update methods

defense-evasion/README.md

@@ -34,7 +34,7 @@ Behaviors that evade detection or avoid other defenses.
 * **Indirect Command Execution** [T1202](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/indirect-command.md)
 * **Install Root Certificate** [T1130](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/install-root-cert.md)
 * **Masquerading** [T1036](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/masquerading.md)
-* **Modify Registry** [T1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
+* **Modify Registry** [E1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
 * **Modify Trusted Execution Environment** [T1399](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/mod-trust-exe-environ.md)
 * **NTFS File Attributes** [T1096](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/ntfs-file-attr.md)
 * **Obfuscated Files or Information** [E1027](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md)

defense-evasion/modify-reg.md

@@ -1,13 +1,13 @@
 |||
 |---------|------------------------|
-|**ID**|**T1112**|
+|**ID**|**E1112**|
 |**Objective(s)**| [Defense Evasion](https://github.com/MBCProject/mbc-markdown/tree/master/defense-evasion), [Persistence](https://github.com/MBCProject/mbc-markdown/tree/master/persistence)|
 |**Related ATT&CK Technique**|[Modify Registry](https://attack.mitre.org/techniques/T1112)|
 
 
 Modify Registry
 ===============
-Malware may make changes to the Windows Registry to hide execution. 
+Malware may make changes to the Windows Registry to hide execution or to persist on the system (note that ATT&CK does not extend this behavior to the Persistence objective). 
 
 See ATT&CK: [**Modify Registry**](https://attack.mitre.org/techniques/T1112).
 

defense-evasion/process-inject.md

@@ -41,4 +41,4 @@ References
 
 <a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser 
 
-<a name="4">[4]</a> https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process 
+<a name="4">[4]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process 

persistence/README.md

@@ -27,7 +27,7 @@ Malware aims to remain on a system regardless of system events.
 * **Local Job Scheduling** [T1168](https://github.com/MBCProject/mbc-markdown/blob/master/execution/local-job-sch.md)
 * **Malicious Network Driver** [M0026](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/malicious-network-drv.md)
 * **Modify Existing Service** [E1031](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/modify-service.md)
-* **Modify Registry** [T1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
+* **Modify Registry** [E1112](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/modify-reg.md)
 * **Modify Trusted Execution Environment** [T1399](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/mod-trust-exe-environ.md)
 * **New Service** [T1050](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/new-service.md)
 * **Office Application Startup** [T1137](https://github.com/MBCProject/mbc-markdown/blob/master/persistence/office-app-startup.md)