From f3fbf1f51bfe1ab647287cce0a5640ca8530639d Mon Sep 17 00:00:00 2001
From: brightmt <50853930+brightmt@users.noreply.github.com>
Date: Fri, 27 Sep 2024 11:58:19 -0400
Subject: [PATCH] Update decrypt-data.md

Added class to CAPE mapping
---
 micro-behaviors/cryptography/decrypt-data.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/micro-behaviors/cryptography/decrypt-data.md b/micro-behaviors/cryptography/decrypt-data.md
index 43a4998..3e6b812 100644
--- a/micro-behaviors/cryptography/decrypt-data.md
+++ b/micro-behaviors/cryptography/decrypt-data.md
@@ -63,9 +63,9 @@ Malware may decrypt data.
 |[encrypt or decrypt via WinCrypt](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/encrypt-or-decrypt-via-wincrypt.yml)|Decrypt Data (C0031)|CryptEncrypt, CryptDecrypt, CryptAcquireContext, CryptGenKey, CryptImportKey|
 |[decrypt data using AES via x86 extensions](https://github.com/mandiant/capa-rules/blob/master/data-manipulation/encryption/aes/decrypt-data-using-aes-via-x86-extensions.yml)|Decrypt Data::AES (C0031.001)|--|
 
-|Tool: CAPE|Mapping|APIs|
-|---|---|---|
-|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|Decrypt Data (C0031)|CryptDecrypt|
+|Tool: CAPE|Class|Mapping|APIs|
+|---|--|---|---|
+|[decryption](https://github.com/kevoreilly/CAPEv2/blob/master/modules/signatures/CAPE.py)|CAPE_Decryption|Decrypt Data (C0031)|CryptDecrypt|
 
 ## Code Snippets