update text for v2.2

Capa2.0 changes

README.md

@@ -1,9 +1,15 @@
-# <a name="mbc"></a>Malware Behavior Catalog v2.0 #
+# <a name="mbc"></a>Malware Behavior Catalog v2.2 #
 The Malware Behavior Catalog (MBC) is a catalog of malware objectives and behaviors, created to support malware analysis-oriented use cases, such as labeling, similarity analysis, and standardized reporting. Please see the [FAQ](./yfaq/README.md) page for answers to common questions.
 
-Check out the [MBC presentation](https://www.youtube.com/watch?v=KY8Ty-0sdVU) given at BSides DC (October 2019).
+Check out the MBC presentations:
 
-The presentation, "[Standardized reporting with the Malware Behavior Catalog](https://vblocalhost.com/presentations/standardized-reporting-with-the-malware-behavior-catalog/)," will be available on demand during the 2020 Virus Bulletin Conference, which will be free and online! Visit [VB2020 localhost](https://vblocalhost.com/) for details.
+* [Standardized Reporting with the Malware Behavior Catalog](https://youtu.be/qZef-SoREdY), VB2020 localhost (October 2020)
+* [Malware Behavior Catalog](https://youtu.be/KY8Ty-0sdVU), BSides DC (October 2019)
+
+We've also mapped MBC (and ATT&CK) to two open-source malware analysis tools:
+
+* [Cuckoo community signatures](https://github.com/MBCProject/community)
+* [capa rules](https://github.com/fireeye/capa-rules)
 
 To join the **MBC mailing list**, please send a request to mbc@mitre.org.
 
@@ -55,7 +61,9 @@ The MBC also contains a collection of [example malware](./xample-malware/README.
 [Micro-behaviors](./micro-behaviors/README.md) and their associated objectives are under development.
 
 ## Malware Objective Descriptions ##
-Malware objectives are defined below. Follow the links to view associated behaviors. Please see the [MBC Matrix](http://maecproject.github.io/ema/index.html) to view all behaviors.
+Malware objectives are defined in the table below. Follow the links to view associated behaviors. A visual representation of the MBC Matrix is also available (opens in a new window). There is another version under [FAQ](./yfaq/) with behavior ids.
+
+<img src="https://raw.githubusercontent.com/MBCProject/mbc-markdown/master/yfaq/mbc_matrix_without_ids.svg" alt="mbc matrix without ids">
 
 |**Objective**|**Description**|
 |---|---|
@@ -72,3 +80,7 @@ Malware objectives are defined below. Follow the links to view associated behavi
 |[**Lateral Movement**](./lateral-movement/README.md)|Malware aims to propagate through the infection of a system or is able to infect a file after executing on a system. The malware may infect actively (e.g., gain access to a machine directly) or passively (e.g., send malicious email).|
 |[**Persistence**](./persistence/README.md)|Malware aims to remain on a system regardless of system events.|
 |[**Privilege Escalation**](./privilege-escalation/README.md)|Malware aims to obtain a higher level of privilege for execution.|
+
+
+**Copyright 2021 The MITRE Corporation. [Terms of Use](./tou.md)**
+

anti-behavioral-analysis/README.md

@@ -6,16 +6,14 @@
 # Anti-Behavioral Analysis
 Behaviors that prevent, obstruct, or evade behavioral analysis (sandbox, debugger, etc). Because the underlying methods differ, separate "detection" and "evasion" behaviors are defined for some anti-behavioral analysis areas (e.g., anti-debugger). 
 
-Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [[2]](#2).
-
 * **Capture Evasion** [B0036](../anti-behavioral-analysis/evade-capture.md)
+* **Conditional Execution** [B0025](../execution/conditional-execute.md)
 * **Debugger Detection** [B0001](../anti-behavioral-analysis/detect-debugger.md)
 * **Debugger Evasion** [B0002](../anti-behavioral-analysis/evade-debugger.md)
 * **Dynamic Analysis Evasion** [B0003](../anti-behavioral-analysis/evade-dynamic-analysis.md)
 * **Emulator Detection** [B0004](../anti-behavioral-analysis/detect-emulator.md)
 * **Emulator Evasion** [B0005](../anti-behavioral-analysis/evade-emulator.md)
 * **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
-* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
 * **Hooking** [F0003](../credential-access/hooking.md)
 * **Memory Dump Evasion** [B0006](../anti-behavioral-analysis/evade-memory-dump.md)
 * **Sandbox Detection** [B0007](../anti-behavioral-analysis/detect-sandbox.md)
@@ -24,6 +22,6 @@ Two primary resources for anti-behavioral analysis behaviors are [[1]](#1) and [
 
 References
 ----------
-<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project
+<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map
 
 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking

anti-behavioral-analysis/detect-emulator.md

@@ -20,4 +20,4 @@ Methods
 
 References
 ----------
-<a name="1">[1]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion
+<a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/

anti-behavioral-analysis/detect-sandbox.md

@@ -34,6 +34,38 @@ Malware Examples
 |[**Terminator**](../xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
 |[**Ursnif**](../xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|
 
+Code Snippets
+-------------
+**Sandbox Detection::Product Key/ID Testing** (B0007.005) - the value 55274-640-2673064-23950 corresponds to Joe Sandbox.
+```asm
+push    ebx
+add     esp, 0FFFFFEF4h
+xor     ebx, ebx
+push    esp             ; phkResult
+push    1               ; samDesired
+push    0               ; ulOptions
+push    offset SubKey   ; "Software\Microsoft\Windows\CurrentVersi"...
+push    80000002h       ; hKey
+call    RegOpenKeyExA
+test    eax, eax
+jnz     short loc_405387
+mov     [esp+110h+cbData], 101h
+lea     eax, [esp+110h+cbData]
+push    eax             ; lpcbData
+lea     eax, [esp+114h+Data]
+push    eax             ; lpData
+push    0               ; lpType 
+push    0               ; lpReserved
+push    offset ValueName ; "ProductId"
+mov     eax, [esp+124h+hKey]
+push    eax             ; hKey
+call    RegQueryValueExA
+lea     eax, [esp+110h+Data]
+cmp     eax, offset a55274640267306 ; "55274-640-2673064-23950"
+jnz     short loc_405387
+mov     bl, 1
+```
+
 References
 ----------
 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html 

anti-behavioral-analysis/detect-vm.md

@@ -62,11 +62,49 @@ Malware Examples
 |[**WebCobra**](../xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
 |[**Redhip**](../xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
 
+Code Snippets
+-------------
+**Virtual Machine Detection::Instruction Testing** (B0009.029)
+ <br/>MD5: 0e058126f26b54b3a4a950313ec5dbce
+```asm
+; ___unwind { // __except handler4
+push ebp
+mov ebp, esp
+push 0FFFFFFFEh
+push offset stru_413980
+push offset __except handler4
+mov eax, large fs:0
+push eax
+sub esp, 14h
+push ebx
+push esi
+push edi
+mov eax, ___security_cookie
+xor [epb+ms_exc.registration.ScopeTable], eax
+xor eax, ebp
+push eax
+lea eax, [ebp+ms_exc.registration]
+mov large fs:0 eax
+mov [ebp+var_19], al
+;  __try { // __except at loc_401CB8
+mov [ebp+ms_exc.registration.TryLevel], eax
+push ebx
+mov ebx, 0
+mov eax, 1
+vpcext 7, 08h
+test ebx, ebx
+setz [ebp+var_19]
+pop ebx
+jmp short loc_401CBB
+```
+
+
+
 References
 ----------
 <a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
 
-<a name="2">[2]</a> http://unprotect.tdgt.org/index.php/Sandbox_Evasion
+<a name="2">[2]</a> https://search.unprotect.it/map/sandbox-evasion/
 
 <a name="3">[3]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
 

anti-behavioral-analysis/evade-debugger.md

@@ -64,6 +64,6 @@ References
 
 <a name="4">[4]</a> http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/
 
-<a name="5">[5]</a> http://unprotect.tdgt.org/index.php/Unprotect_Project
+<a name="5">[5]</a> https://search.unprotect.it/map/
 
 <a name="6">[6]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

anti-behavioral-analysis/evade-memory-dump.md

@@ -22,6 +22,8 @@ Methods
 |**On-the-Fly APIs**|B0006.007|Resolve API addresses before each use to prevent complete dumping.|
 |**SizeOfImage**|B0006.004|Set the SizeOfImage field of PEB.LoaderData to be huge.|
 |**Tampering**|B0006.005|Erase or corrupt specific file parts to prevent rebuilding (header, packer stub, etc.).|
+|**Hook memory mapping APIs**|B0006.010|Hooking prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
+|**Patch MmGetPhysicalMemoryRanges**|B0006.011|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
 
 Malware Examples
 ----------------
@@ -29,6 +31,48 @@ Malware Examples
 |---|---|---|
 |[Kraken](../xample-malware/kraken.md)|April 2008|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|
 
+Code Snippets
+-------------
+**Memory Dump::Code Encryption in Memory** (B0006.011)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+mov cl, 65h ; 'e'
+mov al, 70h ; 'p'
+mov [ebp+var_23], cl
+mov [ebp+var_1F], cl
+mov [ebp+String], bl
+mov [ebp+var_12], bl
+mov [ebp+var_2E], al
+mov [ebp+var_2D], al
+lea ecx, [ebp+String]
+mov al, 74h ; 't'
+mov bl, 2Eh ; '.'
+push ecx
+mov [ebp+var_13], 30h
+mov [ebp+var_11], 30h
+mov [ebp+var_10], 0
+mov [ebp+cp]
+mov [ebp+var_2F], 75h
+mov [ebp+var_2C], 6Fh
+mov [ebp+var_2B], 72h
+mov [ebp+var_2A], al
+mov [ebp+var_29], bl
+mov [ebp+var_28], 62h
+mov [ebp+var_27], 79h
+mov [ebp+var_26], 69h
+mov [ebp+var_25], dl
+mov [ebp+var_24], al
+mov [ebp+var_22], 72h
+mov [ebp+var_21], bl
+mov [ebp+var_20], dl
+mov [ebp+var_1E], al
+mov [ebp+var_1D], 0
+call ds:atoi
+add esp, 4
+mov dword ptr [ebp+hostshort], eax
+jmp short loc_401326
+```
+
 References
 ----------
 <a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, https://www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf

anti-behavioral-analysis/execution-guardrails.md

@@ -1,23 +0,0 @@
-|||
-|---|---|
-|**ID**|**E1480**|
-|**Objective(s)**|[Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
-|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
-
-
-Execution Guardrails
-====================
-Malware may use execution guardrails (environmental conditions) to constrain execution. This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
-
-**See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Deposited Keys**|E1480.m01|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
-|**Environmental Keys**|E1480.m02|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
-|**GetVolumeInformation**|E1480.m03|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
-|**Host Fingerprint Check**|E1480.m04|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
-|**Secure Triggers**|E1480.m05|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
-|**Token Check**|E1480.m06|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|

anti-static-analysis/README.md

@@ -6,10 +6,9 @@
 # Anti-Static Analysis
 Behaviors and code characteristics that prevent static analysis or make it more difficult. Simple static analysis identifies features such as embedded strings, header information, hash values, and file metadata (e.g., creation date). More involved static analysis involves the disassembly of the binary code.
 
-Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]](#2).
-
 * **Call Graph Generation Evasion** [B0010](../anti-static-analysis/evade-call-graph.md)
 * **Disassembler Evasion** [B0012](../anti-static-analysis/evade-disassembler.md)
+* **Data Flow Analysis Evasion** [B0045](../anti-static-analysis/evade-data-flow-analysis.md)
 * **Executable Code Obfuscation** [B0032](../anti-static-analysis/exe-code-obfuscate.md)
 * **Executable Code Optimization** [B0034](../anti-static-analysis/exe-code-optimize.md)
 * **Executable Code Virtualization** [B0008](../anti-static-analysis/exe-code-virtualize.md)
@@ -18,6 +17,6 @@ Two primary resources for anti-static analysis behaviors are [[1]](#1) and [[2]]
 
 References
 ----------
-<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. http://unprotect.tdgt.org/index.php/Unprotect_Project
+<a name="1">[1]</a> Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map/sandbox-evasion/
 
 <a name="2">[2]</a> InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking

anti-static-analysis/evade-data-flow-analysis.md

@@ -0,0 +1,22 @@
+|||
+|---|---|
+|**ID**|**B0045**|
+|**Objective(s)**|[Anti-Static Analysis](../anti-static-analysis)|
+|**Related ATT&CK Technique**|None|
+
+
+Data Flow Analysis Evasion
+==========================
+Malware code evades data flow analysis (also known as information flow analysis and taint-tracking).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Control Dependence**|B0045.001|Data is propagated via an if-then-else clause instead of direct assignment.[[1]](#1)|
+|**Implicit Flows**|B0045.002|Data is propagated via semantic relationships, for example one variable not changing its state could imply the state of another variable.[[1]](#1)|
+|**Arbitrary Memory Corruption**|B0045.003|Data is propagated by corrupting memory, for example overwriting a region of stack space where a file pointer is held.[[1]](#1)|
+
+References
+----------
+<a name="1">[1]</a> http://www.seclab.cs.sunysb.edu/seclab/pubs/antitaint.pdf

anti-static-analysis/exe-code-obfuscate.md

@@ -42,6 +42,60 @@ Malware Examples
 |[**Emotet**](../xample-malware/emotet.md)|2018|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
 
+Code Snippets
+-------------
+**Obfuscated Files or Information::Encoding-Standard Algorithm** (E1027.m02)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+jle short_40182F
+mov dl, byte ptr [ebp+eax+var_7CA8]
+xor dl, cl
+mov byte ptr [ebp+eax+var_7CA8], dl
+inc eax
+cmp eax, edi
+jl short loc_40181A
+```
+**Executable Code Obfuscation::Stack Strings** (B0032.017)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+mov cl, 65h ; 'e'
+mov al, 70h ; 'p'
+mov [ebp+var_23], cl
+mov [ebp_var_1f], cl
+mov [ebp_Str], bl
+mov [ebp+var_12], bl
+mov [ebp+var_2E], al
+mov [ebp+var_2D], al
+lea ecx, [ebp+Str]
+mov al, 74h ; 't'
+mov bl, 2Eh ; '.'
+mov dl. 6Eh ; 'n'
+push ecx ; STR
+mov [ebp+var_13], 30h ; '0'
+mov [ebp+var_11], 30h ; '0'
+mov [ebp+var_10], 0
+mov [ebp+cp], 73h ; 's'
+mov [ebp+var_2F], 75h ; u'
+mov [ebp+var_2C], 6Fh ; 'o'
+mov [ebp+var_2B], 72h ; 'r'
+mov [ebp+var_2A], al
+mov [ebp+var_29], bl
+mov [ebp+var_28], 62h ; 'b'
+mov [ebp+var_27], 79h ; 'y'
+mov [ebp+var_26], 69h ; 'i'
+mov [ebp+var_25], dl
+mov [ebp+var_24], al
+mov [ebp+var_22], 72h ; 'r'
+mov [ebp+var_21], bl
+mov [ebp+var_20], dl
+mov [ebp+var_1E], al
+mov [ebp+var_1D], h
+call ds:atoi
+add esp, 4
+mov dword ptr [ebp+hostshort], eax
+jmp short loc_401326
+```
+
 References
 ----------
 <a name="1">[1]</a> https://insights.sei.cmu.edu/cert/2019/03/api-hashing-tool-imagine-that.html

anti-static-analysis/software-packing.md

@@ -15,6 +15,7 @@ Methods
 |Name|ID|Description|
 |---|---|---|
 |**Armadillo**|F0001.012|Uses Armadillo.|
+|**ASPack**|F0001.013|Uses ASPack.|
 |**Confuser**|F0001.009|Uses Confuser packer.|
 |**Custom Compression**|F0001.005|Uses a custom algorithm to compress an executable file.|
 |**Custom Compression of Code**|F0001.006|Uses a custom algorithm to compress opcode mnemonics.|

command-and-control/README.md

@@ -4,7 +4,7 @@
 
 
 # Command and Control
-Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet.
+Behaviors malware may use to communicate with systems under its control within a target network. There are many ways malware can establish command and control with various levels of covertness, depending on system configuration and network topology. Behaviors may relate to C2 servers or a bot that is part of a botnet. As "server" and "client" are confusing terminology in this context, we use the terms **controller** and **implant**. The controller is the software running on adversary-controlled infrastructure and used to send commands to the implant. The implant is the software running on victim-controlled infrastructure that receives commands from the adversary, executes those commands on the victim, and optionally sends the results back to the adversary.
 
 * **Command and Control Communication** [B0030](../command-and-control/command-control-comm.md)
 * **Domain Name Generation** [B0031](../command-and-control/domain-name-generate.md)

command-and-control/command-control-comm.md

@@ -7,21 +7,46 @@
 
 C2 Communication
 ================
-All command and control malware use client/server communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](../command-and-control/remote-file-copy.md).
+All command and control malware use implant/controller communication. The methods listed below can be used to capture explicit communication details. Remote file copy behavior is captured separately, as is done in ATT&CK - see [Remote File Copy](../command-and-control/remote-file-copy.md).
 
-Command and Control Communication relates to *autonomous* client/server communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](../execution/remote-commands.md) under the Execution objective).
+Command and Control Communication relates to *autonomous* communications, not explicit, on-demand commands that malware provides to an adversary (such commands should be captured with [Remote Commands](../execution/remote-commands.md) under the Execution objective).
 
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
+|**Authenticate**|B0030.011|Implant may authenticate itself to the controller, controller may authenticate itself to implant, or both. This is often at or near the start of communication. Examples include but are not limited to a simple shared secret (e.g. password), challenge-response with symmetric encryption, or challenge-response with asymmetric encryption.|
 |**Check for Payload**|B0030.005|Check for payload.|
-|**Client to Server File Transfer**|B0030.004|File is transferred from client to server.|
-|**Receive Data**|B0030.002|Receive data from a C2 server.|
-|**Request Command**|B0030.008|Client requests a command.|
+|**Directory Listing**|B0030.012|Controller requests a directory listing from the implant, optionally from a given path, optionally recursive.|
+|**Execute File**|B0030.013|Execute/run/open the file using default operating system functionality, optionally with provided command-line arguments. The file may or may not already exist on the victim.|
+|**Execute Shell Command**|B0030.014|Execute/run the given command using a built-in program (e.g. cmd.exe, PowerShell, bash). This differs from Start Interactive Shell because the shell process is started only for the received command or set of commands and then exits. There is no loop looking for additional commands while the shell process is still running.|
+|**File search**|B0030.015|Controller requests the implant to search for a given filename pattern, often a [glob](https://en.wikipedia.org/wiki/Glob_(programming)).|
+|**Implant to Controller File Transfer**|B0030.004|File is transferred from implant to controller.|
+|**Receive Data**|B0030.002|Receive data or command from a controller.|
+|**Request Command**|B0030.008|Implant requests a command.|
 |**Request Email Address List**|B0030.010|Request email address list.|
 |**Request Email Template**|B0030.009|Request email template.|
-|**Send Data**|B0030.001|Send data to a C2 server.|
+|**Send Data**|B0030.001|Send data to a controller.|
 |**Send Heartbeat**|B0030.007|Heartbeat sent.|
-|**Send System Information**|B0030.006|Client sends system information.|
-|**Server to Client File Transfer**|B0030.003|File is transferred from server to client.|
+|**Send System Information**|B0030.006|Implant sends system information.|
+|**Server to Client File Transfer**|B0030.003|File is transferred from controller to implant.|
+|**Start Interactive Shell**|B0030.016|Start an interactive shell using a built-in program (e.g. cmd.exe, PowerShell, bash). This is often implemented with polling the network connection from the controller for text commands to redirect to the shell's stdin and polling the shell's stdout and stderr to redirect over the network to the controller. This differs from Execute Shell Command because the shell process runs across multiple iterations of the recv-command(s)-send-result loop.|
+
+Code Snippets
+-------------
+**C2 Communication::Receive Data** (B0030.02)
+ <br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
+```asm
+loc_401981
+mov ecx, s
+mov edx, edi
+sub edx, esi
+push 0 ; flags
+lea eax, [esi+ebx]
+push edx ;len
+push eax ;buf
+push ecx ;s
+call recv
+jmp short loc_4019A2
+```
+

command-and-control/domain-name-generate.md

@@ -7,7 +7,7 @@
 
 Domain Name Generation
 ======================
-Malware generates the domain name of the command and control server to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced bots; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
+Malware generates the domain name of the controller to which it connects. Access to on the fly domains enables C2 to operate as domains and IP addresses are blocked. The algorithm can be complicated in more advanced implants; understanding the details so that names can be predicted can be useful in mitigation and response. [[1]](#1)
 
 The subsequently defined ATT&CK sub-technique [Dynamic Resolution: Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002/), which is oriented toward an adversary perspective (although its examples include malware), is related to this MBC behavior.
 

command-and-control/remote-file-copy.md

@@ -18,7 +18,7 @@ Malware Examples
 |Name|Date|Description|
 |---|---|---|
 |[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
+|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy implant is running on the target machine, the attacker can use a Windows GUI controller to control the target computer. [[1]](#1)|
 
 References
 ----------

credential-access/hooking.md

@@ -13,15 +13,18 @@ For discussion related to the Credential Access and Collection objectives, see A
 
 Note that in MBC, Hooking is also associated with the [Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation), and [Anti-Behavioral Analysis](../anti-behavioral-analysis) objectives.
 
+For hooking related to memory dump evasion, see [Memory Dump Evasion](../anti-behavioral-analysis/evade-memory-dump.md).
+
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Hook memory mapping APIs**|F0003.002|Prevents memory dumps by preventing mapping of memory into the kernel's virtual address space. [[1]](#1)|
-|**Hook procedures**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[3]](#3)|
-|**Import Address Hooking (IAT) Hooking**|F0003.004|Uses modifications to a process's IAT where pointers to imported API functions are stored.|
-|**Inline Hooking**|F0003.005|Overwrites the first bytes in an API function to redirect code flow.|
-|**Patch MmGetPhysicalMemoryRanges**|F0003.001|Patching this function to always return NULL prevents drivers from getting information about the physical address space layout, preventing memory dumps. [[1]](#1)|
+|**Procedure Hooking**|F0003.003|Intercepts and executes designated code in response to events such as messages, keystrokes, and mouse inputs. [[1]](#1)|
+|**Inline Patching**|F0003.002|Overwrites the first bytes in an API function to redirect code flow.|
+|**Export Address Table (EAT) Hooking**|F0003.006|Hooks the export address table (EAT).|
+|**Import Address Table (IAT) Hooking**|F0003.001|Modifies a process's import address table (IAT), which stores pointers to imported API functions.|
+|**System Service Dispatch Table Hooking**|F0003.004|Hooks the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.|
+|**Shadow SDT Hooking**|F0003.005|Hooks the Shadow SSDT similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).|
 
 Malware Examples
 ----------------
@@ -32,8 +35,8 @@ Malware Examples
 
 References
 ----------
-<a name="1">[1]</a> J. Stuttgen, M. Cohen, Anti-forensic resilient memory acquisition, https://www.dfrws.org/sites/default/files/session-files/paper-anti-forensic_resilient_memory_acquisition.pdf
+<a name="1">[1]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
 
 <a name="2">[2]</a> https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
 
-<a name="3">[3]</a> https://docs.microsoft.com/en-us/windows/win32/winmsg/about-hooks?redirectedfrom=MSDN#hook-procedures
+

defense-evasion/README.md

@@ -10,10 +10,12 @@ Behaviors that evade detection or avoid other defenses.
 * **Bootkit** [F0013](../defense-evasion/boot-sector-mod.md)
 * **Bypass DEP** [B0037](../defense-evasion/bypass-dep.md)
 * **Component Firmware** [F0009](../persistence/component-firmware.md)
+* **Conditional Execution** [B0025](../execution/conditional-execute.md)
 * **Covert Location** [B0040](../defense-evasion/covert-location.md)
-* **Disable Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
-* **Execution Guardrails** [E1480](../anti-behavioral-analysis/execution-guardrails.md)
+* **Disable or Evade Security Tools** [F0004](../defense-evasion/disable-security-tools.md)
+* **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md)
 * **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files.md)
+* **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md)
 * **Hooking** [F0003](../credential-access/hooking.md)
 * **Indicator Blocking** [F0006](../defense-evasion/indicator-blocking.md)
 * **Install Insecure or Malicious Configuration** [E1478](../defense-evasion/config-mod.md)

defense-evasion/disable-security-tools.md

@@ -5,9 +5,9 @@
 |**Related ATT&CK Sub-Technique**|[Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)|
 
 
-Disable Security Tools
-========================
-Malware may disable security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities.
+Disable or Evade Security Tools
+===============================
+Malware may disable or evade security tools to avoid detection. Security tools include OS security features and updating tools, anti-virus (AV) tools, firewalls, tool components providing security related logging and/or reporting, and Antimalware Scan Interface (AMSI) related capabilities. 
 
 Malware-related methods extending ATT&CK's definition are below. 
 
@@ -20,8 +20,12 @@ Methods
 |**AMSI Bypass**|F0004.004|Malware bypasses AMSI (Anti-malware Scan Interface).|
 |**Disable Kernel Patch Protection**|F0004.001|Bypasses or disables kernel patch protection mechanisms such as Windows' PatchGuard, enabling the malware instance to operate at the same level as the operating system kernel and kernel mode drivers (KMD).|
 |**Disable System File Overwrite Protection**|F0004.002|Disables system file overwrite protection mechanisms such as Windows file protection, thereby enabling system files to be modified or replaced.|
+|**Force Lazy Writing**|F0004.006|Some operating systems will sometimes use a form of "lazy writing" for disk I/O, which may obscure the true provenance of the write operation. This method occurs when code intentionally forces the operating system to perform a lazy writing operation. For example, in Windows, a file may be opened, memory mapped, and closed, but the memory map will still exist and can be written to, which will cause a lazy write that looks like it is coming from the System process. [[3]](#3)|
+|**Heavens Gate**|F0004.008|Malware evades endpoint security products by invoking 64-bit code in 32-bit processes, effectively bypassing user-mode hooks. [[4]](#4)|
 |**Modify Policy**|F0004.005|Malware may modify policies to make software less effective.|
 |**Unhook APIs**|F0004.003|Security products may hook APIs to monitor the behavior of malware. To avoid being found, malware may load DLLs in memory and overwrite their bytes.|
+|**Bypass Windows File Protection**|F0004.007|Malware bypasses Windows file protection.|
+|**Disable Code Integrity**|F0004.009|Malware disables Code Integrity driver.|
 
 Malware Examples
 ----------------
@@ -36,3 +40,7 @@ References
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
 
 <a name="2">[2]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
+
+<a name="3">[3]</a> Alexander Adamov, Stealthy WastedLocker: eluding behavior blockers, but not only. Online:   https://vblocalhost.com/conference/presentations/stealthy-wastedlocker-eluding-behaviour-blockers-but-not-only/
+
+<a name="4">[4]</a> Carl Petty, Red Canary, 3/3/2020. Online: https://redcanary.com/blog/heavens-gate-technique-on-linux/

defense-evasion/hidden-files.md

@@ -15,5 +15,8 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Change File Location**|F0005.002|Malware may change the location of itself or another file to prevent detection.|
-|**File Extension Change**|F0005.001|Malware may change the file extension of a file.|
+|**Attribute**|F0005.003|Malware may change or choose an attribute to hide a file or directory.|
+|**Extension**|F0005.001|Malware may change or use a particular file extension to hide a file.|
+|**Location**|F0005.002|Malware may change or choose the location of itself, another file, or a directory to prevent detection.|
+|**Timestamp**|F0005.004|Malware may change the timestamp on a file to prevent detection.|
+

defense-evasion/hide-artifacts.md

@@ -0,0 +1,23 @@
+|||
+|---|---|
+|**ID**|**E1564**|
+|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence)|
+|**Related ATT&CK Technique**|[Hide Artifacts](https://attack.mitre.org/techniques/T1564)|
+
+
+Hidden Artifacts
+================
+Malware may hide artifacts to evade detection and/or to persist on the system. See potential methods related to malware below. 
+
+See ATT&CK: [**Hide Artifacts**](https://attack.mitre.org/techniques/T1564/).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Hidden Userspace Libraries**|E1564.m01|Hides userspace libraries used by the malware instance. Technique refers to hiding libraries loaded in memory (not disk). For example, a userspace library may be injected into a system process such that memory scanning tools may be prevented from finding them. This technique is different than DLL injection, in which the DLL will continue to show up in process metadata that tracks what is stored in memory. This technique involves clearing that metadata or making it inaccessible to security and inspection tools.|
+|**Direct Kernel Object Manipulation**|E1564.m02|Direct Kernel Object Manipulation (DKOM) can be used instead of loading a new driver. It leverages an undocumented function exported by ntdll.dll (NtSystemDebugControl()) that provides debugging functionalities at the kernel level.|
+|**Hidden Kernel Modules**|E1564.m05|Hides the use of kernel modules by the malware instance (e.g. rootkit). Techniques include kernel module list unlinking.|
+|**Hidden Processes**|E1564.m03|Hides processes used by the adversary or malware instance. This can involve techniques such as process list unlinking.|
+|**Hidden Services**|E1564.m04|Hides any system services that the malware instance creates or injects itself into. Services can be hidden by hiding associated registry keys.|
+

defense-evasion/hijack-execution-flow.md

@@ -0,0 +1,34 @@
+|||
+|---|---|
+|**ID**|**F0015**|
+|**Objective(s)**|[Defense Evasion](../defense-evasion), [Persistence](../persistence), [Privilege Escalation](../privilege-escalation)|
+|**Related ATT&CK Technique**|[Hijack Execution Flow](https://attack.mitre.org/techniques/T1574/)|
+
+
+Hijack Execution Flow
+=====================
+Malware may execute by hijacking the way operating systems run programs. Malware (e.g. rootkit) alters API behavior or redirects execution to a malicious API version for a variety of purposes. Malware may use hooking to load and execute code within the context of another process, hiding execution and gaining elevated privileges and access to the process's memory. Different types of hooking are defined as methods below.
+
+See ATT&CK: [**Hijack Execution Flow**](https://attack.mitre.org/techniques/T1574/).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Abuse Windows Function Calls**|F0015.006|Malware abuses native Windows function calls to transfer execution to shellcode that it loads into memory. A pointer to the callback function is used to supply the memory address of the shellcode. Functions that can be abused include EnumResourceTypesA and EnumUILanguagesW. [[4]](#4)|
+|**Export Address Table (EAT) Hooking**|F0015.001|Malware (e.g. rootkit) hooks the export address table (EAT).|
+|**Import Address Table (IAT) Hooking**|F0015.003|Malware (e.g. rootkit) modifies a process's import address table (IAT), which stores pointers to imported API functions.[[1]](#1)|
+|**Inline Patching**|F0015.002|Inline patching (inline hooking) is done by modifying the beginning of a function in order to redirect the execution flow to custom code (i.e. redirecting code flow) before jumping back to the original function.[[2]](#2)|
+|**Shadow System Service Dispatch Table Hooking**|F0015.004|The Shadow System Service Dispatch Table (SSDT) can be hooked similarly to how the SSDT and IAT are hooked. The target of the hooking with the Shadow SSDT is the Windows subsystem (win32k.sys).[[3]](#3)|
+|**System Service Dispatch Table Hooking**|F0015.005|Malware (e.g. rootkit, malicious drivers) may hook the system service dispatch table (SSDT), also called the system service descriptor table. The SSDT contains information about the service tables used by the operating system for dispatching system calls. Hooking the SSDT enables malware to hide files, registry keys, and network connections.[[3]](#3)|
+
+References
+----------
+<a name="1">[1]</a> https://www.sans.org/media/score/checklists/rootkits-investigation-procedures.pdf
+
+<a name="2">[2]</a> https://www.oreilly.com/library/view/learning-malware-analysis/9781788392501/a0a506d6-d062-48c1-a0a8-57d6acb77785.xhtml
+
+<a name="3">[3]</a> https://www.mdpi.com/1999-5903/4/4/971/html
+
+<a name="4">[4]</a> http://ropgadget.com/posts/abusing_win_functions.html
+

defense-evasion/obfuscate-files.md

@@ -9,24 +9,27 @@ Obfuscated Files or Information
 ===============================
 Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself can be encoded or encrypted (i.e., encoding/encryption is a code characteristic).
 
-A related MBC behavior, associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](../anti-static-analysis/exe-code-obfuscate.md).
+A related MBC behavior (code characteristic), associated explicitly with executable code and making its analysis more difficult, is [Executable Code Obfuscation](../anti-static-analysis/exe-code-obfuscate.md).
+
+Another related MBC behavior (code characteristic), is [Software Packing](../anti-static-analysis/software-packing.md) which has methods capturing specific packers and types of compression.
 
 See ATT&CK: [**Obfuscated Files or Information**](https://attack.mitre.org/techniques/T1027/).
 
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Encoding**|E1027.m01|The malware sample, file, or other information is encoded.|
-|**Encoding - Custom Encoding**|E1027.m03|The malware sample, file, or other information is encoded. A custom algorithm is used to encode the malware sample, a file, or other information.|
-|**Encoding - Standard Encoding**|E1027.m02|The malware sample, file, or other information is encoded. A standard algorithm, such as base64 encoding, is used to encode the malware sample, a file, or other information.|
-|**Encryption**|E1027.m04|The malware sample, file, or other information is encrypted.|
-|**Encryption - Custom Encryption**|E1027.m08|The malware sample, file, or other information is encrypted. A custom algorithm is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
-|**Encryption - Custom Encryption of Code**|E1027.m09|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-|**Encryption - Custom Encryption of Data**|E1027.m10|The malware sample, file, or other information is encrypted. A custom encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
-|**Encryption - Standard Encryption**|E1027.m05|The malware sample, file, or other information is encrypted. A standard algorithm, such as Rijndael/AES, DES, RC4, is used to encrypt an executable file. Encryption hinders static analysis of malware code. Also known as *Code Encryption in File*.|
-|**Encryption - Standard Encryption of Code**|E1027.m06|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's executable code, but not necessarily the file's data.|
-|**Encryption - Standard Encryption of Data**|E1027.m07|The malware sample, file, or other information is encrypted. A standard encryption algorithm is used to encrypt a file's data, but not necessarily the file's code.|
+|**Encoding**|E1027.m01|A malware sample, file, or other information is encoded.|
+|**Encoding-Custom Algorithm**|E1027.m03|A custom algorithm is used to encode a malware sample, file or other information.|
+|**Encoding-Standard Algorithm**|E1027.m02|A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information.|
+|**Encryption**|E1027.m04|A malware sample, file, or other information is encrypted.|
+|**Encryption-Custom Algorithm**|E1027.m08|A custom algorithm is used to encrypt a malware sample, file, or other information.|
+|**Encryption-Standard Algorithm**|E1027.m05|A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information.|
+|**Encryption of Code**|E1027.m06|A file's executable code is encrypted, but not necessarily the file's data.|
+|**Encryption of Data**|E1027.m07|A file's data is encrypted, but not necessarily the file's code.|
+
 
 Malware Examples
 ----------------

defense-evasion/process-inject.md

@@ -9,16 +9,16 @@ Process Injection
 =================
 Malware may execute code in the address space of a separate process. 
 
-See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on sub-techniques in the context of [[1]](#1) are in as follows:
+See ATT&CK: [**Process Injection**](https://attack.mitre.org/techniques/T1055). Notes on ATT&CK's sub-techniques in the context of [[1]](#1) are as follows:
 
 |ID|ATT&CK Sub-Technique|Notes|
 |---|---|---|
-|T1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
-|T1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
-|T1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
-|T1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread); also called AtomBombing [[3]](#3). Called *APC Injection and AtomBombing* in [[1]](#1).|
-|T1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
-|T1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|
+|E1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
+|E1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
+|E1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
+|E1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread); also called AtomBombing [[3]](#3). Called *APC Injection and AtomBombing* in [[1]](#1).|
+|E1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
+|E1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|
 
 Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hooking](../credential-access/hooking.md) behavior.
 
@@ -28,7 +28,9 @@ Methods
 |---|---|---|
 |**Hook Injection via SetWindowsHooksEx**|E1055.m01|Malware can leverage hooking functionality to have its malicious DLL loaded upon an event getting triggered in a specific thread, which is usually done by calling SetWindowsHookEx to install a hook routine into the hook chain. [[1]](#1)|
 |**Injection and Persistence via Registry Modification**|E1055.m02|Malware may insert the location of its malicious library under a registry key (e.g., Appinit_DLL, AppCertDlls, IFEO) to have another process load its library. [[1]](#1)|
+|**Injection via Windows Fibers**|E1055.m05|Malware executes shellcode via Windows fibers by converting a thread to a fiber. [[5]](#5)|
 |**Injection using Shims**|E1055.m03|Malware may use shims to target an executable (shims are a way of hooking into APIs and targeting specific executables and are provided by Microsoft for backward compatibility, allowing developers to apply program fixes without rewriting code). [[1]](#1)|
+|**Patch Process Command Line**|E1055.m04|Malware patches the PEB of a process to spoof the arguments.|
 
 Malware Examples
 ----------------
@@ -48,3 +50,5 @@ References
 <a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser
 
 <a name="4">[4]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+
+<a name="5">[5]</a> https://www.ired.team/offensive-security/code-injection-process-injection/executing-shellcode-with-createfiber

defense-evasion/rootkit-behavior.md

@@ -11,21 +11,18 @@ Behaviors of a rootkit: "A rootkit is a collection of computer software, typical
 
 See ATT&CK: [**Rootkit**](https://attack.mitre.org/techniques/T1014).
 
+Rootkits may hide artifacts (kernel modules, services, threads, userspace libraries), prevent actions (API unhooking (prevents API hooks installed by the malware instance from being removed), file access (prevents access to the file system, including specific files and/or directories associated with the malware instance), file deletion (prevents files and/or directories associated with the malware instance from being deleted), memory access (prevents access to system memory where the malware instance stores code or data), native API hooking (prevents other software from hooking native system APIs), registry access (prevents access to the Windows registry, either entire registry or particular registry keys/values), registry deletion (prevents deletion of registry keys and/or values associated with the malware instance).
+
 Methods
 ------- 
 |Name|ID|Description|
 |---|---|---|
-|**Hide Kernel Modules**|E1014.m01|Hides the usage of any kernel modules by the malware instance.|
-|**Hide Services**|E1014.m02|Hides any system services that the malware instance creates or injects itself into.|
-|**Hide Threads**|E1014.m04|Hides one or more threads that belong to the malware instance.|
-|**Hide Userspace Libraries**|E1014.m05|Hides the usage of userspace libraries by the malware instance.|
-|**Prevent API Unhooking**|E1014.m06|Prevents the API hooks installed by the malware instance from being removed.|
-|**Prevent File Access**|E1014.m09|Prevents access to the file system, including to specific files and/or directories associated with the malware instance.|
-|**Prevent File Deletion**|E1014.m10|Prevents files and/or directories associated with the malware instance from being deleted from a system.|
-|**Prevent Memory Access**|E1014.m11|Prevents access to system memory where the malware instance may be storing code or data.|
-|**Prevent Native API Hooking**|E1014.m12|Prevents other software from hooking native system APIs.|
-|**Prevent Registry Access**|E1014.m07|Prevents access to the Windows registry, including to the entire registry and/or to particular registry keys/values.|
-|**Prevent Registry Deletion**|E1014.m08|Prevent Windows registry keys and/or values associated with the malware instance from being deleted from a system.|
+|**Application Rootkit**|E1014.m12|Application rootkits operate by exchanging standard application files with rootkit files, or changing applications by injecting code or patching.|
+|**Bootloader**|E1014.m13|A bootloader rootkit modifies the bootloader, enabling activation before the operating system is started. Also known as a Bootkit. See ATT&CK: [Bootkit](https://attack.mitre.org/techniques/T1542/003/).|
+|**Hardware/Firmware Rootkit**|E1014.m14|A firmware rootkit compromises hardware (e.g. network card, hard drive), system BIOS, UEFI firmware. LoJack is the first in-the-wild UEFI rootkit. See ATT&CK: [System Firmware](https://attack.mitre.org/techniques/T1542/001/).|
+|**Hypervisor/Virtualized Rootkit**|E1014.m15|A hypervisor (virtualized) rootkit hosts the target operating system as a virtual machine, enabling interception of all hardware calls. Also called, virtual-machine-based rootkit (VMBR).|
+|**Kernel Mode Rootkit**|E1014.m16|Rootkit operates by adding or replacing code in OS, device drivers, loadable kernel modules (LKM). Related to ATT&CK: [Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006/)|
+|**Memory Rootkit**|E1014.m17|A memory rootkit hids in RAM. Behaviors may include methods to prevent memory access. The lifespan of a memory rootkit is short because it disappears after a system reboot.|
 
 Malware Examples
 ----------------
@@ -33,6 +30,12 @@ Malware Examples
 |---|---|---|
 |[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
 
+Detection
+---------
+Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Impair Defenses, Highjack Execution Flow. Hidden artifacts include kernel modules (hides use of kernel modules used by the malware instance), services (hides any system services that the malware instance creates or injects itself into), threads (hides one or more threads that belong to the malware instance), userspace libraries (hides use of userspace libraries used by the malware instance). 
+
+Rootkits can also be detected via memory dump analysis or virtual machine introspection.
+
 References
 ----------
 <a name="1">[1]</a> https://en.wikipedia.org/wiki/Rootkit

discovery/README.md

@@ -7,6 +7,10 @@
 Behaviors that aim to gain knowledge about the system and internal network.
 
 * **Analysis Tool Discovery** [B0013](../discovery/analysis-tool-discover.md)
+* **Application Window Discovery** [E1010](../discovery/app-window-discover.md)
+* **Code Discovery** [B0046](../discovery/code-discover.md)
+* **File and Directory Discovery** [E1083](../discovery/file-discover.md)
 * **Self Discovery** [B0038](../discovery/self-discover.md)
 * **SMTP Connection Discovery** [B0014](../discovery/smtp-connect-discover.md)
 * **System Information Discovery** [E1082](../discovery/system-info-discover.md)
+* **Taskbar Discovery** [B0043](../discovery/taskbar-discover.md)

discovery/app-window-discover.md

@@ -0,0 +1,16 @@
+|||
+|---|---|
+|**ID**|**E1010**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|[Application Window Discovery](https://attack.mitre.org/techniques/T1010/) |
+
+
+Application Window Discovery
+============================
+Malware may attempt to get a listing of open application windows.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Window Text**|E1010.m01|After finding an open application window, malware gets graphical window text.|

discovery/code-discover.md

@@ -0,0 +1,18 @@
+|||
+|---|---|
+|**ID**|**B0046**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|None|
+
+
+Code Discovery
+==============
+Malware may inspect code or enumerate aspects.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Enumerate PE Sections**|B0046.001|Malware enumerates virtual offsets of code sections.|
+|**Inspect Section Memory Permissions**|B0046.002|Malware identifies section memory permissions from image section header.|
+|**Parse PE Header**|B0046.003|Malware parses the PE header.|

discovery/file-discover.md

@@ -0,0 +1,16 @@
+|||
+|---|---|
+|**ID**|**E1083**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|[File and Directory Discovery](https://attack.mitre.org/techniques/T1083/) |
+
+
+File and Directory Discovery
+============================
+Malware may enumerate files and directories or may search for specific files or in specific locations.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Log File**|E1083.m01|Malware may look for system log files.|

discovery/taskbar-discover.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**B0043**|
+|**Objective(s)**|[Discovery](../discovery)|
+|**Related ATT&CK Technique**|None|
+
+
+Taskbar Discovery
+=================
+Malware may find the taskbar.

execution/README.md

@@ -7,10 +7,12 @@ Behaviors that execute code on a system to achieve a variety of goals.
 
 * **Command and Scripting Interpreter** [E1059](../execution/command-line.md)
 * **Conditional Execution** [B0025](../execution/conditional-execute.md)
+* **Execution Dependency** [B0044](../execution/execution-dependency.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
 * **Install Additional Program** [B0023](../execution/install-prog.md)
 * **Prevent Concurrent Execution** [B0024](../execution/prevent-concurrent-exe.md)
 * **Remote Commands** [B0011](../execution/remote-commands.md)
 * **Send Email** [B0020](../execution/send-email.md)
 * **Send Poisoned Text Message** [B0021](../execution/send-poison-text-msg.md)
+* **System Services** [E1569](../execution/system-services.md)
 * **User Execution** [E1204](../execution/user-interaction.md)

execution/conditional-execute.md

@@ -1,19 +1,30 @@
 |||
 |---|---|
 |**ID**|**B0025**|
-|**Objective(s)**|[Execution](../execution)|
-|**Related ATT&CK Technique**|None|
+|**Objective(s)**|[Execution](../execution), [Anti-Behavioral Analysis](../anti-behavioral-analysis), [Defense Evasion](../defense-evasion)|
+|**Related ATT&CK Technique**|[Execution Guardrails](https://attack.mitre.org/techniques/T1480)|
 
 
 Conditional Execution
 =====================
-Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution happens autonomously, not because of an attacker's command.
+Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution in malware happens autonomously, not because of an attacker's command.
+
+This behavior is related to the [Evade Dynamic Analysis](../anti-behavioral-analysis/evade-dynamic-analysis.md) behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.
+
+Conditional execution may also be referred to as "execution guardrails." **See ATT&CK:** [**Execution Guardrails**](https://attack.mitre.org/techniques/T1480) (which under ATT&CK does not pertain to anti-behavioral analysis behaviors).
 
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
+|**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
+|**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method.|
+|**GetVolumeInformation**|B0025.003|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
+|**Host Fingerprint Check**|B0025.004|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
+|**Runs as Service**|B0025.007|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[2]](#2)|
+|**Secure Triggers**|B0025.005|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
 |**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
+|**Token Check**|B0025.006|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
 
 Malware Examples
 ----------------
@@ -25,3 +36,6 @@ Malware Examples
 References
 ----------
 <a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+
+<a name="2">[2]</a> 
+https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service

execution/execution-dependency.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**B0044**|
+|**Objective(s)**|[Execution](../execution)|
+|**Related ATT&CK Technique**|None|
+
+
+Execution Dependency
+====================
+Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in [Conditional Execution](../execution/conditional-execute.md) this dependency is not because of an explicit check coded into the malware by the author.

execution/system-services.md

@@ -0,0 +1,23 @@
+|||
+|---|---|
+|**ID**|**E1569**|
+|**Objective(s)**|[Execution](../execution)|
+|**Related ATT&CK Technique**|[System Services](https://attack.mitre.org/techniques/T1569/)|
+
+
+System Services
+===============
+Malware may abuse system services or daemons to execute. 
+
+**See ATT&CK:** [**System Services**](https://attack.mitre.org/techniques/T1569/).
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**MSDTC**|E1569.m01|The Distributed Transaction Coordinator (MSDTC) coordinates transaction across multiple resource managers (databases, message queues and file systems). This legitimate Microsoft service is part of Windows 2000 and later and can be used to import and load DLLs. Malware may abuse MSDTC to import and load DLLs.[[1]](#1)|
+
+
+References
+----------
+<a name="1">[1]</a> https://support.resolver.com/hc/en-ca/articles/207161116-Configure-Microsoft-Distributed-Transaction-Coordinator-MSDTC-

impact/README.md

@@ -6,16 +6,19 @@
 # Impact #
 Behaviors that enable malware to achieve its mission of manipulating, interrupting, or destroying systems and/or data.
 
+* **Clipboard Modification** [E1510](../impact/clipboard-mod.md)
 * **Component Firmware** [F0009](../persistence/component-firmware.md)
 * **Compromise Data Integrity** [B0016](../impact/compromise-data.md)
 * **Data Destruction** [E1485](../impact/data-destruction.md)
 * **Data Encrypted for Impact** [E1486](../impact/encrypt-impact.md)
 * **Denial of Service** [B0033](../impact/denial-of-service.md)
 * **Destroy Hardware** [B0017](../impact/destroy-hardware.md)
+* **Disk Wipe** [F0014](../impact/disk-wipe.md)
 * **Exploit Kit Behavior** [E1190](../impact/exploit-kit-behavior.md)
 * **Exploitation for Client Execution** [E1203](../execution/exploit-software.md)
 * **Generate Fraudulent Advertising Revenue** [E1472](../impact/generate-fraud-rev.md)
 * **Manipulate Network Traffic** [B0019](../impact/manipulate-network-traffic.md)
+* **Modify Hardware** [B0042](../impact/modify-hardware.md)	
 * **Remote Access** [B0022](../impact/remote-access.md)
 * **Resource Hijacking** [B0018](../impact/hijack-sys-resources.md)
 * **Spamming** [B0039](../impact/spamming.md)

impact/clipboard-mod.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**E1510**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Technique**|[Clipboard Modification](https://attack.mitre.org/techniques/T1510/)|
+
+
+Clipboard Modification
+======================
+ATT&CK defines Clipboard Modification as a Mobile technique (Android platform). MBC extends it to the Windows platform. 

impact/data-destruction.md

@@ -16,7 +16,7 @@ Methods
 |Name|ID|Description|
 |---|---|---|
 |**Delete Application/Software**|E1485.m03|An application or software is deleted.|
-|**Delete Shadow Drive**|E1485.m01|Deletes shadow drive data, which is related to ransomware.|
+|**Delete Shadow Copies**|E1485.m04|Deletes shadow drive data, which is related to ransomware.|
 |**Empty Recycle Bin**|E1485.m02|Empties the recycle bin, which can be related to ransomware.|
 
 Malware Examples

impact/disk-wipe.md

@@ -0,0 +1,11 @@
+|||
+|---|---|
+|**ID**|**F0014**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Sub-Technique**|[Disk Wipe](https://attack.mitre.org/techniques/T1561/)|
+
+Disk Wipe
+=========
+Malware may erase the content of storage devices. This behavior is different than [Data Destruction](../impact/data-destruction.md) because sections of the disk are erased rather than individual files.
+
+This description refines the ATT&CK [**Disk Wipe**](https://attack.mitre.org/techniques/T1561/) sub-technique.

impact/encrypt-impact.md

@@ -11,6 +11,12 @@ Malware may encrypt files stored on the system to prevent user access until a ra
 
 See ATT&CK: [**Data Encrypted for Impact**](https://attack.mitre.org/techniques/T1486/) and [**Data Encrypted for Impact (Mobile)**](https://attack.mitre.org/techniques/T1471/). 
 
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Ransom Note**|E1486.001|Ransomware displays a ransom note. Ransom notes are sometimes used to link instances of ransomware, even when the code or anti-analysis techniques change.|
+
 Malware Examples
 ----------------
 |Name|Date|Description|

impact/modify-hardware.md

@@ -0,0 +1,18 @@
+|||
+|---|---|
+|**ID**|**B0042**|
+|**Objective(s)**|[Impact](../impact)|
+|**Related ATT&CK Technique**|None|
+
+
+Modify Hardware
+===============
+Malware modifies hardware.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**CDROM**|B0042.001|The CD-ROM is modified.|
+|**Mouse**|B0042.002|The mouse is modified.|
+|**Printer**|B0042.003|The printer is modified.|

micro-behaviors/README.md

@@ -1,13 +1,15 @@
 # Micro-behaviors #
 Some malware behaviors are low-level, support many objectives and other behaviors, and aren't necessarily malicious. For example, a TCP socket may be created or a string may be checked for some condition. Because such things are often noted in malware analysis, they are captured in MBC. They are called "micro-behaviors."
 
-Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-behavior objectives are shown below.
+Like regular MBC behaviors, micro-behaviors are associated with objectives and can have methods that refine them. Micro-objectives are shown below.
 
-|**Objective**|**Description**|
+|**Micro-objective**|**Description**|
 |---|---|
 |[**Communication**](./communication)|Malware uses various protocols and components to communication.|
 |[**Cryptography**](./cryptography)|Malware uses elements of cryptography.|
-|[**Data Manipulation**](./data-manipulation)|Malware manipulates data.|
-|[**File Manipulation**](./file-manipulation)|Malware manipulates files.|
-|[**Memory Manipulation**](./memory-manipulation)|Malware manipulates memory.|
-|[**Processes**](./processes)|Malware uses processes.|
+|[**Data**](./data)|Malware manipulates data.|
+|[**File System**](./file-system)|Malware manipulates files or directories.|
+|[**Hardware**](./hardware)|Malware has hardware-related behaviors.|
+|[**Memory**](./memory)|Malware manipulates memory.|
+|[**Process**](./process)|Malware uses processes.|
+|[**Operating System**](./operating-system)|Malware makes changes to the operating system.|

micro-behaviors/communication/README.md

@@ -3,17 +3,14 @@
 |**ID**|**OC0006**|
 
 
-# Communication Micro-objectives #
+# Communication Micro-objective #
 Micro-behaviors that enable malware to communicate.
 
-|Name|ID|Description|
-|---|---|---|
-|[**DNS Communication**](../communication/dns-comm.md)|C0011||
-|[**FTP Communication**](../communication/ftp-comm.md)|C0004||
-|[**HTTP Communication**](../communication/http-comm.md)|C0002||
-|[**ICMP Communication**](../communication/icmp-comm.md)|C0014||
-|[**Inter-process Communication**](../communication/inter-process.md)|C0003||
-|[**SMTP Communication**](../communication/smtp-comm.md)|C0012||
-|[**TCP Communication**](../communication/tcp-comm.md)|C0001||
-|[**UDP Communication**](../communication/udp-comm.md)|C0013||
-|[**WinINet Communication**](../communication/wininet.md)|C0005||
+* **DNS Communication** [C0011](../communication/dns-comm.md)
+* **FTP Communication** [C0004](../communication/ftp-comm.md)
+* **HTTP Communication** [C0002](../communication/http-comm.md)
+* **ICMP Communication** [C0014](../communication/icmp-comm.md)
+* **Interprocess Communication** [C0003](../communication/inter-process.md)
+* **SMTP Communication** [C0012](../communication/smtp-comm.md)
+* **Socket Communication** [C0001](../communication/socket-comm.md)
+* **WinINet Communication** [C0005](../communication/wininet.md)

micro-behaviors/communication/ftp-comm.md

@@ -13,5 +13,5 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Put**|C0004.001|FTP Put|
-|**WinINet API**|C0004.002|Send FTP command via WinINet.|
+|**Send File**|C0004.001|Send FTP file.|
+|**WinINet**|C0004.002|Send FTP command via WinINet.|

micro-behaviors/communication/http-comm.md

@@ -9,19 +9,27 @@ HTTP Communication
 ==================
 This micro-behavior is related to HTTP communication. 
 
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**Client**|C0002.002|General HTTP client behavior.|
-|**GET Request**|C0002.004|HTTP Get request.|
-|**IHTMLDocument**|C0002.011|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLDocument Interface.get_body.|
-|**IHTMLElement**|C0002.012|Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IHTMLElement Interface.get_innerText.|
-|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
-|**POST Request**|C0002.005|HTTP Post request.|
-|**PUT Request**|C0002.006|HTTP Put request.|
-|**Request**|C0002.003|Non-specific HTTP request.|
 |**Server**|C0002.001|General HTTP server behavior.|
-|**URLMON Function**|C0002.009|A HTTP request is made via a URLMON function. Specific functions can be captured: e.g., COMMUNICATION::HTTP Communication::URLMON Function.URLDownloadToFileW.|
-|**WinHTTP API**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
-|**WinINet API**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
+|**Client**|C0002.002|General HTTP client behavior.|
+|**Connect to Server**|C0002.009|HTTP client connects to HTTP server.|
+|**Open URL**|C0002.004|HTTP client connects to a URL.|
+|**Download URL**|C0002.006|HTTP client downloads URL to file.|
+|**Extract Body**|C0002.011|HTTP client extracts HTTP body.|
+|**Create Request**|C0002.012|HTTP client creates request.|
+|**Send Request**|C0002.003|HTTP client sends request (GET).|
+|**Send Data**|C0002.005|HTTP clients sends data to a server (POST/PUT).|
+|**Receive Request**|C0002.015|HTTP server receives request.|
+|**Send Response**|C0002.016|HTTP server sends response.|
+|**Get Response**|C0002.017|HTTP client receives response.|
+|**Start Server**|C0002.018|HTTP server is started.|
+|**Set Header**|C0002.013|HTTP header is set.|
+|**Read Header**|C0002.014|HTTP read header.|
+|**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
+|**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
+|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|

micro-behaviors/communication/icmp-comm.md

@@ -13,4 +13,5 @@ Methods
 -------
 |Name|ID|Description|
 |---|---|---|
+|**Echo Request**|C0014.002|Send ICMP echo request.|
 |**Generate Traffic**|C0014.001|Generate ICMP traffic.|

micro-behaviors/communication/socket-comm.md

@@ -0,0 +1,34 @@
+|||
+|---|---|
+|**ID**|**C0001**|
+|**Objective(s)**|[Communication](../communication)|
+|**Related ATT&CK Technique**|None|
+
+
+Socket Communication
+====================
+This micro-behavior focuses on socket (TCP, UDP) communication. 
+
+Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Set Socket Config**|C0001.001|Configure socket.|
+|**Initialize Winsock Library**|C0001.009|Winsock is initialized for TCP communication.|
+|**Start TCP Server**|C0001.005|A TCP server listens for client requests.|
+|**Create Socket**|C0001.003|A server or client creates a UDP or TCP socket.|
+|**Create UDP Socket**|C0001.010|A UDP socket is created.|
+|**Create TCP Socket**|C0001.011|A TCP socket is created.|
+|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
+|**Get Socket Status**|C0001.012|Get socket status.|
+|**Send Data**|C0001.007|Send data on socket.|
+|**Send TCP Data**|C0001.014|Send TCP data.|
+|**Send UDP Data**|C0001.015|Send UDP data.|
+|**Receive Data**|C0001.006|Receive data on socket.|
+|**Receive TCP Data**|C0001.016|Receive TCP data.|
+|**Receive UDP Data**|C0001.017|Receive UDP data.|
+|**TCP Server**|C0001.002|TCP server behavior.|
+|**TCP Client**|C0001.008|TCP client behavior.|
+|**UDP Client**|C0001.013|UDP client behavior.|

micro-behaviors/communication/tcp-comm.md

@@ -1,22 +0,0 @@
-|||
-|---|---|
-|**ID**|**C0001**|
-|**Objective(s)**|[Communication](../communication)|
-|**Related ATT&CK Technique**|None|
-
-
-TCP Communication
-=================
-This micro-behavior focuses on TCP communication. 
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**Client**|C0001.001|General TCP client behavior.|
-|**Connect Socket**|C0001.004|A server or client connects via a TCP socket.|
-|**Create Socket**|C0001.003|A server or client creates a TCP socket.|
-|**Listen Socket**|C0001.005|A server listens for client requests.|
-|**Receive Data**|C0001.006|Receive data on socket.|
-|**Send Data**|C0001.007|Send data on socket.|
-|**Server**|C0001.002|General TCP server behavior.|

micro-behaviors/communication/udp-comm.md

@@ -1,16 +0,0 @@
-|||
-|---|---|
-|**ID**|**C0013**|
-|**Objective(s)**|[Communication](../communication)|
-|**Related ATT&CK Technique**|None|
-
-
-UDP Communication
-=================
-The micro-behavior is related to UDP communication. 
-
-Methods
--------
-|Name|ID|Description|
-|---|---|---|
-|**STUN Server**|C0013.001|Uses a Session Traversal Utilities for NAT server to gather information to support UDP communication.|

micro-behaviors/cryptography/README.md

@@ -3,9 +3,13 @@
 |**ID**|**OC0005**|
 
 
-# Cryptography Micro-objectives #
+# Cryptography Micro-objective #
 Micro-behaviors that enable malware to use crypto.
 
-|Name|ID|Description|
-|---|---|---|
-|[**Generate Pseudo-random Sequence**](../cryptography/gen-random.md)|C0021||
+* **Crypto Library** [C0059](../cryptography/crypto-lib.md)
+* **Encrypt Data** [C0027](../cryptography/encrypt.md)
+* **Decrypt Data** [C0031](../cryptography/decrypt.md)
+* **Generate Pseudo-random Sequence** [C0021](../cryptography/gen-random.md)
+* **Cryptography Hash** [C0029](../cryptography/crypto-hash.md)
+* **Encryption Key** [C0028](../cryptography/key.md)
+* **Hashed Message Authentication Code** [C0061](../cryptography/hmac.md)

micro-behaviors/cryptography/crypto-hash.md

@@ -0,0 +1,21 @@
+|||
+|---|---|
+|**ID**|**C0029**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Cryptographic Hash
+==================
+Malware may use a cryptographic hash. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**MD5**|C0029.001|Malware uses an MD5 hash.|
+|**SHA1**|C0029.002|Malware uses a SHA-1 hash.|
+|**SHA224**|C0029.004|Malware uses a SHA-224 hash.|
+|**SHA256**|C0029.003|Malware uses a SHA-256 hash.|
+|**Snefru**|C0029.006|Malware uses a Snefru hash.|
+|**Tiger**|C0029.005|Malware uses a Tiger hash.|

micro-behaviors/cryptography/crypto-lib.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0059**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Crypto Library
+==============
+Malware uses a crypto library.

micro-behaviors/cryptography/decrypt.md

@@ -0,0 +1,85 @@
+|||
+|---|---|
+|**ID**|**C0031**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Decrypt Data
+============
+Malware may decrypt data. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**AES**|C0031.001|Malware decrypts data encrypted with the AES algorithm.|
+|**Block Cipher**|C0031.002|Malware decrypts data encrypted with a block cipher.|
+|**Blowfish**|C0031.003|Malware decrypts data encrypted with the Blowfish algorithm.|
+|**Camellia**|C0031.004|Malware decrypts data encrypted with the Camellia algorithm.|
+|**3DES**|C0031.005|Malware decrypts data encrypted with the 3DES algorithm.|
+|**HC-128**|C0031.006|Malware decrypts data encrypted with the HC-128 algorithm.|
+|**HC-256**|C0031.007|Malware decrypts data encrypted with the HC-256 algorithm.|
+|**RC4**|C0031.008|Malware decrypts data encrypted with the RC4 algorithm.|
+|**RC6**|C0031.009|Malware decrypts data encrypted with the RC6 algorithm.|
+|**RSA**|C0031.010|Malware decrypts data encrypted with the RSA algorithm.|
+|**Skipjack**|C0031.011|Malware decrypts data encrypted with the Skipjack block cipher algorithm.|
+|**Sosemanuk**|C0031.012|Malware decrypts data encrypted with the Sosemanuk stream cipher.|
+|**Stream Cipher**|C0031.013|Malware decrypts data encrypted with a stream cipher.|
+|**Twofish**|C0031.014|Malware decrypts data encrypted with the Twofish algorithm.|
+
+Code Snippets
+-------------
+**Decrypt Data** (C0031) - the snippet encrypts and decrypts data.
+
+Sample (SHA256): c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
+
+```asm
+push    ebx
+mov     ebx, [esp+4+arg_4]
+push    esi
+lea     eax, [ebx+20h]
+push    eax             ; unsigned int
+call    ??2@YAPAXI@Z    ; operator new(uint)
+mov     ecx, [esp+0Ch+arg_C]
+mov     edx, eax
+add     esp, 4
+mov     esi, [ecx]
+mov     [edx], esi
+mov     esi, [ecx+4]
+mov     [edx+4], esi
+mov     ecx, [ecx+8]
+mov     [edx+8], ecx
+mov     edx, [esp+8+arg_8]
+test    ebx, ebx
+mov     [eax+0Ch], edx
+jle     short loc_B
+mov     esi, [esp+8+arg_0]
+push    edi
+mov     edi, 0FFFFFFFDh
+lea     edx, [eax+3]
+sub     edi, eax
+
+loc_A:
+mov     cl, [edx-3]
+xor     cl, [edx+2]
+xor     cl, [edx-1]
+xor     cl, [edx]
+mov     [edx+0Dh], cl
+xor     [esi], cl
+inc     edx
+inc     esi
+lea     ecx, [edi+edx]
+cmp     ecx, ebx
+jl      short loc_A
+pop     edi
+
+loc_B:
+push    eax             ; void *
+call    ??3@YAXPAX@Z    ; operator delete(void *)
+add     esp, 4
+mov     eax, 1
+pop     esi
+pop     ebx
+retn
+```

micro-behaviors/cryptography/encrypt.md

@@ -0,0 +1,85 @@
+|||
+|---|---|
+|**ID**|**C0027**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Encrypt Data
+============
+Malware may encrypt data. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**AES**|C0027.001|Malware encrypts with the AES algorithm.|
+|**Block Cipher**|C0027.014|Malware encrypts with a block cipher.|
+|**Blowfish**|C0027.002|Malware encrypts with the Blowfish algorithm.|
+|**Camellia**|C0027.003|Malware encrypts with the Camellia algorithm.|
+|**3DES**|C0027.004|Malware encrypts with the 3DES algorithm.|
+|**HC-128**|C0027.006|Malware encrypts with the HC-128 algorithm.|
+|**HC-256**|C0027.007|Malware encrypts with the HC-256 algorithm.|
+|**RC4**|C0027.009|Malware encrypts with the RC4 algorithm.|
+|**RC6**|C0027.010|Malware encrypts with the RC6 algorithm.|
+|**RSA**|C0027.011|Malware encrypts with the RSA algorithm.|
+|**Skipjack**|C0027.013|Malware encrypts with the Skipjack block cipher algorithm.|
+|**Sosemanuk**|C0027.008|Malware encrypts with the Sosemanuk stream cipher.|
+|**Stream Cipher**|C0027.012|Malware encrypts with a stream cipher.|
+|**Twofish**|C0027.005|Malware encrypts with the Twofish algorithm.|
+
+Code Snippets
+-------------
+**Encrypt Data** (C0031) - the snippet encrypts and decrypts data.
+
+Sample (SHA256): c86cbf5e78c9f05ecfc11e4f2c147781cef77842a457e19ba690477eb564c22b
+
+```asm
+push    ebx
+mov     ebx, [esp+4+arg_4]
+push    esi
+lea     eax, [ebx+20h]
+push    eax             ; unsigned int
+call    ??2@YAPAXI@Z    ; operator new(uint)
+mov     ecx, [esp+0Ch+arg_C]
+mov     edx, eax
+add     esp, 4
+mov     esi, [ecx]
+mov     [edx], esi
+mov     esi, [ecx+4]
+mov     [edx+4], esi
+mov     ecx, [ecx+8]
+mov     [edx+8], ecx
+mov     edx, [esp+8+arg_8]
+test    ebx, ebx
+mov     [eax+0Ch], edx
+jle     short loc_B
+mov     esi, [esp+8+arg_0]
+push    edi
+mov     edi, 0FFFFFFFDh
+lea     edx, [eax+3]
+sub     edi, eax
+
+loc_A:
+mov     cl, [edx-3]
+xor     cl, [edx+2]
+xor     cl, [edx-1]
+xor     cl, [edx]
+mov     [edx+0Dh], cl
+xor     [esi], cl
+inc     edx
+inc     esi
+lea     ecx, [edi+edx]
+cmp     ecx, ebx
+jl      short loc_A
+pop     edi
+
+loc_B:
+push    eax             ; void *
+call    ??3@YAXPAX@Z    ; operator delete(void *)
+add     esp, 4
+mov     eax, 1
+pop     esi
+pop     ebx
+retn
+```

micro-behaviors/cryptography/gen-random.md

@@ -7,12 +7,14 @@
 
 Generate Pseudo-random Sequence
 ===============================
-The Generate Pseudo-random Sequence microbehavior can be used for a number of purposes. 
+The Generate Pseudo-random Sequence microbehavior can be used for a number of purposes. The methods below include specific functions, as well as pseudorandom number generators (PRNG).
 
 Methods
 -------
 |Name|ID|Description|
 |---|---|---|
-|**GetTickCount**|C0021.001|Generate random using GetTickCount.|
-|**Use API**|C0021.003|Generate random using a Windows API.|
-|**rand**|C0021.002|Generate random using rand.|
+|**GetTickCount**|C0021.001|Malware generates a pseudo-random sequence using GetTickCount.|
+|**Use API**|C0021.003|Malware generates a pseudo-random sequence using a Windows API.|
+|**rand**|C0021.002|Malware generates a pseudo-random sequence using rand.|
+|**RC4 PRGA**|C0021.004|Malware generates a pseudo-random sequence using the RC4 Pseudo Random (Byte) Generation Algorithm (PRGA).|
+|**Mersenne Twister**|C0021.005|Malware generates a pseudo-random sequence using the Mersenne Twister PRNG.|

micro-behaviors/cryptography/hmac.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0061**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Hashed Message Authentication Code
+==================================
+Malware uses an HMAC schema.

micro-behaviors/cryptography/key.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0028**|
+|**Objective(s)**|[Cryptography](../cryptography)|
+|**Related ATT&CK Technique**|None|
+
+
+Encryption Key
+==============
+Malware may import, generate, or otherwise use an encryption key. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Import Public Key**|C0028.001|Malware imports a public key.|
+|**RC4 KSA**|C0028.002|Malware uses the RC4 Key Scheduling Algorithm (KSA).|

micro-behaviors/data-manipulation/README.md

@@ -1,12 +0,0 @@
-|||
-|---|---|
-|**ID**|**OC0004**|
-
-
-# Data Manipulation Micro-objectives #
-Micro-behaviors related to malware manipulating data.
-
-|Name|ID|Description|
-|---|---|---|
-|[**Check String**](../data-manipulation/check-string.md)|C0019||
-|[**Use Constant**](../data-manipulation/use-constant.md)|C0020||

micro-behaviors/data/README.md

@@ -0,0 +1,18 @@
+|||
+|---|---|
+|**ID**|**OC0004**|
+
+
+# Data Micro-objective #
+Micro-behaviors related to malware manipulating data.
+
+* **Check String** [C0019](../data/check-string.md)
+* **Checksum** [C0032](../data/checksum.md)
+* **Compress Data** [C0024](../data/compress.md)
+* **Compression Library** [C0060](../data/compress-lib.md)
+* **Decompress Data** [C0025](../data/decompress.md)
+* **Encode Data** [C0026](../data/encode.md)
+* **Decode Data** [C0053](../data/decode.md)
+* **Modulo** [C0058](../data/modulo.md)
+* **Non-Cryptographic Hash** [C0030](../data/noncrypto-hash.md)
+* **Use Constant** [C0020](../data/use-constant.md)

micro-behaviors/data/check-string.md

@@ -1,10 +1,10 @@
 |||
 |---|---|
 |**ID**|**C0019**|
-|**Objective(s)**|[Data Manipulation](../data-manipulation)|
+|**Objective(s)**|[Data](../data)|
 |**Related ATT&CK Technique**|None|
 
 
 Check String
 ============
-Malware may check a string for some characteristics, such as being ascii content or length.
+Malware may check a string for some characteristics, such as being ascii content; credit card number; or length.

micro-behaviors/data/checksum.md

@@ -0,0 +1,20 @@
+|||
+|---|---|
+|**ID**|**C0032**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Checksum
+========
+Malware may derive a checksum from some block of data. The checksum is often used for data validation.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Adler**|C0032.005|Malware computes an Adler checksum.|
+|**BSD**|C0032.003|Malware computes a BSD checksum.|
+|**CRC32**|C0032.001|Malware computes a CRC32 checksum.|
+|**Luhn**|C0032.002|Malware uses Luhn algorithm, often to validate identification numbers (e.g, credit card number).| 
+|**Verhoeff**|C0032.004|Malware uses the Verhoeff algorithm, often for purposes of error detection.|

micro-behaviors/data/compress-lib.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0060**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Compression Library
+===================
+Malware uses a compression library.

micro-behaviors/data/compress.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0024**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Compress Data
+=============
+Malware may compress data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**IEncodingFilterFactory**|C0024.002|Malware compresses data using IEncodingFilterFactory.|
+|**QuickLZ**|C0024.001|Malware compresses data using QuickLZ.|

micro-behaviors/data/decode.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0053**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Decode Data
+===========
+Malware may decode data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Base64**|C0053.001|Malware may decode data using Base64.|
+|**XOR**|C0053.002|Malware may use xor to decode data.|

micro-behaviors/data/decompress.md

@@ -0,0 +1,18 @@
+|||
+|---|---|
+|**ID**|**C0025**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Decompress Data
+===============
+Malware may decompress data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**aPLib**|C0025.003|Malware decompresses data using aPLib.|
+|**IEncodingFilterFactory**|C0025.002|Malware decompresses data using IEncodingFilterFactory.|
+|**QuickLZ**|C0025.001|Malware decompresses data using QuickLZ.|

micro-behaviors/data/encode.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0026**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Encode Data
+===========
+Malware may encode data.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Base64**|C0026.001|Malware may encode data using Base64.|
+|**XOR**|C0026.002|Malware may use xor to encode data.|

micro-behaviors/data/modulo.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0058**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Modulo
+======
+Malware calculates a modulo value.

micro-behaviors/data/noncrypto-hash.md

@@ -0,0 +1,20 @@
+|||
+|---|---|
+|**ID**|**C0030**|
+|**Objective(s)**|[Data](../data)|
+|**Related ATT&CK Technique**|None|
+
+
+Non-Cryptographic Hash
+======================
+Malware may use a non-cryptographic hash. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**dhash**|C0030.004|Malware uses the dhash hash function.|
+|**Fast-Hash**|C0030.003|Malware uses the Fast-Hash hash function.|
+|**FNV**|C0030.005|Malware uses the FNV hash function.|
+|**MurmurHash**|C0030.001|Malware uses the MurmurHash hash function.|
+|**pHash**|C0030.002|Malware uses the pHash hash function.|

micro-behaviors/data/use-constant.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0020**|
-|**Objective(s)**|[Data Manipulation](../data-manipulation)|
+|**Objective(s)**|[Data](../data)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/file-manipulation/README.md

@@ -1,12 +0,0 @@
-|||
-|---|---|
-|**ID**|**OC0001**|
-
-
-# File Manipulation Micro-objectives #
-Micro-behaviors related to file manipulation.
-
-|Name|ID|Description|
-|---|---|---|
-|[**Alter File Extension**](../file-manipulation/alter-extend.md)|C0015||
-|[**Create File**](../file-manipulation/create-file.md)|C0016||

micro-behaviors/file-system/README.md

@@ -0,0 +1,21 @@
+|||
+|---|---|
+|**ID**|**OC0001**|
+
+
+# File System Micro-objective #
+Micro-behaviors related to file manipulation.
+
+* **Alter File Extension** [C0015](../file-system/alter-extend.md)
+* **Copy File** [C0045](../file-system/copy-file.md)
+* **Create Directory** [C0046](../file-system/create-dir.md)
+* **Create File** [C0016](../file-system/create-file.md)
+* **Delete Directory** [C0048](../file-system/delete-dir.md)
+* **Delete File** [C0047](../file-system/delete-file.md)
+* **Get File Attributes** [C0049](../file-system/get-file-attr.md)
+* **Move File** [C0063](../file-system/move-file.md)
+* **Read File** [C0051](../file-system/read-file.md)
+* **Read Virtual Disk** [C0056](../file-system/read-virtual-disk.md)
+* **Set File Attributes** [C0050](../file-system/set-file-attr.md)
+* **Write File** [C0052](../file-system/write-file.md)
+* **Move File** [C0063](../file-system/move-file.md)

micro-behaviors/file-system/alter-extend.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0015**|
-|**Objective(s)**|[File Manipulation](../file-manipulation)|
+|**Objective(s)**|[File System](../file-system)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/file-system/copy-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0045**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Copy File
+=========
+Malware copies a file. 

micro-behaviors/file-system/create-dir.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0046**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Create Directory
+================
+Malware creates a directory. 

micro-behaviors/file-system/create-file.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0016**|
-|**Objective(s)**|[File Manipulation](../file-manipulation)|
+|**Objective(s)**|[File System](../file-system)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/file-system/delete-dir.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0048**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Delete Directory
+================
+Malware deletes a directory. 

micro-behaviors/file-system/delete-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0047**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Delete File
+===========
+Malware deletes a file. 

micro-behaviors/file-system/get-file-attr.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0049**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Get File Attributes
+===================
+Malware gets the attributes of a file. 

micro-behaviors/file-system/move-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0063**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Move File
+=========
+Malware moves a file. 

micro-behaviors/file-system/read-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0051**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Read File
+=========
+Malware reads a file. 

micro-behaviors/file-system/read-virtual-disk.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0056**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Read Virtual Disk
+=================
+Malware reads a virtual disk. 

micro-behaviors/file-system/set-file-attr.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0050**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Set File Attributes
+===================
+Malware sets or modifies the attributes of a file.

micro-behaviors/file-system/write-file.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0052**|
+|**Objective(s)**|[File System](../file-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Writes File
+===========
+Malware writes to a file. 

micro-behaviors/hardware/README.md

@@ -3,9 +3,9 @@
 |**ID**|**OC0007**|
 
 
-# Hardware Micro-objectives #
+# Hardware Micro-objective #
 Micro-behaviors related to hardware.
 
-|Name|ID|Description|
-|---|---|---|
-|[**Load Driver**](../hardware/load-driver.md)|C0023||
+* **Install Driver** [C0037](../hardware/install-driver.md)
+* **Load Driver** [C0023](../hardware/load-driver.md)
+* **Simulate Hardware** [C0057](../hardware/simulate-hardware.md)

micro-behaviors/hardware/install-driver.md

@@ -0,0 +1,16 @@
+|||
+|---|---|
+|**ID**|**C0037**|
+|**Objective(s)**|[Hardware](../hardware)|
+|**Related ATT&CK Technique**|None|
+
+
+Install Driver
+==============
+Malware installs a driver or minifilter.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Minifilter**|C0037.001|Malware registers a minifilter.|

micro-behaviors/hardware/load-driver.md

@@ -1,10 +1,16 @@
 |||
 |---|---|
 |**ID**|**C0023**|
-|**Objective(s)**|[Processes](../processes)|
+|**Objective(s)**|[Hardware](../hardware)|
 |**Related ATT&CK Technique**|None|
 
 
 Load Driver
 ===========
-Malware loads a device driver.
+Malware loads a device driver or minifilter.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Minifilter**|C0023.001|Malware starts a minifilter.|

micro-behaviors/hardware/simulate-hardware.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0057**|
+|**Objective(s)**|[Hardware](../hardware)|
+|**Related ATT&CK Technique**|None|
+
+
+Simulate Hardware
+=================
+Malware simulates hardware.
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Ctrl-Alt-Del**|C0057.001|Malware simulates Ctrl-Alt-Del.|
+|**Mouse Click**|C0057.002|Malware simulates mouse click.|

micro-behaviors/memory-manipulation/README.md

@@ -1,15 +0,0 @@
-|||
-|---|---|
-|**ID**|**OC0002**|
-
-
-# Memory Manipulation Micro-objectives #
-Micro-behaviors related to malware manipulating machine memory.
-
-|Name|ID|Description|
-|---|---|---|
-|[**Allocate Memory**](../memory-manipulation/allocate-memory.md)|C0007||
-|[**Change Memory Protection**](../memory-manipulation/memory-protect.md)|C0008||
-|[**Heap Spray**](../memory-manipulation/heapspray.md)|C0006||
-|[**Overflow Buffer**](../memory-manipulation/overflow-buffer.md)|C0010||
-|[**Stack Pivot**](../stack-pivot.md)|C0009||

micro-behaviors/memory/README.md

@@ -0,0 +1,14 @@
+|||
+|---|---|
+|**ID**|**OC0002**|
+
+
+# Memory Micro-objective #
+Micro-behaviors related to malware manipulating machine memory.
+
+* **Allocate Memory** [C0007](../memory/allocate-memory.md)
+* **Change Memory Protection** [C0008](../memory/memory-protect.md)
+* **Free Memory** [C0044](../memory/free-memory.md)
+* **Heap Spray** [C0006](../memory/heapspray.md)
+* **Overflow Buffer** [C0010](../memory/overflow-buffer.md)
+* **Stack Pivot** [C0009](../memory/stack-pivot.md)

micro-behaviors/memory/allocate-memory.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0007**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/free-memory.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0044**|
+|**Objective(s)**|[Memory](../memory)|
+|**Related ATT&CK Technique**|None|
+
+
+Free Memory
+===========
+Malware may free memory.

micro-behaviors/memory/heapspray.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0006**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/memory-protect.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0008**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/overflow-buffer.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0010**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/memory/stack-pivot.md

@@ -1,7 +1,7 @@
 |||
 |---|---|
 |**ID**|**C0009**|
-|**Objective(s)**|[Memory Manipulation](../memory-manipulation)|
+|**Objective(s)**|[Memory](../memory)|
 |**Related ATT&CK Technique**|None|
 
 

micro-behaviors/operating-system/README.md

@@ -0,0 +1,12 @@
+|||
+|---|---|
+|**ID**|**OC0008**|
+
+
+# Operating System Micro-objective #
+Micro-behaviors related to operating systems.
+
+* **Console** [C0033](../operating-system/console.md)
+* **Environment Variable** [C0034](../operating-system/enviro-var.md)
+* **Registry** [C0036](../operating-system/registry.md)
+* **Wallpaper** [C0035](../operating-system/wallpaper.md)

micro-behaviors/operating-system/console.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0033**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Console
+=======
+Malware modifies the console. 

micro-behaviors/operating-system/enviro-var.md

@@ -0,0 +1,17 @@
+|||
+|---|---|
+|**ID**|**C0034**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Environment Variable
+====================
+Malware modifies environment variables. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Set Variable**|C0034.001|Malware sets an environment variable.|
+|**Get Variable**|C0034.002|Malware gets an environment variable.|

micro-behaviors/operating-system/registry.md

@@ -0,0 +1,22 @@
+|||
+|---|---|
+|**ID**|**C0036**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Registry
+========
+Malware modifies the registry. 
+
+Methods
+-------
+|Name|ID|Description|
+|---|---|---|
+|**Create Registry Key**|C0036.004|Malware creates a registry key.|
+|**Delete Registry Key**|C0036.002|Malware deletes a registry key.|
+|**Delete Registry Value**|C0036.007|Malware deletes a registry value.|
+|**Open Registry Key**|C0036.003|Malware opens a registry key.|
+|**Query Registry Key**|C0036.005|Malware queries a registry key.|
+|**Query Registry Value**|C0036.006|Malware queries a registry value.|
+|**Set Registry Key**|C0036.001|Malware sets a registry key.|

micro-behaviors/operating-system/wallpaper.md

@@ -0,0 +1,10 @@
+|||
+|---|---|
+|**ID**|**C0035**|
+|**Objective(s)**|[Operating System](../operating-system)|
+|**Related ATT&CK Technique**|None|
+
+
+Wallpaper
+=========
+Malware modifies the wallpaper. 

micro-behaviors/process/README.md

@@ -0,0 +1,22 @@
+|||
+|---|---|
+|**ID**|**OC0003**|
+
+
+# Process Micro-objective #
+Micro-behaviors related to processes.
+
+* **Allocate Thread Local Storage** [C0040](../process/thread-storage-allocate.md)
+* **Create Mutex** [C0042](../process/create-mutex.md)
+* **Check Mutex** [C0043](../process/check-mutex.md)	
+* **Create Process** [C0017](../process/create-process.md)
+* **Create Thread** [C0038](../process/create-thread.md)
+* **Enumerate Threads** [C0064](../process/enumerate-threads.md)
+* **Open Process** [C0065](../process/open-process.md)
+* **Open Thread** [C0066](../process/open-thread.md)
+* **Resume Thread** [C0054](../process/resume-thread.md)
+* **Set Thread Local Storage Value** [C0041](../process/thread-storage-set-value.md)
+* **Suspend Thread** [C0055](../process/suspend-thread.md)	
+* **Synchronization** [C0022](../process/synchronization.md)
+* **Terminate Process** [C0018](../process/terminate-process.md)
+* **Terminate Thread** [C0039](../process/terminate-thread.md)