downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)|
-|[Conditional Execution](../execution/conditional-execution.md)|Executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)|
-|[Resource Hijacking](../impact/resource-hijacking.md)|Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
-|[Dynamic Analysis Evasion](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|[[1]](#1)|
-|[Emulator Evasion](../anti-behavioral-analysis/emulator-evasion.md)|[[1]](#1)|
-|[Virtual Machine Detection](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment. [[1]](#1)|
-|[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140/)|[[1]](#1)|
-|[Obfuscated Files or Information](../defense-evasion/obfuscated-files-or-information.md)|[[1]](#1)|
-|[Indicator Removal on Host::File Deletion](https://attack.mitre.org/techniques/T1070/004/)|[[1]](#1)|
-|[Process Injection](../defense-evasion/process-injection.md)|Injects miner code into a running process.|
-|[Disable or Evade Security Tools](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs.  [[1]](#1)|
+|[Discovery::System Information Discovery (E1082)](../discovery/system-information-discovery.md)|Learns about the system so it can drop compatible miner software.  [[1]](#1)|
+|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
+|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)|
+|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)|
+|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
+|[Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|[[1]](#1)|
+|[Anti-Behavioral Analysis::Emulator Evasion (B0005)](../anti-behavioral-analysis/emulator-evasion.md)|[[1]](#1)|
+|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment. [[1]](#1)|
+|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|[[1]](#1)|
+|[Defense Evasion::Process Injection (E1055)](../defense-evasion/process-injection.md)|Injects miner code into a running process.|
+|[Defense Evasion::Disable or Evade Security Tools (E1089)](../defense-evasion/disable-or-evade-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs.  [[1]](#1)|
 
 References
 ----------

xample-malware/yispecter.md

@@ -11,14 +11,14 @@ YiSpecter
 =========
 YiSpecter is Apple iOS malware that can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to a C2 server. It uses tricks to hide its icons from iOS’s SpringBoard, which prevents the user from finding and deleting it. The components also use the same name and logos of system apps to trick iOS power users. [[1]](#1)
 
-Behaviors
+MBC Behaviors
 ---------
 |Name|Use|
 |---|---|
 |[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Can download and install arbitrary iOS apps [[1]](#1)|
 |[Defense Evasion::Hidden Artifacts (E1564)](../defense-evasion/hide-artifacts.md)|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)|
 |[Command and Control::Command and Control Communication::Send System Information (B0030.006)](../command-and-control/c2-communication.md)|Connects to the command and control server using HTTP to send device information [[1]](#1)|
-|[Defense Evasion::Install Insecure or Malicious Configuration (E1478)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Changes iOS Safari's default configuration [[1]](#1)|
+|[Defense Evasion::Install Insecure or Malicious Configuration (B0047)](../defense-evasion/install-insecure-or-malicious-configuration.md)|Changes iOS Safari's default configuration [[1]](#1)|
 |[Persistence::Modify Existing Service (F0011)](../persistence/modify-existing-service.md)|Hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements  [[1]](#1)|
 |[Lateral Movement::Supply Chain Compromise:Exploit Private APIs (E1195.m02)](../lateral-movement/supply-chain-compromise.md)|Use of the private api allowed both Installation of malicious apps and uninstallation of legitimate apps without user notification  [[1]](#1)|
 |[Lateral Movement::Supply Chain Compromise:Abuse Enterprise Certificates (E1195.m01)](../lateral-movement/supply-chain-compromise.md)|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution  [[1]](#1)|