update SVGs for MBC v2.1

mbc 2.1 updates p5

README.md

@@ -1,9 +1,15 @@
-# <a name="mbc"></a>Malware Behavior Catalog v2.0 #
+# <a name="mbc"></a>Malware Behavior Catalog v2.1 #
 The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions.
 
-Check out the [MBC presentation](https://www.youtube.com/watch?v=KY8Ty-0sdVU) given at BSides DC (October 2019).
+Check out the MBC presentations:
 
-The presentation, "[Standardized reporting with the Malware Behavior Catalog](https://vblocalhost.com/presentations/standardized-reporting-with-the-malware-behavior-catalog/)," will be available on demand during the 2020 Virus Bulletin Conference, which will be free and online! Visit [VB2020 localhost](https://vblocalhost.com/) for details.
+* [Standardized Reporting with the Malware Behavior Catalog](https://youtu.be/qZef-SoREdY), VB2020 localhost (October 2020)
+* [Malware Behavior Catalog](https://youtu.be/KY8Ty-0sdVU), BSides DC (October 2019)
+
+We've also mapped MBC (and ATT&CK) to two open-source malware analysis tools:
+
+* [Cuckoo community signatures](https://github.com/MBCProject/community)
+* [capa rules](https://github.com/fireeye/capa-rules)
 
 To join the **MBC mailing list**, please send a request to mbc@mitre.org.
 
@@ -55,7 +61,9 @@ The MBC also contains a collection of [example malware](./xample-malware/README.
 [Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.
 
 ## Malware Objective Descriptions ##
-Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors.
+Malware objectives are defined in the table below. Follow the links to view associated behaviors. A visual representation of the MBC Matrix is also available (opens in a new window). There is another version under [FAQ](./yfaq/) with behavior ids.
+
+<img src="https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_without_ids.svg" alt="mbc matrix without ids">
 
 |**Objective**|**Description**|
 |---|---|

anti-behavioral-analysis/README.md

@@ -24,6 +24,6 @@ Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [
 
 References
 ----------
-<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project
+<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map
 
 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking

anti-behavioral-analysis/detect-emulator.md

@@ -20,4 +20,4 @@ Methods
 
 References
 ----------
-<a name="1">[1]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion
+<a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/

anti-behavioral-analysis/detect-sandbox.md

@@ -34,6 +34,38 @@ Malware Examples
 |[**Terminator**](../xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|
 
+Code Snippets
+-------------
+**Sandbox Detection::Product Key/ID Testing** (B0007.005) - the value 55274-640-2673064-23950 corresponds to Joe Sandbox.
+```
+push    ebx
+add     esp, 0FFFFFEF4h
+xor     ebx, ebx
+push    esp             ; phkResult
+push    1               ; samDesired
+push    0               ; ulOptions
+push    offset SubKey   ; "Software\Microsoft\Windows\CurrentVersi"...
+push    80000002h       ; hKey
+call    RegOpenKeyExA
+test    eax, eax
+jnz     short loc_405387
+mov     [esp+110h+cbData], 101h
+lea     eax, [esp+110h+cbData]
+push    eax             ; lpcbData
+lea     eax, [esp+114h+Data]
+push    eax             ; lpData
+push    0               ; lpType 
+push    0               ; lpReserved
+push    offset ValueName ; "ProductId"
+mov     eax, [esp+124h+hKey]
+push    eax             ; hKey
+call    RegQueryValueExA
+lea     eax, [esp+110h+Data]
+cmp     eax, offset a55274640267306 ; "55274-640-2673064-23950"
+jnz     short loc_405387
+mov     bl, 1
+```
+
 References
 ----------
 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 

anti-behavioral-analysis/detect-vm.md

@@ -66,7 +66,7 @@ References
 ----------
 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
 
-<a name="2">[2]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion
+<a name="2">[2]</a> https://search.unprotect.it/map/sandbox-evasion/
 
 <a name="3">[3]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
 

anti-behavioral-analysis/evade-debugger.md

@@ -64,6 +64,6 @@ References
 
 <a name="4">[4]</a> http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/
 
-<a name="5">[5]</a> http://unprotect.tdgt.org/index.php/Unprotect_Project
+<a name="5">[5]</a> https://search.unprotect.it/map/
 
 <a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

anti-behavioral-analysis/execution-guardrails.md

@@ -19,5 +19,13 @@ Methods
 |**Environmental Keys**|E1480.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
 |**GetVolumeInformation**|E1480.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
 |**Host Fingerprint Check**|E1480.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
+|**Runs as Service**|E1480.m07|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[1]](#1)|
 |**Secure Triggers**|E1480.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
 |**Token Check**|E1480.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
+
+References
+----------
+<a name="1">[1]</a> 
+https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service
+
+

anti-static-analysis/README.md

@@ -18,6 +18,6 @@ Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]]
 
 References
 ----------
-<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project
+<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map/sandbox-evasion/
 
 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking

anti-static-analysis/software-packing.md

@@ -15,6 +15,7 @@ Methods
 |Name|ID|Description|
 |---|---|---|
 |**Armadillo**|F0001.012|Uses Armadillo.|
+|**ASPack**|F0001.013|Uses ASPack.|
 |**Confuser**|F0001.009|Uses Confuser packer.|
 |**Custom Compression**|F0001.005|Uses a custom algorithm to compress an executable file.|
 |**Custom Compression of Code**|F0001.006|Uses a custom algorithm to compress opcode mnemonics.|

command-and-control/command-control-comm.md

@@ -17,7 +17,7 @@ Methods
 |---|---|---|
 |**Check for Payload**|B0030.005|Check for payload.|
 |**Client to Server File Transfer**|B0030.004|File is transferred from client to server.|
-|**Receive Data**|B0030.002|Receive data from a C2 server.|
+|**Receive Data**|B0030.002|Receive data or command from a C2 server.|
 |**Request Command**|B0030.008|Client requests a command.|
 |**Request Email Address List**|B0030.010|Request email address list.|
 |**Request Email Template**|B0030.009|Request email template.|

defense-evasion/README.md

@@ -11,7 +11,7 @@ Behaviors that evade detection or avoid other defenses.
 * **Bypass DEP** [B0037](../defense-evasion/bypass-dep.md)
 * **Component Firmware** [F0009](../persistence/component-firmware.md)
 * **Covert Location** [B0040](../defense-evasion/covert-location.md)
-* **Disable Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
+* **Disable or Evade Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
 * **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
 * **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files.md)
 * **Hooking** [F0003](../credential-access/hooking.md)

defense-evasion/disable-security-tools.md

@@ -5,9 +5,9 @@
 |**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|
 
 
-Disable Security Tools
-========================
-Malware may disable security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities.
+Disable or Evade Security Tools
+===============================
+Malware may disable or evade security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities. 
 
 Malware-related methods extending ATT&CK's definition are below. 
 
@@ -20,8 +20,11 @@ Methods
 |**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).|
 |**Disable Kernel Patch Protection**|F0004.001|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
 |**Disable System File Overwrite Protection**|F0004.002|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
+|**Force Lazy Writing**|F0004.006|Some operating systems will sometimes use a form of "lazy writing" for disk I/O, which may obscure the true provenance of the write operation. This method occurs when code intentionally forces the operating system to perform a lazy writing operation. For example, in Windows, a file may be opened, memory mapped, and closed, but the memory map will still exist and can be written to, which will cause a lazy write that looks like it is coming from the System process. [[3]](#3)|
+|**Heavens Gate**|F0004.008|Malware evades endpoint security products by invoking 64-bit code in 32-bit processes, effectively bypassing user-mode hooks. [[4]](#4)|
 |**Modify Policy**|F0004.005|Malware may modify policies to make software less effective.|
 |**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
+|**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.|
 
 Malware Examples
 ----------------
@@ -36,3 +39,7 @@ References
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
 
 <a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
+
+<a name="3">[3]</a> Alexander Adamov, Stealthy WastedLocker: eluding behavior blockers, but not only. Online:   https://vblocalhost.com/conference/presentations/stealthy-wastedlocker-eluding-behaviour-blockers-but-not-only/
+
+<a name="4">[4]</a> Carl Petty, Red Canary, 3/3/2020. Online: https://redcanary.com/blog/heavens-gate-technique-on-linux/

defense-evasion/hidden-files.md

@@ -15,5 +15,8 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Change File Location**|F0005.002|Malware may change the location of itself or another file to prevent detection.|
-|**File Extension Change**|F0005.001|Malware may change the file extension of a file.|
+|**Attribute**|F0005.003|Malware may change or choose an attribute to hide a file or directory.|
+|**Extension**|F0005.001|Malware may change or use a particular file extension to hide a file.|
+|**Location**|F0005.002|Malware may change or choose the location of itself, another file, or a directory to prevent detection.|
+|**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.|
+

defense-evasion/obfuscate-files.md

@@ -9,24 +9,27 @@ Obfuscated Files or Information
 ===============================
 Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself can be encoded or encrypted (i.e., encoding/encryption is a code characteristic).
 
-A related MBC behavior, associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](../anti-static-analysis/exe-code-obfuscate.md).
+A related MBC behavior (code characteristic), associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](../anti-static-analysis/exe-code-obfuscate.md).
+
+Another related MBC behavior (code characteristic), is [Software Packing](../anti-static-analysis/software-packing.md) which has methods capturing specific packers and types of compression.
 
 See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
 
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Encoding**|E1027.m01|The malware sample, file, or other information is encoded.|
-|**Encoding - Custom Encoding**|E1027.m03|The malware sample, file, or other information is encoded. A custom algorithm is used to encode the malware sample, a file, or other information.|
-|**Encoding - Standard Encoding**|E1027.m02|The malware sample, file, or other information is encoded. A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
-|**Encryption**|E1027.m04|The malware sample, file, or other information is encrypted.|
-|**Encryption - Custom Encryption**|E1027.m08|The malware sample, file, or other information is encrypted. A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
-|**Encryption - Custom Encryption of Code**|E1027.m09|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-|**Encryption - Custom Encryption of Data**|E1027.m10|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
-|**Encryption - Standard Encryption**|E1027.m05|The malware sample, file, or other information is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
-|**Encryption - Standard Encryption of Code**|E1027.m06|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-|**Encryption - Standard Encryption of Data**|E1027.m07|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
+|**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
+|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
+|**Encoding-Standard Algorithm**|E1027.m02|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
+|**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted.|
+|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
+|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information.|
+|**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
+|**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
+
 
 Malware Examples
 ----------------

discovery/README.md

@@ -7,6 +7,9 @@
 Behaviors that aim to gain knowledge about the system and internal network.
 
 * **Analysis Tool Discovery** [B0013](../discovery/analysis-tool-discover.md)
+* **Application Window Discovery** [E1010](../discovery/app-window-discover.md)
+* **File and Directory Discovery** [E1083](../discovery/file-discover.md)
 * **Self Discovery** [B0038](../discovery/self-discover.md)
 * **SMTP Connection Discovery** [B0014](../discovery/smtp-connect-discover.md)
 * **System Information Discovery** [E1082](../discovery/system-info-discover.md)
+* **Taskbar Discovery** [B0043](../discovery/taskbar-discover.md)

discovery/app-window-discover.md

@@ -0,0 +1,16 @@
+|||
+|---|---|
+|**ID**|**E1010**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|[Application Window Discovery](https://attack.mitre.org/techniques/T1010/) |
+
+
+Application Window Discovery
+============================
+Malware may attempt to get a listing of open application windows.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.|

discovery/file-discover.md

@@ -0,0 +1,16 @@
+|||
+|---|---|
+|**ID**|**E1083**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/) |
+
+
+File and Directory Discovery
+============================
+Malware may enumerate files and directories or may search for specific files or in specific locations.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Log File**|E1083.m01|Malware may look for system log files.|

discovery/taskbar-discover.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**B0043**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|None|
+
+
+Taskbar Discovery
+=================
+Malware may find the taskbar.

impact/README.md

@@ -6,16 +6,19 @@
 # Impact #
 Behaviors that enable malware to achieve its mission of manipulating, interrupting, or destroying systems and/or data.
 
+* **Clipboard Modification** [E1510](../impact/clipboard-mod.md)
 * **Component Firmware** [F0009](../persistence/component-firmware.md)
 * **Compromise Data Integrity** [B0016](../impact/compromise-data.md)
 * **Data Destruction** [E1485](../impact/data-destruction.md)
 * **Data Encrypted for Impact** [E1486](../impact/encrypt-impact.md)
 * **Denial of Service** [B0033](../impact/denial-of-service.md)
 * **Destroy Hardware** [B0017](../impact/destroy-hardware.md)
+* **Disk Content Wipe** [F0014](../impact/disk-content-wipe.md)
 * **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
 * **Generate Fraudulent Advertising Revenue** [E1472](../impact/generate-fraud-rev.md)
 * **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md)
+* **Modify Hardware** [B0042](../impact/modify-hardware.md)	
 * **Remote Access** [B0022](../impact/remote-access.md)
 * **Resource Hijacking** [B0018](../impact/hijack-sys-resources.md)
 * **Spamming** [B0039](../impact/spamming.md)

impact/clipboard-mod.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**E1510**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Technique**|[Clipboard Modification](https://attack.mitre.org/techniques/T1510/)|
+
+
+Clipboard Modification
+======================
+ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform. 

impact/data-destruction.md

@@ -16,7 +16,6 @@ Methods
 |Name|ID|Description|
 |---|---|---|
 |**Delete Application/Software**|E1485.m03|An application or software is deleted.|
-|**Delete Shadow Drive**|E1485.m01|Deletes shadow drive data, which is related to ransomware.|
 |**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.|
 
 Malware Examples

impact/disk-content-wipe.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**F0014**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Sub-Technique**|[Disk Wipe::Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001/)|
+
+Disk Content Wipe
+=================
+Malware may erase the content of storage devices.
+
+This description refines the ATT&CK [**Disk Wipe::Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001/) sub-technique.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Delete Shadow Drive**|F0014.001|Deletes shadow drive data, which is related to ransomware.|

impact/modify-hardware.md

@@ -0,0 +1,18 @@
+|||
+|---|---|
+|**ID**|**B0042**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Technique**|None|
+
+
+Modify Hardware
+===============
+Malware modifies hardware.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**CDROM**|B0042.001|The CD-ROM is modified.|
+|**Mouse**|B0042.002|The mouse is modified.|
+|**Printer**|B0042.003|The printer is modified.|

micro-behaviors/README.md

@@ -1,13 +1,15 @@
 # Micro-behaviors #
 Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created or a string may be checked for some condition. Because such things are often noted in malware analysis, they are captured in MBC. They are called "micro-behaviors."
 
-Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-behavior objectives are shown below.
+Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-objectives are shown below.
 
-|**Objective**|**Description**|
+|**Micro-objective**|**Description**|
 |---|---|
 |[**Communication**](./communication)|Malware uses various protocols and components to communication.|
 |[**Cryptography**](./cryptography)|Malware uses elements of cryptography.|
-|[**Data Manipulation**](./data-manipulation)|Malware manipulates data.|
-|[**File Manipulation**](./file-manipulation)|Malware manipulates files.|
-|[**Memory Manipulation**](./memory-manipulation)|Malware manipulates memory.|
-|[**Processes**](./processes)|Malware uses processes.|
+|[**Data**](./data)|Malware manipulates data.|
+|[**File System**](./file-system)|Malware manipulates files or directories.|
+|[**Hardware**](./hardware)|Malware has hardware-related behaviors.|
+|[**Memory**](./memory)|Malware manipulates memory.|
+|[**Process**](./process)|Malware uses processes.|
+|[**Operating System**](./operating-system)|Malware makes changes to the operating system.|

micro-behaviors/communication/README.md

@@ -3,17 +3,14 @@
 |**ID**|**OC0006**|
 
 
-# Communication Micro-objectives #
+# Communication Micro-objective #
 Micro-behaviors that enable malware to communicate.
 
-|Name|ID|Description|
-|---|---|---|
-|[**DNS Communication**](../communication/dns-comm.md)|C0011||
-|[**FTP Communication**](../communication/ftp-comm.md)|C0004||
-|[**HTTP Communication**](../communication/http-comm.md)|C0002||
-|[**ICMP Communication**](../communication/icmp-comm.md)|C0014||
-|[**Inter-process Communication**](../communication/inter-process.md)|C0003||
-|[**SMTP Communication**](../communication/smtp-comm.md)|C0012||
-|[**TCP Communication**](../communication/tcp-comm.md)|C0001||
-|[**UDP Communication**](../communication/udp-comm.md)|C0013||
-|[**WinINet Communication**](../communication/wininet.md)|C0005||
+* **DNS Communication** [C0011](../communication/dns-comm.md)
+* **FTP Communication** [C0004](../communication/ftp-comm.md)
+* **HTTP Communication** [C0002](../communication/http-comm.md)
+* **ICMP Communication** [C0014](../communication/icmp-comm.md)
+* **Interprocess Communication** [C0003](../communication/inter-process.md)
+* **SMTP Communication** [C0012](../communication/smtp-comm.md)
+* **Socket Communication** [C0001](../communication/socket-comm.md)
+* **WinINet Communication** [C0005](../communication/wininet.md)

micro-behaviors/communication/ftp-comm.md

@@ -13,5 +13,5 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Put**|C0004.001|FTP Put|
-|**WinINet API**|C0004.002|Send FTP command via WinINet.|
+|**Send File**|C0004.001|Send FTP file.|
+|**WinINet**|C0004.002|Send FTP command via WinINet.|

micro-behaviors/communication/http-comm.md

@@ -9,19 +9,27 @@ HTTP Communication
 ==================
 This micro-behavior is related to HTTP communication. 
 
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Client**|C0002.002|General HTTP client behavior.|
-|**GET Request**|C0002.004|HTTP Get request.|
-|**IHTMLDocument**|C0002.011|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.|
-|**IHTMLElement**|C0002.012|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.|
-|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
-|**POST Request**|C0002.005|HTTP Post request.|
-|**PUT Request**|C0002.006|HTTP Put request.|
-|**Request**|C0002.003|Non-specific HTTP request.|
 |**Server**|C0002.001|General HTTP server behavior.|
-|**URLMON Function**|C0002.009|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.|
-|**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
-|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
+|**Client**|C0002.002|General HTTP client behavior.|
+|**Connect to Server**|C0002.009|HTTP client connects to HTTP server.|
+|**Open URL**|C0002.004|HTTP client connects to a URL.|
+|**Download URL**|C0002.006|HTTP client downloads URL to file.|
+|**Extract Body**|C0002.011|HTTP client extracts HTTP body.|
+|**Create Request**|C0002.012|HTTP client creates request.|
+|**Send Request**|C0002.003|HTTP client sends request (GET).|
+|**Send Data**|C0002.005|HTTP clients sends data to a server (POST/PUT).|
+|**Receive Request**|C0002.015|HTTP server receives request.|
+|**Send Response**|C0002.016|HTTP server sends response.|
+|**Get Response**|C0002.017|HTTP client receives response.|
+|**Start Server**|C0002.018|HTTP server is started.|
+|**Set Header**|C0002.013|HTTP header is set.|
+|**Read Header**|C0002.014|HTTP read header.|
+|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
+|**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
+|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|

micro-behaviors/communication/icmp-comm.md

@@ -13,4 +13,5 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
+|**Echo Request**|C0014.002|Send ICMP echo request.|
 |**Generate Traffic**|C0014.001|Generate ICMP traffic.|

micro-behaviors/communication/socket-comm.md

@@ -0,0 +1,34 @@
+|||
+|---|---|
+|**ID**|**C0001**|
+|**Objective(s)**|[Communication](../communication)|
+|**Related ATT&CK Technique**|None|
+
+
+Socket Communication
+====================
+This micro-behavior focuses on socket (TCP, UDP) communication. 
+
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Set Socket Config**|C0001.001|Configure socket.|
+|**Initialize Winsock Library**|C0001.009|Winsock is initialized for TCP communication.|
+|**Start TCP Server**|C0001.005|A TCP server listens for client requests.|
+|**Create Socket**|C0001.003|A server or client creates a UDP or TCP socket.|
+|**Create UDP Socket**|C0001.010|A UDP socket is created.|
+|**Create TCP Socket**|C0001.011|A TCP socket is created.|
+|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
+|**Get Socket Status**|C0001.012|Get socket status.|
+|**Send Data**|C0001.007|Send data on socket.|
+|**Send TCP Data**|C0001.014|Send TCP data.|
+|**Send UDP Data**|C0001.015|Send UDP data.|
+|**Receive Data**|C0001.006|Receive data on socket.|
+|**Receive TCP Data**|C0001.016|Receive TCP data.|
+|**Receive UDP Data**|C0001.017|Receive UDP data.|
+|**TCP Server**|C0001.002|TCP server behavior.|
+|**TCP Client**|C0001.008|TCP client behavior.|
+|**UDP Client**|C0001.013|UDP client behavior.|

micro-behaviors/communication/tcp-comm.md

@@ -1,22 +0,0 @@
-|||
-|---|---|
-|**ID**|**C0001**|
-|**Objective(s)**|[Communication](../communication)|
-|**Related ATT&CK Technique**|None|
-
-
-TCP Communication
-=================
-This micro-behavior focuses on TCP communication. 
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Client**|C0001.001|General TCP client behavior.|
-|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
-|**Create Socket**|C0001.003|A server or client creates a TCP socket.|
-|**Listen Socket**|C0001.005|A server listens for client requests.|
-|**Receive Data**|C0001.006|Receive data on socket.|
-|**Send Data**|C0001.007|Send data on socket.|
-|**Server**|C0001.002|General TCP server behavior.|

micro-behaviors/communication/udp-comm.md

@@ -1,16 +0,0 @@
-|||
-|---|---|
-|**ID**|**C0013**|
-|**Objective(s)**|[Communication](../communication)|
-|**Related ATT&CK Technique**|None|
-
-
-UDP Communication
-=================
-The micro-behavior is related to UDP communication. 
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**STUN Server**|C0013.001|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.|

micro-behaviors/cryptography/README.md

@@ -3,9 +3,12 @@
 |**ID**|**OC0005**|
 
 
-# Cryptography Micro-objectives #
+# Cryptography Micro-objective #
 Micro-behaviors that enable malware to use crypto.
 
-|Name|ID|Description|
-|---|---|---|
-|[**Generate Pseudo-random Sequence**](../cryptography/gen-random.md)|C0021||
+* **Crypto Library** [C0059](../cryptography/crypto-lib.md)
+* **Encrypt Data** [C0027](../cryptography/encrypt.md)
+* **Decrypt Data** [C0031](../cryptography/decrypt.md)
+* **Generate Pseudo-random Sequence** [C0021](../cryptography/gen-random.md)
+* **Cryptography Hash** [C0029](../cryptography/crypto-hash.md)
+* **Encryption Key** [C0028](../cryptography/key.md)

micro-behaviors/cryptography/crypto-hash.md

@@ -0,0 +1,21 @@
+|||
+|---|---|
+|**ID**|**C0029**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Cryptographic Hash
+==================
+Malware may use a cryptographic hash. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**MD5**|C0029.001|Malware uses an MD5 hash.|
+|**SHA1**|C0029.002|Malware uses a SHA-1 hash.|
+|**SHA224**|C0029.004|Malware uses a SHA-224 hash.|
+|**SHA256**|C0029.003|Malware uses a SHA-256 hash.|
+|**Snefru**|C0029.006|Malware uses a Snefru hash.|
+|**Tiger**|C0029.005|Malware uses a Tiger hash.|

micro-behaviors/cryptography/crypto-lib.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0059**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Crypto Library
+==============
+Malware uses a crypto library.

micro-behaviors/cryptography/decrypt.md

@@ -0,0 +1,85 @@
+|||
+|---|---|
+|**ID**|**C0031**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Decrypt Data
+============
+Malware may decrypt data. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**AES**|C0031.001|Malware decrypts data encrypted with the AES algorithm.|
+|**Block Cipher**|C0031.002|Malware decrypts data encrypted with a block cipher.|
+|**Blowfish**|C0031.003|Malware decrypts data encrypted with the Blowfish algorithm.|
+|**Camellia**|C0031.004|Malware decrypts data encrypted with the Camellia algorithm.|
+|**3DES**|C0031.005|Malware decrypts data encrypted with the 3DES algorithm.|
+|**HC-128**|C0031.006|Malware decrypts data encrypted with the HC-128 algorithm.|
+|**HC-256**|C0031.007|Malware decrypts data encrypted with the HC-256 algorithm.|
+|**RC4**|C0031.008|Malware decrypts data encrypted with the RC4 algorithm.|
+|**RC6**|C0031.009|Malware decrypts data encrypted with the RC6 algorithm.|
+|**RSA**|C0031.010|Malware decrypts data encrypted with the RSA algorithm.|
+|**Skipjack**|C0031.011|Malware decrypts data encrypted with the Skipjack block cipher algorithm.|
+|**Sosemanuk**|C0031.012|Malware decrypts data encrypted with the Sosemanuk stream cipher.|
+|**Stream Cipher**|C0031.013|Malware decrypts data encrypted with a stream cipher.|
+|**Twofish**|C0031.014|Malware decrypts data encrypted with the Twofish algorithm.|
+
+Code Snippets
+-------------
+**Decrypt Data** (C0031) - the snippet encrypts and decrypts data.
+
+Sample (SHA256): c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
+
+```asm
+push    ebx
+mov     ebx, [esp+4+arg_4]
+push    esi
+lea     eax, [ebx+20h]
+push    eax             ; unsigned int
+call    ??2@YAPAXI@Z    ; operator new(uint)
+mov     ecx, [esp+0Ch+arg_C]
+mov     edx, eax
+add     esp, 4
+mov     esi, [ecx]
+mov     [edx], esi
+mov     esi, [ecx+4]
+mov     [edx+4], esi
+mov     ecx, [ecx+8]
+mov     [edx+8], ecx
+mov     edx, [esp+8+arg_8]
+test    ebx, ebx
+mov     [eax+0Ch], edx
+jle     short loc_B
+mov     esi, [esp+8+arg_0]
+push    edi
+mov     edi, 0FFFFFFFDh
+lea     edx, [eax+3]
+sub     edi, eax
+
+loc_A:
+mov     cl, [edx-3]
+xor     cl, [edx+2]
+xor     cl, [edx-1]
+xor     cl, [edx]
+mov     [edx+0Dh], cl
+xor     [esi], cl
+inc     edx
+inc     esi
+lea     ecx, [edi+edx]
+cmp     ecx, ebx
+jl      short loc_A
+pop     edi
+
+loc_B:
+push    eax             ; void *
+call    ??3@YAXPAX@Z    ; operator delete(void *)
+add     esp, 4
+mov     eax, 1
+pop     esi
+pop     ebx
+retn
+```

micro-behaviors/cryptography/encrypt.md

@@ -0,0 +1,85 @@
+|||
+|---|---|
+|**ID**|**C0027**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Encrypt Data
+============
+Malware may encrypt data. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**AES**|C0027.001|Malware encrypts with the AES algorithm.|
+|**Block Cipher**|C0027.014|Malware encrypts with a block cipher.|
+|**Blowfish**|C0027.002|Malware encrypts with the Blowfish algorithm.|
+|**Camellia**|C0027.003|Malware encrypts with the Camellia algorithm.|
+|**3DES**|C0027.004|Malware encrypts with the 3DES algorithm.|
+|**HC-128**|C0027.006|Malware encrypts with the HC-128 algorithm.|
+|**HC-256**|C0027.007|Malware encrypts with the HC-256 algorithm.|
+|**RC4**|C0027.009|Malware encrypts with the RC4 algorithm.|
+|**RC6**|C0027.010|Malware encrypts with the RC6 algorithm.|
+|**RSA**|C0027.011|Malware encrypts with the RSA algorithm.|
+|**Skipjack**|C0027.013|Malware encrypts with the Skipjack block cipher algorithm.|
+|**Sosemanuk**|C0027.008|Malware encrypts with the Sosemanuk stream cipher.|
+|**Stream Cipher**|C0027.012|Malware encrypts with a stream cipher.|
+|**Twofish**|C0027.005|Malware encrypts with the Twofish algorithm.|
+
+Code Snippets
+-------------
+**Encrypt Data** (C0031) - the snippet encrypts and decrypts data.
+
+Sample (SHA256): c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
+
+```asm
+push    ebx
+mov     ebx, [esp+4+arg_4]
+push    esi
+lea     eax, [ebx+20h]
+push    eax             ; unsigned int
+call    ??2@YAPAXI@Z    ; operator new(uint)
+mov     ecx, [esp+0Ch+arg_C]
+mov     edx, eax
+add     esp, 4
+mov     esi, [ecx]
+mov     [edx], esi
+mov     esi, [ecx+4]
+mov     [edx+4], esi
+mov     ecx, [ecx+8]
+mov     [edx+8], ecx
+mov     edx, [esp+8+arg_8]
+test    ebx, ebx
+mov     [eax+0Ch], edx
+jle     short loc_B
+mov     esi, [esp+8+arg_0]
+push    edi
+mov     edi, 0FFFFFFFDh
+lea     edx, [eax+3]
+sub     edi, eax
+
+loc_A:
+mov     cl, [edx-3]
+xor     cl, [edx+2]
+xor     cl, [edx-1]
+xor     cl, [edx]
+mov     [edx+0Dh], cl
+xor     [esi], cl
+inc     edx
+inc     esi
+lea     ecx, [edi+edx]
+cmp     ecx, ebx
+jl      short loc_A
+pop     edi
+
+loc_B:
+push    eax             ; void *
+call    ??3@YAXPAX@Z    ; operator delete(void *)
+add     esp, 4
+mov     eax, 1
+pop     esi
+pop     ebx
+retn
+```

micro-behaviors/cryptography/gen-random.md

@@ -7,12 +7,14 @@
 
 Generate Pseudo-random Sequence
 ===============================
-The Generate Pseudo-random Sequence microbehavior can be used for a number of purposes. 
+The Generate Pseudo-random Sequence microbehavior can be used for a number of purposes. The methods below include specific functions, as well as pseudorandom number generators (PRNG).
 
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**GetTickCount**|C0021.001|Generate random using GetTickCount.|
-|**Use API**|C0021.003|Generate random using a Windows API.|
-|**rand**|C0021.002|Generate random using rand.|
+|**GetTickCount**|C0021.001|Malware generates a pseudo-random sequence using GetTickCount.|
+|**Use API**|C0021.003|Malware generates a pseudo-random sequence using a Windows API.|
+|**rand**|C0021.002|Malware generates a pseudo-random sequence using rand.|
+|**RC4 PRGA**|C0021.004|Malware generates a pseudo-random sequence using the RC4 Pseudo Random (Byte) Generation Algorithm (PRGA).|
+|**Mersenne Twister**|C0021.005|Malware generates a pseudo-random sequence using the Mersenne Twister PRNG.|

micro-behaviors/cryptography/key.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0028**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Encryption Key
+==============
+Malware may import, generate, or otherwise use an encryption key. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Import Public Key**|C0028.001|Malware imports a public key.|
+|**RC4 KSA**|C0028.002|Malware uses the RC4 Key Scheduling Algorithm (KSA).|

micro-behaviors/data-manipulation/README.md

@@ -1,12 +0,0 @@
-|||
-|---|---|
-|**ID**|**OC0004**|
-
-
-# Data Manipulation Micro-objectives #
-Micro-behaviors related to malware manipulating data.
-
-|Name|ID|Description|
-|---|---|---|
-|[**Check String**](../data-manipulation/check-string.md)|C0019||
-|[**Use Constant**](../data-manipulation/use-constant.md)|C0020||

micro-behaviors/data/README.md

@@ -0,0 +1,18 @@
+|||
+|---|---|
+|**ID**|**OC0004**|
+
+
+# Data Micro-objective #
+Micro-behaviors related to malware manipulating data.
+
+* **Check String** [C0019](../data/check-string.md)
+* **Checksum** [C0032](../data/checksum.md)
+* **Compress Data** [C0024](../data/compress.md)
+* **Compression Library** [C0060](../data/compress-lib.md)
+* **Decompress Data** [C0025](../data/decompress.md)
+* **Encode Data** [C0026](../data/encode.md)
+* **Decode Data** [C0053](../data/decode.md)
+* **Modulo** [C0058](../data/modulo.md)
+* **Non-Cryptographic Hash** [C0030](../data/noncrypto-hash.md)
+* **Use Constant** [C0020](../data/use-constant.md)

micro-behaviors/data/check-string.md

@@ -1,10 +1,10 @@
 |||
 |---|---|
 |**ID**|**C0019**|
-|**Objective(s)**|[Data Manipulation](../data-manipulation)|
+|**Objective(s)**|[Data](../data)|
 |**Related ATT&CK Technique**|None|
 
 
 Check String
 ============
-Malware may check a string for some characteristics, such as being ascii content or length.
+Malware may check a string for some characteristics, such as being ascii content; credit card number; or length.

micro-behaviors/data/checksum.md

@@ -0,0 +1,20 @@
+|||
+|---|---|
+|**ID**|**C0032**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Checksum
+========
+Malware may derive a checksum from some block of data. The checksum is often used for data validation.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Adler**|C0032.005|Malware computes an Adler checksum.|
+|**BSD**|C0032.003|Malware computes a BSD checksum.|
+|**CRC32**|C0032.001|Malware computes a CRC32 checksum.|
+|**Luhn**|C0032.002|Malware uses Luhn algorithm, often to validate identification numbers (e.g, credit card number).| 
+|**Verhoeff**|C0032.004|Malware uses the Verhoeff algorithm, often for purposes of error detection.|

micro-behaviors/data/compress-lib.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0060**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Compression Library
+===================
+Malware uses a compression library.

micro-behaviors/data/compress.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0024**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Compress Data
+=============
+Malware may compress data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**IEncodingFilterFactory**|C0024.002|Malware compresses data using IEncodingFilterFactory.|
+|**QuickLZ**|C0024.001|Malware compresses data using QuickLZ.|

micro-behaviors/data/decode.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0053**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Decode Data
+===========
+Malware may decode data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Base64**|C0053.001|Malware may decode data using Base64.|
+|**XOR**|C0053.002|Malware may use xor to decode data.|

micro-behaviors/data/decompress.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0025**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Decompress Data
+===============
+Malware may decompress data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**IEncodingFilterFactory**|C0025.002|Malware decompresses data using IEncodingFilterFactory.|
+|**QuickLZ**|C0025.001|Malware decompresses data using QuickLZ.|

micro-behaviors/data/encode.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0026**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Encode Data
+===========
+Malware may encode data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Base64**|C0026.001|Malware may encode data using Base64.|
+|**XOR**|C0026.002|Malware may use xor to encode data.|

micro-behaviors/data/modulo.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0058**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Modulo
+======
+Malware calculates a modulo value.

micro-behaviors/data/noncrypto-hash.md

@@ -0,0 +1,20 @@
+|||
+|---|---|
+|**ID**|**C0030**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Non-Cryptographic Hash
+======================
+Malware may use a non-cryptographic hash. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**dhash**|C0030.004|Malware uses the dhash hash function.|
+|**Fast-Hash**|C0030.003|Malware uses the Fast-Hash hash function.|
+|**FNV**|C0030.005|Malware uses the FNV hash function.|
+|**MurmurHash**|C0030.001|Malware uses the MurmurHash hash function.|
+|**pHash**|C0030.002|Malware uses the pHash hash function.|

micro-behaviors/data/use-constant.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0020**|
-|**Objective(s)**|[Data Manipulation](../data-manipulation)|
+|**Objective(s)**|[Data](../data)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/file-manipulation/README.md

@@ -1,12 +0,0 @@
-|||
-|---|---|
-|**ID**|**OC0001**|
-
-
-# File Manipulation Micro-objectives #
-Micro-behaviors related to file manipulation.
-
-|Name|ID|Description|
-|---|---|---|
-|[**Alter File Extension**](../file-manipulation/alter-extend.md)|C0015||
-|[**Create File**](../file-manipulation/create-file.md)|C0016||

micro-behaviors/file-system/README.md

@@ -0,0 +1,19 @@
+|||
+|---|---|
+|**ID**|**OC0001**|
+
+
+# File System Micro-objective #
+Micro-behaviors related to file manipulation.
+
+* **Alter File Extension** [C0015](../file-system/alter-extend.md)
+* **Copy File** [C0045](../file-system/copy-file.md)
+* **Create Directory** [C0046](../file-system/create-dir.md)
+* **Create File** [C0016](../file-system/create-file.md)
+* **Delete Directory** [C0048](../file-system/delete-dir.md)
+* **Delete File** [C0047](../file-system/delete-file.md)
+* **Get File Attributes** [C0049](../file-system/get-file-attr.md)
+* **Read File** [C0051](../file-system/read-file.md)
+* **Read Virtual Disk** [C0056](../file-system/read-virtual-disk.md)
+* **Set File Attributes** [C0050](../file-system/set-file-attr.md)
+* **Write File** [C0052](../file-system/write-file.md)

micro-behaviors/file-system/alter-extend.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0015**|
-|**Objective(s)**|[File Manipulation](../file-manipulation)|
+|**Objective(s)**|[File System](../file-system)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/file-system/copy-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0045**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Copy File
+=========
+Malware copies a file. 

micro-behaviors/file-system/create-dir.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0046**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Create Directory
+================
+Malware creates a directory. 

micro-behaviors/file-system/create-file.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0016**|
-|**Objective(s)**|[File Manipulation](../file-manipulation)|
+|**Objective(s)**|[File System](../file-system)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/file-system/delete-dir.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0048**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Delete Directory
+================
+Malware deletes a directory. 

micro-behaviors/file-system/delete-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0047**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Delete File
+===========
+Malware deletes a file. 

micro-behaviors/file-system/get-file-attr.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0049**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Get File Attributes
+===================
+Malware gets the attributes of a file. 

micro-behaviors/file-system/read-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0051**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Read File
+=========
+Malware reads a file. 

micro-behaviors/file-system/read-virtual-disk.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0056**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Read Virtual Disk
+=================
+Malware reads a virtual disk. 

micro-behaviors/file-system/set-file-attr.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0050**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Set File Attributes
+===================
+Malware sets the attributes of a file.

micro-behaviors/file-system/write-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0052**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Writes File
+===========
+Malware writes to a file. 

micro-behaviors/hardware/README.md

@@ -3,9 +3,9 @@
 |**ID**|**OC0007**|
 
 
-# Hardware Micro-objectives #
+# Hardware Micro-objective #
 Micro-behaviors related to hardware.
 
-|Name|ID|Description|
-|---|---|---|
-|[**Load Driver**](../hardware/load-driver.md)|C0023||
+* **Install Driver** [C0037](../hardware/install-driver.md)
+* **Load Driver** [C0023](../hardware/load-driver.md)
+* **Simulate Hardware** [C0057](../hardware/simulate-hardware.md)

micro-behaviors/hardware/install-driver.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0037**|
+|**Objective(s)**|[Hardware](../hardware)|
+|**Related ATT&CK Technique**|None|
+
+
+Install Driver
+==============
+Malware installs a driver.

micro-behaviors/hardware/load-driver.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0023**|
-|**Objective(s)**|[Processes](../processes)|
+|**Objective(s)**|[Hardware](../hardware)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/hardware/simulate-hardware.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0057**|
+|**Objective(s)**|[Hardware](../hardware)|
+|**Related ATT&CK Technique**|None|
+
+
+Simulate Hardware
+=================
+Malware simulates hardware.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Ctrl-Alt-Del**|C0057.001|Malware simulates Ctrl-Alt-Del.|
+|**Mouse Click**|C0057.002|Malware simulates mouse click.|

micro-behaviors/memory-manipulation/README.md

@@ -1,15 +0,0 @@
-|||
-|---|---|
-|**ID**|**OC0002**|
-
-
-# Memory Manipulation Micro-objectives #
-Micro-behaviors related to malware manipulating machine memory.
-
-|Name|ID|Description|
-|---|---|---|
-|[**Allocate Memory**](../memory-manipulation/allocate-memory.md)|C0007||
-|[**Change Memory Protection**](../memory-manipulation/memory-protect.md)|C0008||
-|[**Heap Spray**](../memory-manipulation/heapspray.md)|C0006||
-|[**Overflow Buffer**](../memory-manipulation/overflow-buffer.md)|C0010||
-|[**Stack Pivot**](../stack-pivot.md)|C0009||

micro-behaviors/memory/README.md

@@ -0,0 +1,14 @@
+|||
+|---|---|
+|**ID**|**OC0002**|
+
+
+# Memory Micro-objective #
+Micro-behaviors related to malware manipulating machine memory.
+
+* **Allocate Memory** [C0007](../memory/allocate-memory.md)
+* **Change Memory Protection** [C0008](../memory/memory-protect.md)
+* **Free Memory** [C0044](../memory/free-memory.md)
+* **Heap Spray** [C0006](../memory/heapspray.md)
+* **Overflow Buffer** [C0010](../memory/overflow-buffer.md)
+* **Stack Pivot** [C0009](../memory/stack-pivot.md)

micro-behaviors/memory/allocate-memory.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0007**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/free-memory.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0044**|
+|**Objective(s)**|[Memory](../memory)|
+|**Related ATT&CK Technique**|None|
+
+
+Free Memory
+===========
+Malware may free memory.

micro-behaviors/memory/heapspray.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0006**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/memory-protect.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0008**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/overflow-buffer.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0010**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/stack-pivot.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0009**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/operating-system/README.md

@@ -0,0 +1,12 @@
+|||
+|---|---|
+|**ID**|**OC0008**|
+
+
+# Operating System Micro-objective #
+Micro-behaviors related to operating systems.
+
+* **Console** [C0033](../operating-system/console.md)
+* **Environment Variable** [C0034](../operating-system/enviro-var.md)
+* **Registry** [C0036](../operating-system/registry.md)
+* **Wallpaper** [C0035](../operating-system/wallpaper.md)

micro-behaviors/operating-system/console.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0033**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Console
+=======
+Malware modifies the console. 

micro-behaviors/operating-system/enviro-var.md

@@ -0,0 +1,16 @@
+|||
+|---|---|
+|**ID**|**C0034**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Environment Variable
+====================
+Malware modifies environment variables. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Set Variable**|C0034.001|Malware sets an environment variable.|

micro-behaviors/operating-system/registry.md

@@ -0,0 +1,22 @@
+|||
+|---|---|
+|**ID**|**C0036**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Registry
+========
+Malware modifies the registry. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Create Registry Key**|C0036.004|Malware creates a registry key.|
+|**Delete Registry Key**|C0036.002|Malware deletes a registry key.|
+|**Delete Registry Value**|C0036.007|Malware deletes a registry value.|
+|**Open Registry Key**|C0036.003|Malware opens a registry key.|
+|**Query Registry Key**|C0036.005|Malware queries a registry key.|
+|**Query Registry Value**|C0036.006|Malware queries a registry value.|
+|**Set Registry Key**|C0036.001|Malware sets a registry key.|

micro-behaviors/operating-system/wallpaper.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0035**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Wallpaper
+=========
+Malware modifies the wallpaper. 

micro-behaviors/process/README.md

@@ -0,0 +1,19 @@
+|||
+|---|---|
+|**ID**|**OC0003**|
+
+
+# Process Micro-objective #
+Micro-behaviors related to processes.
+
+* **Allocate Thread Local Storage** [C0040](../process/thread-storage-allocate.md)
+* **Create Mutex** [C0042](../process/create-mutex.md)
+* **Check Mutex** [C0043](../process/check-mutex.md)	
+* **Create Process** [C0017](../process/create-process.md)
+* **Create Thread** [C0038](../process/create-thread.md)
+* **Resume Thread** [C0054](../process/resume-thread.md)
+* **Set Thread Local Storage Value** [C0041](../process/thread-storage-set-value.md)
+* **Suspend Thread** [C0055](../process/suspend-thread.md)	
+* **Synchronization** [C0022](../process/synchronization.md)
+* **Terminate Process** [C0018](../process/terminate-process.md)
+* **Terminate Thread** [C0039](../process/terminate-thread.md)

micro-behaviors/process/check-mutex.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0043**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Check Mutex
+===========
+Malware checks a mutex. 

micro-behaviors/process/create-mutex.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0042**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Create Mutex
+============
+Malware creates a mutex. 

micro-behaviors/process/create-process.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0017**|
-|**Objective(s)**|[Processes](../processes)|
+|**Objective(s)**|[Process](../process)|
 |**Related ATT&CK Technique**|None|
 
 
@@ -15,3 +15,4 @@ Methods
 |---|---|---|
 |**Create Process via Shellcode**|C0017.001|Malware uses shellcode to create a process.|
 |**Create Process via WMI**|C0017.002|Malware uses WMI to create a process.|
+|**Create Suspended Process**|C0017.003|Malware created a suspended process.|

micro-behaviors/process/create-thread.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0038**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Create Thread
+=============
+Malware creates a thread. 

micro-behaviors/process/resume-thread.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0054**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Resume Thread
+=============
+Malware typically resumes a thread in order to execute previously injected code (e.g., in the course of the [Process Injection::Process Hollowing](../../defense-evasion/process-inject.md)).

micro-behaviors/process/suspend-thread.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0055**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Suspend Thread
+==============
+Malware may suspend a thread.

micro-behaviors/process/synchronization.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0022**|
-|**Objective(s)**|[Processes](../processes)|
+|**Objective(s)**|[Process](../process)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/process/terminate-process.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0018**|
-|**Objective(s)**|[Processes](../processes)|
+|**Objective(s)**|[Process](../process)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/process/terminate-thread.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0039**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Terminate Thread
+================
+Malware terminates a thread.

micro-behaviors/process/thread-storage-allocate.md

@@ -0,0 +1,12 @@
+|||
+|---|---|
+|**ID**|**C0040**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Allocate Thread Local Storage
+=============================
+Malware allocates thread local storage. 
+
+This micro behavior is a lower level counterpart to ATT&CK's [**Process Injection::Thread Local Storage**](https://attack.mitre.org/techniques/T1055/005) technique.

micro-behaviors/process/thread-storage-set-value.md

@@ -0,0 +1,12 @@
+|||
+|---|---|
+|**ID**|**C0041**|
+|**Objective(s)**|[Process](../process)|
+|**Related ATT&CK Technique**|None|
+
+
+Set Thread Local Storage Value
+==============================
+Malware allocates thread local storage. 
+
+This micro behavior is a lower level counterpart to ATT&CK's [**Process Injection::Thread Local Storage**](https://attack.mitre.org/techniques/T1055/005) technique.

micro-behaviors/processes/README.md

@@ -1,13 +0,0 @@
-|||
-|---|---|
-|**ID**|**OC0003**|
-
-
-# Process Micro-objectives #
-Micro-behaviors related to processes.
-
-|Name|ID|Description|
-|---|---|---|
-|[**Create Process**](../processes/create-process.md)|C0017||
-|[**Synchronization**](../processes/synchronization.md)|C0022||
-|[**Terminate Process**](../processes/terminate-process.md)|C0018||

persistence/modify-service.md

@@ -2,14 +2,14 @@
 |---|---|
 |**ID**|**F0011**|
 |**Objective(s)**|[Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
-|**Related ATT&CK Sub-Technique**|[Create or Modify System Process: Windows Service](https://attack.mitre.org/techniques/T1543/003/)|
+|**Related ATT&CK Sub-Technique**|[Create or Modify System Process::Windows Service](https://attack.mitre.org/techniques/T1543/003/)|
 
 
 Modify Existing Service
 =======================
 Malware may modify an existing service to gain persistence. Modification may include disabling a service.
 
-See ATT&CK: [**Create or Modify System Process: Windows Service**](https://attack.mitre.org/techniques/T1543/003/).
+See ATT&CK: [**Create or Modify System Process::Windows Service**](https://attack.mitre.org/techniques/T1543/003/).
 
 Malware Examples
 ----------------

xample-malware/dnschanger.md

@@ -16,7 +16,7 @@ Behaviors
 |Name|Use|
 |---|---|
 |[Generate Fraudulent Advertising Revenue](../impact/generate-fraud-rev.md)|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
-|[Disabling Security Tools](../defense-evasion/disable-security-tools.md)|Prevents the infected system from installing anti-virus software updates. [[1]](#1)|
+|[Disable or Evade Security Tools](../defense-evasion/disable-security-tools.md)|Prevents the infected system from installing anti-virus software updates. [[1]](#1)|
 
 References
 ----------

xample-malware/poison-ivy.md

@@ -23,14 +23,14 @@ Behaviors
 |[Input Capture](../collection/input-capture.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 |[Modify Existing Service](../persistence/modify-service.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 |[Modify Registry](../defense-evasion/modify-reg.md)|SSee ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
-|[Create or Modify System Process: Windows Service](https://attack.mitre.org/techniques/T1543/003/)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
+|[Create or Modify System Process::Windows Service](https://attack.mitre.org/techniques/T1543/003/)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 |[Obfuscated Files or Information](../defense-evasion/obfuscate-files.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 |[Process Injection](../defense-evasion/process-inject.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 |[Registry Run Keys / Startup Folder](../persistence/registry-run-startup.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 |[Remote File Copy](../command-and-control/remote-file-copy.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
-|[Rootkit Behavior](../defense-evasion/rootkit-behavior.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
+|[Rootkit](../defense-evasion/rootkit-behavior.md)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 |[Encrypted Channel](https://attack.mitre.org/techniques/T1573/)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
-|[Uncommonly Used Port](https://attack.mitre.org/techniques/T1571/)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
+|[Non-Standard Port](https://attack.mitre.org/techniques/T1571/)|See ATT&CK: [PoisonIvy - Techniques Used](https://attack.mitre.org/software/S0012/).|
 
 References
 ----------

xample-malware/trickbot.md

@@ -18,12 +18,12 @@ Behaviors
 |[Account Discovery](https://attack.mitre.org/techniques/T1087/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Non-Standard Port](https://attack.mitre.org/techniques/T1571/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Credentials from Password Stores::Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Unsecured Credentials::Credentials in Files](https://attack.mitre.org/techniques/T1552/001/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
+|[Unsecured Credentials::Credentials In Files](https://attack.mitre.org/techniques/T1552/001/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Unsecured Credentials::Credentials in Registry](https://attack.mitre.org/techniques/T1552/002/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Encrypted Channel](https://attack.mitre.org/techniques/T1573/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Data from Local System](https://attack.mitre.org/techniques/T1005/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
-|[Disabling Security Tools](../defense-evasion/disable-security-tools.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
+|[Disable or Evade Security Tools](../defense-evasion/disable-security-tools.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Domain Trust Discovery](https://attack.mitre.org/techniques/T1482/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Email Collection](https://attack.mitre.org/techniques/T1114/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
 |[Native API](https://attack.mitre.org/techniques/T1106/)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|

xample-malware/webcobra.md

@@ -32,7 +32,7 @@ Behaviors
 |[Obfuscated Files or Information](../defense-evasion/obfuscate-files.md)|[[1]](#1)|
 |[Indicator Removal on Host::File Deletion](https://attack.mitre.org/techniques/T1070/004/)|[[1]](#1)|
 |[Process Injection](../defense-evasion/process-inject.md)|Injects miner code into a running process.|
-|[Disabling Security Tools](../defense-evasion/disable-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs.  [[1]](#1)|
+|[Disable or Evade Security Tools](../defense-evasion/disable-security-tools.md)|Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs.  [[1]](#1)|
 
 References
 ----------

yfaq/README.md

@@ -1,4 +1,4 @@
-# <a name="faq"></a>Malware Behavior Catalog BETA Frequently Asked Questions # 
+# <a name="faq"></a>Malware Behavior Catalog Frequently Asked Questions # 
 
 * [What's New?](./#next)
 * [Using MBC](./#use)
@@ -9,17 +9,21 @@
 
 ## <a name="next"><a/>What's New? ##
 
-* **MBC Mailing List** - The MBC mailing list is now active. To join, please send a request to mbc@mitre.org.
+* **MBC Mailing List** - To join the MBC mailing list, please send a request to mbc@mitre.org.
+
+* **capa-MBC Mappings** - The MBC team has contributed to the ATT&CK and MBC mappings of [capa](https://github.com/fireeye/capa), the FLARE team's open-source static analysis tool. See [capa rules](https://github.com/fireeye/capa-rules).
 
 * **Cuckoo-MBC Mappings** - Cuckoo Sandbox 2.0.7 includes mappings between its signatures and ATT&CK. The MBC team updated the mappings using MBC, which increased the accuracy due to MBC’s malware focus. A fork of the Cuckoo community repo is now available on [MBCProject](https://github.com/MBCProject) (see [community](https://github.com/MBCProject/community) and [cuckoo](https://github.com/MBCProject/cuckoo)).
 
 * **STIX 2 Representation** - MBC content is available in STIX 2.1 format - see the [mbc-stix2](https://github.com/MBCProject/mbc-stix2) repository.
 
-* **Micro-behaviors** - Low-level malware behaviors that support other objectives and behaviors will be captured as micro-behaviors in MBC Beta.
+* **Micro-behaviors** - Low-level malware behaviors that support other objectives and behaviors are captured as micro-behaviors in MBC 2.x.
 
-* **Version Control** - MBC v1.0 was released at the end of January 2020. All further changes will be tracked. Releases will happen on an as-needed basis. The next release, expected in summer 2020, will include micro-behaviors and changes associated with [ATT&CK sub-techniques](https://attack.mitre.org/resources/updates/updates-july-2020/index.html).
+* **Version Control** - MBC v1.0 was released at the end of January 2020. Further changes are being tracked and releases will happen on an as-needed basis: 
+	- MBC v2.0 was released in September 2020 and includes micro-behaviors and changes associated with [ATT&CK sub-techniques](https://attack.mitre.org/resources/updates/updates-july-2020/index.html).
+	- MBC v2.1 was released in February 2021 and includes additional micro-behaviors and behavior methods.
 
-* **MBC Website** - An MBC website will replace markdown documents by the end of 2020.
+* **MBC Website** - An MBC website will replace markdown documents by mid-2021.
 
 * **Code Snippets** - In addition to associating malware samples to behaviors, we plan to capture code snippets that illustrate behavior implementation.
 
@@ -34,9 +38,11 @@
 
 ### How should information in the Methods section be used? ###
 
-Methods are variations of behaviors and are provided to help explain behaviors. Methods aren't intended to be referenced in analyses in the same way that behaviors are, in part because it would be hard to enumerate all methods associated with a behavior. 
+Methods are variations of behaviors and are provided to help explain behaviors. Although it would be hard to enumerate all methods associated with a behavior, our aim is to define those most commonly used by malware. Methods may be referenced in analyses as a refinement of behaviors. 
 
-MBC aims to support the malware analysis community so eventually, methods could be expanded and refined to serve as "sub-behaviors." If the expansion of methods is warranted, it may be they are used for manual mapping of behaviors while higher-level behaviors are used by automated analysis systems (which is not to say that some methods could not be identified automatically).
+### When should micro-behaviors be used? ###
+
+Micro-behaviors should be used when context isn’t clear but there is value in capturing basic mechanics. For example, a behavior of “write and execute a file” can ideally map to [Execution::Install Additional Program](../execution/install-prog.md), but if the context isn't clear, the behaviors can be captured as [File System::Create File](../micro-behaviors/file-system/create-file.md) and [Process::Create Process](../micro-behaviors/process/create-process.md).
 
 ### Can MBC behaviors be used without MBC objectives? Can objectives be used without behaviors? Or must objectives and behaviors be specified in pairs? Can methods be used alone? ###
 
@@ -48,7 +54,7 @@ Because methods are specific to a behavior, they're always associated with a beh
 
 ### <a name="gotbotkr"><a/>Can malware behaviors identified via manual analysis map to multiple MBC behaviors, or should correspondence be one-to-one? ###
 
-Each malware behavior identified during analysis and associated with a specific code snippet should map to a single MBC behavior. If multiple behaviors seem to apply, the reported behavior should be considered to see whether it can be broken into smaller components that lead to one-to-one mappings.
+Each malware behavior identified during analysis and associated with a specific code snippet should map to a single MBC behavior. If multiple behaviors seem to apply, the reported behavior should be considered to see whether it can be broken into smaller components that lead to one-to-one mappings. 
 
 For example, a [GotBotKR](../xample-malware/gotbotkr.md) report reflecting manual analysis reads, "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2). Initially, one might think this is a single behavior, but it can be broken apart and mapped into two behaviors:
 
@@ -56,6 +62,8 @@ For example, a [GotBotKR](../xample-malware/gotbotkr.md) report reflecting manua
 
 * [EXECUTION::Install Additional Program](../execution/install-prog.md) ("reinstalls [itself] if it has been removed")
 
+Although one-to-one mappings are best practice, there may be some instances when an analyst may choose to map to multiple MBC behaviors.
+
 ### Can malware behaviors identified by automated sandboxes and tools map to multiple MBC behaviors or should correspondence be one-to-one? ###
 
 Behaviors identified by automated tools are often intentionally broad to give an overview of the malware sample's behavior. Broad behaviors will often map to multiple MBC behaviors. For example, if a tool reports that Armadillo was used on the sample, both [Executable Code Obfuscation](../anti-static-analysis/exe-code-obfuscate.md) and [Software Packing](../anti-static-analysis/software-packing.md) behaviors apply.
@@ -74,7 +82,7 @@ No. MBC captures behaviors and characteristics directly associated with malware
 
 ### Can MBC capture specific data values associated with a behavior? ###
 
-No. For example, MBC might capture the behavior ANTI-BEHAVIORAL ANALYSIS::Emulator Detection::Registry Keys, but the specific registry key (e.g., SYSTEM\ControlSet001\Services\VBoxMouse (VBOX)) would be captured outside of MBC (e.g., as STIX Windows Registry Key Object). 
+No. For example, MBC might capture the behavior [ANTI-BEHAVIORAL ANALYSIS::Emulator Detection::Check Emulator-related Registry Keys](../anti-behavioral-analysis/detect-emulator.md), but the specific registry key (e.g., SYSTEM\ControlSet001\Services\VBoxMouse (VBOX)) would be captured outside of MBC (e.g., as STIX Windows Registry Key Object). 
 
 ### If malware displays only some attributes defining a behavior, it is correct to say it exhibits the behavior? ###
 
@@ -103,9 +111,9 @@ It's not feasible for ATT&CK to expand to cover *all* problem spaces, to include
 
 While malware sometimes acts as a surrogate for an adversary (i.e., there is overlap between malware and adversary behavior), there are aspects unique to malware, mostly notably anti-analysis characteristics that are only identified during analysis: [ANTI-BEHAVIORAL ANALYSIS](../anti-behavioral-analysis) and [ANTI-STATIC ANALYSIS](../anti-static-analysis). Some MBC behaviors may be appropriate for inclusion in ATT&CK, but it is up to the ATT&CK team to identify them and integrate the content.
 
-### MBC v1.0 included ATT&CK techniques? Why is MBC Beta a stand-alone *supplement* to ATT&CK? ###
+### MBC 1.0 included ATT&CK techniques? Why is MBC v2.x a stand-alone *supplement* to ATT&CK? ###
 
-Although we believe that to most effectively support malware analysis, MBC should provide a complete set of malware-related behaviors, updates to ATT&CK, including addition of new platforms (e.g., ICS and cloud), make it difficult to keep MBC current. Also, most malware vendors using ATT&CK in their reporting consider the complete set of ATT&CK techniques, even though some techniques are never used. Consequently, MBC Beta defines new, malware-related behaviors, as well as malware-focused enhancements to ATT&CK techniques, but it no longer defines a restricted set of ATT&CK techniques that pertains to malware.
+Although we believe that to most effectively support malware analysis, MBC should provide a complete set of malware-related behaviors, updates to ATT&CK, including addition of new platforms (e.g., ICS and cloud), make it difficult to keep MBC current. Also, most malware vendors using ATT&CK in their reporting consider the complete set of ATT&CK techniques, even though some techniques are never used. Consequently, MBC v2.x defines new, malware-related behaviors, as well as malware-focused enhancements to ATT&CK techniques, but it no longer defines a restricted set of ATT&CK techniques that pertains to malware.
 
 ### Is there a formal relationship between ATT&CK and MBC? ###
 
@@ -170,12 +178,6 @@ Malware behaviors and adversary behaviors can overlap because adversaries someti
 
 MBC maintains a malware, code-oriented perspective, so MBC behavior names will not always match related ATT&CK names (although they usually do).
 
-### Are individual MBC behaviors linked (related) to more than one ATT&CK technique? ###
-
-No. An objective of MBC is to encompass all ATT&CK techniques pertaining to malware; therefore a single MBC behavior is never mapped to multiple ATT&CK techniques (except when an ATT&CK *Enterprise* technique is similar to an ATT&CK *Mobile* technique). 
-
-This means additional MBC behaviors must sometimes be defined. For example, MBC initially defined one [Denial of Service](../impact/denial-of-service.md) behavior, which was not defined in ATT&CK. After an update to ATT&CK defined two related techniques - [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499/) and [Network Denial of Service](https://attack.mitre.org/techniques/T1498/) (equivalent to MBC's Denial of Service behavior), MBC was expanded to include the Endpoint Denial of Service behavior.
-
 ### Are different MBC behaviors linked (related) to the same ATT&CK technique? ###
 
 Yes. Sometimes an ATT&CK technique does not provide enough granularity for malware analysis-oriented use cases; therefore, multiple, more granular MBC behaviors may link to the same ATT&CK technique.