Merge pull request #11 from emmanvg/move-to-v2.0

Move changes for MBC v2.0
2026-06-08 11:36:36 +00:00 · 2020-08-17 14:28:07 -04:00
parent 3559ac6c87 74d816deb1
commit ed2a32e60b
263 changed files with 1520 additions and 2595 deletions
@@ -1,4 +1,4 @@
-# <a name="mbc"></a>Malware Behavior Catalog #
+# <a name="mbc"></a>Malware Behavior Catalog v2.0 #
 The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](https://github.com/MBCProject/mbc-markdown/blob/master/yfaq/README.md) page for answers to common questions.

 Check out the [MBC presentation](https://www.youtube.com/watch?v=KY8Ty-0sdVU) given at BSides DC (October 2019).
@@ -6,17 +6,54 @@ Check out the [MBC presentation](https://www.youtube.com/watch?v=KY8Ty-0sdVU) gi
 To join the **MBC mailing list**, please send a request to mbc@mitre.org.

 ### Objectives ###
-As shown below, thirteen objectives are defined. Two are specific to malware analysis and are not defined in ATT&CK: ANTI-BEHAVIORAL ANALYSIS and ANTI-STATIC ANALYSIS. Eleven are based on ATT&CK tactics and are tailored for malware analysis use cases. 
+As shown below, malware objectives are based on [ATT&CK tactics](https://attack.mitre.org/tactics/enterprise/), and are tailored for the malware analysis use case of characterizing malware based on known objectives and behaviors. Two malware analysis-specific objectives not in ATT&CK are also defined (ANTI-BEHAVIORAL ANALYSIS and ANTI-STATIC ANALYSIS). 

 ### Behaviors ###
-Under each objective, MBC captures all behaviors and code characteristics discovered during malware analysis, with links to [ATT&CK Techniques](https://attack.mitre.org/techniques/enterprise/) as appropriate. Names of MBC behaviors may or may not match related ATT&CK techniques. Any content provided on behavior pages is *supplemental* to ATT&CK content. In other words, ATT&CK content is not duplicated in MBC, and MBC users will want to reference ATT&CK while capturing malware behaviors.
+Under each objective, MBC captures all behaviors and code characteristics discovered during malware analysis, with links to [ATT&CK techniques](https://attack.mitre.org/techniques/enterprise/) as appropriate. Names of MBC behaviors may or may not match related ATT&CK techniques. Any content provided on behavior pages is *supplemental* to ATT&CK content. In other words, ATT&CK content is not duplicated in MBC, and MBC users will reference ATT&CK while capturing malware behaviors.
+
+### Methods ###
+Methods are associated with behaviors and serve different roles, depending on the behavior. In some cases, a method further refines a behavior (i.e., sub-behavior); in other cases, a method is an implementation of a behavior. Previously, methods had no ATT&CK counterpart, but beginning in April 2020, ATT&CK defines sub-techniques, which are similar to methods.
+
+Note that a method cannot be used without a behavior.
+
+### Micro-behaviors ###
+Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created, or a string may be checked for some condition. Because such behaviors are often noted in malware analysis, they are captured in MBC. See [Micro-behaviors](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/README.md) for details.

 ### <a name="ids"></a>Identifiers ###
-The first letter of a behavior identifier indicates whether the behavior is a stub referencing an ATT&CK technique ("T", matching the ATT&CK identifier; e.g. T1234), whether it enhances an ATT&CK technique with malware-specific details ("E"; e.g. E1234), or whether it is a newly defined behavior in MBC ("M"; e.g. M1234). When two or more MBC behaviors refine the same ATT&CK technique, each is given an MBC identifier and each references the ATT&CK identifier. When a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier is preserved and the new ATT&CK identifier is referenced. 
+As shown below, the letter of an identifier relays information about a behavior. 
+
+|**Letter**|**Example**|**Description**|
+|----------------|----------------------|-------------|
+| **B** | *B0040* | An MBC behavior. |
+| **C** | *C0015* | An MBC micro-behavior.|
+| **T** | *T1234* | An ATT&CK technique.|
+| **E** | *E1234* | An ATT&CK technique that has been enhanced with malware-specific details. The numerical portion of the identifier will match the ATT&CK ID (e.g., E1234 enhances T1234).|
+| **F** | *F0004* | An ATT&CK sub-technique that has been enhanced with malware-specific details.| 
+
+Two letters of an identifier relay information about an objective.
+
+|**Letter**|**Example**|**Description**|
+|----------------|----------------------|-------------|
+| **OB** | *OB0001* | An MBC objective.|
+| **OC** | *OC0003* | An MBC micro-objective.|
+| **TA**| *TA0005*| An ATT&CK tactic.|
+| **TE** | *TE0006* | An ATT&CK tactic that has been made malware-focused. The numerical portion of the identifier will match the ATT&CK ID (e.g., TE0007 enhances TA0007).|
+
+Identifiers of methods are formatted in the same say as ATT&CK sub-techniques. If MBC defines a new method for an existing ATT&CK technique, the identifier is changed from "T" to "E" and an "m" identifier is added (e.g., a method added to T1234 would be denoted *E1234.m01* and is different than *T1234.001*, although both refer to the T1234 ATT&CK technique). Method identifiers of "B", "C", and "F" behaviors are defined without the "m" (e.g., *B0008.009*; *C0005.002*; *F0001.005*).
+
+When two or more MBC behaviors refine the same ATT&CK technique, each is given an MBC identifier and each references the ATT&CK identifier. When a new ATT&CK technique is defined *after* an MBC behavior has been defined, the preexisting MBC identifier is preserved and the new ATT&CK identifier is referenced.
+
+### Canonical Representation ###
+The canonical representation for MBC content is **OBJECTIVE::Behavior::Method**. For example, *ANTI-BEHAVIORAL ANALYSIS::Debugger Detection::Process Environment Block*. 
+
+Objectives and behaviors can be used alone, but a method *must* be associated with a behavior.

 ### Example Malware ###
 The MBC also contains a collection of [example malware](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/) that are characterized with malware behaviors.

+## Micro-behavior Objectives ##
+[Micro-behaviors](https://github.com/MBCProject/mbc-markdown/tree/master/micro-behaviors/README.md) and their associated objectives are under development.
+
 ## Malware Objective Descriptions ##
 Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors.

@@ -1,25 +1,25 @@
 |||
 |--|-----|
-|**ID**|**M9001**|
+|**ID**|**OB0001**|

 # Anti-Behavioral Analysis
 Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger). 

 Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).

-* **Capture Evasion** [M0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-capture.md)
-* **Debugger Detection** [M0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-debugger.md)
-* **Debugger Evasion** [M0002](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-debugger.md)
-* **Dynamic Analysis Evasion** [M0003](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md)
-* **Emulator Detection** [M0004](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-emulator.md)
-* **Emulator Evasion** [M0005](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-emulator.md)
-* **Executable Code Virtualization** [M0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
+* **Capture Evasion** [B0036](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-capture.md)
+* **Debugger Detection** [B0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-debugger.md)
+* **Debugger Evasion** [B0002](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-debugger.md)
+* **Dynamic Analysis Evasion** [B0003](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md)
+* **Emulator Detection** [B0004](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-emulator.md)
+* **Emulator Evasion** [B0005](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-emulator.md)
+* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
 * **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
-* **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
-* **Memory Dump Evasion** [M0006](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md)
-* **Sandbox Detection** [M0007](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-sandbox.md)
-* **Software Packing** [E1045](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
-* **Virtual Machine Detection** [M0009](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-vm.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Memory Dump Evasion** [B0006](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md)
+* **Sandbox Detection** [B0007](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-sandbox.md)
+* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
+* **Virtual Machine Detection** [B0009](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-vm.md)

 References
 ----------
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0001**|
+|**ID**|**B0001**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -13,43 +13,51 @@ Details on methods of detecting debuggers are given in the references; many are

 Methods
 -------
-* **API Hook Detection**: module bounds based [[7]](#7)
-* **CheckRemoteDebuggerPresent**: The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).
-* **CloseHandle**: (NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)
-* **Debugger Artifacts**: Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).
-* **Hardware Breakpoints**: (SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.
-* **Interrupt 0x2d**: If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.
-* **Interrupt 1**: [[7]](#7)
-* **IsDebuggerPresent**: The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.
-* **Memory Breakpoints**: (PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.
-* **Memory Write Watching**: [[7]](#7)
-* **Monitoring Thread**: Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.
-* **NtQueryInformationProcess**: Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).
-* **NtQueryObject**: The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.
-* **NtSetInformationThread**: Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)
-* **NtYieldExecution/SwitchToThread**: [[7]](#7)
-* **OutputDebugString**: (GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.
-* **Page Exception Breakpoint Detection**: [[7]](#7)
-* **Parent Process**: (Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)
-* **Process Environment Block**: The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see next method).
-* **Process Jobs**: [[7]](#7)
-* **ProcessHeap**: Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).
-* **RtlAdjustPrivilege**: Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).
-* **SeDebugPrivilege**: (Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)
-* **SetHandleInformation**: (Protected Handle);
-* **Software Breakpoints**: (INT3/0xCC)
-* **Stack Canary**: Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.
-* **TIB Aware**: Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).
-* **Timing/Delay Checks**: Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging. 
-* **TLS Callbacks**: [[7]](#7)
-* **UnhandledExceptionFilter**: The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.
-* **WudfIsAnyDebuggerPresent**: WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0001.001|**API Hook Detection**|Module bounds based [[7]](#7).|
+|B0001.034|**Anti-debugging Instructions**|Malware code contains mnemonics related to anti-debugging (e.g., rdtsc, icebp).|
+|B0001.002|**CheckRemoteDebuggerPresent**|The kernel32!CheckRemoteDebuggerPresent function calls NtQueryInformationProcess with ProcessInformationClass parameter set to 7 (ProcessDebugPort constant).|
+|B0001.003|**CloseHandle**|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)|
+|B0001.004|**Debugger Artifacts**|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
+|B0001.005|**Hardware Breakpoints**|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.|
+|B0001.006|**Interrupt 0x2d**|If int 0x2d is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware.|
+|B0001.007|**Interrupt 1**|[[7]](#7)|
+|B0001.008|**IsDebuggerPresent**|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.|
+|B0001.009|**Memory Breakpoints**|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.|
+|B0001.010|**Memory Write Watching**|[[7]](#7)|
+|B0001.011|**Monitoring Thread**|Malware may spawn a monitoring thread to detect tampering, breakpoints, etc.|
+|B0001.012|**NtQueryInformationProcess**|Calling NtQueryInformationProcess with its ProcessInformationClass parameter set to 0x07 (ProcessDebugPort constant) will cause the system to set ProcessInformation to -1 if the process is being debugged. Calling with ProcessInformationClass set to 0x0E (ProcessDebugFlags) or 0x11 (ProcessDebugObject) are used similarly. Testing "ProcessDebugPort" is equivalent to using the kernel32!CheckRemoteDebuggerPresent API call (see next method).|
+|B0001.013|**NtQueryObject**|The ObjectTypeInformation and ObjectAllTypesInformation flags are checked for debugger detection.|
+|B0001.014|**NtSetInformationThread**|Calling this API with a fake class length or thread handle can indicate whether it is hooked. After calling NtSetInformationThread properly, the HideThreadFromDebugger flag is checked with the NtQueryInformationThread API. [[7]](#7)|
+|B0001.015|**NtYieldExecution/SwitchToThread**| [[7]](#7)|
+|B0001.016|**OutputDebugString**|(GetLastError); The OutputDebugString function will demonstrate different behavior depending whether or not a debugger is present. See [[7]](#7) for details.|
+|B0001.017|**Page Exception Breakpoint Detection**| [[7]](#7).|
+|B0001.018|**Parent Process**|(Explorer.exe); Executing an application by a debugger will result in the parent process being the debugger process rather than the shell process (Explorer.exe) or the command line. Malware checks its parent process; if it's not explorer.exe, it's assumed to be a debugger. [[7]](#7)|
+|B0001.019|**Process Environment Block**|The Process Environment Block (PEB) is a Windows data structure associated with each process that contains several fields, such as "BeingDebugged," "NtGlobalFlag," and "IsDebugged". Testing the value of this PEB field of a particular process can indicate whether the process is being debugged. Testing "BeingDebugged" is equivalent to using the kernel32!IsDebuggerPresent API call (see separate method).|
+|B0001.035|**Process Environment Block BeingDebugged**|The BeingDebugged field is tested to determine whether the process is being debugged.|
+|B0001.036|**Process Environment Block NtGlobalFlag**|The NtGlobalFlag field is tested to determine whether the process is being debugged.|
+|B0001.037|**Process Environment Block IsDebugged**|The IsDebugged field is tested to determine whether the process is being debugged.|
+|B0001.020|**Process Jobs**|[[7]](#7)|
+|B0001.021|**ProcessHeap**|Process heaps are affected by debuggers. Malware can detect a debugger by checking heap header fields such as Flags (debugger present if value greater than 2) or ForceFlags (debugger present if value greater than 0).|
+|B0001.022|**RtlAdjustPrivilege**|Malware may call RtlAdjustPrivilege to detect if a debugger is attached (or to prevent a debugger from attaching).|
+|B0001.023|**SeDebugPrivilege**|(Csrss.exe); Using the OpenProcess function on the csrss.exe process can detect a debugger. [[7]](#7)|
+|B0001.024|**SetHandleInformation**|(Protected Handle)|
+|B0001.025|**Software Breakpoints**|(INT3/0xCC)|
+|B0001.026|**Stack Canary**|Similar to the anti-exploitation method of the same name, malware may try to detect mucking with values on the stack.|
+|B0001.027|**TIB Aware**|Malware may access information in the Thread Information Block (TIB) for debug detection or process obfuscation detection. The TIB can be accessed as an offset of the segment register (e.g., fs:[20h]).|
+|B0001.028|**Timing/Delay Check**|Malware may compare time between two points to detect unusual execution, such as the (relative) massive delays introduced by debugging.|
+|B0001.032|**Timing/Delay Check GetTickCount**|Malware uses GetTickCount function in a timing/delay check.|
+|B0001.033|**Timing/Delay Check QueryPerformanceCounter**|Malware uses QueryPerformanceCounter in a timing/delay check.|
+|B0001.029|**TLS Callbacks**|[[7]](#7)|
+|B0001.030|**UnhandledExceptionFilter**|The UnhandledExceptionFilter function is called if no registered exception handlers exist, but it will not be reached if a debugger is present. See [[7]](#7) for details.|
+|B0001.031|**WudfIsAnyDebuggerPresent**|Includes use of WudfIsAnyDebuggerPresent, WudfIsKernelDebuggerPresent, WudfIsUserDebuggerPresent.|

 Malware Examples
 ----------------
-|Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**Redhip**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/redhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[4]](#4)|
+|Name|Date|ID|Description|
+|-----------------------------|--------|--------|-----------------------------|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/redhip.md)|January 2011|M0001.034, M0001.019|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|

 References
 ----------
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0004**|
+|**ID**|**B0004**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -11,16 +11,12 @@ Detects whether the malware instance is being executed inside an emulator. If so

 Methods
 -------
-* **Check for Emulator-related Files**: Checks whether particular files (e.g., QEMU files) exist.
-* **Check for WINE Version**: Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.
-* **Check Emulator-related Registry Keys**: Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)
-* **Failed Network Connections**: Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.
-
-Malware Examples
----------------
-|Name|Date|Description|
+|ID|Name|Description|
 |-----------------------------|--------|-----------------------------|
-
+|B0004.001|**Check for Emulator-related Files**|Checks whether particular files (e.g., QEMU files) exist.|
+|B0004.002|**Check for WINE Version**|Checks for WINE via the `get_wine_version` function from WINE's `ntdll.dll`.|
+|B0004.003|**Check Emulator-related Registry Keys**|Emulators register artifacts in the registry, which can be detected by malware. For example, installation of QEMU results in the registry key: *HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0* with value=*Identifier* and data=*QEMU*, or registry key: *HARDWARE\Description\System* with value=*SystemBiosVersion* and data=*QEMU*. [[1]](#1)|
+|B0004.004|**Failed Network Connections**|Some emulated systems fail to handle some network communications; such failures will indicate the emulated environment.|

 References
 ----------
@@ -1,34 +1,38 @@
 |||
 |---------|------------------------|
-|**ID**|**M0007**|
+|**ID**|**B0007**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
+|**Related ATT&CK Sub-techniques**|[Virtualization/Sandbox Evasion: System Checks](https://attack.mitre.org/techniques/T1497/001/), [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/)|


 Sandbox Detection
 =================
 Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.

-The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/).
+The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.

 Methods
 -------
-* **Check Clipboard Data**: Checks clipboard data which can be used to detect whether execution is inside a sandbox.
-* **Check Files**: Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.
-* **Human User Check**: Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3).
-* **Injected DLL Testing**: Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.
-* **Product Key/ID Testing**: Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry. 
-* **Screen Resolution Testing**: Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.
-* **Self Check**: Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.
-* **Timing/Date Check**: Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.
-* **Timing/Uptime Check**: Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0007.001|**Check Clipboard Data**|Checks clipboard data which can be used to detect whether execution is inside a sandbox.|
+|B0007.002|**Check Files**|Sandboxes create files on the file system. Malware can check the different folders to find sandbox artifacts.|
+|B0007.003|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel [[3]](#3). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
+|B0007.004|**Injected DLL Testing**|Testing for the name of a particular DLL that is known to be injected by a sandbox for API hooking is a common way of detecting sandbox environments. This can be achieved through the kernel32!GetModuleHandle API call and other means.|
+|B0007.005|**Product Key/ID Testing**|Checking for a particular product key/ID associated with a sandbox environment (commonly associated with the Windows host OS used in the environment) can be used to detect whether a malware instance is being executed in a particular sandbox. This can be achieved through several means, including testing for the Key/ID in the Windows registry.|
+|B0007.006|**Screen Resolution Testing**|Sandboxes aren't used in the same manner as a typical user environment, so most of the time the screen resolution stays at the minimum 800x600 or lower. No one is actually working on a such small screen. Malware could potentially detect the screen resolution to determine if it's a user machine or a sandbox.|
+|B0007.007|**Self Check**|Malware may check its own characteristics to determine whether it's running in a sandbox. For example, a malicious Office document might check its file name or VB project name.|
+|B0007.008|**Timing/Date Check**|Calling GetSystemTime or equiv and only executing code if the current date/hour/minute/second passes some check. Often this is for running only after or only until a specific date. This behavior can be mitigated in non-automated analysis environments.|
+|B0007.009|**Timing/Uptime Check**|Comparing single GetTickCount with some value to see if system has been started at least *X* amount ago. This behavior can be mitigated in non-automated analysis environments.|

 Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
 |[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
-|**Rombertik**|May 2015|[[2]](#2)|
+|[**Rombertik**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/rombertik.md)|May 2015|[[2]](#2)|
+|[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4) |
+|[**Ursnif**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|

 References
 ----------
@@ -36,4 +40,6 @@ References
 
 <a name="2">[2]</a> http://labs.lastline.com/exposing-rombertik-turning-the-tables-on-evasive-malware

-<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
+<a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
+
+<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf 
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0009**|
+|**ID**|**B0009**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|

@@ -9,55 +9,79 @@ Virtual Machine Detection
 =========================
 Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)

-The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK: [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/).
+The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion): for details, see the ATT&CK [**Virtualization/Sandbox Evasion**](https://attack.mitre.org/techniques/T1497/) technique and its sub-techniques.

 Methods
 -------
-* **Check File and Directory Artifacts**: Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)
-* **Check Memory Artifacts**: VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)
-* **Check Named System Objects**: Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.
-* **Check Processes**: The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)
-* **Check Registry Keys**: Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)
-* **Check Running Services**: VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)
-* **Check Software**: Malware may check whether software is relatively current.
-* **Check Virtual Devices**: The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)
-* **Check Windows**: Malware may check windows for VM-related characteristics such as:
-	* *Window size*: tiny window size may indicate a VM.
-	* *Unique windows*: may check for the presence of known windows from analysis tools running in a VM.
-	* *Title bars*: may inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.
-* **Guest Process Testing**: Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.
-* **HTML5 Performance Object Check**: In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.
-* **Human User Check**: Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5).
-* **Modern Specs Check**: Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment: 
-   * *Total physical memory*: most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).
-   * *Drive size*: most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).
-   * *USB drive*: checks whether there is a potential USB drive; if not a virtual environment is suspected.
-   * *Printer*: checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.
-   * *Processor count*: checks number of processors; single CPU machines are suspect.
-   * *Keyboard layout*
-* **Unique Hardware/Firmware Check**: Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Items checked include:
-   * *BIOS*: characteristics of the BIOS, such as version, can indicate virtualization.
-   * *I/O Communication Port*: VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.
-   * *CPU Name*
-   * *CPU Location*: When an Operating System is virtualized, the CPU is relocated. [[2]](#2)
-   * *MAC Address*: VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)
-* **Instruction Testing**: The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)
-   * *SIDT (red pill)*: Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.
-   * *SGDT/SLDT (no pill)*: The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.
-   * *SMSW*
-   * *STR*
-   * *CPUID*: Checking the CPU ID found within the registry can provide information to system type.
-   * *IN*
-   * *RDTSC*
-   * *VMCPUID*
-   * *VPCEXT*
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0009.001|**Check File and Directory Artifacts**|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)|
+|B0009.002|**Check Memory Artifacts**|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)|
+|B0009.003|**Check Named System Objects**|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.|
+|B0009.004|**Check Processes**|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)|
+|B0009.005|**Check Registry Keys**|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)|
+|B0009.006|**Check Running Services**|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)|
+|B0009.007|**Check Software**|Malware may check software version; for example, to determine whether the software is relatively current.|
+|B0009.008|**Check Virtual Devices**|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)|
+|B0009.009|**Check Windows**|Malware may check windows for VM-related characteristics.|
+
+| | | | |
+|----------|-----------------------------|--------|-----------------------------|
+| |B0009.020|*Window size*| Tiny window size may indicate a VM.|
+| |B0009.021|*Unique windows*|May check for the presence of known windows from analysis tools running in a VM.|
+| |B0009.022|*Title bars*|May inject malicious code to svchost.exe to check all open window title bar text to a list of strings indicating virtualized environment.|
+
+| | | |
+|-----------------------------|--------|-----------------------------|
+|B0009.010|**Guest Process Testing**|Virtual machines offer guest additions that can be installed to add functionality such as clipboard sharing. Detecting the process responsible for these tasks, via its name or other methods, is a technique employed by malware for detecting whether it is being executed in a virtual machine.|
+|B0009.011|**HTML5 Performance Object Check**|In three browser families, it is possible to extract the frequency of the Windows performance counter frequency, using standard HTML and Javascript. This value can then be used to detect whether the code is being executed in a virtual machine, by detecting two specific frequencies commonly used in virtual but not physical machines.|
+|B0009.012|**Human User Check**|Detects whether there is any "user" activity on the machine, such as the movement of the mouse cursor, non-default wallpaper, or recently opened Office files. Directories or file might be counted. If there is no human activity, the machine is suspected to be a virtualized machine and/or sandbox. Other items used to detect a user: mouse clicks (single/double), DialogBox, scrolling, color of background pixel, change in foreground window [[5]](#5). This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002/) sub-technique.|
+|B0009.013|**Modern Specs Check**|Different aspects of the hardware are inspected to determine whether the machine has modern characteristics. A machine with substandard specifications indicates a virtual environment.|
+
+| | | | |
+|----------|-----------------------------|--------|-----------------------------|
+| |B0009.014|*Total physical memory*|Most modern machines have at leave 4 GB of memory. (GlobalMemoryStatusEx) [[5]](#5).|
+| |B0009.015|*Drive size*|Most modern machines have at least 80 GB disks. May use DeviceloControl (IOCTL_DISK_GET_LENGTH_INFO) or GetDiskFreeSpaceEx (TotalNumberOfBytes) [[5]](#5).|
+| |B0009.016|*USB drive*|Checks whether there is a potential USB drive; if not a virtual environment is suspected.|
+| |B0009.017|*Printer*|Checks whether there is a potential connected printer or default Windows printers; if not a virtual environment is suspected.|
+| |B0009.018|*Processor count*|Checks number of processors; single CPU machines are suspect.|
+| |B0009.019|*Keyboard layout*|Check keyboard layout.|
+
+| | | |
+|-----------------------------|--------|-----------------------------|
+|B0009.023|**Unique Hardware/Firmware Check**|Malware may check for hardware characteristics unique to being virtualized, allowing the malware to detect the virtual environment. Items checked include:|
+
+| | | | |
+|----------|-----------------------------|--------|-----------------------------|
+| |B0009.024|*BIOS*|Characteristics of the BIOS, such as version, can indicate virtualization.|
+| |B0009.025|*I/O Communication Port*|VMware uses virtual I/O ports for communication between the virtual machine and the host operating system to support functionality like copy and paste between the two systems. The port can be queried and compared with a magic number VMXh to identify the use of VMware.|
+| |B0009.026|*CPU Name*|Checks the CPU name to determine virtualization.|
+| |B0009.027|*CPU Location*|When an Operating System is virtualized, the CPU is relocated. [[2]](#2)|
+| |B0009.028|*MAC Address*|VMware uses specific virtual MAC address that can be detected. The usual MAC address used started with the following numbers: "00:0C:29", "00:1C:14", "00:50:56", "00:05:69". Virtualbox uses specific virtual MAC address that can be detected by Malware. The usual MAC address used started with the following numbers: 08:00:27. [[2]](#2)|
+
+| | | |
+|-----------------------------|--------|-----------------------------|
+|B0009.029|**Instruction Testing**|The execution of certain x86 instructions will result in different values when executed inside of a VM instead of on bare metal. Accordingly, these can be used to detect the execution of the malware in a VM. [[2]](#2)|
+
+| | | | |
+|----------|-----------------------------|--------|-----------------------------|
+| |B0009.030|*SIDT (red pill)*|Red Pill is an anti-VM technique that executes the SIDT instruction to grab the value of the IDTR register. The virtual machine monitor must relocate the guest's IDTR to avoid conflict with the host's IDTR. Since the virtual machine monitor is not notified when the virtual machine runs the SIDT instruction, the IDTR for the virtual machine is returned.|
+| |B0009.031|*SGDT/SLDT (no pill)*|The No Pill technique relies on the fact that the LDT structure is assigned to a processor not an Operating System. The LDT location on a host machine will be zero and on a virtual machine will be non-zero.
+| |B0009.032|*SMSW*| |
+| |B0009.033|*STR*| |
+| |B0009.034|*CPUID*|Checking the CPU ID found within the registry can provide information to system type.|
+| |B0009.035|*IN*| |
+| |B0009.036|*RDTSC*| |
+| |B0009.037|*VMCPUID*| |
+| |B0009.038|*VPCEXT*| |

 Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
-|**GravityRAT**|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
+|[**GravityRAT**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|

 References
 ----------
@@ -65,8 +89,10 @@ References

 <a name="2">[2]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion

-<a name="3">[3]>/a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
+<a name="3">[3]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
 
 <a name="4">[4]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="5">[5]</a> https://github.com/LordNoteworthy/al-khaser
+
+<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0036**|
+|**ID**|**B0036**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -10,18 +10,11 @@ Malware has characteristics enabling it to evade capture from the infected syste

 Methods
 -------
-* **Memory-only Payload**: Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).
-* **Encrypted Payloads**: Decryption key is stored external to the executable or never touches the disk.
-* **Multiple Stages of Loaders**: Multiple stages of loaders are used with an encoded payload.
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-| | | |
-
-References
----------
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0036.001|**Memory-only Payload**|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).|
+|B0036.002|**Encrypted Payloads**|Decryption key is stored external to the executable or never touches the disk.|
+|B0036.003|**Multiple Stages of Loaders**: Multiple stages of loaders are used with an encoded payload.|

 
 
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0002**|
+|**ID**|**B0002**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -13,36 +13,38 @@ A thorough reference for anti-debugging, both detection and evasion, is given in

 Methods
 -------
-* **Block Interrupts**: Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.
-* **Break Point Clearing**: Intentionally clearing software or hardware breakpoints.
-* **Byte Stealing**: Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.
-* **Change SizeOfImage**: Changinging this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.
-* **Code Integrity Check**: Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.
-* **Exception Misdirection**: Using exception handling (SEH) to cause flow of program to non-obvious paths.
-* **Get Base Indirectly**: CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.
-* **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution.
-* **Hook Interrupt**: modification of interrupt vector or descriptor tables.
-* **Import Obfuscation**: Add obfuscation between imports calls and APIs.
-* **Inlining**: variation of static linking where full API code inserted everywhere it would have been called.
-* **Loop Escapes**: Use SEH or other methods to break out of a loop instead of a conditional jump.
-* **Malloc Use**: Instead of unpacking into a pre-defined section/segment (ex: .text) of the binary, use malloc() / VirtualAlloc() to create a new segment. This makes keeping track of memory locations across different runs more difficult, as there is no guarantee that malloc/VirtualAlloc will assign the same address range each time.
-* **Modify PE Header**: Any part of the header is changed or erased.
-* **Nanomites**: int3 with code replacement table; debugs itself.
-* **Obfuscate Library Use**: LoadLibrary API calls or direct access of kernel32 via PEB (fs[0]) pointers, used to rebuild IAT or just obfuscate library use.
-* **Parallel Threads**: Use several parallel threads to make analysis harder.
-* **Pipeline Misdirection**: Take advantage of pipelining in modern processors to misdirect debugging, emulation, or static analysis tools. An unpacker can assume a certain number of opcodes will be cached and then proceed to overwrite them in memory, causing a debugger/emulator/analyzer to follow different code than is normally executed.
-* **Pre-Debug**: Prevents debugger from attaching to process or to break until after the code of interest has been executed
-* **Relocate API Code**: relocate API code in separate buffer (calls don’t lead to imported DLLs).
-* **Return Obfuscation**: Overwrite the RET address on the stack or the code at the RET address. Variation seen that writes to the start-up code or main module that called the malware's WinMain or DllMain.
-* **RtlAdjustPrivilege**: Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached.
-* **Section Misalignment**: Some analysis tools cannot handle binaries with misaligned sections.
-* **Self-Debugging**: Debug itself to prevent another debugger to be attached.
-* **Self-Unmapping**: UnmapViewOfFile() on itself
-* **Static Linking**: Copy locally the whole content of API code.
-* **Stolen API Code**: A variation of "byte stealing" where the first few instructions or bytes of an API are executed in user code, allowing the IAT to point into the middle of an API function. This confuses IAT rebuilders such as ImpRec and Scylla and may bypass breakpoints.
-* **Tampering**: Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).
-* **Thread Timeout**: Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.
-* **Use Interrupts**: The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0002.001|**Block Interrupts**|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.|
+|B0002.002|**Break Point Clearing**|Intentionally clearing software or hardware breakpoints.|
+|B0002.003|**Byte Stealing**|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.|
+|B0002.004|**Change SizeOfImage**|Changinging this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.|
+|B0002.005|**Code Integrity Check**|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.|
+|B0002.006|**Exception Misdirection**|Using exception handling (SEH) to cause flow of program to non-obvious paths.|
+|B0002.007|**Get Base Indirectly**|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.|
+|B0002.008|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
+|B0002.009|**Hook Interrupt**|Modification of interrupt vector or descriptor tables.|
+|B0002.010|**Import Obfuscation**: Add obfuscation between imports calls and APIs.|
+|B0002.011|**Inlining**|Variation of static linking where full API code inserted everywhere it would have been called.|
+|B0002.012|**Loop Escapes**|Use SEH or other methods to break out of a loop instead of a conditional jump.|
+|B0002.013|**Malloc Use**|Instead of unpacking into a pre-defined section/segment (ex: .text) of the binary, use malloc() / VirtualAlloc() to create a new segment. This makes keeping track of memory locations across different runs more difficult, as there is no guarantee that malloc/VirtualAlloc will assign the same address range each time.|
+|B0002.014|**Modify PE Header**|Any part of the header is changed or erased.|
+|B0002.015|**Nanomites**|int3 with code replacement table; debugs itself.|
+|B0002.016|**Obfuscate Library Use**|LoadLibrary API calls or direct access of kernel32 via PEB (fs[0]) pointers, used to rebuild IAT or just obfuscate library use.|
+|B0002.017|**Parallel Threads**|Use several parallel threads to make analysis harder.|
+|B0002.018|**Pipeline Misdirection**|Take advantage of pipelining in modern processors to misdirect debugging, emulation, or static analysis tools. An unpacker can assume a certain number of opcodes will be cached and then proceed to overwrite them in memory, causing a debugger/emulator/analyzer to follow different code than is normally executed.|
+|B0002.019|**Pre-Debug**|Prevents debugger from attaching to process or to break until after the code of interest has been executed.|
+|B0002.020|**Relocate API Code**|Relocate API code in separate buffer (calls don’t lead to imported DLLs).|
+|B0002.021|**Return Obfuscation**|Overwrite the RET address on the stack or the code at the RET address. Variation seen that writes to the start-up code or main module that called the malware's WinMain or DllMain.|
+|B0002.022|**RtlAdjustPrivilege**|Calling RtlAdjustPrivilege to either prevent a debugger from attaching or to detect if a debugger is attached.|
+|B0002.023|**Section Misalignment**|Some analysis tools cannot handle binaries with misaligned sections.|
+|B0002.024|**Self-Debugging**|Debug itself to prevent another debugger to be attached.|
+|B0002.025|**Self-Unmapping**|UnmapViewOfFile() on itself.|
+|B0002.026|**Static Linking**|Copy locally the whole content of API code.|
+|B0002.027|**Stolen API Code**|A variation of "byte stealing" where the first few instructions or bytes of an API are executed in user code, allowing the IAT to point into the middle of an API function. This confuses IAT rebuilders such as ImpRec and Scylla and may bypass breakpoints.|
+|B0002.028|**Tampering**|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
+|B0002.029|**Thread Timeout**|Setting dwMilliseconds in WaitForSingleObject to a small number will timeout the thread before the analyst can step through and analyze the code executing in the thread. Modifying this via patch, register, or stack to the value `0xFFFFFFFF`, the **INFINITE** constant circumvents this anti-debugging technique.|
+|B0002.030|**Use Interrupts**|The unpacking code relies on use of int 1 or int 3, or it uses the interrupt vector table as part of the decryption "key".|

 Malware Examples
 ----------------
@@ -50,6 +52,7 @@ Malware Examples
 |-----------------------------|--------|-----------------------------|
 |**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)|
 |**Dridex**|March 2015|[[3]](#3)|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|

 References
 ----------
@@ -63,3 +66,4 @@ References

 <a name="5">[5]</a> http://unprotect.tdgt.org/index.php/Unprotect_Project
 
+<a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 
@@ -1,26 +1,29 @@
 |||
 |---------|------------------------|
-|**ID**|**M0003**|
+|**ID**|**B0003**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|None|
+|**Related ATT&CK Technique**|[Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/)|

 Dynamic Analysis Evasion
 ========================
 Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine. 

-See [Emulator Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/emulator-evade.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 
+See [Emulator Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 

 Methods
 -------
-* **Alternative ntdll.dll** A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.
-* **Data Flood**: Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)
-* **Delayed Execution** - Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. 
-* **Demo Mode**: Inclusion of a demo binary/mode that is executed when token is absent or not enough privileged.
-* **Drop Code**: Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).
-* **Encode File**: Encode a file on disk, such as an implant's config file.
-* **Hook File System**: execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.
-* **Hook Interrupt**: modification of interrupt vector or descriptor tables.
-* **Illusion**: Creates an illusion; makes the analyst think something happened when it didn't.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0003.001|**Alternative ntdll.dll**|A copy of ntdll.dll is dropped to the filesystem and then loaded. This alternative DLL is used to execute function calls to evade sandboxes which use hooking in the operating system's ntdll.dll.|
+|B0003.002|**Data Flood**|Overloads a sandbox by generating a flood of meaningless behavioral data. [[1]](#1)|
+|B0003.003|**Delayed Execution**|Stalling code is typically executed before any malicious behavior. The malware's aim is to delay the execution of the malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting malicious behavior. This method is very similar to ATT&CK's [Virtualization/Sandbox Evasion: Time Based Evasion](https://attack.mitre.org/techniques/T1497/003/) sub-technique.| 
+|B0003.004|**Demo Mode**|Inclusion of a demo binary/mode that is executed when token is absent or not privileged enough.|
+|B0003.005|**Drop Code**|Original file is written to disk then executed. May confuse some sandboxes, especially if the dropped executable must be provided specific arguments and the original dropper is not associated with the drop file(s).|
+|B0003.006|**Encode File**|Encode a file on disk, such as an implant's config file.|
+|B0003.007|**Hook File System**|Execution happens when a particular file or directory is accessed, often through hooking certain API calls such as CreateFileA and CreateFileW.|
+|B0003.008|**Hook Interrupt**|Modification of interrupt vector or descriptor tables.|
+|B0003.009|**Illusion**|Creates an illusion; makes the analyst think something happened when it didn't.|
+|B0003.010|**Restart**|Restarts or shuts down system to bypass sandboxing.|


 Malware Examples
@@ -31,6 +34,7 @@ Malware Examples
 |[**Terminator**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/terminator.md)|October 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
 |**Nap**|2013|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
 |**Smokeloader**|2019|Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [[4]](#4)|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades dynamic analysis.)|

 References
 ----------
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0005**|
+|**ID**|**B0005**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -10,9 +10,15 @@ Behaviors that obstruct analysis in an emulator.

 Methods
 -------
-* **Different Opcode Sets**: Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.
-* **Undocumented Opcodes**: Use rare or undocumented opcodes to block non-exhaustive emulators.
-* **Unusual/Undocumented API Calls**: Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).
-* **Extra Loops/Time Locks**: Add extra loops to make time-constraint emulators give up.
-
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0005.001|**Different Opcode Sets**|Use different opcodes sets (ex: FPU, MMX, SSE) to block emulators.|
+|B0005.002|**Undocumented Opcodes**|Use rare or undocumented opcodes to block non-exhaustive emulators.|
+|B0005.003|**Unusual/Undocumented API Calls**|Call unusual APIs to block non-exhaustive emulators (particularly anti-virus).|
+|B0005.004|**Extra Loops/Time Locks**|Add extra loops to make time-constraint emulators give up.|

+Malware Examples
+----------------
+|Name|Date|Description|
+|-----------------------------|-----------|-----------------------------|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Evades emulator-based analysis.)|
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0006**|
+|**ID**|**B0006**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -10,15 +10,17 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor

 Methods
 -------
-* **Code Encryption in Memory**: Encrypt the executing malware instance code in memory.
-* **Erase the PE header**: Erase PE header from memory.
-* **Hide virtual memory**: Hide arbitrary segments of virtual memory.
-* **SizeOfImage**: Set the SizeOfImage field of PEB.LoaderData to be huge.
-* **Tampering**: Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).
-* **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution.
-* **On-the-Fly APIs**: Resolve API addresses before each use to prevent complete dumping.
-* **Feed Misinformation**: API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/hooking.md).
-* **Flow Opcode Obstruction**: flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4)
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0006.001|**Code Encryption in Memory**|Encrypt the executing malware instance code in memory.|
+|B0006.002|**Erase the PE header**|Erase PE header from memory.|
+|B0006.003|**Hide virtual memory**|Hide arbitrary segments of virtual memory.|
+|B0006.004|**SizeOfImage**|Set the SizeOfImage field of PEB.LoaderData to be huge.|
+|B0006.005|**Tampering**|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
+|B0006.006|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
+|B0006.007|**On-the-Fly APIs**|Resolve API addresses before each use to prevent complete dumping.|
+|B0006.008|**Feed Misinformation**|API behavior can be altered to prevent memory dumps. For example, inaccurate data can be reported when the contents of the physical memory of the system on which the malware instance is executing is retrieved. See [Hooking](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md).|
+|B0006.009|**Flow Opcode Obstruction**|Flow opcodes (e.g., jumps, loops) are removed and emulated (or decrypted) by the packer during execution, resulting in incorrect dumps. [[4]](#4).

 Malware Examples
 ----------------
@@ -2,31 +2,24 @@
 |---------|------------------------|
 |**ID**|**E1480**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480/)|
+|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|

 Execution Guardrails
 ====================
 Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.

-**See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480/) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
+**See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).

 Methods
 -------
-* **Deposited Keys**: Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.
-* **Environmental Keys**: Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.
-* **GetVolumeInformation**: This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.
-* **Host Fingerprint Check**: Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.
-* **Secure Triggers**: Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).
-* **Token Check**: Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|E1480.m01|**Deposited Keys**|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
+|E1480.m02|**Environmental Keys**|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
+|E1480.m03|**GetVolumeInformation**|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
+|E1480.m04|**Host Fingerprint Check**| Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
+|E1480.m05|**Secure Triggers**|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
+|E1480.m06|**Token Check**|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|


-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-
-
-References
----------
-

@@ -1,19 +1,19 @@
 |||
 |--|-----|
-|**ID**|**M9002**|
+|**ID**|**OB0002**|

 # Anti-Static Analysis
 Behaviors and code characteristics that prevent static analysis or make it more difficult. Simple static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.

 Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).

-* **Call Graph Generation Evasion** [M0010](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-call-graph.md)
-* **Disassembler Evasion** [M0012](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-disassembler.md)
-* **Executable Code Obfuscation** [M0032](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md)
-* **Executable Code Optimization** [M0034](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-optimize.md)
-* **Executable Code Virtualization** [M0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
+* **Call Graph Generation Evasion** [B0010](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-call-graph.md)
+* **Disassembler Evasion** [B0012](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/evade-disassembler.md)
+* **Executable Code Obfuscation** [B0032](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-obfuscate.md)
+* **Executable Code Optimization** [B0034](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-optimize.md)
+* **Executable Code Virtualization** [B0008](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/exe-code-virtualize.md)
 * **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
-* **Software Packing** [E1045](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
+* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)


 References
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0010**|
+|**ID**|**B0010**|
 |**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -11,13 +11,10 @@ Malware code evades accurate call graph generation during disassembly. Call grap

 Methods
 -------
-* **Two-layer Function Return**: two layer jumping confuses tools plotting call graphs. [[3]](#3)
-* **Invoke NTDLL System Calls via Encoded Table**: invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)
-
-Malware Examples
----------------
-|Name|Date|Description|
+|ID|Name|Description|
 |-----------------------------|--------|-----------------------------|
+|B0010.001|**Two-layer Function Return**|Two layer jumping confuses tools plotting call graphs. [[3]](#3)|
+|B0010.002|**Invoke NTDLL System Calls via Encoded Table**|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[3]](#3)|

 References
 ----------
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0012**|
+|**ID**|**B0012**|
 |**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -11,16 +11,13 @@ Malware code evades disassembly in a recursive or linear disassembler. Some meth

 Methods
 -------
-* **Argument Obfuscation**: Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.
-* **Conditional Misdirection**: Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).
-* **Value Dependent Jumps**: Explicit use of computed values for control flow, often many times in the same basic block or function.
-* **Variable Recomposition**: Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.
-* **VBA Stomping**: Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.
-   
-Malware Examples
----------------
-|Name|Date|Description|
+|ID|Name|Description|
 |-----------------------------|--------|-----------------------------|
+|B0012.001|**Argument Obfuscation**|Simple number or string arguments to API calls are calculated at runtime, making linear disassembly more difficult.|
+|B0012.002|**Conditional Misdirection**|Conditional jumps are sometimes used to confuse disassembly engines, resulting in the wrong instruction boundaries and thus wrong mnemonic and operands; identified by instructions *jmp/jcc to a label+#* (e.g., JNE loc_401345fe+2).|
+|B0012.003|**Value Dependent Jumps**|Explicit use of computed values for control flow, often many times in the same basic block or function.|
+|B0012.004|**Variable Recomposition**|Variables, often strings, are broken into multiple parts and store out of order, in different memory ranges, or both. They must then be recomposed before use.|
+|B0012.005|**VBA Stomping**|Typically, VBA source code is compiled into p-code, which is stored with compressed sourced code in the OLE file with VBA macros. VBA Stomping - when the VBA source code is removed and only the p-code remains - makes analysis much harder. See [[3]](#3) for an analysis of a VBA-Stomped malicious VBA Office document. See [[4]](#4) for information on Evil Clippy, a tool that creates malicious MS Office documents.|

 References
 ----------
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0032**|
+|**ID**|**B0032**|
 |**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -13,31 +13,33 @@ For encryption and encoding characteristics of malware samples, as well as malwa

 Methods
 -------
-* **API Hashing**: Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1) 
-* **Code Insertion**: Insert code to impede disassembly.
-   * *Dead Code Insertion*: Include "dead" code with no real functionality.
-   * *Fake Code Insertion*: Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.
-   * *Jump Insertion*: Insert jumps to make analysis visually harder.
-   * *Thunk Code Insertion*: Variation on Jump Insertion. Used by some compilers for user-generated functions.
-   * *Junk Code Insertion*: Insert dummy code between relevant opcodes. Can make signature writing more complex.
-* **Data Value Obfuscation**: Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*.  [NEEDS REVIEW]
-* **Entry Point Obfuscation**: Obfuscate the entry point of the malware executable.
-* **Guard Pages**: Encrypt blocks of code individually and decrypt temporarily only upon execution.
-* **Import Address Table Obfuscation**: Obfuscate the import address table.
-* **Import Compression**: Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.
-* **Instruction Overlap**: Jump after the first byte of an instruction to confuse disassembler.
-* **Interleaving Code**: Split code into sections that may be rearranged and are connected by unconditional jumps.
-* **Merged Code Sections**: Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.
-* **Structured Exception Handling (SEH)**: A portion of the code always generates an exception so that malicious code is executed with the exception handling. See  [[3]](#3).
-* **Stack Strings**: Build and decrypt strings on the stack at each use, then discard to avoid obvious references.
-* **Symbol Obfuscation**: Remove or rename symbolic information commonly inserted by compilers for debugging purposes.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0032.001|**API Hashing**|Instead of storing function names in the Import Address Table (IAT) and calling GetProcAddress, a DLL is loaded and the name of each of its exports is hashed until it matches a specific hash. Manual symbol resolution is then used to access and execute the exported function. This method is often used by shellcode because it reduces the size of each import from a human-readable string to a sequence of four bytes. The Method is also known as "Imports by Hash" and "GET_APIS_WITH_CRC." [[1]](#1)| 
+|M0032.002 |**Code Insertion**|Insert code to impede disassembly.|
+|B0032.003|*Dead Code Insertion*|Include "dead" code with no real functionality.|
+|B0032.004|*Fake Code Insertion*|Add fake code similar to known packers or known goods to fool identification. Can confuse some automated unpackers.|
+|B0032.005|*Jump Insertion*|Insert jumps to make analysis visually harder.|
+|B0032.006|*Thunk Code Insertion*|Variation on Jump Insertion. Used by some compilers for user-generated functions.|
+|B0032.007|*Junk Code Insertion*|Insert dummy code between relevant opcodes. Can make signature writing more complex.|
+|B0032.008|**Data Value Obfuscation**|Obfuscate data values through indirection of local or global variables. For example, the instruction *if (a == 0) do x* can be obfuscated by setting a global variable, *Z*, to zero and using it in the instruction: *if (a==Z) do x*.  [NEEDS REVIEW]|
+|B0032.009|**Entry Point Obfuscation**|Obfuscate the entry point of the malware executable.|
+|B0032.010|**Guard Pages**|Encrypt blocks of code individually and decrypt temporarily only upon execution.|
+|B0032.011|**Import Address Table Obfuscation**|Obfuscate the import address table.|
+|B0032.012|**Import Compression**|Store and load imports with a compact import table format. Each DLL needed by the executable is mentioned in the IAT, but only one function from each/most is imported; the rest are imported via GetProcAddress calls.|
+|B0032.013|**Instruction Overlap**|Jump after the first byte of an instruction to confuse disassembler.|
+|B0032.014|**Interleaving Code**|Split code into sections that may be rearranged and are connected by unconditional jumps.|
+|B0032.015|**Merged Code Sections**|Merge all sections resulting in just one entry in the sections table to make readability more difficult. May affect some detection signatures if written to be section dependent.|
+|B0032.016|**Structured Exception Handling (SEH)**|A portion of the code always generates an exception so that malicious code is executed with the exception handling. See  [[3]](#3).|
+|B0032.017|**Stack Strings**|Build and decrypt strings on the stack at each use, then discard to avoid obvious references.|
+|B0032.018|**Symbol Obfuscation**|Remove or rename symbolic information commonly inserted by compilers for debugging purposes.|
   
 Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------------------------|--------|-----------------------------|
-|[**Heriplor Trojan**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
-|**Geodo**|August 2018|Geodo macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
+|[**Heriplor**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/heriplor.md)|March 2019|The Heriplor Trojan uses API Hashing. [[1]](#1)|
+|[**Emotet**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|

 References
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0034**|
+|**ID**|**B0034**|
 |**Objective(s)**| [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -11,13 +11,11 @@ Code is optimized, making it harder to statically analyze.

 Methods
 -------
-* **Jump/Call Absolute Address**: Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.
-* **Minification**: Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.
-   
-Malware Examples
----------------
-|Name|Date|Description|
+|ID|Name|Description|
 |-----------------------------|--------|-----------------------------|
+|B0034.001|**Jump/Call Absolute Address**|Relative operands of jumps and calls into are made absolute (better compression). May confuse some basic block detection algorithms.|
+|B0034.002|**Minification**|Minification is 'the process of removing all unnecessary characters from source code without changing its functionality.' [[1]](#1) A simple example is when all the unnecessary whitespace and comments are removed. Minification is distinguished from compression in that it neither adds to nor changes the code seen by the interpreter. Minification is often used for malware written in interpreted languages, such as JavaScript, PHP, or Python. Legitimate code that is transmitted many times a second, such as JavaScript on websites, often uses minification to simply reduce the number of bytes transmitted.|
+

 References
 ----------
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0008**|
+|**ID**|**B0008**|
 |**Objective(s)**| [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis)|
 |**Related ATT&CK Technique**|None|

@@ -13,7 +13,9 @@ Virtualized code is a software protection technique. Themida is a commercial too

 Methods
 -------
-* **Multiple VMs**: multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0008.001|**Multiple VMs**|Multiple virtual machines with different architectures (CISC, RISC, etc.) can be used inside of a single executable in order to make reverse engineering even more difficult.|

 Malware Examples
 ----------------
@@ -1,29 +1,37 @@
 |||
 |---------|------------------------|
-|**ID**|**E1045**|
+|**ID**|**F0001**|
 |**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Anti-Static Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-static-analysis), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Software Packing](https://attack.mitre.org/techniques/T1045/)|
+|**Related ATT&CK Sub-Technique**|[Obfuscated Files or Information: Software Packing](https://attack.mitre.org/techniques/T1027/002)|

 Software Packing
 ================
-This code characteristic - Software Packing - can make static and behavioral analysis difficult and includes packing with software protectors, such as Themida and Armadillo [[1]](#1). Methods related to anti-analysis are below. 
+This code characteristic - Software Packing - can make static and behavioral analysis difficult and includes packing with software protectors, such as Themida and Armadillo [[1]](#1). Methods related to anti-analysis are below. This behavior covers both characteristics of the malware (i.e., how it is packed) as well as behaviors of the malware (e.g., the malware packs another executable file).

-This description refines the ATT&CK [**Software Packing**](https://attack.mitre.org/techniques/T1045/) technique.
+This description refines the ATT&CK [**Obfuscated Files or Information: Software Packing**](https://attack.mitre.org/techniques/T1027/002) sub-technique.

 Methods
 -------
-* **Nested Packing**: the malware is packed by one packer, the result is packed, etc.
-* **Standard Compression**: Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.
-* **Standard Compression of Code**: Uses a standard algorithm to compress the opcode mnemonics.
-* **Standard Compression of Data**: Uses a standard algorithm to compress strings and variables (executable file data).
-* **Custom Compression**: Uses a custom algorithm to compress an executable file.
-* **Custom Compression of Code**: Uses a custom algorithm to compress opcode mnemonics.
-* **Custom Compression of Data**: Uses a custom algorithm to compress strings and variables (executable file data).
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|F0001.001|**Nested Packing**|The malware is packed by one packer, the result is packed, etc.|
+|F0001.002|**Standard Compression**|Uses a standard algorithm, such as UPX or LZMA, to compress an executable file.|
+|F0001.003|**Standard Compression of Code**|Uses a standard algorithm to compress the opcode mnemonics.|
+|F0001.004|**Standard Compression of Data**|Uses a standard algorithm to compress strings and variables (executable file data).|
+|F0001.005|**Custom Compression**|Uses a custom algorithm to compress an executable file.|
+|F0001.006|**Custom Compression of Code**|Uses a custom algorithm to compress opcode mnemonics.|
+|F0001.007|**Custom Compression of Data**|Uses a custom algorithm to compress strings and variables (executable file data).|
+|F0001.008|**UPX**|Uses UPX packer.|
+|F0001.009|**Confuser**|Uses Confuser packer.|
+|F0001.010|**VMProtect**|Uses VMProtect.|
+|F0001.011|**Themida**|Uses Themida.|
+|F0001.012|**Armadillo**|Uses Armadillo.|

 Malware Examples
 ----------------
 |Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
+|-----------------------------|--------|-----------------------------|
+|[**Redhip**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|

 References
 ----------
@@ -31,3 +39,4 @@ References

 <a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.
 
+<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
@@ -1,24 +1,12 @@
 |||
 |--|-----|
-|**ID**|**M9003**|
+|**ID**|**OB0003**|

 # Collection #
 Behaviors that identify and gather information, such as sensitive files, from a target network prior to exfiltration. This objective includes locations on a system or network where the malware may look for information to exfiltrate.

-* **Access Call Log** [T1433](https://github.com/MBCProject/mbc-markdown/blob/master/collection/access-call-log.md)
-* **Access Sensitive Data or Credentials in Files** [E1409](https://github.com/MBCProject/mbc-markdown/blob/master/collection/access-sensitive-data.md)
-* **Audio Capture** [T1123](https://github.com/MBCProject/mbc-markdown/blob/master/collection/audio-capture.md)
-* **Automated Collection** [T1119](https://github.com/MBCProject/mbc-markdown/blob/master/collection/auto-collect.md)
-* **Capture SMS Message** [T1412](https://github.com/MBCProject/mbc-markdown/blob/master/collection/capture-sms.md)
-* **Clipboard Data** [T1115](https://github.com/MBCProject/mbc-markdown/blob/master/collection/clipboard-data.md)
-* **Data from Local System** [T1005](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-local-system.md)
-* **Data from Network Shared Drive** [T1039](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-network-share.md)
-* **Data from Removable Media** [T1025](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-removable-media.md)
-* **Data Staged** [T1074](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-staged.md)
-* **Email Collection** [T1114](https://github.com/MBCProject/mbc-markdown/blob/master/collection/email-collect.md)
+* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-markdown/blob/master/collection/cryptocurrency.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
 * **Input Capture** [E1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
-* **Location Tracking** [T1430](https://github.com/MBCProject/mbc-markdown/blob/master/collection/location-track.md)
-* **Man in the Browser** [T1185](https://github.com/MBCProject/mbc-markdown/blob/master/collection/man-in-browser.md)
-* **Microphone or Camera Capture** [T1429](https://github.com/MBCProject/mbc-markdown/blob/master/collection/micro-cam-capture.md)
-* **Screen Capture** [T1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
-* **Video Capture** [T1125](https://github.com/MBCProject/mbc-markdown/blob/master/collection/video-capture.md)
+* **Keylogging** [F0002](https://github.com/MBCProject/mbc-markdown/blob/master/collection/keylogging.md)
+* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1433**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Access Call Log](https://attack.mitre.org/techniques/T1433/)|
-
-Access Call Log
-===============
-Malware gathers call log data.
-
-**See ATT&CK:** [**Access Call Log**](https://attack.mitre.org/techniques/T1433/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**E1409**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Access Sensitive Data or Credentials in Files](https://attack.mitre.org/techniques/T1409/)|
-
-Access Sensitive Data or Credentials in Files
-=============================================
-Malware accesses files that contain sensitive data or credentials (e.g., passwords). Access of Bitcoin and other cryptocurrency wallets also fall under this behavior.
-
-**See ATT&CK:** [**Access Sensitive Data or Credentials in Files**](https://attack.mitre.org/techniques/T1409/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1123**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Audio Capture](https://attack.mitre.org/techniques/T1123/)|
-
-Audio Capture
-=============
-Malware leverages system's peripheral devices to capture audio.
-
-**See ATT&CK:** [**Audio Capture**](https://attack.mitre.org/techniques/T1123/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1119**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Automated Collection](https://attack.mitre.org/techniques/T1119/)|
-
-Automated Collection
-====================
-Malware uses automated techniques for collecting system data.
-
-**See ATT&CK:** [**Automated Collection**](https://attack.mitre.org/techniques/T1119/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1412**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Capture SMS Messages](https://attack.mitre.org/techniques/T1412/)|
-
-Capture SMS Messages
-====================
-Malware captures data sent via SMS (e.g., authentication credentials).
-
-**See ATT&CK:** [**Capture SMS Messages**](https://attack.mitre.org/techniques/T1412/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1115**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Clipboard Data](https://attack.mitre.org/techniques/T1115/)|
-
-Clipboard Data
-==============
-Malware collects data stored in the Windows clipboard.
-
-**See ATT&CK:** [**Clipboard Data**](https://attack.mitre.org/techniques/T1115/).
@@ -0,0 +1,17 @@
+|||
+|---------|------------------------|
+|**ID**|**B0028**|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
+|**Related ATT&CK Technique**|None|
+
+Cryptocurrency
+==============
+Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets.
+
+Methods
+-------
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0028.001|**Bitcoin**|Access Bitcoin data.|
+|B0028.002|**Ethereum**|Access Ethereum data.|
+|B0028.003|**Zcash**|Access Zcash data.|
@@ -1,22 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1005**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Data from Local System](https://attack.mitre.org/techniques/T1005/)|
-
-Data from Local System
-======================
-Malware collects sensitive data from local system sources.
-
-**See ATT&CK:** [**Data from Local System**](https://attack.mitre.org/techniques/T1005/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1039**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Data from Network Shared Drive](https://attack.mitre.org/techniques/T1039/)|
-
-Data from Network Shared Drive
-==============================
-Malware collects from remote systems via shared network drives that are accessible from the compromised system.
-
-**See ATT&CK:** [**Data from Network Shared Drive**](https://attack.mitre.org/techniques/T1039/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1025**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Data from Removable Media](https://attack.mitre.org/techniques/T1025/)|
-
-Data from Removable Media
-=========================
-Malware collects from removable media connected to the compromised system.
-
-**See ATT&CK:** [**Data from Removable Media**](https://attack.mitre.org/techniques/T1025/).
@@ -1,21 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1074**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Data Staged](https://attack.mitre.org/techniques/T1074/)|
-
-Data Staged
-===========
-Malware stages collected data prior to [Exfiltration](https://github.com/MBCProject/mbc-markdown/tree/master/exfiltration).
-
-**See ATT&CK:** [**Data Staged**](https://attack.mitre.org/techniques/T1074/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1114**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Email Collection](https://attack.mitre.org/techniques/T1114/)|
-
-Email Collection
-================
-Malware targets user email for collection.
-
-**See ATT&CK:** [**Email Collection**](https://attack.mitre.org/techniques/T1114/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -2,25 +2,22 @@
 |---------|------------------------|
 |**ID**|**E1056**|
 |**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Input Capture](https://attack.mitre.org/techniques/T1056/)|
+|**Related ATT&CK Technique**|[Input Capture](https://attack.mitre.org/techniques/T1056)|

 Input Capture
 =============
 Malware captures user input.

-**See ATT&CK:** [**Input Capture**](https://attack.mitre.org/techniques/T1056/).
+**See ATT&CK:** [**Input Capture**](https://attack.mitre.org/techniques/T1056).

 Methods
 -------
-* **Mouse Events**: Mouse events are captured.
-* **Keyboard Events**: Keyboard events are captured.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|E1056.m01|**Mouse Events**|Mouse events are captured.|

 Malware Examples
 ----------------
 |Name|Date|Description|
 |-----------------------------|--------|-----------------------------|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
+|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/poison-ivy.md)|2005|Captures input.|
@@ -0,0 +1,18 @@
+|||
+|---------|------------------------|
+|**ID**|**F0002**|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
+|**Related ATT&CK Sub-Technique**|[Input Capture: Keylogging](https://attack.mitre.org/techniques/T1056/001)|
+
+Keylogging
+==========
+Malware captures user keyboard input.
+
+**See ATT&CK:** [**Input Capture: Keylogging**](https://attack.mitre.org/techniques/T1056/001).
+
+Methods
+-------
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|F0002.001|**Application Hook**|Keystrokes are captured with an application hook.|
+|F0002.002|**Polling**|Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState).|
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1430**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Location Tracking](https://attack.mitre.org/techniques/T1430/)|
-
-Location Tracking
-=================
-Malware tracks a system's physical location.
-
-**See ATT&CK:** [**Location Tracking**](https://attack.mitre.org/techniques/T1430/).
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1185**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Man in the Browser](https://attack.mitre.org/techniques/T1185/)|
-
-Man in the Browser
-==================
-Malware leverages vulnerabilities and functionality in browser software to change content, modify behavior, and intercept information.
-
-**See ATT&CK:** [**Man in the Browser**](https://attack.mitre.org/techniques/T1185/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1429**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Microphone or Camera Recordings](https://attack.mitre.org/techniques/T1429/), [Capture Camera](https://attack.mitre.org/techniques/T1512/), [Capture Audio](https://attack.mitre.org/techniques/T1429/)|
-
-Microphone or Camera Capture
-============================
-Malware records activities using the device microphone and/or camera.
-
-**See ATT&CK:** [**Microphone or Camera Recordings**](https://attack.mitre.org/techniques/T1429/), [Capture Camera](https://attack.mitre.org/techniques/T1512/), [Capture Audio](https://attack.mitre.org/techniques/T1429/).
@@ -1,11 +1,17 @@
 |||
 |---------|------------------------|
-|**ID**|**T1113**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
+|**ID**|**E1113**|
+|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
 |**Related ATT&CK Technique**|[Screen Capture](https://attack.mitre.org/techniques/T1113/)|

 Screen Capture
-==============
-Malware takes screen captures.
+=============
+Malware takes screen captures of the desktop.

-**See ATT&CK:** [**Screen Capture**](https://attack.mitre.org/techniques/T1113/).
+**See ATT&CK:** [**Screen Capture**](https://attack.mitre.org/techniques/T1113/).
+
+Methods
+-------
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|E1113.m01|**WinAPI**|Screen is captured using WinAPI functions (e.g., user32.GetDesktopWindow).|
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1125**|
-|**Objective(s)**|[Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection)|
-|**Related ATT&CK Technique**|[Video Capture](https://attack.mitre.org/techniques/T1125/)|
-
-Video Capture
-=============
-Malware captures video recordings.
-
-**See ATT&CK:** [**Video Capture**](https://attack.mitre.org/techniques/T1125/).
@@ -1,26 +1,10 @@
 |||
 |--|-----|
-|**ID**|**M9004**|
+|**ID**|**OB0004**|

 # Command and Control
 Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.

-* **Command and Control Communication** [M0030](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md)
-* **Commonly Used Port** [T1043](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/common-port.md)
-* **Connection Proxy** [T1090](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/connect-proxy.md)
-* **Custom Command and Control Protocol** [T1094](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/custom-c2-protocol.md)
-* **Custom Cryptographic Protocol** [T1024](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/custom-crypto-protocol.md)
-* **Data Encoding** [T1132](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/data-encode.md)
-* **Data Obfuscation** [T1001](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/data-obfuscate.md)
-* **Domain Name Generation** [M0031](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/domain-name-generate.md)
-* **Fallback Channels** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/fallback-channels.md)
-* **Multi-hop Proxy** [T1188](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/multihop-proxy.md)
-* **Multi-Stage Channels** [T1104](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/multi-stage-channels.md)
-* **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
-* **Remote Access Tools** [T1219](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-access-tools.md)
-* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
-* **Standard Application Layer Protocol** [T1071](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-app-protocol.md)
-* **Standard Cryptographic Protocol** [T1032](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-crypto-protocol.md)
-* **Standard Non-Application Layer Protocol** [T1095](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/std-non-app-protocol.md)
-* **Uncommonly Used Port** [T1065](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/uncommon-port.md)
-* **Web Service** [T1102](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/web-service.md)
+* **Command and Control Communication** [B0030](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/command-control-comm.md)
+* **Domain Name Generation** [B0031](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/domain-name-generate.md)
+* **Remote File Copy** [E1105](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/remote-file-copy.md)
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0030**|
+|**ID**|**B0030**|
 |**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
 |**Related ATT&CK Technique**|None|

@@ -12,9 +12,15 @@ Command and Control Communication relates to *autonomous* client/server communic

 Methods
 -------
-* **Check for Payload**
-* **Send System Information**
-* **Send Heartbeat**
-* **Request Command**
-* **Request Email Template**
-* **Request Email Address List**
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0030.001|**Send Data**|Send data to a C2 server.|
+|B0030.002|**Receive Data**|Receive data from a C2 server.|
+|B0030.003|**Server to Client File Transfer**|File is transferred from server to client.|
+|B0030.004|**Client to Server File Transfer**|File is transferred from client to server.|
+|B0030.005|**Check for Payload**|Check for payload.|
+|B0030.006|**Send System Information**|Client sends system information.|
+|B0030.007|**Send Heartbeat**|Heartbeat sent.|
+|B0030.008|**Request Command**|Client requests a command.|
+|B0030.009|**Request Email Template**|Request email template.|
+|B0030.010|**Request Email Address List**|Request email address list.|
@@ -1,18 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1043**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Commonly Used Port](https://attack.mitre.org/techniques/T1043/), [Commonly Used Port - Mobile](https://attack.mitre.org/techniques/T1436/)|
-
-Commonly Used Port
-==================
-Malware may use a common port to avoid detection of command and control activity.
-
-**See ATT&CK:** [**Commonly Used Port**](https://attack.mitre.org/techniques/T1043/) and [**Commonly Used Port (Mobile)**](https://attack.mitre.org/techniques/T1436/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1090**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Connection Proxy](https://attack.mitre.org/techniques/T1090/)|
-
-Connection Proxy
-================
-Malware may use a connection proxy to manage command and control communications.
-
-**See ATT&CK:** [**Connection Proxy**](https://attack.mitre.org/techniques/T1090/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1094**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Custom Command and Control Protocol](https://attack.mitre.org/techniques/T1094/)|
-
-Custom Command and Control Protocol
-===================================
-Malware may use a custom command and control protocol instead of encapsulating commands and data in a [Standard Application Layer Protocol](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control/std-protocol.md).
-
-**See ATT&CK:** [**Custom Command and Control Protocol**](https://attack.mitre.org/techniques/T1094/).
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1024**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Custom Cryptographic Protocol](https://attack.mitre.org/techniques/T1024/)|
-
-Custom Cryptographic Protocol
-=============================
-Malware may use a custom cryptographic protocol to hide command and control communications.
-
-**See ATT&CK:** [**Custom Cryptographic Protocol**](https://attack.mitre.org/techniques/T1024/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1132**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Data Encoding](https://attack.mitre.org/techniques/T1132/)|
-
-Data Encoding
-=============
-Malware encodes its command and control information using a standard system such as Unicode, Base64, etc.
-
-**See ATT&CK:** [**Data Encoding**](https://attack.mitre.org/techniques/T1132/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1001**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Data Obfuscation](https://attack.mitre.org/techniques/T1001/)|
-
-Data Obfuscation
-================
-Malware hides its command and control information.
-
-**See ATT&CK:** [**Data Obfuscation**](https://attack.mitre.org/techniques/T1001/).
@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
-|**ID**|**M0031**|
+|**ID**|**B0031**|
 |**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/)|
+|**Related ATT&CK Sub-Technique**|[Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/)|

 Domain Name Generation
 ======================
 Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)

-The subsequently defined ATT&CK technique [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1483/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.
+The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.

 Malware Examples
 ----------------
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1008**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Fallback Channels](https://attack.mitre.org/techniques/T1008/)|
-
-Fallback Channels
-=================
-Malware may contain a secondary command and control server or may communicate over a backup channel.
-
-**See ATT&CK:** [**Fallback Channels**](https://attack.mitre.org/techniques/T1008/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1104**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Multi-Stage Channels](https://attack.mitre.org/techniques/T1104/)|
-
-Multi-Stage Channels
-====================
-Malware may create multiple stages for command and control, making detection more difficult.
-
-**See ATT&CK:** [**Multi-Stage Channels**](https://attack.mitre.org/techniques/T1104/).
@@ -1,13 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1188**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Multi-hop Proxy](https://attack.mitre.org/techniques/T1188/)|
-
-Multi-hop Proxy
-===============
-Malware may chain together multiple proxies to disguise the source of malicious C2 traffic. 
-
-In MBC, this behavior includes installing a multi-hop proxy, such as Tor.
-
-**See ATT&CK:** [**Multi-hop Proxy**](https://attack.mitre.org/techniques/T1188/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1205**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[Port Knocking](https://attack.mitre.org/techniques/T1205/)|
-
-Port Knocking
-=============
-Malware may hide open ports.
-
-**See ATT&CK:** [**Port Knocking**](https://attack.mitre.org/techniques/T1205/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1219**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Remote Access Tools](https://attack.mitre.org/techniques/T1219/)|
-
-Remote Access Tools
-===================
-Malware may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems.
-
-**See ATT&CK:** [**Remote Access Tools**](https://attack.mitre.org/techniques/T1219/).
@@ -2,7 +2,7 @@
 |---------|------------------------|
 |**ID**|**E1105**|
 |**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Lateral Movement](https://github.com/MBCProject/mbc-markdown/tree/master/lateral-movement), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[Remote File Copy](https://attack.mitre.org/techniques/T1105/)|
+|**Related ATT&CK Technique**|[Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)|

 Remote File Copy
 ================
@@ -10,7 +10,7 @@ Malware may copy files from one system to another.

 Note that this behavior is separate from possible execution (installation) of the file, which is covered by the [Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md) behavior. 

-**See ATT&CK:** [**Remote File Copy**](https://attack.mitre.org/techniques/T1105/).
+**See ATT&CK:** [**Ingress Tool Transfer**](https://attack.mitre.org/techniques/T1105/).

 Malware Examples
 ----------------
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1071**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Standard Application Layer Protocol](https://attack.mitre.org/techniques/T1071/)|
-
-Standard Application Layer Protocol
-===================================
-Malware may use a standard application layer protocol (e.g., HTTP) to blend with usual traffic.
-
-**See ATT&CK:** [**Standard Application Layer Protocol**](https://attack.mitre.org/techniques/T1071/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -1,21 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1032**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Standard Cryptographic Protocol](https://attack.mitre.org/techniques/T1032/)|
-
-Standard Cryptographic Protocol
-===============================
-Malware may use a standard cryptographic protocol to conceal command and control traffic or other data.
-
-**See ATT&CK:** [**Standard Cryptographic Protocol**](https://attack.mitre.org/techniques/T1032/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|--------|-----------------------------|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1095**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Standard Non-Application Layer Protocol](https://attack.mitre.org/techniques/T1095/)|
-
-Standard Non-Application Layer Protocol
-=======================================
-Malware may use a standard non-application layer protocol (e.g., ICMP) because such protocols may be less commonly monitored, enabling communication to be hidden.
-
-**See ATT&CK:** [**Standard Non-Application Layer Protocol**](https://attack.mitre.org/techniques/T1095/).
@@ -1,22 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1065**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control)|
-|**Related ATT&CK Technique**|[Uncommonly Used Port](https://attack.mitre.org/techniques/T1065/)|
-
-Uncommonly Used Port
-====================
-Malware may use an uncommon port to bypass poorly configured boundary controllers.
-
-**See ATT&CK:** [**Uncommonly Used Port**](https://attack.mitre.org/techniques/T1065/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1102**|
-|**Objective(s)**|[Command and Control](https://github.com/MBCProject/mbc-markdown/tree/master/command-and-control), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Web Service](https://attack.mitre.org/techniques/T1102/)|
-
-Web Service
-===========
-Malware may use existing external Web services for relaying C2 commands.
-
-**See ATT&CK:** [**Web Service**](https://attack.mitre.org/techniques/T1102/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1171**|
-|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[LLMNR/NBT-NS Poisoning](https://attack.mitre.org/techniques/T1171/)|
-
-LLMNR/NBT-NS Poisoning
-======================
-Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. Malware may spoof an authoritative source, poisoning the service.
-
-**See ATT&CK:** [**LLMNR/NBT-NS Poisoning**](https://attack.mitre.org/techniques/T1171/).
@@ -1,19 +1,15 @@
 |||
 |--|-----|
-|**ID**|**M9005**|
+|**ID**|**OB0005**|

 # Credential Access
 Behaviors to obtain credential access, allowing it or its underlying threat actor to assume control of an account, with the associated system and network permissions.

-* **Access Sensitive Data or Credentials in Files** [E1409](https://github.com/MBCProject/mbc-markdown/blob/master/collection/access-sensitive-data.md)
-* **Account Manipulation** [T1098](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/acct-manipulate.md)
-* **Capture SMS Messages** [T1412](https://github.com/MBCProject/mbc-markdown/blob/master/collection/capture-sms.md)
-* **Credential Dumping** [T1003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credential-dump.md)
-* **Credentials in Files** [T1081](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-files.md)
-* **Credentials in Registry** [T1214](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-registry.md)
-* **Credentials in Web Browsers** [T1503](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-web-browsers.md)
-* **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Cryptocurrency** [B0028](https://github.com/MBCProject/mbc-markdown/blob/master/collection/cryptocurrency.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
 * **Input Capture** [E1056](https://github.com/MBCProject/mbc-markdown/blob/master/collection/input-capture.md)
-* **LLMNR/NBT-NS Poisoning** [T1171](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/LLMNR-poison.md)
-* **Network Sniffing** [T1040](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/network-sniff.md)
-* **Private Keys** [T1145](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/private-keys.md)
+* **Keylogging** [F0002](https://github.com/MBCProject/mbc-markdown/blob/master/collection/keylogging.md)
+* **Screen Capture** [E1113](https://github.com/MBCProject/mbc-markdown/blob/master/collection/screen-capture.md)
+
+
+
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1098**|
-|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Account Manipulation](https://attack.mitre.org/techniques/T1098/)|
-
-Account Manipulation
-====================
-Malware may manipulate accounts to maintain access to credentials or permission levels.
-
-**See ATT&CK:** [**Account Manipulation**](https://attack.mitre.org/techniques/T1098/).
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1003**|
-|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Credential Dumping](https://attack.mitre.org/techniques/T1003/)|
-
-Credential Dumping
-==================
-Malware may obtain account login and password information.
-
-**See ATT&CK:** [**Credential Dumping**](https://attack.mitre.org/techniques/T1003/).
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1081**|
-|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Credentials in Files](https://attack.mitre.org/techniques/T1081/)|
-
-Credentials in Files
-====================
-Malware may search local file system and remote file shares for files containing passwords.
-
-**See ATT&CK:** [**Credentials in Files**](https://attack.mitre.org/techniques/T1081/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1214**|
-|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Credentials in Registry](https://attack.mitre.org/techniques/T1214/)|
-
-Credentials in Registry
-=======================
-Malware may query the Registry looking for credentials and passwords.
-
-**See ATT&CK:** [**Credentials in Registry**](https://attack.mitre.org/techniques/T1214/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1503**|
-|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Credentials in Web Browsers](https://attack.mitre.org/techniques/T1503/)|
-
-Credentials in Web Browsers
-===========================
-Malware may acquire credentials from web browsers by reading files specific to the target browser.
-
-**See ATT&CK:** [**Credentials in Web Browsers**](https://attack.mitre.org/techniques/T1503/).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
@@ -1,25 +1,27 @@
 |||
 |------------------|------------------------|
-|**ID**|**E1179**|
-|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
-|**Related ATT&CK Technique**|[Hooking](https://attack.mitre.org/techniques/T1179/)|
+|**ID**|**F0003**|
+|**Objective(s)**|[Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis), [Collection](https://github.com/MBCProject/mbc-markdown/tree/master/collection), [Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access), [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
+|**Related ATT&CK Sub-Technique**|[Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)|


 Hooking
 =======
-Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Obstruction](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/memory-dump-obstruct.md).
+Malware alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Methods related to anti-behavioral analysis are below. For example, hooking can be used to prevent memory dumps - see also [Memory Dump Evasion](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-memory-dump.md).

-For discussion related to the Credential Access, Persistence, and Privilege Escalation objectives, see ATT&CK: [**Hooking**](https://attack.mitre.org/techniques/T1179/). 
+For discussion related to the Credential Access and Collection objectives, see ATT&CK: [**Input Capture: Credential API Hooking**](https://attack.mitre.org/techniques/T1056/004/). 

-Note that in MBC, but not in ATT&CK, Hooking is also associated with the [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion) and [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis) objectives.
+Note that in MBC, Hooking is also associated with the [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation), and [Anti-Behavioral Analysis](https://github.com/MBCProject/mbc-markdown/tree/master/anti-behavioral-analysis) objectives.

 Methods
 -------
-* **Patch MmGetPhysicalMemoryRanges**: Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)
-* **Hook memory mapping APIs**: Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)
-* **Hook procedures**: Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)
-* **Import Address Hooking (IAT) Hooking**: uses modifications to a process's IAT where pointers to imported API functions are stored.
-* **Inline Hooking**: overwrites the first bytes in an API function to redirect code flow.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|F0003.001|**Patch MmGetPhysicalMemoryRanges**| Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
+|F0003.002|**Hook memory mapping APIs**|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
+|F0003.003|**Hook procedures**|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)|
+|F0003.004|**Import Address Hooking (IAT) Hooking**|Uses modifications to a process's IAT where pointers to imported API functions are stored.|
+|F0003.005|**Inline Hooking**|Overwrites the first bytes in an API function to redirect code flow.|

 Malware Examples
 ----------------
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1145**|
-|**Objective(s)**|[Credential Access](https://github.com/MBCProject/mbc-markdown/tree/master/credential-access)|
-|**Related ATT&CK Technique**|[Private Keys](https://attack.mitre.org/techniques/T1145/)|
-
-Private Keys
-============
-Malware may gather private keys from compromised systems.
-
-**See ATT&CK:** [**Private Keys**](https://attack.mitre.org/techniques/T1145/).
@@ -1,55 +1,25 @@
 |||
 |--|-----|
-|**ID**|**M9006**|
+|**ID**|**OB0006**|

 # Defense Evasion #
 Behaviors that evade detection or avoid other defenses.

-* **Access Token Manipulation** [T1134](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/access-token.md)
-* **Alternative Installation Location** [M0027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/alter-install-location.md)
-* **Application Discovery** [T1418](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/app-discover.md)
-* **Binary Padding** [T1009](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/binary-pad.md)
-* **BITS Jobs** [T1197](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bits-jobs.md)
-* **Boot Sector Modification** [M0028](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/boot-sector-mod.md)
-* **Bypass User Account Control** [T1088](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-user-acct-cntl.md)
-* **Code Signing** [T1116](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/code-signing.md)
-* **Component Object Model Hijacking** [T1122](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/component-hijack.md)
-* **Configuration Modification** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md)
-* **Covert Location** [M0040](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/convert-location.md)
-* **DCShadow** [T1207](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/dcshadow.md)
-* **Deobfuscate/Decode Files or Information** [T1140](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md)
-* **Disabling Security Tools** [E1089](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)
-* **DLL Search Order Hijacking** [T1038](https://github.com/MBCProject/mbc-markdown/blob/master/privilege-escalation/dll-search-order-hijack.md)
+* **Alternative Installation Location** [B0027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/alter-install-location.md)
+* **Bootkit** [F0013](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/boot-sector-mod.md)
+* **Bypass DEP** [B0037](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/bypass-dep.md)
+* **Component Firmware** [F0009](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/component-firmware.md)
+* **Covert Location** [B0040](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/covert-location.md)
+* **Disable Security Tools** [F0004](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)
 * **Execution Guardrails** [E1480](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/execution-guardrails.md)
-* **Exploitation for Defense Evasion** [T1211](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/exploit-for-defense.md)
-* **File Deletion** [E1107](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/file-deletion.md)
-* **File Permissions Modification** [T1222](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/file-permission-mod.md)
-* **File System Logical Offsets** [T1006](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/file-sys-logical-offset.md)
-* **Hidden Files and Directories** [E1158](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/hidden-files.md)
-* **Hidden Window** [T1143](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/hidden-window.md)
-* **HISTCONTROL** [T1148](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/histcontrol.md)
-* **Hooking** [E1179](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
-* **Image File Execution Options Injection** [T1183](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/image-file-exe-opt-inj.md)
-* **Indicator Blocking** [E1054](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indicator-blocking.md)
-* **Indicator Removal on Host** [T1070](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indicator-remove-host.md)
-* **Indirect Command Execution** [T1202](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indirect-command.md)
-* **Install Root Certificate** [T1130](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/install-root-cert.md)
-* **Masquerading** [T1036](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/masquerading.md)
+* **Hidden Files and Directories** [F0005](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/hidden-files.md)
+* **Hooking** [F0003](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/hooking.md)
+* **Indicator Blocking** [F0006](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indicator-blocking.md)
+* **Install Insecure or Malicious Configuration** [E1478](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/config-mod.md)
 * **Modify Registry** [E1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
-* **Modify Trusted Execution Environment** [T1399](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/mod-trust-exe-environ.md)
-* **NTFS File Attributes** [T1096](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/ntfs-file-attr.md)
 * **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)
-* **Parent PID Spoofing** [T1502](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/parent-pid-spoof.md)
-* **Polymorphic Code** [M0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md)
-* **Port Knocking** [T1205](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/port-knocking.md)
-* **Process Hollowing** [T1093](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-hollow.md)
+* **Polymorphic Code** [B0029](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/polymorphic-code.md)
 * **Process Injection** [E1055](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md)
-* **Redundant Access** [T1008](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/redundant-access.md)
-* **Regsvr32** [T1117](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/regsvr32.md)
-* **Rundll32** [T1085](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rundll32.md)
-* **Rootkit Behavior** [E1014](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rootkit-behavior.md)
-* **Scripting** [T1064](https://github.com/MBCProject/mbc-markdown/blob/master/execution/scripting.md)
-* **Software Packing** [E1045](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
-* **Timestomp** [T1099](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/timestomp.md)
-* **Virtualization/Sandbox Evasion** [T1497](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/virtualization-sandbox-evade.md)
-* **Web Service** [T1102](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/web-service.md)
+* **Rootkit** [E1014](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/rootkit-behavior.md)
+* **Self Deletion** [F0007](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/self-deletion.md)
+* **Software Packing** [F0001](https://github.com/MBCProject/mbc-markdown/blob/master/anti-static-analysis/software-packing.md)
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1134**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
-|**Related ATT&CK Technique**|[Access Token Manipulation](https://attack.mitre.org/techniques/T1134)|
-
-
-Access Token Manipulation
-=========================
-Malware manipulates access tokens to make a running process appear as thought it belongs to someone other than the user who started the process. 
-
-See ATT&CK: [**Access Token Manipulation**](https://attack.mitre.org/techniques/T1134).
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0027**|
+|**ID**|**B0027**|
 |**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|

@@ -11,8 +11,10 @@ Malware may install itself not as a file on the hard drive. [[1]](#1)

 Methods
 ------- 
-* **Fileless Malware**: Stores itself in memory.
-* **Registry Install**: Stores itself in the Windows registry.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0027.001|**Fileless Malware**|Stores itself in memory.|
+|B0027.002|**Registry Install**|Stores itself in the Windows registry.|

 Malware Examples
 ----------------
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1009**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Binary Padding](https://attack.mitre.org/techniques/T1009)|
-
-
-Binary Padding
-==============
-Malware is padded to increase its size beyond what security tools can handle or to change its hash. 
-
-See ATT&CK: [**Binary Padding**](https://attack.mitre.org/techniques/T1009).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1197**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[BITS Jobs](https://attack.mitre.org/techniques/T1197)|
-
-
-BITS Jobs
-=========
-Malware may abuse Windows Background Intelligent Transfer Service (BITS) to download and/or execute malicious code. 
-
-See ATT&CK: [**BITS Jobs**](https://attack.mitre.org/techniques/T1197).
@@ -1,14 +1,14 @@
 |||
 |---------|------------------------|
-|**ID**|**M0028**|
+|**ID**|**F0013**|
 |**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[Bootkit](https://attack.mitre.org/techniques/T1067/)|
+|**Related ATT&CK Sub-Technique**|[Pre-OS Boot: Bootkit](https://attack.mitre.org/techniques/T1542/003)|

-Boot Sector Modification
-========================
-The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: [**Bootkit**](https://attack.mitre.org/techniques/T1067/).
+Bootkit
+=======
+The boot sectors of a hard drive are modified (e.g., Master Boot Record (MBR)). ATT&CK associates bootkits with the Persistence. See ATT&CK: [**Pre-OS Boot: Bootkit**](https://attack.mitre.org/techniques/T1067/).

-The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect. 
+The MBC also associates the Bootkit behavior with Defense Evasion because the malware may execute before or external to the system's kernel or hypervisor (e.g., through the BIOS), making it more difficult to detect. (As of 2020, ATT&CK also associates the technique with Persistence.) 

 Malware Examples
 ----------------
@@ -0,0 +1,20 @@
+|||
+|---------|------------------------|
+|**ID**|**B0037**|
+|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
+|**Related ATT&CK Technique**|None|
+
+
+Bypass Data Execution Prevention
+================================
+Malware may bypass Data Execution Prevention (DEP).
+
+Methods
+------- 
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0037.001|**ROP Chains**| Return-Oriented Programming can be used to bypass DEP. It can also be used to bypass code signing. [[1]](#1)
+
+References
+----------
+<a name="1">[1]</a> https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce 
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1088**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
-|**Related ATT&CK Technique**|[Bypass User Account Control](https://attack.mitre.org/techniques/T1088)|
-
-
-Bypass User Account Control
-===========================
-Malware bypasses Windows User Account Control. 
-
-See ATT&CK: [**Bypass User Account Control**](https://attack.mitre.org/techniques/T1088).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1116**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Code Signing](https://attack.mitre.org/techniques/T1116)|
-
-
-Code Signing
-============
-Malware code is digitally signed to appear as legitimate software. 
-
-See ATT&CK: [**Code Signing**](https://attack.mitre.org/techniques/T1116).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1122**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[Component Object Model Hijacking](https://attack.mitre.org/techniques/T1122)|
-
-
-Component Object Model Hijacking
-=================================
-Malware hijacks a component object model (COM) object to execute itself or other malicious code. 
-
-See ATT&CK: [**Component Object Model Hijacking**](https://attack.mitre.org/techniques/T1122).
@@ -5,8 +5,8 @@
 |**Related ATT&CK Technique**|[Install Insecure or Malicious Configuration](https://attack.mitre.org/techniques/T1478)|


-Configuration Modification
-==========================
+Install Insecure or Malicious Configuration
+===========================================
 Malware may install malicious configuration settings or may modify existing configuration settings. This MBC behavior extends the related ATT&CK technique to all platforms and to the Persistence objective. 

 See ATT&CK: [**Install Insecure or Malicious Configuration**](https://attack.mitre.org/techniques/T1478).
@@ -1,6 +1,6 @@
 |||
 |---------|------------------------|
-|**ID**|**M0040**|
+|**ID**|**B0040**|
 |**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
 |**Related ATT&CK Technique**|None|

@@ -11,5 +11,7 @@ Malware may hide data or binary files within other files, the registry, etc.

 Methods
 -------
-* **Hide Data in Registry**: malware may use a registry key to store a long sequence of bytes.
-* **Steganography**: malware may store information in an image.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|B0040.001|**Hide Data in Registry**|Malware may use a registry key to store a long sequence of bytes.|
+|B0040.002|**Steganography**|Malware may store information in an image.|
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1207**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[DCShadow](https://attack.mitre.org/techniques/T1207)|
-
-
-DCShadow
-========
-Malware may use DCShadow, a method of manipulating Active Directory (AD) data, to register a rogue domain controller, which may be able to inject and replicate changes into the AD infrastructure for any domain object (e.g., credentials and keys). 
-
-See ATT&CK: [**DCShadow**](https://attack.mitre.org/techniques/T1207).
@@ -1,23 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1140**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)|
-
-
-Deobfuscate/Decode Files or Information
-=======================================
-This behavior is the counterpart to [Obfuscated Files or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md), which is used to hide artifacts of an intrusion. 
-
-See ATT&CK: [**Deobfuscate/Decode Files or Information**](https://attack.mitre.org/techniques/T1140).
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-|[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-
-References
----------
-<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -1,24 +1,26 @@
 |||
 |---------|------------------------|
-|**ID**|**E1089**|
+|**ID**|**F0004**|
 |**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Disabling Security Tools](https://attack.mitre.org/techniques/T1089/)|
+|**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|

-Disabling Security Tools
+Disable Security Tools
 ========================
 Malware may disable security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities.

 Malware-related methods extending ATT&CK's definition are below. 

-See ATT&CK: [**Disabling Security Tools**](https://attack.mitre.org/techniques/T1089/).
+See ATT&CK: [**Impair Defenses: Disable or Modify Tools**](https://attack.mitre.org/techniques/T1562/001).

 Methods
 -------
-* **Disable Kernel Patch Protection**: Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).
-
-* **Disable System File Overwrite Protection**: Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.
-
-* **Unhook APIs**: Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes. 
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|F0004.001|**Disable Kernel Patch Protection**|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
+|F0004.002|**Disable System File Overwrite Protection**|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
+|F0004.003|**Unhook APIs**|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
+|F0004.004|**AMSI Bypass**|Malware bypasses AMSI (Anti-malware Scan Interface).|
+|F0004.005|**Modify Policy**|Malware may modify policies to make software less effective.|

 Malware Examples
 ----------------
@@ -26,7 +28,10 @@ Malware Examples
 |-----------------------------|-----------|-----------------------------|
 |[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)| 2018 | Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**DNSChanger**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/dnschanger.md)|2011|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|

 References
 ----------
-<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html 
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1211**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211)|
-
-
-Exploitation for Defense Evasion
-================================
-Malware may exploit a software vulnerability in defensive security software to avoid detection. 
-
-See ATT&CK: [**Exploitation for Defense Evasion**](https://attack.mitre.org/techniques/T1211).
@@ -1,17 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**E1107**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[File Deletion](https://attack.mitre.org/techniques/T1107)|
-
-
-File Deletion
-=============
-Malware may remove dropped files or tools to avoid detection. 
-
-See ATT&CK: [**File Deletion**](https://attack.mitre.org/techniques/T1107).
-
-Methods
-------
-* **Uninstall Self**: Uninstalls self after execution is finished or when system conditions dictate.
-
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1222**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[File Permissions Modification](https://attack.mitre.org/techniques/T1222)|
-
-
-File Permissions Modification
-============================
-Malware may modify file permissions to evade detection. 
-
-See ATT&CK: [**File Permissions Modification**](https://attack.mitre.org/techniques/T1222).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1006]**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[File System Logical Offsets](https://attack.mitre.org/techniques/T1006)|
-
-
-File System Logical Offsets
-===========================
-Malware may bypass Windows file access controls by analyzing file system data structures. 
-
-See ATT&CK: [**File System Logical Offsets**](https://attack.mitre.org/techniques/T1006).
@@ -1,17 +1,19 @@
 |||
 |---------|------------------------|
-|**ID**|**E1158**|
+|**ID**|**F0005**|
 |**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[Hidden Files and Directories](https://attack.mitre.org/techniques/T1158)|
+|**Related ATT&CK Sub-Technique**|[Hide Artifacts: Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001/)|


 Hidden Files and Directories
 ============================
 Malware may hide files and folders to avoid detection and/or to persist on the system. See potential methods below. 

-See ATT&CK: [**Hidden Files and Directories**](https://attack.mitre.org/techniques/T1158).
+See ATT&CK: [**Hide Artifacts: Hidden Files and Directories**](https://attack.mitre.org/techniques/T1564/001/).

 Methods
 -------
-* **File Extension Change**: Malware may change the file extension of a file.
-* **Change File Location**: Malware may change the location of itself or another file to prevent detection.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|F0005.001|**File Extension Change**|Malware may change the file extension of a file.|
+|F0005.002|**Change File Location**|Malware may change the location of itself or another file to prevent detection.|
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1143**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Hidden Window](https://attack.mitre.org/techniques/T1143)|
-
-
-Hidden Window
-=============
-Malware may use a macOS/OS X tag to prevent its application icron from appearing in the Dock to avoid detection. 
-
-See ATT&CK: [**Hidden Window**](https://attack.mitre.org/techniques/T1143).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1148**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[HISTCONTROL](https://attack.mitre.org/techniques/T1148)|
-
-
-HISTCONTROL
-===========
-Malware may configure this environment variable to hide its activity. 
-
-See ATT&CK: [**HISTCONTROL**](https://attack.mitre.org/techniques/T1148).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1183**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[Image File Execution Options Injection](https://attack.mitre.org/techniques/T1183)|
-
-
-Image File Execution Options Injection
-======================================
-Malware may use Image File Execution Options to launch a process. 
-
-See ATT&CK: [**Image File Execution Options Injection**](https://attack.mitre.org/techniques/T1183).
@@ -1,23 +1,17 @@
 |||
 |---------|------------------------|
-|**ID**|**E1054**|
+|**ID**|**F0006**|
 |**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Indicator Blocking](https://attack.mitre.org/techniques/T1054/)|
+|**Related ATT&CK Sub-Technique**|[Impair Defenses: Indicator Blocking](https://attack.mitre.org/techniques/T1562/006/)|

 Indicator Blocking
 ==================
 Malware blocks indicators or events that would indicate malicious activity. Methods relevant to the malware domain are below. 

-See ATT&CK: [**Indicator Blocking**](https://attack.mitre.org/techniques/T1054/).
+See ATT&CK: [**Impair Defenses: Indicator Blocking**](https://attack.mitre.org/techniques/T1562/006/).

 Methods
 -------
-* **Remove SMS Warning Messages**: Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria. 
-
-Malware Examples
----------------
-|Name|Date|Description|
-|-----------------------------|-----------|-----------------------------|
-
-References
----------
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|F0006.001|**Remove SMS Warning Messages**|Malware captures the message body of incoming SMS messages and aborts displaying messages that meets a certain criteria.|
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1070**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Indicator Removal on Host](https://attack.mitre.org/techniques/T1070)|
-
-
-Indicator Removal on Host
-=========================
-Malware may delete artifacts on the infected system. 
-
-See ATT&CK: [**Indicator Removal on Host**](https://attack.mitre.org/techniques/T1070).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1202**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Indirect Command Execution](https://attack.mitre.org/techniques/T1202)|
-
-
-Indirect Command Execution
-==========================
-Malware may may use Windows utilities to execute commands. 
-
-See ATT&CK: [**Indirect Command Execution**](https://attack.mitre.org/techniques/T1202).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1130**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Install Root Certificate](https://attack.mitre.org/techniques/T1130)|
-
-
-Install Root Certificate
-========================
-Malware may install a root certificate to avoid warning prompts during certificate-enabled connections. 
-
-See ATT&CK: [**Install Root Certificate**](https://attack.mitre.org/techniques/T1130).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1036**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[Masquerading](https://attack.mitre.org/techniques/T1036)|
-
-
-Masquerading
-============
-Malware may change the name or location of files to avoid detection. 
-
-See ATT&CK: [**Masquerading**](https://attack.mitre.org/techniques/T1036).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1399**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
-|**Related ATT&CK Technique**|[Modify Trusted Execution Environment](https://attack.mitre.org/techniques/T1399)|
-
-
-Modify Trusted Execution Environment
-====================================
-Malware may run code in the Android Trusted Execution Environment. 
-
-See ATT&CK: [**Modify Trusted Execution Environment**](https://attack.mitre.org/techniques/T1399).
@@ -1,12 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1096**|
-|**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion)|
-|**Related ATT&CK Technique**|[NTFS File Attributes](https://attack.mitre.org/techniques/T1096/)|
-
-
-NTFS File Attributes
-====================
-Malware may store malicious data in file attribute metadata. 
-
-See ATT&CK: [**NTFS File Attributes**](https://attack.mitre.org/techniques/T1096/). 
@@ -15,16 +15,27 @@ See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techn

 Methods
 -------
-* **Encoding**:
-   * *Standard Encoding*: A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.
-   * *Custom Encoding*: A custom algorithm is used to encode the malware sample, a file, or other information.
-* **Encryption**: 
-   * *Standard Encryption*: A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
-   * *Standard Encryption of Code*: A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data. 
-   * *Standard Encryption of Data*: A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code. 
-   * *Custom Encryption*: A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as **Code Encryption in File**.
-   * *Custom Encryption of Code*: A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.
-   * *Custom Encryption of Data*: A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.
+|ID|Name|Description|
+|-----------------------------|--------|-----------------------------|
+|E1027.m01|**Encoding**|The malware sample, file, or other information is encoded.|
+
+| | | | |
+|----------|-----------------------------|--------|-----------------------------|
+| |E1027.m02|*Standard Encoding*|A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
+| |E1027.m03|*Custom Encoding*|A custom algorithm is used to encode the malware sample, a file, or other information.|
+
+| | | |
+|-----------------------------|--------|-----------------------------|
+|E1027.m04|**Encryption**|The malware sample, file, or other information is encrypted.|
+
+| | | | |
+|----------|-----------------------------|--------|-----------------------------|
+| |E1027.m05|*Standard Encryption*|A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
+| |E1027.m06|*Standard Encryption of Code*|A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
+| |E1027.m07|*Standard Encryption of Data*|A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
+| |E1027.m08|*Custom Encryption*|A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
+| |E1027.m09|*Custom Encryption of Code*|A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
+| |E1027.m10|*Custom Encryption of Data*|A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|


 Malware Examples
@@ -32,3 +43,5 @@ Malware Examples
 |Name|Date|Description|
 |-----------------------------|-----------|-----------------------------|
 |[**TrickBot**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
+|[**Poison Ivy**](https://github.com/MBCProject/mbc-markdown/tree/master/xample-malware/poison-ivy.md)|2005|Obfuscates files.|
+|[**WebCobra**](https://github.com/MBCProject/mbc-markdown/blob/master/xample-malware/webcobra.md)|2018|Obfuscates files.|
@@ -1,11 +0,0 @@
-|||
-|---------|------------------------|
-|**ID**|**T1502**|
-|**Objective(s)**|[Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Privilege Escalation](https://github.com/MBCProject/mbc-markdown/tree/master/privilege-escalation)|
-|**Related ATT&CK Technique**|[Parent PID Spoofing](https://attack.mitre.org/techniques/T1502/)|
-
-Parent PID Spoofing
-===================
-Malware may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.
-
-See ATT&CK: [**Parent PID Spoofing**](https://attack.mitre.org/techniques/T1502/). 
--- a/Show More
+++ b/Show More