mbc behavior related techniques

anti-behavioral-analysis/detect-sandbox.md

@@ -9,8 +9,8 @@ Sandbox Detection
 =================
 Detects whether the malware instance is being executed inside an instrumented sandbox environment (e.g., Cuckoo Sandbox). If so, conditional execution selects a benign execution path.
 
-The Sandbox Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** techniques and their sub-techniques.
-
+The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior.
+ 
 Methods
 -------
 |Name|ID|Description|

anti-behavioral-analysis/detect-vm.md

@@ -9,7 +9,7 @@ Virtual Machine Detection
 =========================
 Detects whether the malware instance is being executed in a virtual machine (VM), such as VMWare. If so, conditional execution selects a benign execution path. [[1]](#1)
 
-The Virtual Machine Detection behavior relates to anti-analysis, whereas a related ATT&CK technique relates to [Defense Evasion](../defense-evasion): for details, see the ATT&CK **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))** techniques and their sub-techniques.
+The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior.
 
 Methods
 -------

anti-behavioral-analysis/evade-debugger.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**B0002**|
 |**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis)|
-|**Related ATT&CK Technique**|[Debugger Evasion](https://attack.mitre.org/techniques/T1622/)|
+|**Related ATT&CK Technique**|[Debugger Evasion (T1622)](https://attack.mitre.org/techniques/T1622/)|
 
 
 Debugger Evasion
@@ -11,7 +11,7 @@ Behaviors that make debugging difficult.
 
 A thorough reference for anti-debugging, both detection and evasion, is given in [[1]](#1).
 
-The subsequently defined ATT&CK technique [Debugger Evasion](https://attack.mitre.org/techniques/T1622/) is related to this MBC behavior.
+The related [Debugger Evasion (T1622)](https://attack.mitre.org/techniques/T1622/) ATT&CK technique was defined subsequent to this MBC behavior.
 
 Methods
 -------

anti-behavioral-analysis/evade-dynamic-analysis.md

@@ -9,9 +9,9 @@ Dynamic Analysis Evasion
 ========================
 Malware may obstruct dynamic analysis in a sandbox, emulator, or virtual machine. 
 
-See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Execution Guardrails](../anti-behavioral-analysis/execution-guardrails.md) for a behavior that constrains dynamic execution based on environmental conditions. 
+See [Emulator Evasion](../anti-behavioral-analysis/evade-emulator.md) for an  emulator-specific evasion behavior, and see [Conditional Execution](../anti-behavioral-analysis/conditional-execute.md) for a behavior that constrains dynamic execution based on environmental conditions. 
 
-See ATT&CK: **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/))**.
+The related Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/techniques/T1497/), [T1633](https://attack.mitre.org/techniques/T1633/)) ATT&CK technique was defined subsequent to this MBC behavior.
 
 Methods
 -------

command-and-control/domain-name-generate.md

@@ -9,7 +9,7 @@ Domain Name Generation
 ======================
 Malware generates the domain name of the controller to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced implants; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
 
-The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.
+The related [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/) ATT&CK sub-technique (oriented toward an adversary perspective with examples that include malware) was defined subsequent to this MBC behavior.
 
 Malware Examples
 ----------------

execution/conditional-execute.md

@@ -2,7 +2,7 @@
 |---|---|
 |**ID**|**B0025**|
 |**Objective(s)**|[Execution](../execution), [Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
+|**Related ATT&CK Technique**|[Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480)|
 
 
 Conditional Execution
@@ -11,14 +11,14 @@ Malware checks system environment conditions or characteristics to determine exe
 
 This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
 
-Conditional execution may also be referred to as "execution guardrails." **See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
+Some aspects of conditional execution are related to the ATT&CK [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480) technique; however the ATT&CK technique is not focused on anti-behavioral analysis behaviors.
 
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
 |**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
-|**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
+|**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method. The subsequently defined ATT&CK sub-technique [Execution Guardrails: Environmental Keying (T1480.001)](https://attack.mitre.org/techniques/T1480/001/) is related to this MBC method. |
 |**GetVolumeInformation**|B0025.003|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
 |**Host Fingerprint Check**|B0025.004|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
 |**Runs as Service**|B0025.007|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[2]](#2)|

execution/send-email.md

@@ -9,7 +9,7 @@ Send Email
 ==========
 Sends an email message from the system on which the malware is executing to one or more recipients, mostly commonly for the purpose of spamming or for distributing a malicious attachment or URL (malspamming).
 
-**See related ATT&CK Techniques:** [**Phishing**](https://attack.mitre.org/techniques/T1566/). This technique is defined in PRE-ATT&CK, which being related to initial access, is not included in MBC.
+This behavior is related to the [Phishing (T1566)](https://attack.mitre.org/techniques/T1566/) ATT&CK technique, defined under ATT&CK's Initial Access tactic.
 
 Malware Examples
 ----------------

impact/compromise-data.md

@@ -9,4 +9,4 @@ Compromise Data Integrity
 =========================
 Data stored on the file system of a compromised system is manipulated to compromise its integrity.
 
-The subsequently defined ATT&CK sub-technique [Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/) is related to this MBC behavior.
+The related [Data Manipulation: Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001/) ATT&CK sub-technique was defined subsequent to this MBC behavior.

impact/denial-of-service.md

@@ -11,7 +11,7 @@ Malware may make a network unavailable, for example, by launching a network-base
 
 Endpoint denial of service behaviors are captured by the [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499/) technique.
 
-The subsequently defined ATT&CK technique [Network Denial of Service](https://attack.mitre.org/techniques/T1498/) is related to this MBC behavior.
+The related [Network Denial of Service](https://attack.mitre.org/techniques/T1498/) ATT&CK technique was defined subsequent to this MBC behavior.
 
 Malware Examples
 ----------------

impact/hijack-sys-resources.md

@@ -9,7 +9,7 @@ Resource Hijacking
 ==================
 Uses system resources for other purposes; as a result, the system may not be available for intended uses.
 
-The subsequently defined ATT&CK technique [Resource Hijacking](https://attack.mitre.org/techniques/T1496/) is related to this MBC behavior.
+The related [Resource Hijacking](https://attack.mitre.org/techniques/T1496/) ATT&CK technique was defined subsequent to this MBC behavior.
 
 Methods
 -------

impact/manipulate-network-traffic.md

@@ -9,7 +9,7 @@ Manipulate Network Traffic
 ==========================
 Malware intercepts and manipulates network traffic, typically accessing or modifying data, going to or originating from the system on which the malware instance is executing. Also known as a Man-in-the-Middle attack.
 
-The subsequently defined ATT&CK sub-technique [Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/) is related to this MBC behavior.
+The related [Data Manipulation: Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002/) ATT&CK sub-technique was defined subsequent to this MBC behavior.
 
 Malware Examples
 ----------------